| |
| |||||||
Log-Analyse und Auswertung: PiccShare Updater & Snoozer.exe mit Malwarebyte u.a. gefundenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
25.02.2015, 23:01
| #1 |
 |  PiccShare Updater & Snoozer.exe mit Malwarebyte u.a. gefunden Hallo zusammen, das ist mein erster post hier und dabei dachte ich immer, ich passe gut auf... naja, meist schon... Leider kann ich nicht genau sagen, wann mein Problem angefangen hat, da ich erst mal gar nichts bemerkt habe. Darum beschreibe ich mal rückwärts: Diesen Monat habe ich verschiedene Virenscanner etc. auf mein System losgelassen, darunter Malwarebyte und eset online (02-2015), AVG. Zum Jahreswechsel habe ich versucht, eine saubere Sicherung zurückzuspielen, aber scheinbar war die auch schon verseucht. Hier also die aktuellen Berichte von Malwarbyte (15.02.2015): Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 15.02.2015 Suchlauf-Zeit: 16:53:50 Logdatei: Malwarebyte2015-02-15.txt Administrator: Ja Version: 2.00.4.1028 Malware Datenbank: v2015.02.15.03 Rootkit Datenbank: v2015.02.03.01 Lizenz: Testversion Malware Schutz: Aktiviert Bösartiger Webseiten Schutz: Aktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: Stefan Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 403432 Verstrichene Zeit: 8 Min, 11 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (Keine schädliche Elemente erkannt) Module: 0 (Keine schädliche Elemente erkannt) Registrierungsschlüssel: 20 PUP.Optional.PiccShare.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{553318DA-D010-469E-84B1-496563CAE1C0}, In Quarantäne, [fdc21d01b8d2ac8ac41e3fc7f112e41c], PUP.Optional.PiccShare.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{671F1846-80F2-4ED8-B183-A921E6A4D5D5}, In Quarantäne, [fdc21d01b8d2ac8ac41e3fc7f112e41c], PUP.Optional.PiccShare.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{41DF0821-AF9A-4246-B01E-DB43C0E7A775}, In Quarantäne, [fdc21d01b8d2ac8ac41e3fc7f112e41c], PUP.Optional.PiccShare.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{41DF0821-AF9A-4246-B01E-DB43C0E7A775}, In Quarantäne, [fdc21d01b8d2ac8ac41e3fc7f112e41c], PUP.Optional.PiccShare.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{671F1846-80F2-4ED8-B183-A921E6A4D5D5}, In Quarantäne, [fdc21d01b8d2ac8ac41e3fc7f112e41c], PUP.Optional.PiccShare.A, HKLM\SOFTWARE\CLASSES\PiccShare.BHO.1, In Quarantäne, [fdc21d01b8d2ac8ac41e3fc7f112e41c], PUP.Optional.PiccShare.A, HKLM\SOFTWARE\CLASSES\PiccShare.BHO, In Quarantäne, [fdc21d01b8d2ac8ac41e3fc7f112e41c], PUP.Optional.PiccShare.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\PiccShare.BHO, In Quarantäne, [fdc21d01b8d2ac8ac41e3fc7f112e41c], PUP.Optional.PiccShare.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\PiccShare.BHO.1, In Quarantäne, [fdc21d01b8d2ac8ac41e3fc7f112e41c], PUP.Optional.PiccShare.A, HKU\S-1-5-21-1056989918-4030749953-1757699205-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{553318DA-D010-469E-84B1-496563CAE1C0}, In Quarantäne, [fdc21d01b8d2ac8ac41e3fc7f112e41c], PUP.Optional.PiccShare.A, HKU\S-1-5-21-1056989918-4030749953-1757699205-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{553318DA-D010-469E-84B1-496563CAE1C0}, In Quarantäne, [fdc21d01b8d2ac8ac41e3fc7f112e41c], PUP.Optional.PiccShare.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{553318DA-D010-469E-84B1-496563CAE1C0}, In Quarantäne, [fdc21d01b8d2ac8ac41e3fc7f112e41c], PUP.Optional.SimpleNewTab.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{5C2DD58F-613F-4580-8AC0-F10D760AF938}, In Quarantäne, [0cb35ac4a1e9c96d89f995738281af51], PUP.Optional.SimpleNewTab.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{8DAA9564-C7BF-43E1-ADB9-17B44DA980A6}, In Quarantäne, [0cb35ac4a1e9c96d89f995738281af51], PUP.Optional.SimpleNewTab.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{B47A69DE-9B38-4EC0-996E-99F90C0F8CA5}, In Quarantäne, [0cb35ac4a1e9c96d89f995738281af51], PUP.Optional.SimpleNewTab.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{B47A69DE-9B38-4EC0-996E-99F90C0F8CA5}, In Quarantäne, [0cb35ac4a1e9c96d89f995738281af51], PUP.Optional.OfferMosquito.A, HKU\S-1-5-21-1056989918-4030749953-1757699205-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\OfferMosquito, In Quarantäne, [259a57c7deacae8882bb26ee0cf9da26], PUP.Optional.SimpleNewTab.A, HKU\S-1-5-21-1056989918-4030749953-1757699205-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SimpleNewTab, In Quarantäne, [0fb0c15dfc8eaf87bfd08739b350ff01], PUP.Optional.Softonic.A, HKU\S-1-5-21-1056989918-4030749953-1757699205-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Softonic, In Quarantäne, [1aa5001eb6d4fe38eda4deba00037888], PUP.Optional.OfferMosquito.A, HKU\S-1-5-21-1056989918-4030749953-1757699205-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\gbmdkmlcnbapgegninelmjbfibaghdmk, In Quarantäne, [b708041adfabab8bfc95368a9c67cf31], Registrierungswerte: 1 PUP.Optional.DataMgr.A, HKU\S-1-5-21-1056989918-4030749953-1757699205-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|DataMgr, "C:\Users\Stefan\AppData\Roaming\DataMgr\DataMgr.exe", In Quarantäne, [e9d625f958327fb7c920e32cf213718f] Registrierungsdaten: 0 (Keine schädliche Elemente erkannt) Ordner: 4 PUP.Optional.SimpleNewTab.A, C:\Users\Stefan\AppData\Local\simple_new_tab, In Quarantäne, [3a8598867c0ebe78364bcf94a063db25], PUP.Optional.SimpleNewTab.A, C:\Users\Stefan\AppData\Local\simple_new_tab\htmls, In Quarantäne, [3a8598867c0ebe78364bcf94a063db25], PUP.Optional.OfferMosquito.A, C:\Users\Stefan\AppData\Local\ext_offermosquito, In Quarantäne, [6a55d04ec3c753e387fcb7ac5ea5e41c], PUP.Optional.PiccShare.A, C:\Users\Stefan\AppData\Local\ext_piccshare, In Quarantäne, [cbf4d549becc71c592b53f31798a30d0], Dateien: 6 PUP.Optional.PiccShare.A, C:\Users\Stefan\AppData\Local\ext_piccshare\ext_piccshare.dll, In Quarantäne, [fdc21d01b8d2ac8ac41e3fc7f112e41c], PUP.Optional.SimpleNewTab.A, C:\Users\Stefan\AppData\Local\simple_new_tab\simple_new_tab.dll, In Quarantäne, [0cb35ac4a1e9c96d89f995738281af51], PUP.Optional.DataMgr.A, C:\Users\Stefan\AppData\Roaming\DataMgr\DataMgr.exe, In Quarantäne, [e9d625f958327fb7c920e32cf213718f], PUP.Optional.SimpleNewTab.A, C:\Users\Stefan\AppData\Local\simple_new_tab\htmls\index.html, In Quarantäne, [3a8598867c0ebe78364bcf94a063db25], PUP.Optional.OfferMosquito.A, C:\Users\Stefan\AppData\Local\ext_offermosquito\atl100.dll, In Quarantäne, [6a55d04ec3c753e387fcb7ac5ea5e41c], PUP.Optional.OfferMosquito.A, C:\Users\Stefan\AppData\Local\ext_offermosquito\msvcr100d.dll, In Quarantäne, [6a55d04ec3c753e387fcb7ac5ea5e41c], Physische Sektoren: 0 (Keine schädliche Elemente erkannt) (end) Meine Probleme davor waren eher merkwürdige Fenster nach PC Start, die sich so schnell wieder schlossen, dass ich sie nur lesen konnte, indem ich mal eine Videokamera mitlaufen ließ: " updater" und ""USB Monitor ToDo". Nach dem Malwarebyte Einsatz tauchte zumindest das "updater" Fenster nicht mehr auf. Tatsächlich habe ich schon vor "Ewigkeiten", also vielleicht vor einem Jahr einen Mimo USB Touch Monitor angeschlossen, touch lief aber nicht. Auch waren die Treiber dafür schwer aufzutreiben bzw. nur von einer Webseite, die wahrscheinlich nicht von Mimo war. Da hatte schon mal AVG angeschlagen, weshalb ich versucht habe, eine saubere Sicherung zurückzuspielen. Hat aber nichts geholfen, siehe AVG 2014: Code:
ATTFilter Win32/DH{JwBhWDU} gefunden
C:\Users\Stefan\AppData\Local\Temp\Temp1_MimoDrivers_touch_win.zip\touchdriver\touch_setup.exe
FRST.txt (25.02.2015): Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-02-2015 Ran by Stefan (administrator) on MUSIK on 25-02-2015 15:17:23 Running from C:\Users\Stefan\Desktop Loaded Profiles: Stefan (Available profiles: Stefan) Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 (Default browser: FF) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgrsa.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgcsrva.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (DisplayLink Corp.) C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe (Microsoft Corporation) C:\Windows\System32\wisptis.exe (Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\WTabletServicePro.exe (DisplayLink Corp.) C:\Program Files\DisplayLink Core Software\DisplayLinkUserAgent.exe (Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe (Adobe Systems Incorporated) C:\Program Files\Adobe\Elements 13 Organizer\PhotoshopElementsFileAgent.exe (Acronis) C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\AdAwareService.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgemca.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (Nero AG) C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe () C:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe (M-Audio) C:\Program Files (x86)\M-Audio USB Quattro\Install\QuatInst.exe () C:\Program Files (x86)\CyberLink\Shared Files\RichVideo.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe (Microsoft Corporation) C:\Windows\System32\TCPSVCS.EXE (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe (DisplayLink Corp.) C:\Program Files\DisplayLink Core Software\DisplayLinkUI.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Apache Software Foundation) C:\Program Files (x86)\VMware\VMware Server\tomcat\bin\tomcat6.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe (RME) C:\Windows\System32\fireface.exe (Wacom Technology) C:\Program Files\Tablet\Wacom\WacomHost.exe (Intel Corporation) C:\Windows\System32\igfxsrvc.exe (AVG Secure Search) C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\ToolbarUpdater.exe (RME) C:\Windows\System32\TotalMixFX.exe (RME) C:\Windows\System32\firefaceusb.exe (TODO: <Company name>) C:\VIA_XHCI\usb3Monitor.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe (Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe (Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\AdAwareTray.exe () C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\loggingserver.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe () C:\Program Files\Fractal Audio\Axe-Fx II Driver\FASUSBAudioCpl.exe () C:\Program Files (x86)\JFritz\jfritz.exe (Microsoft Corporation) C:\Windows\System32\wisptis.exe (Oracle Corporation) C:\Program Files (x86)\Java\jre1.8.0_31\launch4j-tmp\jfritz.exe () C:\Program Files (x86)\Acronis\DiskDirector\OSS\reinstall_svc.exe () C:\Program Files (x86)\AVG Secure Search\vprot.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Lavasoft) C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe (Acronis) C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe (Acronis) C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgui.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe () C:\Program Files (x86)\ZOOM\Edit_Share\bin\ZOOM Edit&Share startup.exe () C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe (VMware, Inc.) C:\Program Files (x86)\VMware\VMware Server\vmware-authd.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler64.exe (VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe (Samsung Electronics.) C:\Program Files (x86)\Samsung Magician\Samsung Magician.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Intel(R) Corporation) C:\Program Files\Intel\NCS2\WMIProv\ncs2prov.exe (Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe (Acronis) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [FirefaceTray] => C:\Windows\system32\fireface.exe [114176 2012-07-12] (RME) HKLM\...\Run: [FirefaceMixTray2] => C:\Windows\system32\TotalMixFX.exe [5417984 2012-12-18] (RME) HKLM\...\Run: [FirefaceUsbTray1] => C:\Windows\system32\firefaceusb.exe [91648 2012-12-18] (RME) HKLM\...\Run: [VIAxHCUtl] => C:\VIA_XHCI\usb3Monitor.exe [331776 2011-03-28] (TODO: <Company name>) HKLM\...\Run: [Acronis Scheduler2 Service] => C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [517912 2013-02-15] (Acronis) HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169768 2015-01-27] (Apple Inc.) HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [557984 2014-08-27] (Adobe Systems Incorporated) HKLM\...\Run: [] => [X] HKLM\...\Run: [AdAwareTray] => C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\AdAwareTray.exe [8947008 2014-12-18] () HKLM-x32\...\Run: [vProt] => C:\Program Files (x86)\AVG Secure Search\vprot.exe [2640408 2014-08-26] () HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2015-01-20] (Apple Inc.) HKLM-x32\...\Run: [Ad-Aware Browsing Protection] => C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe [198032 2011-10-21] (Lavasoft) HKLM-x32\...\Run: [TrueImageMonitor.exe] => C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe [6405376 2013-03-27] (Acronis) HKLM-x32\...\Run: [AcronisTibMounterMonitor] => C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe [1105848 2013-01-10] (Acronis) HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2015\avgui.exe [3674576 2015-01-06] (AVG Technologies CZ, s.r.o.) HKLM-x32\...\Run: [Path] => C:\Program Files (x86)\ZOOM\Edit_Share\bin\ZOOM Edit&Share startup.exe [1989632 2012-06-08] () HKLM-x32\...