|
Log-Analyse und Auswertung: PUP.Optional.InstallCore.A gefundenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
14.12.2014, 19:21 | #1 |
| PUP.Optional.InstallCore.A gefunden MBAM hat die oben genannte Bedrohnung auf meinem PC und meiner SD Karte gefunden. SD Karte Formatieren hat leider nichts gebracht. Die SD karte lese ich mit einem SD Card reader aus, kann sich der Virus auf diesen übertragen ? Hab ich da einen schlimmen Trojaner oder nur ADware ? MBAM Logs sind unten verlinkt. |
14.12.2014, 20:22 | #2 |
/// the machine /// TB-Ausbilder | PUP.Optional.InstallCore.A gefunden Hi,
__________________Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen. Ich kann auf Arbeit keine Anhänge öffnen, danke. So funktioniert es: Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit (Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ |
15.12.2014, 11:43 | #3 |
| PUP.Optional.InstallCore.A gefunden Danke, mein Fehler.
__________________Hier die beiden Logs, erst das System. Suchlauf Datum: 14.12.2014 Suchlauf-Zeit: 18:35:45 Logdatei: MBAM.txt Administrator: Ja Version: 2.00.4.1028 Malware Datenbank: v2014.12.14.06 Rootkit Datenbank: v2014.12.08.03 Lizenz: Premium Malware Schutz: Aktiviert Bösartiger Webseiten Schutz: Aktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 8.1 CPU: x64 Dateisystem: NTFS Benutzer: Raf Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 375527 Verstrichene Zeit: 22 Min, 31 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (Keine schädliche Elemente erkannt) Module: 0 (Keine schädliche Elemente erkannt) Registrierungsschlüssel: 2 PUP.Optional.InstallCore.A, HKU\S-1-5-21-3570792933-1699095929-2760690963-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE\1I1T1Q1S, , [843a0e540577b0860b8e95fc2bd8cd33], PUP.Optional.InstallCore.A, HKU\S-1-5-21-3570792933-1699095929-2760690963-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE, , [ba04e47e9be1aa8c4970a403f80cbb45], Registrierungswerte: 1 PUP.Optional.InstallCore.A, HKU\S-1-5-21-3570792933-1699095929-2760690963-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE|tb, 0N2X1N, , [ba04e47e9be1aa8c4970a403f80cbb45] Registrierungsdaten: 0 (Keine schädliche Elemente erkannt) Ordner: 0 (Keine schädliche Elemente erkannt) Dateien: 0 (Keine schädliche Elemente erkannt) Physische Sektoren: 0 (Keine schädliche Elemente erkannt) (end) Und hier von der SD Karte. Suchlauf Datum: 14.12.2014 Suchlauf-Zeit: 19:04:37 Logdatei: MBAM SD Karte.txt Administrator: Ja Version: 2.00.4.1028 Malware Datenbank: v2014.12.14.06 Rootkit Datenbank: v2014.12.08.03 Lizenz: Premium Malware Schutz: Aktiviert Bösartiger Webseiten Schutz: Aktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 8.1 CPU: x64 Dateisystem: NTFS Benutzer: Raf Suchlauf-Art: Benutzerdefinierter Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 353102 Verstrichene Zeit: 8 Min, 4 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Aktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (Keine schädliche Elemente erkannt) Module: 0 (Keine schädliche Elemente erkannt) Registrierungsschlüssel: 2 PUP.Optional.InstallCore.A, HKU\S-1-5-21-3570792933-1699095929-2760690963-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE\1I1T1Q1S, , [c106a7b9d7a51f17b4e5c2cf23e048b8], PUP.Optional.InstallCore.A, HKU\S-1-5-21-3570792933-1699095929-2760690963-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE, , [5e69c997255768ce2a8f782fe024b848], Registrierungswerte: 1 PUP.Optional.InstallCore.A, HKU\S-1-5-21-3570792933-1699095929-2760690963-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE|tb, 0N2X1N, , [5e69c997255768ce2a8f782fe024b848] Registrierungsdaten: 0 (Keine schädliche Elemente erkannt) Ordner: 0 (Keine schädliche Elemente erkannt) Dateien: 0 (Keine schädliche Elemente erkannt) Physische Sektoren: 0 (Keine schädliche Elemente erkannt) (end) So, hier der FRST.txt FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 14-12-2014 01 Ran by Raf (administrator) on RAFNESS on 15-12-2014 11:25:29 Running from C:\Users\Raf\Downloads Loaded Profile: Raf (Available profiles: Raf & Gast) Platform: Windows 8.1 Connected (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe (Acer Incorporated) C:\Program Files (x86)\Acer\AOP Framework\CCDMonitorService.exe (Intel(R) Corporation) C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (Microsoft Corporation) C:\Windows\System32\dasHost.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Acer Cloud Technology) C:\Program Files (x86)\Acer\AOP Framework\acer\ccd.exe (Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe (acer) C:\Program Files\Acer\User Experience Improvement Program\Framework\UBTService.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Acer Incorporated) C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxsrvc.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Pokki) C:\Users\Raf\AppData\Local\Pokki\Engine\HostAppServiceUpdater.exe (Spotify Ltd) C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe (ICQ) C:\Users\Raf\AppData\Roaming\ICQM\icq.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe (Acer Incorporated) C:\Program Files (x86)\Acer\AOP Framework\BackgroundAgent.exe (Pokki) C:\Users\Raf\AppData\Local\Pokki\Engine\HostAppService.exe (Pokki) C:\Users\Raf\AppData\Local\Pokki\Engine\HostAppService.exe (Pokki) C:\Users\Raf\AppData\Local\Pokki\Engine\StartMenuIndexer.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_246.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_246.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13654744 2013-09-30] (Realtek Semiconductor) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated) HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [4085896 2014-08-18] (AVAST Software) HKLM-x32\...\Run: [BacKGround Agent] => C:\Program Files (x86)\Acer\AOP Framework\BackgroundAgent.exe [52992 2014-08-06] (Acer Incorporated) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKU\S-1-5-21-3570792933-1699095929-2760690963-1001\...\Run: [Pokki] => "%LOCALAPPDATA%\Pokki\Engine\HostAppServiceUpdater.exe" /LOGON HKU\S-1-5-21-3570792933-1699095929-2760690963-1001\...\Run: [Spotify Web Helper] => C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe [1168896 2014-07-22] (Spotify Ltd) HKU\S-1-5-21-3570792933-1699095929-2760690963-1001\...\Run: [icq] => C:\Users\Raf\AppData\Roaming\ICQM\icq.exe [34923528 2014-08-21] (ICQ) HKU\S-1-5-21-3570792933-1699095929-2760690963-1001\...\RunOnce: [Adobe Speed Launcher] => 1418637181 ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-3570792933-1699095929-2760690963-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://acer13.msn.com/?pc=ACJB HKU\S-1-5-21-3570792933-1699095929-2760690963-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com/?pc=ACJB SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM -> {AA9A4890-4262-4441-8977-E2FFCBFB706C} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?hspart=acer&hsimp=yhs-acer_001&p={searchTerms} SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM-x32 -> {AA9A4890-4262-4441-8977-E2FFCBFB706C} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?hspart=acer&hsimp=yhs-acer_001&p={searchTerms} SearchScopes: HKU\S-1-5-21-3570792933-1699095929-2760690963-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?PC=WCUG&FORM=WCUGDF&q={searchTerms} SearchScopes: HKU\S-1-5-21-3570792933-1699095929-2760690963-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?PC=WCUG&FORM=WCUGDF&q={searchTerms} SearchScopes: HKU\S-1-5-21-3570792933-1699095929-2760690963-1001 -> {8100CE5E-F751-4CF9-8466-54E9FE2CC8C7} URL = SearchScopes: HKU\S-1-5-21-3570792933-1699095929-2760690963-1001 -> {AA9A4890-4262-4441-8977-E2FFCBFB706C} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?hspart=acer&hsimp=yhs-acer_001&p={searchTerms} BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 FireFox: ======== FF ProfilePath: C:\Users\Raf\AppData\Roaming\Mozilla\Firefox\Profiles\1955p245.default FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_246.dll () FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_246.dll () FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Users\Raf\AppData\Roaming\Mozilla\Firefox\Profiles\1955p245.default\searchplugins\google-images.xml FF SearchPlugin: C:\Users\Raf\AppData\Roaming\Mozilla\Firefox\Profiles\1955p245.default\searchplugins\google-maps.xml FF Extension: DownloadHelper - C:\Users\Raf\AppData\Roaming\Mozilla\Firefox\Profiles\1955p245.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-09-06] FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-08-18] FF HKU\S-1-5-21-3570792933-1699095929-2760690963-1001\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Raf\AppData\Roaming\Mozilla\Firefox\Profiles\1955p245.default\extensions\cliqz@cliqz.com Chrome: ======= CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-08-18] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-08-18] (AVAST Software) R2 CCDMonitorService; C:\Program Files (x86)\Acer\AOP Framework\CCDMonitorService.exe [3058944 2014-08-06] (Acer Incorporated) R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe [733696 2013-07-01] (Intel(R) Corporation) [File not signed] S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\TXE Components\TCS\SocketHeciServer.exe [822232 2013-07-01] (Intel(R) Corporation) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation) R3 UEIPSvc; C:\Program Files\Acer\User Experience Improvement Program\Framework\UBTService.exe [222952 2014-01-24] (acer) S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation) S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-08-18] () R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-08-18] (AVAST Software) R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-08-18] (AVAST Software) R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-08-18] () R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1041168 2014-11-22] (AVAST Software) R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427360 2014-08-18] (AVAST Software) R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [92008 2014-08-18] (AVAST Software) R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [224896 2014-08-18] () R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-12-15] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2014-11-21] (Malwarebytes Corporation) R3 TXEIx64; C:\Windows\System32\drivers\TXEIx64.sys [88592 2014-01-15] (Intel Corporation) S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation) ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-12-15 