| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: PDF mit Trojaner geöffnet, Windows 7Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
13.05.2015, 21:03
| #1 |
 |  PDF mit Trojaner geöffnet, Windows 7 Hallo liebe Helfer... trotz des besseren Wissens habe ich eine PDF aus dem Anhang einer Mail von DHL (gefälscht) geöffnet...voll ärgerlich. Und wenn man die Titel der Beiträge hier so liest...nicht als einziger  Hier ist das Ergebnis von virustotal: https://www.virustotal.com/de/file/a83514836227367a2c43e4b48aaffbddaa7b083b50c51626342dc91c4e685266/analysis/1431545205/ Er hat was gefunden: Sophos Troj/PDFDown-C 20150513 DEFOGGER: Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 21:33 on 13/05/2015 (Boss)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 13-05-2015
Ran by Boss (administrator) on MARLENE on 13-05-2015 21:33:56
Running from C:\Users\Papa\Desktop\TrojanerBoard
Loaded Profiles: Boss & Papa (Available profiles: Boss & Papa & Mama)
Platform: Microsoft Windows 7 Professional Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AMD) C:\Windows\System32\atiesrxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corporation) C:\Program Files\Microsoft LifeCam\MSCamS32.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Windows\vVX1000.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(AMD) C:\Program Files\ATI Technologies\HydraVision\HydraDM.exe
(Dropbox, Inc.) C:\Users\Papa\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
() C:\Program Files\QNAP\Qfinder\iSCSIAgent.exe
(Microsoft Corporation) C:\Program Files\Windows Live\Mail\wlmail.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Program Files\Windows Live\Contacts\wlcomm.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_17_0_0_169.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_17_0_0_169.exe
(Farbar) C:\Users\Papa\Desktop\TrojanerBoard\FRST(1).exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [10127976 2011-06-28] (Realtek Semiconductor)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [728312 2015-05-07] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [VX1000] => C:\Windows\vVX1000.exe [762736 2010-05-20] (Microsoft Corporation)
HKLM\...\Run: [LifeCam] => C:\Program Files\Microsoft LifeCam\LifeExp.exe [119152 2010-05-20] (Microsoft Corporation)
HKLM\...\Run: [iSCSIAgent] => C:\Program Files\QNAP\Qfinder\iSCSIAgent.exe [1739952 2015-02-25] ()
HKLM\...\Run: [Avira Systray] => C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe [129272 2015-03-16] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\x86\CLIStart.exe [748256 2014-09-15] (Advanced Micro Devices, Inc.)
HKU\S-1-5-21-638442100-2917554848-3055500443-1003\...\Run: [HydraVisionDesktopManager] => C:\Program Files\ATI Technologies\HydraVision\HydraDM.exe [389120 2013-08-30] (AMD)
Startup: C:\Users\Papa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2015-01-23]
ShortcutTarget: Dropbox.lnk -> C:\Users\Boss\AppData\Roaming\Dropbox\bin\Dropbox.exe (No File)
Startup: C:\Users\Papa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk [2014-12-23]
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKU\S-1-5-21-638442100-2917554848-3055500443-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKU\S-1-5-21-638442100-2917554848-3055500443-1003\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_31\bin\ssv.dll [2015-01-22] (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-22] (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Boss\AppData\Roaming\Mozilla\Firefox\Profiles\ussg0rg9.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-16] ()
FF Plugin: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-22] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-22] (Oracle Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Extension: Adblock Plus - C:\Users\Boss\AppData\Roaming\Mozilla\Firefox\Profiles\ussg0rg9.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-06-22]
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S2 AntiVirMailService; C:\Program Files\Avira\AntiVir Desktop\avmailc7.exe [827640 2015-05-07] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [434424 2015-05-07] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [434424 2015-05-07] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe [1185584 2015-05-07] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [201008 2015-03-16] (Avira Operations GmbH & Co. KG)
R2 DiagTrack; C:\Windows\system32\diagtrack.dll [851456 2015-04-27] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R1 AsIO; C:\Windows\System32\drivers\AsIO.sys [11296 2009-08-04] ()