\Run: [DivXMediaServer] => C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [448856 2014-11-17] (DivX, LLC) HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1861968 2014-01-10] () HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.) HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) Winlogon\Notify\ScCertProp: wlnotify.dll [X] Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X] HKU\S-1-5-21-1056989918-4030749953-1757699205-1000\...\MountPoints2: {0ffc3392-cd8d-11e3-8de4-005056c00008} - F:\Start_Center.exe Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\FASUSBAudio Control Panel Autostart.lnk ShortcutTarget: FASUSBAudio Control Panel Autostart.lnk -> C:\Program Files\Fractal Audio\Axe-Fx II Driver\FASUSBAudioCpl.exe () Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\JFritz.lnk ShortcutTarget: JFritz.lnk -> C:\Program Files (x86)\JFritz\jfritz.exe () ShellIconOverlayIdentifiers: [AcronisSyncError] -> {934BC6C0-FEC2-4df5-A100-961DE2C8A0ED} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll (Acronis) ShellIconOverlayIdentifiers: [AcronisSyncInProgress] -> {00F848DC-B1D4-4892-9C25-CAADC86A215D} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll (Acronis) ShellIconOverlayIdentifiers: [AcronisSyncOk] -> {71573297-552E-46fc-BE3D-3DFAF88D47B7} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll (Acronis) BootExecute: autocheck autochk * sdnclean64.exe ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-1056989918-4030749953-1757699205-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp HKU\S-1-5-21-1056989918-4030749953-1757699205-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.fbdownloader.com/?channel=fpo SearchScopes: HKU\S-1-5-21-1056989918-4030749953-1757699205-1000 -> DefaultScope {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxp://search.fbdownloader.com/search.php?channel=fpo&q={searchTerms} SearchScopes: HKU\S-1-5-21-1056989918-4030749953-1757699205-1000 -> {3ED46B8D-86B9-42D1-AFB1-67E2089836BE} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&type=302398&p={searchTerms} SearchScopes: HKU\S-1-5-21-1056989918-4030749953-1757699205-1000 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxp://search.fbdownloader.com/search.php?channel=fpo&q={searchTerms} SearchScopes: HKU\S-1-5-21-1056989918-4030749953-1757699205-1000 -> {D47A8809-59E8-460D-BFCF-4D9552F41F63} URL = hxxp://www.google.de/search?q={searchTerms} BHO: No Name -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> No File BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: No Name -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> No File BHO-x32: No Name -> {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} -> No File BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation) BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: ChromeFrame BHO -> {ECB3C477-1A0A-44BD-BB57-78F9EFE34FA7} -> C:\Program Files (x86)\Google\Chrome Frame\Application\32.0.1700.107\npchrome_frame.dll (Google Inc.) Toolbar: HKLM-x32 - AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\18.1.9.799\AVG Secure Search_toolbar.dll (AVG Secure Search) DPF: HKLM-x32 {22E5D91F-89E6-4405-AD9C-0AF27BA6F06B} file:///J:/dieAuster/+2014-03-29/components/hidinputmonitorx.ocx DPF: HKLM-x32 {4F63D44B-6274-4D60-8AB1-CAA7116B8AF3} file:///J:/dieAuster/+2014-03-29/components/A9.ocx DPF: HKLM-x32 {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} hxxp://download.bitdefender.com/resources/scanner/sources/de/scan8/oscan8.cab DPF: HKLM-x32 {7030CC6C-1A88-4591-BB5A-651B9F7F0C30} file:///J:/dieAuster/+2014-03-29/components/wmvhdrating.ocx DPF: HKLM-x32 {8AD9C840-044E-11D1-B3E9-00805F499D93} DPF: HKLM-x32 {B94C2238-346E-4C5E-9B36-8CC627F35574} DPF: HKLM-x32 {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} DPF: HKLM-x32 {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} DPF: HKLM-x32 {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} DPF: HKLM-x32 {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab Handler-x32: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - C:\Program Files (x86)\Google\Chrome Frame\Application\32.0.1700.107\npchrome_frame.dll (Google Inc.) Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - No File Handler-x32: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\18.1.9\ViProtocol.dll (AVG Secure Search) Winsock: Catalog9 11 C:\Program Files (x86)\VMware\VMware Server\vsocklib.dll [313904] (VMware, Inc.) Winsock: Catalog9 12 C:\Program Files (x86)\VMware\VMware Server\vsocklib.dll [313904] (VMware, Inc.) Winsock: Catalog9-x64 11 C:\Program Files (x86)\VMware\VMware Server\x64\vsocklib.dll [410160] (VMware, Inc.) Winsock: Catalog9-x64 12 C:\Program Files (x86)\VMware\VMware Server\x64\vsocklib.dll [410160] (VMware, Inc.) Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt Tcpip\Parameters: [DhcpNameServer] 192.168.222.1 FireFox: ======== FF ProfilePath: C:\Users\Stefan\AppData\Roaming\Mozilla\Profiles\qowzt09f.Standard-Benutzer FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll () FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @wacom.com/wtPlugin,version=2.1.0.7 -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom) FF Plugin: wacom.com/WacomTabletPlugin -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll () FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin -> C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\18.1.9\\npsitesafety.dll No File FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC) FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @videolan.org/vlc,version=2.0.6 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: @wacom.com/wtPlugin,version=2.1.0.7 -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll (Wacom) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin-x32: wacom.com/WacomTabletPlugin -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll (Wacom) FF Plugin HKU\S-1-5-21-1056989918-4030749953-1757699205-1000: bebomedia.com/OfferMosquitoIEHelper -> C:\Users\Stefan\AppData\Local\ext_offermosquito\npOfferMosquitoIEHelper.dll No File FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npLegitCheckPlugin.dll (Microsoft Corporation) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPSibelius.dll () FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\PDFNetC.dll (PDFTron Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\ScorchPDFWrapper.dll () FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\avg-secure-search.xml FF Extension: DownloadHelper - C:\Users\Stefan\AppData\Roaming\Mozilla\Profiles\qowzt09f.Standard-Benutzer\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-12-12] FF Extension: DownThemAll! AntiContainer - C:\Users\Stefan\AppData\Roaming\Mozilla\Profiles\qowzt09f.Standard-Benutzer\Extensions\anticontainer@downthemall.net.xpi [2013-03-01] FF Extension: NoScript - C:\Users\Stefan\AppData\Roaming\Mozilla\Profiles\qowzt09f.Standard-Benutzer\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2013-03-01] FF Extension: DownThemAll! - C:\Users\Stefan\AppData\Roaming\Mozilla\Profiles\qowzt09f.Standard-Benutzer\Extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [2013-03-01] FF HKLM-x32\...