11:25 - 2014-12-15 11:26 - 00010736 _____ () C:\Users\Raf\Downloads\FRST.txt 2014-12-15 11:24 - 2014-12-15 11:25 - 00000000 ____D () C:\FRST 2014-12-15 11:22 - 2014-12-15 11:22 - 02119168 _____ (Farbar) C:\Users\Raf\Downloads\FRST64.exe 2014-12-14 19:13 - 2014-12-14 19:13 - 00001686 _____ () C:\Users\Raf\Desktop\MBAM SD Karte.txt 2014-12-14 18:59 - 2014-12-14 18:59 - 00001672 _____ () C:\Users\Raf\Desktop\MBAM.txt 2014-12-14 17:30 - 2014-10-30 23:37 - 00129536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe 2014-12-14 17:30 - 2014-10-30 23:34 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe 2014-12-12 11:03 - 2014-12-12 11:03 - 01060864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc71.dll 2014-12-12 11:03 - 2014-12-12 11:03 - 00348160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr71.dll 2014-12-11 18:37 - 2014-12-11 18:37 - 00000000 ____D () C:\Users\Raf\Downloads\Musik 2014-12-11 11:00 - 2014-11-26 22:10 - 00714720 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-12-11 11:00 - 2014-11-26 22:10 - 00106976 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-12-11 10:54 - 2014-12-11 10:54 - 00000000 ____D () C:\Windows\system32\appraiser 2014-12-10 06:37 - 2014-11-10 03:29 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\DeviceSetupStatusProvider.dll 2014-12-10 06:37 - 2014-11-10 02:51 - 00028672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DeviceSetupStatusProvider.dll 2014-12-10 06:36 - 2014-10-31 00:39 - 01970432 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll 2014-12-10 06:36 - 2014-10-31 00:38 - 01612992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll 2014-12-10 06:26 - 2014-11-22 04:13 - 25059840 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-12-10 06:26 - 2014-11-22 03:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-12-10 06:26 - 2014-11-22 03:34 - 06039552 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-12-10 06:26 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-12-10 06:26 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-12-10 06:26 - 2014-11-22 02:43 - 14412800 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-12-10 06:26 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-12-10 06:26 - 2014-11-22 02:28 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-12-10 06:26 - 2014-11-22 02:15 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-12-10 06:26 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-12-10 06:26 - 2014-11-22 02:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-12-10 06:26 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-12-10 06:26 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-12-10 06:26 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-12-10 06:25 - 2014-12-04 00:37 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-12-10 06:25 - 2014-12-04 00:09 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll 2014-12-10 06:25 - 2014-12-03 00:09 - 01083392 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-12-10 06:25 - 2014-12-03 00:09 - 00740864 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll 2014-12-10 06:25 - 2014-12-03 00:09 - 00412672 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll 2014-12-10 06:25 - 2014-12-03 00:09 - 00396288 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll 2014-12-10 06:25 - 2014-12-03 00:09 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll 2014-12-10 06:25 - 2014-11-22 03:50 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-12-10 06:25 - 2014-11-22 03:49 - 00417280 _____ (Microsoft Corporation) C:\Windows\system32\html.iec 2014-12-10 06:25 - 2014-11-22 03:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-12-10 06:25 - 2014-11-22 03:35 - 00812544 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2014-12-10 06:25 - 2014-11-22 03:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-12-10 06:25 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-12-10 06:25 - 2014-11-22 03:06 - 00340992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec 2014-12-10 06:25 - 2014-11-22 03:06 - 00145408 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll 2014-12-10 06:25 - 2014-11-22 03:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-12-10 06:25 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2014-12-10 06:25 - 2014-11-22 02:59 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll 2014-12-10 06:25 - 2014-11-22 02:55 - 00661504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2014-12-10 06:25 - 2014-11-22 02:52 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll 2014-12-10 06:25 - 2014-11-22 02:49 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-12-10 06:25 - 2014-11-22 02:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-12-10 06:25 - 2014-11-22 02:49 - 00373760 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-12-10 06:25 - 2014-11-22 02:46 - 02125312 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-12-10 06:25 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-12-10 06:25 - 2014-11-22 02:34 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll 2014-12-10 06:25 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-12-10 06:25 - 2014-11-22 02:29 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll 2014-12-10 06:25 - 2014-11-22 02:25 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll 2014-12-10 06:25 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-12-10 06:25 - 2014-11-22 02:23 - 00326656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2014-12-10 06:25 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-12-10 06:25 - 2014-11-07 05:16 - 01762840 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2014-12-10 06:25 - 2014-11-07 04:26 - 01489072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll 2014-12-10 06:25 - 2014-11-01 00:57 - 01091072 _____ (Microsoft Corporation) C:\Windows\system32\MrmCoreR.dll 2014-12-10 06:25 - 2014-11-01 00:47 - 00790528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MrmCoreR.dll 2014-12-10 06:25 - 2014-10-13 03:43 - 00238912 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\sdbus.sys 2014-12-10 06:25 - 2014-10-13 03:43 - 00153920 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\dumpsd.sys 2014-12-10 06:25 - 2014-10-13 03:43 - 00086336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pdc.sys 2014-12-10 06:25 - 2014-10-13 03:43 - 00039744 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\intelpep.sys 2014-12-09 01:00 - 2014-12-09 01:00 - 00000548 _____ () C:\Users\Raf\Desktop\Summer Cem Babas Barbies Bargeld.txt 2014-12-03 15:48 - 2014-12-03 15:48 - 00805319 _____ () C:\Users\Raf\Downloads\3.jpeg 2014-12-02 19:45 - 2014-12-02 19:45 - 00000499 _____ () C:\Users\Raf\Desktop\Andorra.txt 2014-12-02 14:13 - 2014-12-02 14:14 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-11-30 00:17 - 2014-11-30 00:22 - 00000300 _____ () C:\Users\Raf\Desktop\Neues Textdokument (8).txt 2014-11-26 11:12 - 2014-11-26 11:12 - 00000000 __SHD () C:\Users\Raf\AppData\Local\EmieBrowserModeList 2014-11-26 10:05 - 2014-11-26 10:05 - 00683496 _____ (Opera Software) C:\Users\Gast\Downloads\Opera_NI_stable.exe 2014-11-26 07:55 - 2014-12-07 17:41 - 00001321 _____ () C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Opera.lnk 2014-11-26 07:55 - 2014-11-26 07:55 - 00001321 _____ () C:\Users\Gast\Desktop\Opera.lnk 2014-11-26 07:55 - 2014-11-26 07:55 - 00000000 ____D () C:\Users\Gast\AppData\Roaming\Opera Software 2014-11-26 07:55 - 2014-11-26 07:55 - 00000000 ____D () C:\Users\Gast\AppData\Local\Opera Software 2014-11-26 07:54 - 2014-12-09 11:39 - 00002159 _____ () C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pokki Start Menu.lnk 2014-11-26 07:54 - 2014-11-26 10:08 - 00002330 _____ () C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnk 2014-11-26 07:53 - 2014-11-26 07:53 - 00000000 ____D () C:\Users\Gast\AppData\Roaming\Opera 2014-11-26 07:53 - 2014-11-26 07:53 - 00000000 ____D () C:\Users\Gast\AppData\Roaming\Macromedia 2014-11-26 07:53 - 2014-11-26 07:53 - 00000000 ____D () C:\Users\Gast\AppData\Local\Opera 2014-11-26 07:52 - 2014-11-26 07:53 - 00000000 ____D () C:\Users\Gast\AppData\Roaming\Mozilla 2014-11-26 07:52 - 2014-11-26 07:53 - 00000000 ____D () C:\Users\Gast\AppData\Local\Mozilla 2014-11-26 07:52 - 2014-11-26 07:52 - 00000000 ____D () C:\Users\Gast\PicStream 2014-11-26 07:52 - 2014-11-26 07:52 - 00000000 ____D () C:\Users\Gast\AppData\Roaming\AVAST Software 2014-11-26 07:52 - 2014-11-26 07:52 - 00000000 ____D () C:\Users\Gast\AppData\Local\clear.fi 2014-11-26 07:52 - 2014-11-26 07:52 - 00000000 ____D () C:\Users\Gast\AppData\Local\AOP SDK 2014-11-26 07:51 - 2014-11-26 07:51 - 00001454 _____ () C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-11-26 07:51 - 2014-11-26 07:51 - 00000020 ___SH () C:\Users\Gast\ntuser.ini 2014-11-26 07:51 - 2014-11-26 07:51 - 00000000 _SHDL () C:\Users\Gast\Vorlagen 2014-11-26 07:51 - 2014-11-26 07:51 - 00000000 _SHDL () C:\Users\Gast\Startmenü 2014-11-26 07:51 - 2014-11-26 07:51 - 00000000 _SHDL () C:\Users\Gast\Netzwerkumgebung 2014-11-26 07:51 - 2014-11-26 07:51 - 00000000 _SHDL () C:\Users\Gast\Lokale Einstellungen 2014-11-26 07:51 - 2014-11-26 07:51 - 00000000 _SHDL () C:\Users\Gast\Eigene Dateien 2014-11-26 07:51 - 2014-11-26 07:51 - 00000000 _SHDL () C:\Users\Gast\Druckumgebung 2014-11-26 07:51 - 2014-11-26 07:51 - 00000000 _SHDL () C:\Users\Gast\Documents\Eigene Musik 2014-11-26 07:51 - 2014-11-26 07:51 - 00000000 _SHDL () C:\Users\Gast\Documents\Eigene Bilder 2014-11-26 07:51 - 2014-11-26 07:51 - 00000000 _SHDL () C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programme 2014-11-26 07:51 - 2014-11-26 07:51 - 00000000 _SHDL () C:\Users\Gast\AppData\Local\Verlauf 2014-11-26 07:51 - 2014-11-26 07:51 - 00000000 _SHDL () C:\Users\Gast\AppData\Local\Anwendungsdaten 2014-11-26 07:51 - 2014-11-26 07:51 - 00000000 _SHDL () C:\Users\Gast\Anwendungsdaten 2014-11-26 07:51 - 2014-11-26 07:51 - 00000000 ____D () C:\Users\Gast\AppData\Roaming\Adobe 2014-11-26 07:51 - 2014-11-26 07:51 - 00000000 ____D () C:\Users\Gast\AppData\Local\VirtualStore 2014-11-26 07:51 - 2014-11-26 07:51 - 00000000 ____D () C:\Users\Gast\AppData\Local\Packages 2014-11-26 07:50 - 2014-12-10 01:13 - 00000000 ____D () C:\Users\Gast\AppData\Local\Pokki 2014-11-26 07:50 - 2014-11-26 07:52 - 00000000 ____D () C:\Users\Gast 2014-11-26 07:50 - 2014-11-12 07:33 - 00000000 ___RD () C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools 2014-11-26 07:50 - 2014-09-15 10:23 - 