R1 AsUpIO; C:\Windows\System32\drivers\AsUpIO.sys [11448 2009-07-06] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [107400 2015-05-07] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2015-05-07] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37896 2015-05-07] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [37896 2015-03-05] (Avira Operations GmbH & Co. KG)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [13216 2009-07-16] ()
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2014-05-27] (Avira GmbH)
S3 VX1000; C:\Windows\System32\DRIVERS\VX1000.sys [1961072 2010-05-20] (Microsoft Corporation)
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-05-13 21:33 - 2015-05-13 21:33 - 00000000 ____D () C:\FRST
2015-05-13 21:33 - 2015-05-13 21:33 - 00000000 _____ () C:\Users\Boss\defogger_reenable
2015-05-13 21:32 - 2015-05-13 21:33 - 00000000 ____D () C:\Users\Papa\Desktop\TrojanerBoard
2015-05-13 20:29 - 2015-05-01 15:16 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 08:09 - 2015-05-05 03:12 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-05-13 08:09 - 2015-04-27 21:11 - 03989440 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2015-05-13 08:09 - 2015-04-27 21:11 - 03934144 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-05-13 08:09 - 2015-04-27 21:11 - 00137664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-05-13 08:09 - 2015-04-27 21:11 - 00067520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-05-13 08:09 - 2015-04-27 21:08 - 01307648 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-05-13 08:09 - 2015-04-27 21:05 - 00851456 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-05-13 08:09 - 2015-04-27 21:05 - 00635392 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-05-13 08:09 - 2015-04-27 21:05 - 00400896 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-05-13 08:09 - 2015-04-27 21:05 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-05-13 08:09 - 2015-04-27 21:05 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-05-13 08:09 - 2015-04-27 21:05 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-05-13 08:09 - 2015-04-27 21:05 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-05-13 08:09 - 2015-04-27 21:05 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll
2015-05-13 08:09 - 2015-04-27 21:05 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-05-13 08:09 - 2015-04-27 21:05 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-05-13 08:09 - 2015-04-27 21:05 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-05-13 08:09 - 2015-04-27 21:05 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-05-13 08:09 - 2015-04-27 21:04 - 01061376 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-05-13 08:09 - 2015-04-27 21:04 - 00641536 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-05-13 08:09 - 2015-04-27 21:04 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-05-13 08:09 - 2015-04-27 21:04 - 00364544 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe
2015-05-13 08:09 - 2015-04-27 21:04 - 00262656 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-05-13 08:09 - 2015-04-27 21:04 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2015-05-13 08:09 - 2015-04-27 21:04 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-05-13 08:09 - 2015-04-27 21:04 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe
2015-05-13 08:09 - 2015-04-27 21:04 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-05-13 08:09 - 2015-04-27 21:04 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe
2015-05-13 08:09 - 2015-04-27 21:04 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-05-13 08:09 - 2015-04-27 21:04 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-05-13 08:09 - 2015-04-27 21:03 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-05-13 08:09 - 2015-04-27 21:03 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe
2015-05-13 08:09 - 2015-04-27 21:01 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-05-13 08:09 - 2015-04-27 21:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-05-13 08:09 - 2015-04-27 20:59 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-05-13 08:09 - 2015-04-27 20:59 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-05-13 08:09 - 2015-04-27 20:00 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-05-13 08:09 - 2015-04-22 03:48 - 00342736 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-05-13 08:09 - 2015-04-21 18:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-05-13 08:09 - 2015-04-21 18:25 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-05-13 08:09 - 2015-04-21 18:24 - 19691008 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-05-13 08:09 - 2015-04-21 18:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-05-13 08:09 - 2015-04-21 18:11 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-05-13 08:09 - 2015-04-21 18:10 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-05-13 08:09 - 2015-04-21 18:09 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-05-13 08:09 - 2015-04-21 18:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-05-13 08:09 - 2015-04-21 18:04 - 02278400 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-05-13 08:09 - 2015-04-21 18:03 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-05-13 08:09 - 2015-04-21 18:02 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-05-13 08:09 - 2015-04-21 18:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-05-13 08:09 - 2015-04-21 17:58 - 00664576 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-05-13 08:09 - 2015-04-21 17:58 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-05-13 08:09 - 2015-04-21 17:58 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-05-13 08:09 - 2015-04-21 17:57 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-05-13 08:09 - 2015-04-21 17:51 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-05-13 08:09 - 2015-04-21 17:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-05-13 08:09 - 2015-04-21 17:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-05-13 08:09 - 2015-04-21 17:39 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-05-13 08:09 - 2015-04-21 17:38 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-05-13 08:09 - 2015-04-21 17:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-05-13 08:09 - 2015-04-21 17:31 - 04305920 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-05-13 08:09 - 2015-04-21 17:26 - 00688640 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-05-13 08:09 - 2015-04-21 17:26 - 00685568 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-05-13 08:09 - 2015-04-21 17:25 - 02052608 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-05-13 08:09 - 2015-04-21 17:24 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-05-13 08:09 - 2015-04-21 17:17 - 12828672 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-05-13 08:09 - 2015-04-21 17:02 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-05-13 08:09 - 2015-04-21 16:58 - 01310208 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-05-13 08:09 - 2015-04-21 16:56 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-05-13 08:09 - 2015-04-20 04:56 - 01250816 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-05-13 08:09 - 2015-04-20 04:56 - 00909312 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-05-13 08:09 - 2015-04-20 04:03 - 02382336 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-05-13 08:09 - 2015-04-18 04:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-05-13 08:09 - 2015-04-13 05:19 - 00259072 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-05-13 08:09 - 2015-01-29 05:02 - 02311168 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll
2015-05-13 08:08 - 2015-03-04 06:11 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\shimeng.dll
2015-05-13 08:08 - 2015-03-04 06:10 - 00295936 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2015-05-13 08:08 - 2015-03-04 06:10 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\aelupsvc.dll
2015-05-13 08:08 - 2015-03-04 06:10 - 00020992 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2015-05-13 08:08 - 2015-02-18 09:06 - 00123904 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2015-05-10 20:57 - 2015-05-10 20:57 - 00000000 ____D () C:\Users\Mama\AppData\Roaming\ATI
2015-05-10 20:57 - 2015-05-10 20:57 - 00000000 ____D () C:\Users\Mama\AppData\Local\ATI
2015-05-10 12:53 - 2015-05-10 12:53 - 00000000 ____D () C:\Program Files\13-9_win7_win8_32-64_hydravision
2015-05-10 12:50 - 2015-05-10 12:50 - 00000000 ____D () C:\Program Files\Sapphire TRIXX
2015-05-10 12:48 - 2015-05-10 12:48 - 00000000 ____D () C:\Users\Papa\AppData\Roaming\ATI
2015-05-10 12:48 - 2015-05-10 12:48 - 00000000 ____D () C:\Users\Papa\AppData\Local\ATI
2015-05-10 12:48 - 2015-05-10 12:48 - 00000000 ____D () C:\ProgramData\ATI
2015-05-10 12:48 - 2015-05-10 12:48 - 00000000 _____ () C:\Windows\ativpsrm.bin
2015-05-10 12:46 - 2015-05-10 12:46 - 00054924 _____ () C:\Windows\system32\CCCInstall_201505101246249548.log
2015-05-10 12:46 - 2015-05-10 12:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center
2015-05-10 12:46 - 2015-05-10 12:46 - 00000000 ____D () C:\ProgramData\AMD
2015-05-10 12:46 - 2015-05-10 12:46 - 00000000 ____D () C:\Program Files\AMD AVT
2015-05-10 12:44 - 2015-05-10 12:44 - 00000000 ____D () C:\Program Files\Common Files\ATI Technologies