\Firefox\Extensions: [avg@toolbar] - C:\ProgramData\AVG Secure Search\FireFoxExt\18.1.9.799 FF Extension: AVG Security Toolbar - C:\ProgramData\AVG Secure Search\FireFoxExt\18.1.9.799 [2014-08-26] Chrome: ======= CHR HKLM-x32\...\Chrome\Extension: [ndibdjnfmopecpmkdieinmbadjfpblof] - C:\ProgramData\AVG Secure Search\ChromeExt\17.3.0.49\avg.crx [Not Found] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AdobeActiveFileMonitor13.0; C:\Program Files\Adobe\Elements 13 Organizer\PhotoshopElementsFileAgent.exe [231120 2015-01-30] (Adobe Systems Incorporated) R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-19] (Apple Inc.) R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe [3440080 2015-01-06] (AVG Technologies CZ, s.r.o.) R2 avgwd; C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe [309232 2015-01-06] (AVG Technologies CZ, s.r.o.) R2 DisplayLinkService; C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe [9954096 2014-03-27] (DisplayLink Corp.) R2 LavasoftAdAwareService11; C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\AdAwareService.exe [713568 2014-12-18] () R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation) R2 NMSAccess; C:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe [71096 2010-03-04] () R2 OS Selector; C:\Program Files (x86)\Acronis\DiskDirector\OSS\reinstall_svc.exe [2155848 2011-11-15] () R2 QuattroInstallerService; C:\Program Files (x86)\M-Audio USB Quattro\Install\QuatInst.exe [86016 2010-01-02] (M-Audio) [File not signed] R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared Files\RichVideo.exe [266343 2006-09-29] () [File not signed] R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.) R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.) R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.) R2 simptcp; C:\Windows\SysWOW64\tcpsvcs.exe [9216 2009-07-14] (Microsoft Corporation) R2 VMAuthdService; C:\Program Files (x86)\VMware\VMware Server\vmware-authd.exe [121392 2009-10-20] (VMware, Inc.) S2 VMwareHostd; C:\Program Files (x86)\VMware\VMware Server\vmware-hostd.exe [322096 2009-10-20] () R2 VMwareServerWebAccess; C:\Program Files (x86)\VMware\VMware Server\tomcat\bin\Tomcat6.exe [57344 2009-10-20] (Apache Software Foundation) [File not signed] R2 vToolbarUpdater18.1.9; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\ToolbarUpdater.exe [1820184 2014-08-11] (AVG Secure Search) S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation) R2 WTabletServicePro; C:\Program Files\Tablet\Wacom\WTabletServicePro.exe [671512 2014-12-22] (Wacom Technology, Corp.) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [153368 2014-06-18] (AVG Technologies CZ, s.r.o.) R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [260888 2014-12-08] (AVG Technologies CZ, s.r.o.) R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [203544 2014-11-18] (AVG Technologies CZ, s.r.o.) R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [243480 2014-08-28] (AVG Technologies CZ, s.r.o.) R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [313624 2014-07-18] (AVG Technologies CZ, s.r.o.) R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [124184 2014-10-05] (AVG Technologies CZ, s.r.o.) R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-06-18] (AVG Technologies CZ, s.r.o.) R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [274200 2014-10-10] (AVG Technologies CZ, s.r.o.) R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [50976 2014-08-11] (AVG Technologies) S3 axefx2load; C:\Windows\System32\Drivers\axefx2load.sys [55600 2011-11-01] (Cypress Semiconductor) S3 BEHRINGER_PT_MIDI; C:\Windows\System32\drivers\bhrngr_m.sys [43584 2013-06-08] (Ploytec GmbH) S2 cvintdrv; C:\Windows\SysWow64\Drivers\cvintdrv.sys [6848 1998-04-13] () R3 DisplayLinkUsbIo_x64; C:\Windows\System32\DRIVERS\DisplayLinkUsbIo_x64_7.5.54609.0.sys [46384 2014-03-31] () S3 fasusbaudio; C:\Windows\System32\DRIVERS\fasusbaudio_x64.sys [252120 2013-06-07] () S3 fasusbaudioks; C:\Windows\System32\DRIVERS\fasusbaudioks_x64.sys [53464 2013-06-07] () S3 fireface64; C:\Windows\System32\drivers\fireface_64.sys [114304 2012-07-12] (RME) R3 firefaceu64; C:\Windows\System32\drivers\fireface_usb_64.sys [102016 2012-12-18] (RME) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-25] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation) S3 Ph6xIB64; C:\Windows\System32\DRIVERS\Ph6xIB64.sys [1512832 2009-06-10] (NXP Semiconductors GmbH) R0 PxHlpa64; C:\Windows\System32\drivers\PxHlpa64.sys [56336 2013-09-03] (Corel Corporation) S3 SCL01164; C:\Windows\System32\DRIVERS\SCL01164.sys [72320 2010-05-07] (SCM Microsystems Inc.) R0 snapman378; C:\Windows\System32\DRIVERS\snman378.sys [237600 2011-12-29] (Acronis) S4 sptd; C:\Windows\System32\Drivers\sptd.sys [871408 2010-01-02] (Duplex Secure Ltd.) S3 StarOpen; C:\Windows\System32\Drivers\StarOpen.sys [5504 2009-11-12] () S3 StarOpen; C:\Windows\SysWow64\Drivers\StarOpen.sys [7168 2009-11-12] () [File not signed] S3 synusb64; C:\Windows\System32\DRIVERS\synusb64.sys [30352 2009-06-26] (Steinberg Media Technologies GmbH) R0 tib; C:\Windows\System32\DRIVERS\tib.sys [1120032 2013-07-26] (Acronis International GmbH) R0 tib_mounter; C:\Windows\System32\DRIVERS\tib_mounter.sys [183224 2013-07-26] (Acronis) S3 Trufos; C:\Windows\System32\DRIVERS\Trufos.sys [389240 2014-10-09] (BitDefender S.R.L.) S3 VBoxUSB; C:\Windows\System32\Drivers\VBoxUSB.sys [117040 2011-12-19] (Oracle Corporation) R0 vidsflt; C:\Windows\System32\DRIVERS\vidsflt.sys [117024 2013-07-26] (Acronis International GmbH) R2 VMparport; C:\Windows\system32\drivers\VMparport.sys [18480 2009-10-20] (VMware, Inc.) R3 VUSB3HUB; C:\Windows\System32\DRIVERS\ViaHub3.sys [176640 2011-05-21] (VIA Technologies, Inc.) R3 xhcdrv; C:\Windows\System32\DRIVERS\xhcdrv.sys [230400 2011-05-21] (VIA Technologies, Inc.) S3 ZOOM_R16MTR; C:\Windows\System32\Drivers\zmr16usbaudio.sys [96768 2012-04-12] (Zoom Corporation.) S3 DisplayLinkUsbPort; system32\DRIVERS\DisplayLinkUsbPort_6.3.40660.0.sys [X] S3 pccsmcfd; system32\DRIVERS\pccsmcfdx64.sys [X] S1 SBRE; \??