00000000 ___RD () C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility 2014-11-26 07:50 - 2014-03-18 10:49 - 00000369 _____ () C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk 2014-11-26 07:50 - 2014-03-18 10:49 - 00000369 _____ () C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk 2014-11-26 07:50 - 2013-08-22 16:36 - 00000000 ___RD () C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories 2014-11-26 07:50 - 2013-08-22 16:36 - 00000000 ____D () C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance 2014-11-25 13:10 - 2014-11-25 13:10 - 00001847 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera 12.16 1860.lnk 2014-11-25 13:10 - 2014-11-25 13:10 - 00001835 _____ () C:\Users\Public\Desktop\Opera 12.16 1860.lnk 2014-11-25 13:10 - 2014-11-25 13:10 - 00000000 ____D () C:\Users\Raf\AppData\Roaming\Opera 2014-11-25 13:10 - 2014-11-25 13:10 - 00000000 ____D () C:\Users\Raf\AppData\Local\Opera 2014-11-25 13:10 - 2014-11-25 13:10 - 00000000 ____D () C:\Program Files\Opera x64 2014-11-25 13:10 - 2014-11-25 13:10 - 00000000 ____D () C:\Program Files (x86)\Opera x64 2014-11-21 03:36 - 2014-11-21 03:36 - 00000763 _____ () C:\Users\Raf\Desktop\Karies.txt 2014-11-19 20:06 - 2014-11-10 00:19 - 00991232 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2014-11-19 20:06 - 2014-11-10 00:19 - 00806400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll 2014-11-19 20:06 - 2014-11-10 00:18 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\pku2u.dll 2014-11-19 20:06 - 2014-11-10 00:18 - 00208896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pku2u.dll ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-12-15 11:11 - 2014-09-09 12:16 - 00000000 ____D () C:\Users\Raf\AppData\Roaming\vlc 2014-12-15 11:10 - 2014-08-18 07:33 - 00003918 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{15A1396F-65D9-4948-8A78-422AAE8D4D90} 2014-12-15 11:02 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\sru 2014-12-15 11:00 - 2014-08-18 07:29 - 00003598 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3570792933-1699095929-2760690963-1001 2014-12-15 10:55 - 2014-08-18 07:27 - 00002162 _____ () C:\Users\Raf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pokki Start Menu.lnk 2014-12-15 10:53 - 2014-08-26 10:47 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-12-15 10:53 - 2014-08-18 07:23 - 00000000 ____D () C:\Users\Raf\AppData\Local\Pokki 2014-12-14 23:41 - 2014-08-18 07:47 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-12-14 23:37 - 2014-07-22 12:25 - 01155592 _____ () C:\Windows\WindowsUpdate.log 2014-12-14 20:52 - 2013-08-22 16:20 - 00000000 ____D () C:\Windows\CbsTemp 2014-12-14 17:23 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\AppReadiness 2014-12-13 19:50 - 2014-08-18 07:45 - 00280064 ___SH () C:\Users\Raf\Downloads\Thumbs.db 2014-12-13 18:48 - 2014-08-18 07:43 - 00000000 ____D () C:\Users\Raf\dwhelper 2014-12-12 13:12 - 2014-04-03 06:46 - 00002457 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk 2014-12-12 12:26 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\rescache 2014-12-12 11:06 - 2013-08-22 15:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-12-12 11:05 - 2014-03-18 10:39 - 00035574 _____ () C:\Windows\PFRO.log 2014-12-12 11:03 - 2014-11-06 03:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Comodo 2014-12-12 11:01 - 2014-04-03 06:36 - 00000000 ____D () C:\Program Files (x86)\WildTangent Games 2014-12-12 11:00 - 2014-04-03 06:36 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games 2014-12-12 11:00 - 2014-04-03 06:36 - 00000000 ____D () C:\ProgramData\WildTangent 2014-12-12 10:41 - 2014-04-03 06:48 - 00000000 ____D () C:\ProgramData\McAfee 2014-12-12 10:40 - 2013-08-22 14:25 - 00262144 ___SH () C:\Windows\system32\config\BBI 2014-12-12 10:39 - 2013-08-22 16:36 - 00000000 ___HD () C:\Windows\ELAMBKUP 2014-12-12 09:16 - 2014-08-19 16:13 - 00248832 ___SH () C:\Users\Raf\Desktop\Thumbs.db 2014-12-12 08:29 - 2014-11-06 16:02 - 00000000 ____D () C:\Users\Raf\Desktop\Ebay 2014-12-11 18:43 - 2014-09-13 21:09 - 00000152 _____ () C:\Users\Raf\Desktop\Neues Textdokument (3).txt 2014-12-11 11:00 - 2013-08-22 14:25 - 00262144 ___SH () C:\Windows\system32\config\ELAM 2014-12-11 10:58 - 2014-08-18 07:39 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2014-12-11 10:54 - 2014-08-21 21:25 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-12-11 10:54 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\sr-Latn-RS 2014-12-11 10:54 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\sr-Latn-CS 2014-12-11 10:54 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\PolicyDefinitions 2014-12-11 10:54 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\AppCompat 2014-12-11 09:55 - 2014-08-21 15:29 - 00000000 ____D () C:\Windows\system32\MRT 2014-12-11 09:50 - 2014-08-21 15:29 - 112710672 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-12-10 15:01 - 2014-10-14 07:20 - 00000000 ____D () C:\Program Files (x86)\Opera 2014-12-10 08:04 - 2014-07-19 19:14 - 00764340 _____ () C:\Windows\system32\perfh007.dat 2014-12-10 08:04 - 2014-07-19 19:14 - 00159160 _____ () C:\Windows\system32\perfc007.dat 2014-12-10 08:04 - 2014-03-18 10:47 - 01776918 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-12-10 01:41 - 2014-10-24 15:36 - 00001122 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-12-10 01:41 - 2014-08-26 10:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-12-10 01:41 - 2014-08-26 10:46 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-12-10 01:41 - 2014-08-18 07:47 - 00003772 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-12-09 12:50 - 2013-08-22 15:46 - 00030645 _____ () C:\Windows\setupact.log 2014-12-09 11:34 - 2014-08-18 07:53 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update 2014-12-03 15:01 - 2014-10-14 07:21 - 00003850 _____ () C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1413267635 2014-12-03 15:01 - 2014-10-14 07:20 - 00001061 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk 2014-11-22 09:32 - 2014-08-18 07:26 - 00002333 _____ () C:\Users\Raf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnk 2014-11-22 05:08 - 2014-08-18 07:53 - 01041168 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys 2014-11-21 06:14 - 2014-08-26 10:46 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-11-21 06:14 - 2014-08-26 10:46 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-11-21 06:14 - 2014-08-26 10:46 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-11-19 06:07 - 2014-11-06 03:24 - 00000000 ____D () C:\Users\Raf\Desktop\CR7Z Some content of TEMP: ==================== C:\Users\Gast\AppData\Local\Temp\oct3431.tmp.exe C:\Users\Raf\AppData\Local\Temp\AskPIP_FF_.exe C:\Users\Raf\AppData\Local\Temp\ochelper.dll C:\Users\Raf\AppData\Local\Temp\ochelper.exe C:\Users\Raf\AppData\Local\Temp\oct72A6.tmp.exe C:\Users\Raf\AppData\Local\Temp\octD99A.tmp.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-12-10 05:19 ==================== End Of Log ============================ --- --- --- Und hier der Addition.txt Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 14-12-2014 01 Ran by Raf at 2014-12-15 11:27:12 Running from C:\Users\Raf\Downloads Boot Mode: Normal ========================================================== ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736} ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) abDocs (HKLM-x32\...\{CA4FE8B0-298C-4E5D-A486-F33B126D6A0A}) (Version: 1.04.3004 - Acer Incorporated) abMedia (HKLM-x32\...\{E9AF1707-3F3A-49E2-8345-4F2D629D0876}) (Version: 2.05.2007.2 - Acer Incorporated) abPhoto (HKLM-x32\...\{B5AD89F2-03D3-4206-8487-018298007DD0}) (Version: 3.00.2007.1 - Acer Incorporated) Acer Docs Office AddIn (HKLM-x32\...\{DCBF3379-246B-47E1-8173-639B63940838}) (Version: 3.01.2001 - Acer) Acer Explorer Agent (HKLM\...\{4D0F42CF-1693-43D9-BDC8-19141D023EE0}) (Version: 2.00.3000 - Acer Incorporated) Acer Portal (HKLM-x32\...\{A5AD0B17-F34D-49BE-A157-C8B3D52ACD13}) (Version: 2.04.2007 - Acer Incorporated) Acer Recovery Management (HKLM\...\{07F2005A-8CAC-4A4B-83A2-DA98A722CA61}) (Version: 6.00.8106 - Acer Incorporated) Acer Remote Files (HKLM\...\{13885028-098C-4799-9B71-27DAC96502D5}) (Version: 1.02.2003 - Acer Incorporated) Acer User Experience Improvement Program App Monitor Plugin (HKLM\...\{978724F6-1863-4DD5-9E66-FB77F5AB5613}) (Version: 1.01.3003 - Acer Incorporated) Acer User Experience Improvement Program Framework (HKLM\...\{12A718F2-2357-4D41-9E1F-18583A4745F7}) (Version: 1.01.3003 - Acer Incorporated) Acer Video Player (HKLM-x32\...\{B6846F20-4821-11E3-8F96-0800200C9A66}) (Version: 1.00.2001.4 - Acer Incorporated) Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.246 - Adobe Systems Incorporated) Adobe Reader XI (11.0.04) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AB0000000001}) (Version: 11.0.04 - Adobe Systems Incorporated) Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated) AOP Framework (HKLM-x32\...\{4A37A114-702F-4055-A4B6-16571D4A5353}) (Version: 3.01.2012.1 - Acer Incorporated) avast! Free Antivirus (HKLM-x32\...\Avast) (Version: 9.0.2021 - AVAST Software) Cliqz (HKLM-x32\...\{5A0C0737-6AFE-4DC6-A8B4-6DFE509ACD75}_is1) (Version: 0.5.22 - Cliqz.com) CyberLink PowerDVD 12 (HKLM-x32\...\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.3716.57 - CyberLink Corp.) FormatFactory 3.3.5.0 (HKLM-x32\...\FormatFactory) (Version: 3.3.5.0 - Format Factory) Host App Service (HKU\S-1-5-21-3570792933-1699095929-2760690963-1001\...\Pokki) (Version: 0.269.4.112 - Pokki) Hotkey Utility (HKLM-x32\...\{A6DC88AD-501A-44BC-884D-57435F972E2C}) (Version: 3.00.8102 - Acer Incorporated) ICQ 8.2 (build 7126) (HKU\S-1-5-21-3570792933-1699095929-2760690963-1001\...\ICQ) (Version: 8.2.7126.0 - ICQ) Identity Card (HKLM-x32\...\{3D9CB654-99AD-4301-89C6-0D12A790767C}) (Version: 2.00.8101 - Acer Incorporated) Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3355 - Intel Corporation) Intel(R) Trusted Execution Engine (HKLM\...\{176E2755-0A17-42C6-88E2-192AB2131278}) (Version: 1.0.0.1064 - Intel Corporation) LibreOffice 4.2.6.3 (HKLM-x32\...\{14DB1822-00B5-4820-86B5-EF893CA46B53}) (Version: 4.2.6.3 - The Document Foundation) Live Updater (HKLM-x32\...\{EE26E302-876A-48D9-9058-3129E5B99999}) (Version: 2.00.8100 - Acer Incorporated) LottozahlenGenerator 5.0.1 (HKLM-x32\...\LottozahlenGenerator_is1) (Version: - ) Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation) Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4569.1506 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Mozilla Firefox 34.