2015-05-10 12:44 - 2015-05-10 12:44 - 00000000 ____D () C:\Program Files\AMD
2015-05-10 12:43 - 2015-05-10 12:43 - 00000000 ____D () C:\Program Files\ATI
2015-05-10 12:42 - 2015-05-10 12:53 - 00000000 ____D () C:\Program Files\ATI Technologies
2015-05-10 12:41 - 2015-05-10 12:41 - 00000000 ____D () C:\Program Files\AMD-Catalyst-14-9-win7-win8.1-32Bit-dd-ccc-whql
2015-05-10 12:40 - 2015-05-10 12:40 - 27185683 _____ () C:\Users\Papa\Downloads\13-9_win7_win8_32-64_hydravision_635163290847474865.zip
2015-05-10 12:37 - 2015-05-10 12:37 - 03650806 _____ () C:\Users\Papa\Downloads\TRIXX_installer_635456807114954507.zip
2015-05-10 12:31 - 2015-05-10 12:34 - 210810949 _____ () C:\Users\Papa\Downloads\amd-catalyst-14-9-win7-win8.1-32bit-dd-ccc-whql_635476727041970015.zip
2015-05-08 21:36 - 2015-05-09 14:21 - 00000000 ____D () C:\Users\Papa\AppData\Roaming\XnView
2015-05-08 21:35 - 2015-05-08 21:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XnView
2015-05-08 21:35 - 2015-05-08 21:35 - 00000000 ____D () C:\Program Files\XnView
2015-05-08 21:33 - 2015-05-08 21:33 - 05062128 _____ (Gougelet Pierre-e ) C:\Users\Papa\Downloads\XnView-win.exe
2015-05-08 21:08 - 2015-05-08 21:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QNAP
2015-05-08 21:07 - 2015-05-09 14:38 - 00000000 ____D () C:\Users\Papa\Desktop\Entwickeln
2015-05-08 21:06 - 2015-05-08 21:07 - 31496600 _____ (Igor Pavlov) C:\Users\Papa\Downloads\QNAPQfinderWindows-5.0.1.0225.exe
2015-05-07 21:19 - 2015-05-07 21:19 - 00000000 _____ () C:\Users\Papa\Desktop\Neues Textdokument.txt
2015-05-07 21:04 - 2015-05-07 21:48 - 00016760 _____ () C:\Users\Papa\Downloads\planungSiedlungsfest.xlsx
2015-04-29 18:05 - 2015-04-29 18:16 - 00000000 ____D () C:\Users\Papa\Desktop\Neuer Ordner
2015-04-24 14:29 - 2015-04-24 14:29 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2015-04-15 20:22 - 2015-04-15 20:22 - 00000000 ___RD () C:\Program Files\Skype
2015-04-15 20:22 - 2015-04-15 20:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2015-04-15 20:22 - 2015-04-15 20:22 - 00000000 ____D () C:\Program Files\Common Files\Skype
2015-04-15 11:04 - 2015-03-25 05:00 - 03088384 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-04-15 11:04 - 2015-03-25 05:00 - 02020864 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-04-15 11:04 - 2015-03-25 05:00 - 00566784 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-04-15 11:04 - 2015-03-25 05:00 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-04-15 11:04 - 2015-03-25 05:00 - 00131584 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-04-15 11:04 - 2015-03-25 05:00 - 00092672 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-04-15 11:04 - 2015-03-25 05:00 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-04-15 11:04 - 2015-03-25 05:00 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-04-15 11:04 - 2015-03-25 05:00 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-04-15 11:04 - 2015-03-25 05:00 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-04-15 11:04 - 2015-03-25 05:00 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-04-15 11:04 - 2015-03-23 05:06 - 00860160 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-04-15 11:04 - 2015-03-23 05:06 - 00630784 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-04-15 11:04 - 2015-03-23 05:06 - 00576000 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-04-15 11:04 - 2015-03-23 05:06 - 00331264 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-04-15 11:04 - 2015-03-23 05:06 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-04-15 11:04 - 2015-03-23 05:06 - 00159744 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-04-15 11:04 - 2015-03-23 05:06 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-04-15 11:04 - 2015-03-23 04:59 - 00896000 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-04-15 11:04 - 2015-03-10 05:08 - 01237504 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2015-04-15 11:04 - 2015-03-10 05:05 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2015-04-15 11:04 - 2015-03-05 06:06 - 00305152 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-04-15 11:04 - 2015-03-04 06:16 - 00249784 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys
2015-04-15 11:04 - 2015-03-04 06:10 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\clfsw32.dll
2015-04-15 11:04 - 2015-02-25 05:03 - 00514560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2015-04-14 03:38 - 2015-04-14 03:38 - 01217192 _____ (Microsoft Corporation) C:\Windows\system32\FM20.DLL
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-05-13 21:34 - 2015-01-15 16:26 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-05-13 21:33 - 2014-06-20 22:54 - 00000000 ____D () C:\Users\Boss