\C:\Windows\system32\drivers\SBREdrv.sys [X] S3 VBoxNetFlt; system32\DRIVERS\VBoxNetFlt.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-02-25 15:17 - 2015-02-25 15:17 - 00027686 _____ () C:\Users\Stefan\Desktop\FRST.txt 2015-02-25 15:16 - 2015-02-25 15:17 - 00000000 ____D () C:\FRST 2015-02-25 15:12 - 2015-02-25 15:12 - 00000584 _____ () C:\Users\Stefan\Desktop\defogger_disable.log 2015-02-25 15:12 - 2015-02-25 15:12 - 00000020 _____ () C:\Users\Stefan\defogger_reenable 2015-02-21 17:51 - 2015-02-21 17:51 - 00001124 _____ () C:\Users\Public\Desktop\Finale NotePad 2012.lnk 2015-02-21 17:51 - 2015-02-21 17:51 - 00000000 ____D () C:\Users\Stefan\Documents\Finale-Dateien 2015-02-21 17:51 - 2015-02-21 17:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Finale NotePad 2012 2015-02-21 17:50 - 2015-02-21 17:51 - 00000000 ____D () C:\Program Files (x86)\Finale NotePad 2012 2015-02-18 16:06 - 2015-02-18 16:06 - 00001201 _____ () C:\Users\Stefan\Desktop\Axe-Edit.lnk 2015-02-15 20:58 - 2015-02-15 20:58 - 00002926 _____ () C:\Users\Stefan\.recently-used.xbel 2015-02-15 18:32 - 2015-02-15 18:32 - 02085888 _____ (Farbar) C:\Users\Stefan\Desktop\FRST64.exe 2015-02-15 18:32 - 2015-02-15 18:32 - 00057438 _____ () C:\Users\Stefan\Desktop\trojaner-board.de Anleitung.html 2015-02-15 18:32 - 2015-02-15 18:32 - 00000000 ____D () C:\Users\Stefan\Desktop\trojaner-board.de Anleitung-Dateien 2015-02-15 18:31 - 2015-02-15 18:31 - 00380416 _____ () C:\Users\Stefan\Desktop\Gmer-19357.exe 2015-02-15 18:30 - 2015-02-15 18:30 - 00050477 _____ () C:\Users\Stefan\Desktop\Defogger.exe 2015-02-15 18:28 - 2015-02-15 18:28 - 00000000 _____ () C:\Users\Stefan\Desktop\WinCDEmu.txt 2015-02-15 16:52 - 2015-02-25 15:15 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2015-02-15 16:52 - 2015-02-15 16:52 - 00001112 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2015-02-15 16:52 - 2015-02-15 16:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2015-02-15 16:52 - 2015-02-15 16:52 - 00000000 ____D () C:\ProgramData\Malwarebytes 2015-02-15 16:52 - 2015-02-15 16:52 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2015-02-15 16:52 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2015-02-15 16:52 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2015-02-15 16:52 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2015-02-15 13:39 - 2015-02-15 13:39 - 00000000 __SHD () C:\Users\Stefan\AppData\Local\EmieBrowserModeList 2015-02-11 20:36 - 2015-02-13 16:20 - 00000000 ____D () C:\Kaspersky Rescue Disk 10.0 2015-02-11 18:50 - 2015-01-23 05:42 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2015-02-11 18:50 - 2015-01-23 05:41 - 06041600 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2015-02-11 18:50 - 2015-01-23 04:43 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2015-02-11 18:50 - 2015-01-23 04:17 - 04300800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2015-02-11 12:50 - 2015-02-11 12:50 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\Lavasoft 2015-02-11 12:37 - 2015-02-25 15:14 - 00002327 _____ () C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk 2015-02-11 12:37 - 2015-02-11 12:37 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\LavasoftStatistics 2015-02-11 12:37 - 2015-02-11 12:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft 2015-02-11 12:36 - 2015-02-11 12:36 - 00000000 ____D () C:\Program Files\Lavasoft 2015-02-11 12:35 - 2015-02-11 12:35 - 00000000 ____D () C:\Program Files\Common Files\Lavasoft 2015-02-11 09:52 - 2015-01-14 06:47 - 00389808 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2015-02-11 09:52 - 2015-01-14 06:09 - 00342712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2015-02-11 09:52 - 2015-01-12 04:09 - 25056256 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2015-02-11 09:52 - 2015-01-12 04:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2015-02-11 09:52 - 2015-01-12 04:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2015-02-11 09:52 - 2015-01-12 03:49 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2015-02-11 09:52 - 2015-01-12 03:48 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2015-02-11 09:52 - 2015-01-12 03:48 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2015-02-11 09:52 - 2015-01-12 03:48 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2015-02-11 09:52 - 2015-01-12 03:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2015-02-11 09:52 - 2015-01-12 03:40 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2015-02-11 09:52 - 2015-01-12 03:39 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2015-02-11 09:52 - 2015-01-12 03:36 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2015-02-11 09:52 - 2015-01-12 03:34 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2015-02-11 09:52 - 2015-01-12 03:34 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2015-02-11 09:52 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2015-02-11 09:52 - 2015-01-12 03:25 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2015-02-11 09:52 - 2015-01-12 03:21 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2015-02-11 09:52 - 2015-01-12 03:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2015-02-11 09:52 - 2015-01-12 03:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2015-02-11 09:52 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2015-02-11 09:52 - 2015-01-12 03:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2015-02-11 09:52 - 2015-01-12 03:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2015-02-11 09:52 - 2015-01-12 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2015-02-11 09:52 - 2015-01-12 03:07 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2015-02-11 09:52 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2015-02-11 09:52 - 2015-01-12 03:04 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2015-02-11 09:52 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2015-02-11 09:52 - 2015-01-12 03:00 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2015-02-11 09:52 - 2015-01-12 02:59 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2015-02-11 09:52 - 2015-01-12 02:57 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2015-02-11 09:52 - 2015-01-12 02:55 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2015-02-11 