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 34.0 (x86 de)) (Version: 34.0 - Mozilla) Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 31.0 - Mozilla) Nero BackItUp 12 Essentials OEM.a01 (HKLM-x32\...\{551AC8F2-FEA2-4B45-ACF7-C98681233CC9}) (Version: 12.5.01200 - Nero AG) Opera 12.16 (HKLM\...\Opera 12.16.1860) (Version: 12.16.1860 - Opera Software ASA) Opera Stable 26.0.1656.32 (HKLM-x32\...\Opera 26.0.1656.32) (Version: 26.0.1656.32 - Opera Software ASA) Pokki Start Menu (HKU\S-1-5-21-3570792933-1699095929-2760690963-1001\...\Pokki_Start_Menu) (Version: 0.269.4.112 - Pokki) Prerequisite installer (x32 Version: 12.0.0003 - Nero AG) Hidden Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.3.3.34 - Realtek Semiconductor Corp.) Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.29.314.2014 - Realtek) Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7054 - Realtek Semiconductor Corp.) Skype™ 6.20 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.20.104 - Skype Technologies S.A.) Spotify (HKLM-x32\...\Spotify) (Version: 0.9.6.81.gd359a796 - Spotify AB) TippGenerator 7.70 ProVersion (HKLM-x32\...\TippGeneratorPro_is1) (Version: - ) VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN) WinRAR 5.11 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.11.0 - win.rar GmbH) ==================== Custom CLSID (selected items): ========================== (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.) ==================== Restore Points ========================= 26-11-2014 01:51:26 Windows Update 03-12-2014 03:17:38 Geplanter Prüfpunkt 11-12-2014 08:45:26 Windows Update 12-12-2014 10:01:54 eBay Worldwide wird entfernt ==================== Hosts content: ========================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.) Task: {134C1EB9-02A4-4615-9EFA-5EF24A51EEB1} - System32\Tasks\Hotkey Utility => C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe [2013-12-30] (Acer Incorporated) Task: {1E016BE8-FBC4-4CF4-96B0-AAF55F67B1AF} - System32\Tasks\AcerCloud => C:\Program Files (x86)\Acer\Acer Portal\acpanel_win.exe [2014-01-16] (Acer Incorporated) Task: {6CEB9F54-2DF5-404E-B647-7E0C23CCEF37} - System32\Tasks\Recovery Management\Notification => C:\Program Files\Acer\Acer Recovery Management\Notification\Notification.exe [2014-03-18] (Acer Incorporated) Task: {964A360F-5ADE-4131-A540-6C88202545B0} - System32\Tasks\Opera scheduled Autoupdate 1413267635 => C:\Program Files (x86)\Opera\launcher.exe [2014-11-25] (Opera Software) Task: {9EC02602-83E4-4159-9D30-180A7FDEA08D} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2014-12-11] (Microsoft Corporation) Task: {A4385175-D440-4698-8BFC-88F79DFFC144} - System32\Tasks\ALUAgent => C:\Program Files (x86)\Acer\Live Updater\liveupdater_agent.exe [2013-01-22] () Task: {A6288010-F26C-4005-B961-6625B30C142F} - System32\Tasks\{6135AB29-C3E6-464E-99C4-749893E521DD} => Firefox.exe hxxp://ui.skype.com/ui/0/6.20.0.104/de/abandoninstall?source=lightinstaller&page=tsMain Task: {B2A24E93-7A1E-4A9D-A70D-63AF5B675582} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-08-18] (AVAST Software) Task: {C3611A00-4008-4697-AA02-E3735CDC8959} - System32\Tasks\ALU => C:\Program Files (x86)\Acer\Live Updater\updater.exe [2013-07-08] () Task: {EAD71B41-5043-4D96-B3F8-B10DD58FEB21} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-12-10] (Adobe Systems Incorporated) Task: {F065E4FA-7DA2-4017-97C7-B040EDBD9174} - System32\Tasks\UbtFrameworkService => C:\Program Files\Acer\User Experience Improvement Program\Framework\TriggerFramework.exe [2014-01-24] (TODO: <Company name>) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe ==================== Loaded Modules (whitelisted) ============= 2014-08-18 07:52 - 2014-08-18 07:52 - 00301152 _____ () C:\Program Files\AVAST Software\Avast\aswProperty.dll 2014-12-11 15:28 - 2014-12-11 15:28 - 02905600 _____ () C:\Program Files\AVAST Software\Avast\defs\14121100\algo.dll 2014-12-14 14:08 - 2014-12-14 14:08 - 02908160 _____ () C:\Program Files\AVAST Software\Avast\defs\14121400\algo.dll 2014-08-21 08:17 - 2014-08-21 08:17 - 00859144 _____ () C:\Users\Raf\AppData\Roaming\ICQM\ICQ\dll\YLUSBTEL.dll 2014-08-18 07:52 - 2014-08-18 07:52 - 19329904 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll 2014-09-02 20:20 - 2014-09-02 20:20 - 00015616 _____ () C:\Windows\assembly\GAC_MSIL\MyService\1.0.0.1__2dfa3f50f0bed57d\MyService.dll 2014-08-06 15:47 - 2014-08-06 15:47 - 00013568 _____ () C:\Program Files (x86)\Acer\AOP Framework\ServiceInterface.dll 2014-07-24 17:43 - 2014-07-24 17:43 - 00279296 _____ () C:\Program Files (x86)\Acer\AcerCloud Docs\libcurl.dll 2014-07-22 16:43 - 2014-07-22 16:43 - 00203008 _____ () C:\Program Files (x86)\Acer\abPhoto\curllib.dll 2014-07-22 16:44 - 2014-07-22 16:44 - 00630528 _____ () C:\Program Files (x86)\Acer\abPhoto\tag.dll 2014-07-22 16:44 - 2014-07-22 16:44 - 00654552 _____ () C:\Program Files (x86)\Acer\abPhoto\sqlite3.dll 2014-07-22 16:43 - 2014-07-22 16:43 - 00119552 _____ () C:\Program Files (x86)\Acer\abPhoto\OpenLDAP.dll 2014-10-02 19:07 - 2014-10-02 19:07 - 00569856 _____ () C:\Users\Raf\AppData\Local\Pokki\Engine\ppGoogleNaClPluginChrome.dll 2014-10-02 19:07 - 2014-10-02 19:07 - 01400846 _____ () C:\Users\Raf\AppData\Local\Pokki\Engine\avcodec-54.dll 2014-10-02 19:07 - 2014-10-02 19:07 - 00151054 _____ () C:\Users\Raf\AppData\Local\Pokki\Engine\avutil-51.dll 2014-10-02 19:07 - 2014-10-02 19:07 - 00222734 _____ () C:\Users\Raf\AppData\Local\Pokki\Engine\avformat-54.dll 2014-12-02 14:13 - 2014-12-02 14:14 - 03758192 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ==================== Alternate Data Streams (whitelisted) ========= (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.) ==================== Safe Mode (whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""="" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""="" ==================== EXE Association (whitelisted) ============= (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.) ==================== MSCONFIG/TASK MANAGER disabled items ========= (Currently there is no automatic fix for this section.) ========================= Accounts: ========================== Administrator (S-1-5-21-3570792933-1699095929-2760690963-500 - Administrator - Disabled) Gast (S-1-5-21-3570792933-1699095929-2760690963-501 - Limited - Enabled) => C:\Users\Gast HomeGroupUser$ (S-1-5-21-3570792933-1699095929-2760690963-1003 - Limited - Enabled) Raf (S-1-5-21-3570792933-1699095929-2760690963-1001 - Administrator - Enabled) => C:\Users\Raf ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (12/14/2014 11:37:24 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: icq.exe, Version: 8.2.7126.0, Zeitstempel: 0x53e25ade Name des fehlerhaften Moduls: ieframe.dll, Version: 11.0.9600.17496, Zeitstempel: 0x546fe320 Ausnahmecode: 0xc000041d Fehleroffset: 0x001288a4 ID des fehlerhaften Prozesses: 0x17a8 Startzeit der fehlerhaften Anwendung: 0xicq.exe0 Pfad der fehlerhaften Anwendung: icq.exe1 Pfad des fehlerhaften Moduls: icq.exe2 Berichtskennung: icq.exe3 Vollständiger Name des fehlerhaften Pakets: icq.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: icq.exe5 Error: (12/14/2014 11:37:20 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: icq.exe, Version: 8.2.7126.0, Zeitstempel: 0x53e25ade Name des fehlerhaften Moduls: ieframe.dll, Version: 11.0.9600.17496, Zeitstempel: 0x546fe320 Ausnahmecode: 0xc0000005 Fehleroffset: 0x001288a4 ID des fehlerhaften Prozesses: 0x17a8 Startzeit der fehlerhaften Anwendung: 0xicq.exe0 Pfad der fehlerhaften Anwendung: icq.exe1 Pfad des fehlerhaften Moduls: icq.exe2 Berichtskennung: icq.exe3 Vollständiger Name des fehlerhaften Pakets: icq.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: icq.exe5 Error: (12/12/2014 01:12:15 PM) (Source: MsiInstaller) (EventID: 1024) (User: Rafness) Description: Produkt: Adobe Reader XI (11.0.09) - Deutsch - Update "{AC76BA86-7AD7-0000-2550-7A8C40011010}" konnte nicht installiert werden. Fehlercode 1625. Windows Installer kann Protokolle erstellen, um bei der Problembehandlung betreffend der Installation von Softwarepaketen behilflich zu sein. Verwenden Sie folgenden Link, um Anweisungen zur Aktivierung der Protokollierungsunterstützung zu erhalten: hxxp://go.microsoft.com/fwlink/?LinkId=23127 Error: (12/11/2014 09:05:16 AM) (Source: Desktop Window Manager) (EventID: 9020) (User: ) Description: Der Desktopfenster-Manager hat einen schwerwiegenden Fehler (0x8898008d) festgestellt. Error: (12/10/2014 01:13:57 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: McSvHost.exe, Version: 3.8.703.0, Zeitstempel: 0x51f7deae Name des fehlerhaften Moduls: ntdll.dll, Version: 6.3.9600.17278, Zeitstempel: 0x53eebd22 Ausnahmecode: 0xc0000374 Fehleroffset: 0x00000000000f0d6c ID des fehlerhaften Prozesses: 0x7e8 Startzeit der fehlerhaften Anwendung: 0xMcSvHost.exe0 Pfad der fehlerhaften Anwendung: McSvHost.exe1 Pfad des fehlerhaften Moduls: McSvHost.exe2 Berichtskennung: McSvHost.exe3 Vollständiger Name des fehlerhaften Pakets: McSvHost.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: McSvHost.exe5 Error: (12/09/2014 11:33:58 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: McSvHost.exe, Version: 3.8.703.0, Zeitstempel: 0x51f7deae Name des fehlerhaften Moduls: HOMENE~3.DLL, Version: 6.8.718.0, Zeitstempel: 0x537aebe5 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0000000000226ce1 ID des fehlerhaften Prozesses: 0xa08 Startzeit der fehlerhaften Anwendung: 0xMcSvHost.exe0 Pfad der fehlerhaften Anwendung: McSvHost.exe1 Pfad des fehlerhaften Moduls: McSvHost.exe2 Berichtskennung: McSvHost.exe3 Vollständiger Name des fehlerhaften Pakets: McSvHost.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: McSvHost.exe5 Error: (12/09/2014 11:32:19 AM) (Source: Desktop Window Manager) (EventID: 9020) (User: ) Description: Der Desktopfenster-Manager hat einen schwerwiegenden Fehler (0x8898008d) festgestellt. Error: (12/09/2014 11:29:34 AM) (Source: Software Protection Platform Service) (EventID: 16385) (User: ) Description: Fehler beim Planen des Softwareschutzdiensts für den erneuten Start bei 2114-11-15T10:29:34Z. Fehlercode: 0x80071A90. Error: (12/07/2014 04:36:03 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 34.0.0.5442, Zeitstempel: 0x54754d35 Name des fehlerhaften Moduls: mozalloc.dll, Version: 34.0.0.5442, Zeitstempel: 0x54754649 Ausnahmecode: 0x80000003 Fehleroffset: 0x00001425 ID des fehlerhaften Prozesses: 0x1ed4 Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0 Pfad der fehlerhaften Anwendung: plugin-container.exe1 Pfad des fehlerhaften Moduls: plugin-container.exe2 Berichtskennung: plugin-container.exe3 Vollständiger Name des fehlerhaften Pakets: plugin-container.