2015-05-13 21:04 - 2009-07-14 06:34 - 00025328 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-05-13 21:04 - 2009-07-14 06:34 - 00025328 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-05-13 21:02 - 2014-06-20 21:07 - 01594538 _____ () C:\Windows\WindowsUpdate.log
2015-05-13 21:00 - 2014-06-20 22:56 - 01618320 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-05-13 20:58 - 2015-01-23 16:22 - 00000000 ___RD () C:\Users\Papa\Dropbox
2015-05-13 20:58 - 2015-01-23 16:17 - 00000000 ____D () C:\Users\Papa\AppData\Roaming\Dropbox
2015-05-13 20:58 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2015-05-13 20:55 - 2014-08-09 22:30 - 00017702 _____ () C:\Windows\setupact.log
2015-05-13 20:55 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-13 20:55 - 2009-07-14 06:33 - 00334288 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-05-13 20:53 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2015-05-13 20:53 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\AdvancedInstallers
2015-05-13 20:30 - 2014-08-11 16:46 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-05-13 20:28 - 2014-06-22 10:37 - 00000000 ____D () C:\Windows\system32\MRT
2015-05-13 20:24 - 2014-06-22 10:37 - 137310008 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-05-10 21:11 - 2014-07-01 20:16 - 00000000 ____D () C:\Users\Papa\AppData\Roaming\Canon
2015-05-10 12:43 - 2014-06-22 20:05 - 00000000 ____D () C:\ProgramData\Package Cache
2015-05-09 08:42 - 2015-01-23 16:19 - 00000000 ____D () C:\Users\Papa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-05-07 17:50 - 2014-06-22 20:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-05-07 17:49 - 2014-06-22 20:07 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-05-07 17:49 - 2014-06-22 20:07 - 00107400 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-05-07 17:49 - 2014-06-22 20:07 - 00037896 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2015-05-01 14:58 - 2014-08-09 22:30 - 00203332 _____ () C:\Windows\PFRO.log
2015-04-30 21:07 - 2014-08-20 20:19 - 00000000 ____D () C:\Users\Mama\AppData\Roaming\Canon
2015-04-26 20:15 - 2014-06-21 09:05 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2015-04-17 08:22 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2015-04-16 19:30 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\AppCompat
2015-04-16 11:34 - 2014-06-22 19:25 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-04-16 11:34 - 2014-06-22 19:25 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-04-15 20:38 - 2014-12-11 08:18 - 00000000 ____D () C:\Windows\system32\appraiser
2015-04-15 20:38 - 2014-06-22 18:53 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-04-15 20:22 - 2014-08-31 10:40 - 00002687 _____ () C:\Users\Public\Desktop\Skype.lnk
2015-04-15 20:22 - 2014-08-31 10:40 - 00000000 ____D () C:\ProgramData\Skype
2015-04-14 21:17 - 2015-03-15 16:00 - 00000000 ____D () C:\Users\Papa\Desktop\Zukunft
Some content of TEMP:
====================
C:\Users\Boss\AppData\Local\Temp\avgnt.exe
C:\Users\Boss\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exe
C:\Users\Boss\AppData\Local\Temp\jre-8u31-windows-au.exe
C:\Users\Boss\AppData\Local\Temp\Lifecam3.0.204.0.exe
C:\Users\Boss\AppData\Local\Temp\Quarantine.exe
C:\Users\Boss\AppData\Local\Temp\sqlite3.dll
C:\Users\Mama\AppData\Local\Temp\avgnt.exe
C:\Users\Mama\AppData\Local\Temp\o8rc357d.dll
C:\Users\Mama\AppData\Local\Temp\zeb6uopg.dll
C:\Users\Papa\AppData\Local\Temp\avgnt.exe
C:\Users\Papa\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpv9jk43.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-05-04 07:24
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 13-05-2015
Ran by Boss at 2015-05-13 21:34:44
Running from C:\Users\Papa\Desktop\TrojanerBoard
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-638442100-2917554848-3055500443-500 - Administrator - Disabled)
Boss (S-1-5-21-638442100-2917554848-3055500443-1001 - Administrator - Enabled) => C:\Users\Boss
Gast (S-1-5-21-638442100-2917554848-3055500443-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-638442100-2917554848-3055500443-1002 - Limited - Enabled)
Mama (S-1-5-21-638442100-2917554848-3055500443-1004 - Limited - Enabled) => C:\Users\Mama
Papa (S-1-5-21-638442100-2917554848-3055500443-1003 - Limited - Enabled) => C:\Users\Papa
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Flash Player 17 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\...\{319271B3-E2AA-F623-928E-245C9EBF16F7}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 1.0.2.43 - Atheros Communications Inc.)