09:52 - 2015-01-12 02:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2015-02-11 09:52 - 2015-01-12 02:48 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2015-02-11 09:52 - 2015-01-12 02:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2015-02-11 09:52 - 2015-01-12 02:46 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2015-02-11 09:52 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2015-02-11 09:52 - 2015-01-12 02:43 - 14401024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2015-02-11 09:52 - 2015-01-12 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2015-02-11 09:52 - 2015-01-12 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2015-02-11 09:52 - 2015-01-12 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2015-02-11 09:52 - 2015-01-12 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2015-02-11 09:52 - 2015-01-12 02:27 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2015-02-11 09:52 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2015-02-11 09:52 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2015-02-11 09:52 - 2015-01-12 02:22 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2015-02-11 09:52 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2015-02-11 09:52 - 2015-01-12 02:14 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2015-02-11 09:52 - 2015-01-12 02:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2015-02-11 09:52 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2015-02-11 09:52 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2015-02-11 09:52 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2015-02-11 09:52 - 2015-01-10 07:48 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2015-02-11 09:52 - 2015-01-10 07:48 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2015-02-11 09:52 - 2015-01-10 07:48 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll 2015-02-11 09:52 - 2015-01-10 07:48 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll 2015-02-11 09:52 - 2015-01-10 07:48 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll 2015-02-11 09:52 - 2015-01-10 07:48 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll 2015-02-11 09:52 - 2015-01-10 07:48 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll 2015-02-11 09:52 - 2015-01-10 07:27 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll 2015-02-11 09:52 - 2015-01-10 07:27 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll 2015-02-11 09:52 - 2015-01-10 07:27 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2015-02-11 09:52 - 2015-01-10 07:27 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll 2015-02-11 09:52 - 2015-01-10 07:27 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll 2015-02-11 09:52 - 2015-01-10 07:27 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll 2015-02-11 09:52 - 2015-01-10 07:27 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll 2015-02-11 09:51 - 2015-01-15 09:14 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2015-02-11 09:51 - 2015-01-15 09:14 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys 2015-02-11 09:51 - 2015-01-15 09:09 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2015-02-11 09:51 - 2015-01-15 09:09 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll 2015-02-11 09:51 - 2015-01-15 09:09 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe 2015-02-11 09:51 - 2015-01-15 09:09 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll 2015-02-11 09:51 - 2015-01-15 09:09 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll 2015-02-11 09:51 - 2015-01-15 09:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe 2015-02-11 09:51 - 2015-01-15 09:06 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll 2015-02-11 09:51 - 2015-01-15 09:06 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll 2015-02-11 09:51 - 2015-01-15 09:04 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll 2015-02-11 09:51 - 2015-01-15 08:42 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe 2015-02-11 09:51 - 2015-01-15 08:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2015-02-11 09:51 - 2015-01-15 08:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2015-02-11 09:51 - 2015-01-15 08:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll 2015-02-11 09:51 - 2015-01-15 08:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll 2015-02-11 09:51 - 2015-01-15 08:37 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll 2015-02-11 09:51 - 2015-01-15 05:22 - 00458824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys 2015-02-11 09:51 - 2015-01-14 07:09 - 05554112 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2015-02-11 09:51 - 2015-01-14 07:05 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll 2015-02-11 09:51 - 2015-01-14 07:05 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll 2015-02-11 09:51 - 2015-01-14 07:04 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe 2015-02-11 09:51 - 2015-01-14 06:44 - 03972544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2015-02-11 09:51 - 2015-01-14 06:44 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2015-02-11 09:51 - 2015-01-14 06:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll 2015-02-11 09:51 - 2015-01-13 04:10 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2015-02-11 09:51 - 2015-01-13 03:49 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll 2015-02-11 09:51 - 2014-12-12 06:31 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll 2015-02-11 09:51 - 2014-12-12 06:07 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll 2015-02-11 09:51 - 2014-12-08 04:09 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll 2015-02-11 09:51 - 2014-12-08 03:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll 2015-02-11 09:51 - 2014-11-26 04:53 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll 2015-02-11 09:51 - 2014-11-26 04:32 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll 2015-02-11 09:51 - 2014-07-07 03:07 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll 2015-02-11 09:51 - 2014-07-07 03:06 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll 2015-02-11 09:51 - 2014-07-07 02:40 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll 2015-02-11 09:51 - 2014-07-07 02:40 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll 2015-02-11 09:50 - 2015-01-09 03:03 - 03201536 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2015-02-09 22:34 - 2015-02-09 22:34 - 00000000 ____D () C:\Users\Stefan\AppData\Local\Wacom 2015-02-09 22:34 - 2015-02-09 