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: plugin-container.exe5 Error: (12/07/2014 01:13:14 PM) (Source: Winlogon) (EventID: 4005) (User: ) Description: Der Windows-Anmeldeprozess wurde unerwartet beendet. System errors: ============= Error: (12/14/2014 00:20:28 PM) (Source: DCOM) (EventID: 10010) (User: Rafness) Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001} Error: (12/13/2014 10:13:18 AM) (Source: DCOM) (EventID: 10010) (User: Rafness) Description: {1B1F472E-3221-4826-97DB-2C2324D389AE} Error: (12/13/2014 10:12:47 AM) (Source: DCOM) (EventID: 10010) (User: Rafness) Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001} Error: (12/13/2014 08:50:03 AM) (Source: DCOM) (EventID: 10010) (User: Rafness) Description: {1B1F472E-3221-4826-97DB-2C2324D389AE} Error: (12/13/2014 08:49:33 AM) (Source: DCOM) (EventID: 10010) (User: Rafness) Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001} Error: (12/13/2014 08:40:37 AM) (Source: DCOM) (EventID: 10010) (User: Rafness) Description: {1B1F472E-3221-4826-97DB-2C2324D389AE} Error: (12/13/2014 08:40:07 AM) (Source: DCOM) (EventID: 10010) (User: Rafness) Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001} Error: (12/13/2014 08:32:15 AM) (Source: DCOM) (EventID: 10010) (User: Rafness) Description: {1B1F472E-3221-4826-97DB-2C2324D389AE} Error: (12/13/2014 08:31:44 AM) (Source: DCOM) (EventID: 10010) (User: Rafness) Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001} Error: (12/12/2014 11:22:22 AM) (Source: DCOM) (EventID: 10010) (User: Rafness) Description: {1B1F472E-3221-4826-97DB-2C2324D389AE} Microsoft Office Sessions: ========================= Error: (12/14/2014 11:37:24 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: icq.exe8.2.7126.053e25adeieframe.dll11.0.9600.17496546fe320c000041d001288a417a801d017b8c0217025C:\Users\Raf\AppData\Roaming\ICQM\icq.exeC:\Windows\SYSTEM32\ieframe.dllc5e3b496-83e1-11e4-826a-f80f41c798ce Error: (12/14/2014 11:37:20 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: icq.exe8.2.7126.053e25adeieframe.dll11.0.9600.17496546fe320c0000005001288a417a801d017b8c0217025C:\Users\Raf\AppData\Roaming\ICQM\icq.exeC:\Windows\SYSTEM32\ieframe.dllc362f301-83e1-11e4-826a-f80f41c798ce Error: (12/12/2014 01:12:15 PM) (Source: MsiInstaller) (EventID: 1024) (User: Rafness) Description: Adobe Reader XI (11.0.09) - Deutsch{AC76BA86-7AD7-0000-2550-7A8C40011010}1625(NULL)(NULL)(NULL) Error: (12/11/2014 09:05:16 AM) (Source: Desktop Window Manager) (EventID: 9020) (User: ) Description: 0x8898008d Error: (12/10/2014 01:13:57 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: McSvHost.exe3.8.703.051f7deaentdll.dll6.3.9600.1727853eebd22c000037400000000000f0d6c7e801d0139bb865b956C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exeC:\Windows\SYSTEM32\ntdll.dll6e80a45a-8001-11e4-8267-f80f41c798ce Error: (12/09/2014 11:33:58 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: McSvHost.exe3.8.703.051f7deaeHOMENE~3.DLL6.8.718.0537aebe5c00000050000000000226ce1a0801d006ce5af75596C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exec:\PROGRA~1\COMMON~1\mcafee\mhn\HOMENE~3.DLLe14f8d95-7f8e-11e4-8267-f80f41c798ce Error: (12/09/2014 11:32:19 AM) (Source: Desktop Window Manager) (EventID: 9020) (User: ) Description: 0x8898008d Error: (12/09/2014 11:29:34 AM) (Source: Software Protection Platform Service) (EventID: 16385) (User: ) Description: 0x80071A902114-11-15T10:29:34Z Error: (12/07/2014 04:36:03 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: plugin-container.exe34.0.0.544254754d35mozalloc.dll34.0.0.54425475464980000003000014251ed401d0121e07c1c0d2C:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dllbfc756c7-7e26-11e4-8267-f80f41c798ce Error: (12/07/2014 01:13:14 PM) (Source: Winlogon) (EventID: 4005) (User: ) Description: ==================== Memory info =========================== Processor: Intel(R) Celeron(R) CPU J1900 @ 1.99GHz Percentage of memory in use: 47% Total physical RAM: 3978.51 MB Available physical RAM: 2078.27 MB Total Pagefile: 4938.51 MB Available Pagefile: 2737.26 MB Total Virtual: 131072 MB Available Virtual: 131071.8 MB ==================== Drives ================================ Drive c: (Acer) (Fixed) (Total:223.5 GB) (Free:168.31 GB) NTFS Drive d: (DATA) (Fixed) (Total:224.26 GB) (Free:223.86 GB) NTFS Drive f: () (Removable) (Total:14.72 GB) (Free:14.69 GB) FAT32 ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 465.8 GB) (Disk ID: 141A2013) Partition: GPT Partition Type. ======================================================== Disk: 1 (Size: 14.7 GB) (Disk ID: 00000000) Partition: GPT Partition Type. ==================== End Of Log ============================ |
15.12.2014, 20:27 | #4 |
/// the machine /// TB-Ausbilder | PUP.Optional.InstallCore.A gefunden Downloade Dir bitte AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
17.12.2014, 21:17 | #5 |
| PUP.Optional.InstallCore.A gefunden So, hier der ADW cleaner Log, und der nächste folgt in einigen Minuten. Code:
ATTFilter # AdwCleaner v4.105 - Bericht erstellt am 17/12/2014 um 20:53:17 # Aktualisiert 08/12/2014 von Xplode # Database : 2014-12-16.1 [Live] # Betriebssystem : Windows 8.1 Connected (64 bits) # Benutzername : Raf - RAFNESS # Gestartet von : C:\Users\Raf\Downloads\AdwCleaner_4.105.exe # Option : Löschen ***** [ Dienste ] ***** ***** [ Dateien / Ordner ] ***** Ordner Gelöscht : C:\Users\Raf\AppData\Local\CrashRpt ***** [ Tasks ] ***** ***** [ Verknüpfungen ] ***** ***** [ Registrierungsdatenbank ] ***** Schlüssel Gelöscht : HKCU\Software\Classes\pokki Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Pokki] Schlüssel Gelöscht : HKCU\Software\Classes\AllFileSystemObjects\shell\pokki Schlüssel Gelöscht : HKCU\Software\Classes\Directory\shell\pokki Schlüssel Gelöscht : HKCU\Software\Classes\Drive\shell\pokki Schlüssel Gelöscht : HKCU\Software\Classes\lnkfile\shell\pokki Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00B11DA2-75ED-4364-ABA5-9A95B1F5E946} Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AA9A4890-4262-4441-8977-E2FFCBFB706C} Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472F-A0FF-E1416B8B2E3A} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AA9A4890-4262-4441-8977-E2FFCBFB706C} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472F-A0FF-E1416B8B2E3A} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AA9A4890-4262-4441-8977-E2FFCBFB706C} Schlüssel Gelöscht : HKCU\Software\InstallCore Schlüssel Gelöscht : HKCU\Software\OCS Schlüssel Gelöscht : HKCU\Software\Pokki Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Pokki ***** [ Browser ] ***** -\\ Internet Explorer v11.0.9600.17416 -\\ Mozilla Firefox v34.0 (x86 de) -\\ Opera v26.0.1656.60 [C:\Users\Gast\AppData\Roaming\Opera Software\Opera Stable\preferences] - Gelöscht [Extension] : aaipilfmheplbcghignccoiiebekkdhe [C:\Users\Gast\AppData\Roaming\Opera Software\Opera Stable\preferences] - Gelöscht [Extension] : elchiiiejkobdbblfejjkbphbddgmljf [C:\Users\Gast\AppData\Roaming\Opera Software\Opera Stable\preferences] - Gelöscht [Extension] : ffhfoagmjcnkolneahbpagjcjjaeofbg [C:\Users\Gast\AppData\Roaming\Opera Software\Opera Stable\preferences] - Gelöscht [Extension] : hjghiofiijcepdnocbgefbdlbckjfheg [C:\Users\Gast\AppData\Roaming\Opera Software\Opera Stable\preferences] - Gelöscht [Extension] : iklgpchfbohgmghgfagediakopecfmbm [C:\Users\Gast\AppData\Roaming\Opera Software\Opera Stable\preferences] - Gelöscht [Extension] : kfgaibfbmkjgmimhbbaikfnpkkjkpoan [C:\Users\Gast\AppData\Roaming\Opera Software\Opera Stable\preferences] - Gelöscht [Extension] : lmnbobhffedhdhfpcjkjphcfpeeiocdn [C:\Users\Gast\AppData\Roaming\Opera Software\Opera Stable\preferences] - Gelöscht [Extension] : kjpifmjicccpbkfjdkehimhgklfkbanh [C:\Users\Gast\AppData\Roaming\Opera Software\Opera Stable\preferences] - Gelöscht [Extension] : hoidflomjnnnbiemmkjdjkkialmhbago [C:\Users\Gast\AppData\Roaming\Opera Software\Opera Stable\preferences] - Gelöscht [Extension] : ekpibplnnkfdcafdpoekhoffegcajene [C:\Users\Gast\AppData\Roaming\Opera Software\Opera Stable\preferences] - Gelöscht [Extension] : ipljmghelflfikejmgkmlmpjmehfjodc [C:\Users\Gast\AppData\Roaming\Opera Software\Opera Stable\preferences] - Gelöscht [Extension] : ejddjnilmdncjilbfjgameihlklfpohp [C:\Users\Gast\AppData\Roaming\Opera Software\Opera Stable\preferences] - Gelöscht [Extension] : eagomcfjiefffhpaejnlpjccikpipdoe ************************* AdwCleaner[R0].txt - [4359 octets] - [17/12/2014 20:45:12] AdwCleaner[R1].txt - [4419 octets] - [17/12/2014 20:49:34] AdwCleaner[S0].txt - [3816 octets] - [17/12/2014 20:53:17] ########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [3876 octets] ########## Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 6.4.0 (11.29.2014:1) OS: Windows 8.1 Connected x64 Ran by Raf on 17.12.2014 at 21:11:59,32 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys ~~~ Files Successfully deleted: [File] C:\Windows\prefetch\ASKPIP_FF_.EXE-F562E0D2.pf ~~~ Folders ~~~ FireFox Emptied folder: C:\Users\Raf\AppData\Roaming\mozilla\firefox\profiles\1955p245.default\minidumps [13 files] ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 17.12.2014 at 21:15:23,50 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ |
18.12.2014, 20:31 | #6 |
/// the machine /// TB-Ausbilder | PUP.Optional.InstallCore.A gefundenESET Online Scanner
Downloade Dir bitte SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ --> PUP.Optional.InstallCore.A gefunden |
21.12.2014, 08:27 | #7 |
| PUP.Optional.InstallCore.A gefunden Hier der Eset Log Code:
ATTFilter ESETSmartInstaller@High as downloader log: all ok # product=EOS # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.7623 # api_version=3.0.2 # EOSSerial=deef9c021e1b264b8e222d03e3fa3801 # engine=21650 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2014-12-21 06:37:49 # local_time=2014-12-21 07:37:49 (+0100, Mitteleuropäische Zeit) # country="Germany" # lang=1031 # osver=6.2.9200 NT # compatibility_mode_1='avast! Antivirus' # compatibility_mode=783 16777213 71 94 296128 299852 0 0 # compatibility_mode_1='' # compatibility_mode=5893 16776574 100 94 3369846 34244473 0 0 # scanned=192418 # found=2 # cleaned=0 # scan_time=6370 sh=A24E0031F28E6940CE65A27CCCDD2BB90BA4E228 ft=1 fh=7dcb11e9939f426b vn="Variante von Win32/InstallCore.QW evtl. unerwünschte Anwendung" ac=I fn="C:\$Recycle.Bin\S-1-5-21-3570792933-1699095929-2760690963-1001\$REKWHHY.exe" sh=9A801D76DB4A7AE3C39F1FABDE894B0389317F89 ft=1 fh=7dcb11e99e0d9fbf vn="Variante von Win32/InstallCore.QW evtl. unerwünschte Anwendung" ac=I fn="C:\$Recycle.Bin\S-1-5-21-3570792933-1699095929-2760690963-1001\$RG46HHI.exe" Security Log Code:
ATTFilter Results of screen317's Security Check version 0.99.93 x64 (UAC is enabled) Internet Explorer 11 ``````````````Antivirus/Firewall Check:`````````````` Windows Defender avast! Antivirus Antivirus up to date! (On Access scanning disabled!) `````````Anti-malware/Other Utilities Check:````````` Adobe Flash Player 15.0.0.246 Flash Player out of Date! Adobe Reader XI Mozilla Firefox (34.0) ````````Process Check: objlist.exe by Laurent```````` AVAST Software Avast AvastSvc.exe AVAST Software Avast ng ngservice.exe AVAST Software Avast ng vbox\AvastVBoxSVC.exe AVAST Software Avast AvastUI.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: % ````````````````````End of Log`````````````````````` FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 21-12-2014 Ran by Raf (administrator) on RAFNESS on 21-12-2014 08:25:29 Running from C:\Users\Raf\Downloads Loaded Profile: Raf (Available profiles: Raf & Gast) Platform: Windows 8.1 Connected (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Acer Incorporated) C:\Program Files (x86)\Acer\AOP Framework\CCDMonitorService.exe (Intel(R) Corporation) C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe (Microsoft Corporation) C:\Windows\System32\dasHost.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Acer Cloud Technology) C:\Program Files (x86)\Acer\AOP Framework\acer\ccd.exe (Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe (acer) C:\Program Files\Acer\User Experience Improvement Program\Framework\UBTService.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\ng\ngservice.exe (Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe (Acer Incorporated) C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\igfxsrvc.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Spotify Ltd) C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe (ICQ) C:\Users\Raf\AppData\Roaming\ICQM\icq.exe () C:\Program Files (x86)\Audials\Audials 12\AudialsNotifier.exe (Acer Incorporated) C:\Program Files (x86)\Acer\AOP Framework\BackgroundAgent.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_246.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_246.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13654744 2013-09-30] (Realtek Semiconductor) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated) HKLM-x32\...\Run: [BacKGround Agent] => C:\Program Files (x86)\Acer\AOP Framework\BackgroundAgent.exe [52992 2014-08-06] (Acer Incorporated) HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5223016 2014-12-17] (AVAST Software) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKU\S-1-5-21-3570792933-1699095929-2760690963-1001\...\Run: [Spotify Web Helper] => C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe [1168896 2014-07-22] (Spotify Ltd) HKU\S-1-5-21-3570792933-1699095929-2760690963-1001\...\Run: [icq] => C:\Users\Raf\AppData\Roaming\ICQM\icq.exe [34923528 2014-08-21] (ICQ) HKU\S-1-5-21-3570792933-1699095929-2760690963-1001\...\Run: [AudialsNotifier] => C:\Program Files (x86)\Audials\Audials 12\AudialsNotifier.exe [2412296 2014-12-10] () HKU\S-1-5-21-3570792933-1699095929-2760690963-1001\...\RunOnce: [Adobe Speed Launcher] => 1419145582 ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-3570792933-1699095929-2760690963-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://acer13.msn.com/?pc=ACJB HKU\S-1-5-21-3570792933-1699095929-2760690963-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com/?pc=ACJB SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-3570792933-1699095929-2760690963-1001 -> {8100CE5E-F751-4CF9-8466-54E9FE2CC8C7} URL = BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 FireFox: ======== FF ProfilePath: C:\Users\Raf\AppData\Roaming\Mozilla\Firefox\Profiles\1955p245.default FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_246.dll () FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_246.dll () FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Users\Raf\AppData\Roaming\Mozilla\Firefox\Profiles\1955p245.default\searchplugins\google-images.xml FF SearchPlugin: C:\Users\Raf\AppData\Roaming\Mozilla\Firefox\Profiles\1955p245.default\searchplugins\google-maps.xml FF Extension: DownloadHelper - C:\Users\Raf\AppData\Roaming\Mozilla\Firefox\Profiles\1955p245.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-09-06] FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-12-17] FF HKU\S-1-5-21-3570792933-1699095929-2760690963-1001\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Raf\AppData\Roaming\Mozilla\Firefox\Profiles\1955p245.default\extensions\cliqz@cliqz.com Chrome: ======= CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-12-17] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-12-17] (AVAST Software) R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4012248 2014-12-17] (Avast Software) R2 CCDMonitorService; C:\Program Files (x86)\Acer\AOP Framework\CCDMonitorService.exe [3058944 2014-08-06] (Acer Incorporated) R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe [733696 2013-07-01] (Intel(R) Corporation) [File not signed] S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\TXE Components\TCS\SocketHeciServer.exe [822232 2013-07-01] (Intel(R) Corporation) R3 UEIPSvc; C:\Program Files\Acer\User Experience Improvement Program\Framework\UBTService.exe [222952 2014-01-24] (acer) S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation) S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-12-17] () R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [83280 2014-12-17] (AVAST Software) R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-12-17] (AVAST Software) S0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-12-17] () R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2014-12-17] (AVAST Software) S1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2014-12-17] (AVAST Software) R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2014-12-17] (AVAST Software) R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2014-12-17] () R1 RrNetCapFilterDriver; C:\Windows\system32\DRIVERS\RrNetCapFilterDriver.sys [24744 2014-12-10] (Audials AG) R3 TXEIx64; C:\Windows\System32\drivers\TXEIx64.sys [88592 2014-01-15] (Intel Corporation) R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [270728 2014-12-17] (Avast Software) S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation) R3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-12-21 08:25 - 2014-12-21 08:25 - 00000000 ____D () C:\Users\Raf\Downloads\FRST-OlderVersion 2014-12-21 08:16 - 2014-12-21 08:16 - 00852505 _____ () C:\Users\Raf\Downloads\SecurityCheck.exe 2014-12-21 05:47 - 2014-12-21 05:47 - 00000000 ____D () C:\Program Files (x86)\ESET 2014-12-21 05:45 - 2014-12-21 05:46 - 02347384 _____ (ESET) C:\Users\Raf\Downloads\esetsmartinstaller_deu.exe 2014-12-21 00:33 - 2014-12-21 00:33 - 00923778 _____ () C:\Users\Raf\Downloads\7.jpeg 2014-12-20 07:01 - 2014-12-20 07:01 - 00837383 _____ () C:\Users\Raf\Downloads\2(1).jpeg 2014-12-20 07:01 - 2014-12-20 07:01 - 00478391 _____ () C:\Users\Raf\Downloads\1(1).jpeg 2014-12-17 23:34 - 2014-12-19 00:43 - 00000000 ____D () C:\Users\Raf\Desktop\Casio ^^ 2014-12-17 23:22 - 2014-12-17 23:49 - 00000000 ____D () C:\Users\Raf\Desktop\Casio 2014-12-17 22:56 - 2014-12-17 22:56 - 00000247 _____ () C:\Windows\system32\2014-12-17-21-56-07.048-aswFe.exe-5784.log 2014-12-17 22:49 - 2014-12-17 22:56 - 00000247 _____ () C:\Windows\system32\2014-12-17-21-49-09.068-aswFe.exe-6080.log 2014-12-17 21:33 - 2014-12-17 22:49 - 00000247 _____ () C:\Windows\system32\2014-12-17-20-33-15.078-aswFe.exe-5300.log 2014-12-17 21:33 - 2014-12-17 21:33 - 00000197 _____ () C:\Windows\system32\2014-12-17-20-33-11.004-AvastVBoxSVC.exe-1376.log 2014-12-17 21:25 - 2014-12-17 21:25 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Raf\Downloads\mbam-setup-2.0.4.1028.exe 2014-12-17 21:24 - 2014-12-17 21:24 - 00000000 ____D () C:\Windows\SysWOW64\vbox 2014-12-17 21:24 - 2014-12-17 21:24 - 00000000 ____D () C:\Windows\system32\vbox 2014-12-17 21:23 - 2014-12-17 21:23 - 00000000 ____D () C:\Users\Raf\AppData\Roaming\AVAST Software 2014-12-17 21:22 - 2014-12-17 21:22 - 01050432 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys.1418847743140 2014-12-17 21:22 - 2014-12-17 21:22 - 01050432 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys 2014-12-17 21:22 - 2014-12-17 21:22 - 00436624 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys 2014-12-17 21:22 - 2014-12-17 21:22 - 00364512 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe 2014-12-17 21:22 - 2014-12-17 21:22 - 00267632 _____ () C:\Windows\system32\Drivers\aswVmm.sys 2014-12-17 21:22 - 2014-12-17 21:22 - 00116728 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys 2014-12-17 21:22 - 2014-12-17 21:22 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys 2014-12-17 21:22 - 2014-12-17 21:22 - 00083280 _____ (AVAST Software) C:\Windows\system32\Drivers\aswmonflt.sys 2014-12-17 21:22 - 2014-12-17 21:22 - 00082768 _____ (AVAST Software) C:\Windows\system32\Drivers\aswmonflt.sys.1418847740312 2014-12-17 21:22 - 2014-12-17 21:22 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys 2014-12-17 21:22 - 2014-12-17 21:22 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr 2014-12-17 21:22 - 2014-12-17 21:22 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys 2014-12-17 21:22 - 2014-12-17 21:22 - 00003924 _____ () C:\Windows\System32\Tasks\avast! Emergency Update 2014-12-17 21:22 - 2014-12-17 21:22 - 00001984 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk 2014-12-17 21:22 - 2014-12-17 21:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software 2014-12-17 21:22 - 2014-12-17 21:21 - 01049920 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys.1418847740312 2014-12-17 21:20 - 2014-12-17 21:20 - 00000000 ____D () C:\Program Files\AVAST Software 2014-12-17 21:18 - 2014-12-17 21:20 - 131078000 _____ (AVAST Software) C:\Users\Raf\Downloads\avast_free_antivirus_setup.exe 2014-12-17 21:15 - 2014-12-17 21:15 - 00000831 _____ () C:\Users\Raf\Desktop\JRT.txt 