22:34 - 00000000 ____D () C:\Users\Stefan\.android 2015-02-09 22:33 - 2015-02-09 22:34 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wacom Tablett 2015-02-09 22:33 - 2015-02-09 22:33 - 00000000 ____D () C:\Users\Stefan\AppData\Local\Wacom Help 2015-02-09 01:06 - 2015-02-09 22:36 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\WTablet 2015-02-09 01:03 - 2015-02-09 22:33 - 00000000 ____D () C:\Program Files\Tablet 2015-02-09 01:03 - 2015-02-09 01:03 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_wacomrouterfilter_01009.Wdf 2015-02-09 01:03 - 2015-02-09 01:03 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_wachidrouter_01009.Wdf 2015-02-09 01:03 - 2015-02-09 01:03 - 00000000 ____D () C:\Program Files\TabletPlugins 2015-02-09 01:03 - 2015-02-09 01:03 - 00000000 ____D () C:\Program Files (x86)\TabletPlugins 2015-02-09 01:03 - 2014-12-22 21:42 - 02029336 _____ (Wacom Technology, Corp.) C:\Windows\system32\WacomMT.dll 2015-02-09 01:03 - 2014-12-22 21:42 - 01997592 _____ (Wacom Technology, Corp.) C:\Windows\system32\Wacom_Tablet.dll 2015-02-09 01:03 - 2014-12-22 21:42 - 01990936 _____ (Wacom Technology, Corp.) C:\Windows\system32\Wacom_Touch_Tablet.dll 2015-02-09 01:03 - 2014-12-22 21:42 - 01863960 _____ (Wacom Technology, Corp.) C:\Windows\system32\Wintab32.dll 2015-02-09 01:03 - 2014-12-22 21:42 - 01626392 _____ (Wacom Technology, Corp.) C:\Windows\SysWOW64\WacomMT.dll 2015-02-09 01:03 - 2014-12-22 21:42 - 01618712 _____ (Wacom Technology, Corp.) C:\Windows\SysWOW64\Wacom_Tablet.dll 2015-02-09 01:03 - 2014-12-22 21:42 - 01612056 _____ (Wacom Technology, Corp.) C:\Windows\SysWOW64\Wacom_Touch_Tablet.dll 2015-02-09 01:03 - 2014-12-22 21:42 - 01497368 _____ (Wacom Technology, Corp.) C:\Windows\SysWOW64\Wintab32.dll 2015-02-09 01:03 - 2014-10-25 21:52 - 00100664 _____ (Wacom Technology) C:\Windows\system32\Drivers\wachidrouter.sys 2015-02-09 01:03 - 2014-10-25 21:52 - 00015160 _____ (Wacom Technology) C:\Windows\system32\Drivers\wacomrouterfilter.sys 2015-02-09 01:03 - 2014-10-25 21:52 - 00014136 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\hidkmdf.sys 2015-02-08 03:38 - 2015-02-11 17:51 - 00001676 _____ () C:\Users\Stefan\Desktop\Adobe Photoshop Elements 13.lnk 2015-02-08 03:12 - 2015-02-08 03:12 - 00000000 ____D () C:\Users\Stefan\Documents\NewBlueFX 2015-02-08 03:10 - 2015-02-08 03:10 - 00000000 ____D () C:\Users\Stefan\Documents\Adobe 2015-02-08 02:50 - 2015-02-08 02:50 - 00003498 _____ () C:\Windows\System32\Tasks\AdobeAAMUpdater-1.0-Musik-Stefan 2015-02-08 02:29 - 2015-02-11 17:51 - 00001676 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop Elements 13.lnk 2015-02-08 02:13 - 2015-02-11 09:45 - 00001084 _____ () C:\Users\Public\Desktop\Adobe Premiere Elements 13.lnk 2015-02-08 02:13 - 2015-02-08 03:15 - 00000000 ____D () C:\ProgramData\regid.1986-12.com.adobe 2015-02-08 02:13 - 2015-02-08 02:13 - 00001052 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Premiere Elements 13.lnk 2015-02-08 02:08 - 2015-02-08 03:20 - 00000000 ____D () C:\Program Files\Common Files\Adobe 2015-02-08 02:07 - 2015-02-08 03:26 - 00000000 ____D () C:\Program Files\Adobe 2015-02-08 02:05 - 2013-09-03 11:01 - 00056336 ____N (Corel Corporation) C:\Windows\system32\Drivers\PxHlpa64.sys 2015-02-08 02:05 - 2012-04-24 11:01 - 00011376 ____N (Corel Corporation) C:\Windows\system32\Drivers\cdralw2k.sys 2015-02-08 02:05 - 2012-04-24 11:01 - 00010864 ____N (Corel Corporation) C:\Windows\system32\Drivers\cdr4_xp.sys 2015-02-08 02:04 - 2015-02-08 02:05 - 00000000 ____D () C:\ProgramData\Package Cache 2015-02-06 10:38 - 2015-02-06 12:07 - 02347384 _____ (ESET) C:\Users\Stefan\Desktop\esetsmartinstaller_deu.exe 2015-01-31 15:36 - 2015-01-31 15:35 - 00450892 ____R () C:\Windows\system32\Drivers\etc\hosts.20150131-153622.backup 2015-01-31 15:17 - 2015-01-31 15:17 - 00001401 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk 2015-01-31 15:17 - 2015-01-31 15:17 - 00001389 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk 2015-01-31 15:17 - 2015-01-31 15:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2 2015-01-31 15:17 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe 2015-01-31 15:11 - 2015-01-31 15:11 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking 2015-01-31 11:03 - 2015-01-31 11:03 - 00003238 _____ () C:\Windows\System32\Tasks\SamsungMagician 2015-01-31 11:03 - 2015-01-31 11:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung Magician 2015-01-31 11:03 - 2015-01-31 11:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes 2015-01-31 11:02 - 2015-01-31 11:03 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7 2015-01-31 11:02 - 2015-01-31 11:03 - 00000000 ____D () C:\Program Files\iTunes 2015-01-31 11:02 - 2015-01-31 11:02 - 00000000 ____D () C:\Program Files\iPod 2015-01-31 11:02 - 2015-01-31 11:02 - 00000000 ____D () C:\Program Files (x86)\iTunes 2015-01-28 13:30 - 2015-01-28 13:30 - 00003886 _____ () C:\Windows\System32\Tasks\Adobe Acrobat Update Task 2015-01-27 02:53 - 2015-01-27 02:53 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-02-25 15:14 - 2013-12-25 14:29 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2015-02-25 15:14 - 2013-05-31 17:48 - 00000350 _____ () C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job 2015-02-25 15:14 - 2013-05-17 09:36 - 00250370 _____ () C:\Windows\setupact.log 2015-02-25 15:14 - 2011-07-26 23:07 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\JFritz 2015-02-25 15:14 - 2010-01-03 01:15 - 00000000 ____D () C:\ProgramData\VMware 2015-02-25 15:14 - 2010-01-03 00:51 - 00000000 ____D () C:\Users\Stefan\AppData\Local\Adobe 2015-02-25 15:14 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-02-25 15:12 - 2010-01-02 21:03 - 01766006 _____ () C:\Windows\WindowsUpdate.log 2015-02-25 15:12 - 2010-01-02 21:02 - 00000000 ____D () C:\Users\Stefan 2015-02-25 15:12 - 2009-07-14 05:45 - 00025536 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-02-25 15:12 - 2009-07-14 05:45 - 00025536 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-02-25 15:10 - 2010-11-20 23:31 - 00000000 ____D () C:\ProgramData\MFAData 2015-02-25 14:55 - 2012-06-16 02:52 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2015-02-25 14:40 - 2013-12-25 14:29 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2015-02-25 08:56 - 2009-07-14 18:58 - 00723752 _____ () C:\Windows\system32\perfh007.dat 2015-02-25 08:56 - 2009-07-14 18:58 - 00162398 _____ () C:\Windows\system32\perfc007.dat 2015-02-25 08:56 - 2009-07-14 06:13 - 01668856 _____ () C:\Windows\system32\PerfStringBackup.INI 2015-02-25 08:52 - 2010-01-02 21:05 - 00003922 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{19C9D25B-2315-454A-A195-01EAF0641687} 2015-02-24 13:36 - 2012-02-23 02:18 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\Mp3tag 2015-02-24 12:52 - 2014-05-01 17:08 - 00000000 ____D () C:\temp 2015-02-23 13:56 - 2010-01-03 00:31 - 00000000 ___RD () C:\Users\Stefan\Virtual Machines 2015-02-23 12:32 - 2010-01-02 21:52 - 00245312 _____ () C:\Users\Stefan\AppData\Local\GDIPFONTCACHEV1.DAT 2015-02-23 11:08 - 2009-07-14 05:45 - 00970200 _____ () C:\Windows\system32\FNTCACHE.DAT 2015-02-19 00:14 - 2010-02-12 13:30 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\Audacity 2015-02-17 19:42 - 2014-08-21 16:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Fractal Audio 2015-02-17 19:37 - 2013-02-08 19:20 - 00000000 ____D () C:\Windows\system32\axefx2load 2015-02-16 18:42 - 2013-02-21 02:50 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\vlc 2015-02-15 21:18 - 2010-04-14 09:20 - 00000000 ____D () C:\Users\Stefan\.gimp-2.6 2015-02-15 20:58 - 2010-04-14 10:13 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\gtk-2.0 2015-02-15 17:21 - 2012-02-23 12:39 - 00226006 _____ () C:\Windows\PFRO.log 2015-02-15 17:07 - 2013-08-06 11:16 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\DataMgr 2015-02-14 09:23 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache 2015-02-14 01:23 - 2012-08-21 16:51 - 00000000 ____D () C:\Program Files (x86)\SpeedFan 2015-02-13 18:02 - 2014-12-05 11:06 - 00000000 ____D () C:\ProgramData\AVG2015 2015-02-11 15:11 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions 2015-02-11 15:00 - 2010-01-02 21:40 - 00000000 ____D () C:\ProgramData\Microsoft Help 2015-02-11 14:58 - 2013-08-06 10:12 - 00000000 ____D () C:\Windows\system32\MRT 2015-02-11 14:54 - 2010-01-02 21:13 - 116773704 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2015-02-11 12:35 - 2011-06-18 23:35 - 00000000 ____D () C:\ProgramData\Lavasoft 2015-02-10 12:25 - 2014-06-15 23:34 - 00001274 _____ () C:\Users\Stefan\Desktop\VQ Audio CD 2.lnk 2015-02-08 03:14 - 2010-01-03 00:50 - 00000000 ____D () C:\ProgramData\Adobe 2015-02-08 03:12 - 2010-01-03 00:51 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\Adobe 2015-02-07 11:34 - 2013-12-25 14:29 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2015-02-07 11:34 - 2013-12-25 14:29 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2015-02-06 13:26 - 2015-01-04 13:42 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\Snz 2015-02-05 16:55 - 2012-06-16 02:52 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2015-02-05 16:55 - 2012-04-12 10:24 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2015-02-05 16:55 - 2011-05-26 02:43 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2015-01-31 15:38 - 2011-04-10 23:44 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy 2015-01-31 15:33 - 2013-10-22 08:09 - 00000000 ____D () C:\ProgramData\Oracle 2015-01-31 15:32 - 2009-07-14 03:34 - 00450892 ____R () C:\Windows\system32\Drivers\etc\hosts.20150131-153534.backup 2015-01-31 15:22 - 2014-11-25 23:28 - 00272296 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2015-01-31 15:22 - 2014-11-25 23:28 - 00176552 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2015-01-31 15:22 - 2014-11-25 23:28 - 00176552 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2015-01-31 15:22 - 2014-11-25 23:28 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2015-01-31 15:22 - 2014-11-25 23:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2015-01-31 15:22 - 2012-09-05 20:18 - 00000000 ____D () C:\Program Files (x86)\Java 2015-01-31 15:19 - 2013-05-16 22:01 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2 2015-01-31 15:16 - 2011-04-10 23:44 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2015-01-31 14:55 - 2014-08-06 18:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG 2015-01-31 11:03 - 2014-02-03 08:35 - 00000000 ____D () C:\Program Files (x86)\Samsung Magician 2015-01-31 11:03 - 2013-07-24 09:23 - 00001113 _____ () C:\Users\Public\Desktop\Samsung Magician.lnk 2015-01-31 11:02 - 2012-02-22 22:42 - 00000000 ____D () C:\Program Files\Common Files\Apple 2015-01-28 13:28 - 2013-03-01 12:40 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service ==================== Files in the root of some directories ======= 2013-05-21 10:09 - 2014-06-23 08:29 - 0003728 _____ () C:\Program Files (x86)\Mozilla Firefoxavg-secure-search.xml 2011-07-26 23:07 - 2011-07-26 23:07 - 0000000 _____ () C:\Users\Stefan\AppData\Roaming\JFritz.lock 2010-11-15 19:07 - 2010-11-15 19:07 - 0038425 _____ () C:\Users\Stefan\AppData\Roaming\Microsoft Access 97-2003.ADR 2010-11-15 19:06 - 2010-11-15 19:06 - 0012957 _____ () C:\Users\Stefan\AppData\Roaming\Microsoft Access 97-2003.CAL 2010-08-03 14:51 - 2013-10-03 12:54 - 0038422 _____ () C:\Users\Stefan\AppData\Roaming\Microsoft Excel 97-2003.ADR 2010-08-03 14:50 - 2011-09-01 15:57 - 0012954 _____ () C:\Users\Stefan\AppData\Roaming\Microsoft Excel 97-2003.CAL 2013-10-03 12:54 - 2013-10-15 21:02 - 0009312 _____ () C:\Users\Stefan\AppData\Roaming\Microsoft Excel 97-2003.EML 2010-01-18 01:33 - 2014-03-31 12:35 - 0111104 _____ () C:\Users\Stefan\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2013-07-21 14:24 - 2013-07-21 14:24 - 0047776 _____ () C:\Users\Stefan\AppData\Local\ext_piccshare_uninst.exe 2010-01-03 04:06 - 2012-08-21 16:48 - 0007614 _____ () C:\Users\Stefan\AppData\Local\resmon.resmoncfg 2008-02-05 13:28 - 2008-02-05 13:28 - 0000051 _____ () C:\Users\Stefan\AppData\Local\setup.txt ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-02-25 11:21 ==================== End Of Log ============================ Eine Frage noch zu GMER: Gmer sagt: Code:
ATTFilter Disk \Device\Harddisk0\DR0 unknown MBR code
Habt ihr Hilfe für mich? Wie soll ich hier vorgehen? Danke schon mal! |
| Themen zu PiccShare Updater & Snoozer.exe mit Malwarebyte u.a. gefunden |
| ad-aware, antivirus, avg security toolbar, fehlercode 0x0, fehlercode 0xc0000005, fehlercode 0xc0000374, fehlercode 0xc0150014, fehlercode 24, fehlercode 28, fehlercode windows, flash player, g2nu/g2.1nu, kaspersky, launch, piccshare, pup.optional.datamgr.a, pup.optional.offermosquito.a, pup.optional.piccshare.a, pup.optional.simplenewtab.a, pup.optional.softonic.a, registry, safer networking, secure search, security, software, svchost.exe, tablet, vtoolbarupdater |
Baum-Darstellung