2014-12-17 21:13 - 2014-10-30 12:25 - 00275080 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe 2014-12-17 21:11 - 2014-12-17 21:11 - 00000000 ____D () C:\Windows\ERUNT 2014-12-17 21:01 - 2014-12-17 21:01 - 01707646 _____ (Thisisu) C:\Users\Raf\Downloads\JRT.exe 2014-12-17 20:56 - 2014-12-17 20:56 - 00000000 ____D () C:\Users\Raf\AppData\Local\CrashRpt 2014-12-17 20:45 - 2014-12-17 20:53 - 00000000 ____D () C:\AdwCleaner 2014-12-17 20:43 - 2014-12-17 20:44 - 00000517 _____ () C:\Users\Raf\Desktop\ADW Cleaner.txt 2014-12-17 20:43 - 2014-12-17 20:43 - 02166272 _____ () C:\Users\Raf\Downloads\AdwCleaner_4.105.exe 2014-12-17 16:56 - 2014-12-17 16:56 - 00821253 _____ () C:\Users\Raf\Downloads\2.jpeg 2014-12-17 16:56 - 2014-12-17 16:56 - 00802023 _____ () C:\Users\Raf\Downloads\1.jpeg 2014-12-17 00:39 - 2014-12-17 00:39 - 00011264 ___SH () C:\Users\Gast\Desktop\Thumbs.db 2014-12-17 00:21 - 2014-12-17 00:21 - 00000000 ____D () C:\Users\Gast\AppData\Local\Adobe 2014-12-15 14:55 - 2014-12-15 14:55 - 00000970 _____ () C:\Users\Public\Desktop\Audials 12.lnk 2014-12-15 14:53 - 2014-12-15 14:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audials 12 2014-12-15 14:53 - 2014-12-15 14:53 - 00000000 ____D () C:\ProgramData\RapidSolution 2014-12-15 14:53 - 2014-12-15 14:53 - 00000000 ____D () C:\Program Files (x86)\Audials 2014-12-15 14:50 - 2014-12-15 14:50 - 00000000 ____D () C:\Users\Raf\AppData\Local\RapidSolution 2014-12-15 14:46 - 2014-12-15 14:47 - 66540424 _____ () C:\Users\Raf\Downloads\Audials_One-Setup.exe 2014-12-15 11:27 - 2014-12-15 11:28 - 00022647 _____ () C:\Users\Raf\Downloads\Addition.txt 2014-12-15 11:25 - 2014-12-21 08:25 - 00009442 _____ () C:\Users\Raf\Downloads\FRST.txt 2014-12-15 11:24 - 2014-12-21 08:25 - 00000000 ____D () C:\FRST 2014-12-15 11:22 - 2014-12-21 08:25 - 02122240 _____ (Farbar) C:\Users\Raf\Downloads\FRST64.exe 2014-12-14 19:13 - 2014-12-14 19:13 - 00001686 _____ () C:\Users\Raf\Desktop\MBAM SD Karte.txt 2014-12-14 18:59 - 2014-12-14 18:59 - 00001672 _____ () C:\Users\Raf\Desktop\MBAM.txt 2014-12-14 17:30 - 2014-10-30 23:37 - 00129536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe 2014-12-14 17:30 - 2014-10-30 23:34 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe 2014-12-12 11:03 - 2014-12-12 11:03 - 01060864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc71.dll 2014-12-12 11:03 - 2014-12-12 11:03 - 00348160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr71.dll 2014-12-11 18:37 - 2014-12-11 18:37 - 00000000 ____D () C:\Users\Raf\Downloads\Musik 2014-12-11 11:00 - 2014-11-26 22:10 - 00714720 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-12-11 11:00 - 2014-11-26 22:10 - 00106976 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-12-11 10:54 - 2014-12-11 10:54 - 00000000 ____D () C:\Windows\system32\appraiser 2014-12-10 10:16 - 2014-12-10 10:16 - 00048296 _____ (RapidSolution Software AG) C:\Windows\system32\Drivers\tbhsd.sys 2014-12-10 10:16 - 2014-12-10 10:16 - 00024744 _____ (Audials AG) C:\Windows\system32\Drivers\RrNetCapFilterDriver.sys 2014-12-10 06:37 - 2014-11-10 03:29 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\DeviceSetupStatusProvider.dll 2014-12-10 06:37 - 2014-11-10 02:51 - 00028672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DeviceSetupStatusProvider.dll 2014-12-10 06:36 - 2014-10-31 00:39 - 01970432 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll 2014-12-10 06:36 - 2014-10-31 00:38 - 01612992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll 2014-12-10 06:26 - 2014-11-22 04:13 - 25059840 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-12-10 06:26 - 2014-11-22 03:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-12-10 06:26 - 2014-11-22 03:34 - 06039552 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-12-10 06:26 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-12-10 06:26 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-12-10 06:26 - 2014-11-22 02:43 - 14412800 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-12-10 06:26 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-12-10 06:26 - 2014-11-22 02:28 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-12-10 06:26 - 2014-11-22 02:15 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-12-10 06:26 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-12-10 06:26 - 2014-11-22 02:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-12-10 06:26 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-12-10 06:26 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-12-10 06:26 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-12-10 06:25 - 2014-12-04 00:37 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-12-10 06:25 - 2014-12-04 00:09 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll 2014-12-10 06:25 - 2014-12-03 00:09 - 01083392 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-12-10 06:25 - 2014-12-03 00:09 - 00740864 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll 2014-12-10 06:25 - 2014-12-03 00:09 - 00412672 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll 2014-12-10 06:25 - 2014-12-03 00:09 - 00396288 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll 2014-12-10 06:25 - 2014-12-03 00:09 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll 2014-12-10 06:25 - 2014-11-22 03:50 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-12-10 06:25 - 2014-11-22 03:49 - 00417280 _____ (Microsoft Corporation) C:\Windows\system32\html.iec 2014-12-10 06:25 - 2014-11-22 03:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-12-10 06:25 - 2014-11-22 03:35 - 00812544 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2014-12-10 06:25 - 2014-11-22 03:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-12-10 06:25 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-12-10 06:25 - 2014-11-22 03:06 - 00340992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec 2014-12-10 06:25 - 2014-11-22 03:06 - 00145408 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll 2014-12-10 06:25 - 2014-11-22 03:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-12-10 06:25 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2014-12-10 06:25 - 2014-11-22 02:59 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll 2014-12-10 06:25 - 2014-11-22 02:55 - 00661504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2014-12-10 06:25 - 2014-11-22 02:52 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll 2014-12-10 06:25 - 2014-11-22 02:49 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-12-10 06:25 - 2014-11-22 02:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-12-10 06:25 - 2014-11-22 02:49 - 00373760 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-12-10 06:25 - 2014-11-22 02:46 - 02125312 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-12-10 06:25 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-12-10 06:25 - 2014-11-22 02:34 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll 2014-12-10 06:25 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-12-10 06:25 - 2014-11-22 02:29 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll 2014-12-10 06:25 - 2014-11-22 02:25 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll 2014-12-10 06:25 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-12-10 06:25 - 2014-11-22 02:23 - 00326656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2014-12-10 06:25 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-12-10 06:25 - 2014-11-07 05:16 - 01762840 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2014-12-10 06:25 - 2014-11-07 04:26 - 01489072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll 2014-12-10 06:25 - 2014-11-01 00:57 - 01091072 _____ (Microsoft Corporation) C:\Windows\system32\MrmCoreR.dll 2014-12-10 06:25 - 2014-11-01 00:47 - 00790528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MrmCoreR.dll 2014-12-10 06:25 - 2014-10-13 03:43 - 00238912 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\sdbus.sys 2014-12-10 06:25 - 2014-10-13 03:43 - 00153920 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\dumpsd.sys 2014-12-10 06:25 - 2014-10-13 03:43 - 00086336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pdc.sys 2014-12-10 06:25 - 2014-10-13 03:43 - 00039744 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\intelpep.sys 2014-12-09 01:00 - 2014-12-09 01:00 - 00000548 _____ () C:\Users\Raf\Desktop\Summer Cem Babas Barbies Bargeld.txt 2014-12-02 19:45 - 2014-12-02 19:45 - 00000499 _____ () C:\Users\Raf\Desktop\Andorra.txt 2014-12-02 14:13 - 2014-12-02 14:14 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-11-30 00:17 - 2014-11-30 00:22 - 00000300 _____ () C:\Users\Raf\Desktop\Neues Textdokument (8).txt 2014-11-26 11:12 - 2014-11-26 11:12 - 00000000 __SHD () C:\Users\Raf\AppData\Local\EmieBrowserModeList 2014-11-26 10:05 - 2014-11-26 10:05 - 00683496 _____ (Opera Software) C:\Users\Gast\Downloads\Opera_NI_stable.exe 2014-11-26 07:55 - 2014-12-07 17:41 - 00001321 _____ () C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Opera.lnk 2014-11-26 07:55 - 2014-11-26 07:55 - 00001321 _____ () C:\Users\Gast\Desktop\Opera.lnk 2014-11-26 07:55 - 2014-11-26 07:55 - 00000000 ____D () C:\Users\Gast\AppData\Roaming\Opera Software 2014-11-26 07:55 - 2014-11-26 07:55 - 00000000 ____D () C:\Users\Gast\AppData\Local\Opera Software 2014-11-26 07:54 - 2014-12-17 07:32 - 00002159 _____ () C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pokki Start Menu.lnk 2014-11-26 07:54 - 2014-11-26 10:08 - 00002330 _____ () C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnk 2014-11-26 07:53 - 2014-11-26 07:53 - 00000000 ____D () C:\Users\Gast\AppData\Roaming\Opera 2014-11-26 07:53 - 2014-11-26 07:53 - 00000000 ____D () C:\Users\Gast\AppData\Roaming\Macromedia 2014-11-26 07:53 - 2014-11-26 07:53 - 00000000 ____D () C:\Users\Gast\AppData\Local\Opera 2014-11-26 07:52 - 2014-11-26 07:53 - 00000000 ____D () C:\Users\Gast\AppData\Roaming\Mozilla 2014-11-26 07:52 - 2014-11-26 07:53 - 00000000 ____D () C:\Users\Gast\AppData\Local\Mozilla 2014-11-26 07:52 - 2014-11-26 07:52 - 00000000 ____D () C:\Users\Gast\PicStream 2014-11-26 07:52 - 2014-11-26 07:52 - 00000000 ____D () C:\Users\Gast\AppData\Local\clear.fi 2014-11-26 07:52 - 2014-11-26 07:52 - 00000000 ____D () C:\Users\Gast\AppData\Local\AOP SDK 2014-11-26 07:51 - 2014-12-17 00:21 - 00000000 ____D () C:\Users\Gast\AppData\Roaming\Adobe 2014-11-26 07:51 - 2014-11-26 07:51 - 00001454 _____ () C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-11-26 07:51 - 2014-11-26 07:51 - 00000020 ___SH () C:\Users\Gast\ntuser.ini 2014-11-26 07:51 - 2014-11-26 07:51 - 00000000 _SHDL () C:\Users\Gast\Vorlagen 2014-11-26 07:51 - 2014-11-26 07:51 - 00000000 _SHDL () C:\Users\Gast\Startmenü 2014-11-26 07:51 - 2014-11-26 07:51 - 00000000 _SHDL () C:\Users\Gast\Netzwerkumgebung 2014-11-26 07:51 - 2014-11-26 07:51 - 00000000 _SHDL () C:\Users\Gast\Lokale Einstellungen 2014-11-26 07:51 - 2014-11-26 07:51 - 00000000 _SHDL () C:\Users\Gast\Eigene Dateien 2014-11-26 07:51 - 2014-11-26 07:51 - 00000000 _SHDL () C:\Users\Gast\Druckumgebung 2014-11-26 07:51 - 2014-11-26 07:51 - 00000000 _SHDL () C:\Users\Gast\Documents\Eigene Musik 2014-11-26 07:51 - 2014-11-26 07:51 - 00000000 _SHDL () C:\Users\Gast\Documents\Eigene Bilder 2014-11-26 07:51 - 2014-11-26 07:51 - 00000000 _SHDL () C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programme 2014-11-26 07:51 - 2014-11-26 07:51 - 00000000 _SHDL () C:\Users\Gast\AppData\Local\Verlauf 2014-11-26 07:51 - 2014-11-26 07:51 - 00000000 _SHDL () C:\Users\Gast\AppData\Local\Anwendungsdaten 2014-11-26 07:51 - 2014-11-26 07:51 - 00000000 _SHDL () C:\Users\Gast\Anwendungsdaten 2014-11-26 07:51 - 2014-11-26 07:51 - 00000000 ____D () C:\Users\Gast\AppData\Local\VirtualStore 2014-11-26 07:51 - 2014-11-26 07:51 - 00000000 ____D () C:\Users\Gast\AppData\Local\Packages 2014-11-26 07:50 - 2014-12-17 06:05 - 00000000 ____D () C:\Users\Gast\AppData\Local\Pokki 2014-11-26 07:50 - 2014-11-26 07:52 - 00000000 ____D () C:\Users\Gast 2014-11-26 07:50 - 2014-11-12 07:33 - 00000000 ___RD () C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools 2014-11-26 07:50 - 2014-09-15 10:23 - 00000000 ___RD () C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility 2014-11-26 07:50 - 2014-03-18 10:49 - 00000369 _____ () C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk 2014-11-26 07:50 - 2014-03-18 10:49 - 00000369 _____ () C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk 2014-11-26 07:50 - 2013-08-22 16:36 - 00000000 ___RD () C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories 2014-11-26 07:50 - 2013-08-22 16:36 - 00000000 ____D () C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance 2014-11-25 13:10 - 2014-11-25 13:10 - 00001847 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera 12.16 1860.lnk 2014-11-25 13:10 - 2014-11-25 13:10 - 00001835 _____ () C:\Users\Public\Desktop\Opera 12.16 1860.lnk 2014-11-25 13:10 - 2014-11-25 13:10 - 00000000 ____D () C:\Users\Raf\AppData\Roaming\Opera 2014-11-25 13:10 - 2014-11-25 13:10 - 00000000 ____D () C:\Users\Raf\AppData\Local\Opera 2014-11-25 13:10 - 2014-11-25 13:10 - 00000000 ____D () C:\Program Files\Opera x64 2014-11-25 13:10 - 2014-11-25 13:10 - 00000000 ____D () C:\Program Files (x86)\Opera x64 2014-11-21 03:36 - 2014-11-21 03:36 - 00000763 _____ () C:\Users\Raf\Desktop\Karies.txt ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-12-21 08:11 - 2014-08-18 07:29 - 00003600 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3570792933-1699095929-2760690963-1001 2014-12-21 08:02 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\sru 2014-12-21 07:41 - 2014-08-18 07:47 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-12-21 07:11 - 2014-07-22 12:25 - 02039900 _____ () C:\Windows\WindowsUpdate.log 2014-12-21 06:11 - 2014-08-18 07:33 - 00003918 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{15A1396F-65D9-4948-8A78-422AAE8D4D90} 2014-12-21 05:47 - 2014-08-18 07:45 - 00279040 ___SH () C:\Users\Raf\Downloads\Thumbs.db 2014-12-21 04:46 - 2014-09-09 12:16 - 00000000 ____D () C:\Users\Raf\AppData\Roaming\vlc 2014-12-21 00:39 - 2014-08-18 07:43 - 00000000 ____D () C:\Users\Raf\dwhelper 2014-12-19 20:01 - 2014-10-14 07:20 - 00000000 ____D () C:\Program Files (x86)\Opera 2014-12-18 23:10 - 2014-08-19 16:13 - 00248832 ___SH () C:\Users\Raf\Desktop\Thumbs.db 2014-12-18 19:16 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\AppReadiness 2014-12-17 22:06 - 2013-08-22 16:20 - 00000000 ____D () C:\Windows\CbsTemp 2014-12-17 21:20 - 2014-08-18 07:51 - 00000000 ____D () C:\ProgramData\AVAST Software 2014-12-17 21:08 - 2014-03-18 10:39 - 00682074 _____ () C:\Windows\PFRO.log 2014-12-17 21:08 - 2013-08-22 15:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-12-17 21:07 - 2013-08-22 14:25 - 00262144 ___SH () C:\Windows\system32\config\BBI 2014-12-17 21:05 - 2013-08-22 14:25 - 00262144 ___SH () C:\Windows\system32\config\ELAM 2014-12-17 16:10 - 2014-08-18 07:27 - 00002162 _____ () C:\Users\Raf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pokki Start Menu.lnk 2014-12-17 16:07 - 2014-10-14 07:21 - 00003850 _____ () C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1413267635 2014-12-17 16:07 - 2014-10-14 07:20 - 00001021 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk 2014-12-17 06:05 - 2014-08-18 07:23 - 00000000 ____D () C:\Users\Raf\AppData\Local\Pokki 2014-12-15 14:57 - 2013-08-22 15:46 - 00031366 _____ () C:\Windows\setupact.log 2014-12-12 13:12 - 2014-04-03 06:46 - 00002457 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk 2014-12-12 12:26 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\rescache 2014-12-12 11:03 - 2014-11-06 03:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Comodo 2014-12-12 11:01 - 2014-04-03 06:36 - 00000000 ____D () C:\Program Files (x86)\WildTangent Games 2014-12-12 11:00 - 2014-04-03 06:36 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games 2014-12-12 11:00 - 2014-04-03 06:36 - 00000000 ____D () C:\ProgramData\WildTangent 2014-12-12 10:41 - 2014-04-03 06:48 - 00000000 ____D () C:\ProgramData\McAfee 2014-12-12 10:39 - 2013-08-22 16:36 - 00000000 ___HD () C:\Windows\ELAMBKUP 2014-12-12 08:29 - 2014-11-06 16:02 - 00000000 ____D () C:\Users\Raf\Desktop\Ebay 2014-12-11 18:43 - 2014-09-13 21:09 - 00000152 _____ () C:\Users\Raf\Desktop\Neues Textdokument (3).txt 2014-12-11 10:58 - 2014-08-18 07:39 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2014-12-11 10:54 - 2014-08-21 21:25 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-12-11 10:54 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\sr-Latn-RS 2014-12-11 10:54 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\sr-Latn-CS 2014-12-11 10:54 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\PolicyDefinitions 2014-12-11 10:54 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\AppCompat 2014-12-11 09:55 - 2014-08-21 15:29 - 00000000 ____D () C:\Windows\system32\MRT 2014-12-11 09:50 - 2014-08-21 15:29 - 112710672 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-12-10 08:04 - 2014-07-19 19:14 - 00764340 _____ () C:\Windows\system32\perfh007.dat 2014-12-10 08:04 - 2014-07-19 19:14 - 00159160 _____ () C:\Windows\system32\perfc007.dat 2014-12-10 08:04 - 2014-03-18 10:47 - 01776918 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-12-10 01:41 - 2014-08-18 07:47 - 00003772 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-11-22 09:32 - 2014-08-18 07:26 - 00002333 _____ () C:\Users\Raf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnk Some content of TEMP: ==================== C:\Users\Gast\AppData\Local\Temp\oct3431.tmp.exe C:\Users\Raf\AppData\Local\Temp\AskPIP_FF_.exe C:\Users\Raf\AppData\Local\Temp\ochelper.dll C:\Users\Raf\AppData\Local\Temp\ochelper.exe C:\Users\Raf\AppData\Local\Temp\oct72A6.tmp.exe C:\Users\Raf\AppData\Local\Temp\octD99A.tmp.exe C:\Users\Raf\AppData\Local\Temp\Quarantine.exe C:\Users\Raf\AppData\Local\Temp\sqlite3.dll ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-12-20 07:21 ==================== End Of Log ============================ --- --- --- |
21.12.2014, 23:30 | #8 |
/// the machine /// TB-Ausbilder | PUP.Optional.InstallCore.A gefunden Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter C:\$Recycle.Bin Emptytemp: Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Fertig Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
22.12.2014, 10:53 | #9 |
| PUP.Optional.InstallCore.A gefundenCode:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 21-12-2014 Ran by Raf at 2014-12-22 05:02:22 Run:1 Running from C:\Users\Raf\Downloads Loaded Profile: Raf (Available profiles: Raf & Gast) Boot Mode: Normal ============================================== Content of fixlist: ***************** C:\$Recycle.Bin Emptytemp: ***************** C:\$Recycle.Bin => Moved successfully. EmptyTemp: => Removed 1.7 GB temporary data. The system needed a reboot. ==== End of Fixlog ==== Code:
ATTFilter # DelFix v10.8 - Datei am 22/12/2014 um 05:14:32 erstellt # Aktualisiert am 29/07/2014 von Xplode # Benutzer : Raf - RAFNESS # Betriebssystem : Windows 8.1 Connected (64 bits) ~ Aktiviere die Benutzerkontensteuerung ... OK ~ Entferne die Bereinigungsprogramme ... Gelöscht : C:\FRST Gelöscht : C:\AdwCleaner Gelöscht : C:\Users\Raf\Downloads\FRST-OlderVersion Gelöscht : C:\Users\Raf\Desktop\JRT.txt Gelöscht : C:\Users\Raf\Downloads\Addition.txt Gelöscht : C:\Users\Raf\Downloads\AdwCleaner_4.105.exe Gelöscht : C:\Users\Raf\Downloads\esetsmartinstaller_deu.exe Gelöscht : C:\Users\Raf\Downloads\Fixlog.txt Gelöscht : C:\Users\Raf\Downloads\FRST.txt Gelöscht : C:\Users\Raf\Downloads\FRST64.exe Gelöscht : C:\Users\Raf\Downloads\JRT.exe Gelöscht : C:\Users\Raf\Downloads\SecurityCheck.exe Gelöscht : HKLM\SOFTWARE\AdwCleaner ~ Erstelle ein Backup der Registrierungsdatenbank ... OK ~ Lösche die Wiederherstellungspunkte ... Gelöscht : RP #22 [Geplanter Prüfpunkt | 12/03/2014 03:17:38] Gelöscht : RP #23 [Windows Update | 12/11/2014 08:45:26] Gelöscht : RP #24 [eBay Worldwide wird entfernt | 12/12/2014 10:01:54] Gelöscht : RP #25 [Installed Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 | 12/15/2014 13:51:44] Gelöscht : RP #26 [avast! antivirus system restore point | 12/17/2014 20:03:17] Ein neuer Wiederherstellungspunkt wurde erstellt ! ~ Stelle die Systemeinstellungen wieder her ... OK ########## - EOF - ########## Ich lasse demnächst noch MBAM durchlaufen um sicher zu gehen. |
23.12.2014, 11:47 | #10 |
/// the machine /// TB-Ausbilder | PUP.Optional.InstallCore.A gefunden Wenn die Karte beim Onlinescan dran war, ja.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
Themen zu PUP.Optional.InstallCore.A gefunden |
adware, card reader, fehlercode 0x80000003, fehlercode 0x80071a90, fehlercode 0xc0000005, fehlercode 0xc0000374, fehlercode 0xc000041d, formatiere, formatieren, gefunde, karte, mbam, nichts, pup.optional.installcore.a, reader, sd karte, troja, trojaner, verlinkt, virus, win32/installcore.qw, übertragen |