Avira (HKLM\...\{b5675cc4-ab8b-4945-8c1d-4c5479556d6a}) (Version: 1.1.34.19732 - Avira Operations GmbH & Co. KG)
Avira (Version: 1.1.34.19732 - Avira Operations GmbH & Co. KG) Hidden
Avira Antivirus (HKLM\...\Avira Antivirus) (Version: 15.0.10.434 - Avira Operations GmbH & Co. KG)
Canon MP Navigator 2.0 (HKLM\...\MP Navigator 2.0) (Version: - )
Canon MP150 (HKLM\...\{CA9A3609-3ECC-4574-8824-A8161A71A603}) (Version: - )
CCleaner (HKLM\...\CCleaner) (Version: 4.16 - Piriform)
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
Dropbox (HKU\S-1-5-21-638442100-2917554848-3055500443-1003\...\Dropbox) (Version: 3.4.6 - Dropbox, Inc.)
ESET Online Scanner v3 (HKLM\...\ESET Online Scanner) (Version: - )
Fotogalerie (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
HydraVision (Version: 4.2.252.0 - Advanced Micro Devices, Inc.) Hidden
Java 8 Update 31 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
Junk Mail filter update (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft LifeCam (HKLM\...\{5FC7AB5C-61FC-42DF-A923-5139BCF10D42}) (Version: 3.22.270.0 - Microsoft Corporation)
Microsoft Office Home and Student 2010 (HKLM\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x86) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Movie Maker (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 37.0.2 (x86 de) (HKLM\...\Mozilla Firefox 37.0.2 (x86 de)) (Version: 37.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 30.0 - Mozilla)
ProjectLibre (HKLM\...\{E29A4ED9-3192-4D72-A2E2-9C32B512714D}) (Version: 1.5.19.0 - ProjectLibre)
QNAP Qfinder (HKLM\...\QNAP_FINDER) (Version: 5.0.1.0225 - QNAP Systems, Inc.)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6402 - Realtek Semiconductor Corp.)
Sapphire TRIXX (HKLM\...\Sapphire TRIXX) (Version: - )
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Skype™ 7.0 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
VisiPics V1.31 (HKLM\...\VisiPics_is1) (Version: - Ozone)
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Win32DiskImager version 0.9.5 (HKLM\...\{D074CE74-912A-4AD3-A0BF-3937D9D01F17}_is1) (Version: 0.9.5 - ImageWriter Developers)
Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
XnView 2.32 (HKLM\...\XnView_is1) (Version: 2.32 - Gougelet Pierre-e)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-638442100-2917554848-3055500443-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Papa\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-638442100-2917554848-3055500443-1001_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-638442100-2917554848-3055500443-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-638442100-2917554848-3055500443-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-638442100-2917554848-3055500443-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-638442100-2917554848-3055500443-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-638442100-2917554848-3055500443-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-638442100-2917554848-3055500443-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-638442100-2917554848-3055500443-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-638442100-2917554848-3055500443-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-638442100-2917554848-3055500443-1003_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Papa\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-638442100-2917554848-3055500443-1003_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-638442100-2917554848-3055500443-1003_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-638442100-2917554848-3055500443-1003_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-638442100-2917554848-3055500443-1003_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-638442100-2917554848-3055500443-1003_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-638442100-2917554848-3055500443-1003_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-638442100-2917554848-3055500443-1003_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-638442100-2917554848-3055500443-1003_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-638442100-2917554848-3055500443-1003_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
==================== Restore Points =========================
10-05-2015 12:43:25 Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727
12-05-2015 08:35:08 Windows Update
13-05-2015 20:16:41 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {01AD3CEB-9D22-4855-8AB3-762E5C495DB0} - System32\Tasks\iSCSIAgentAutoStartup => C:\Program Files\QNAP\Qfinder\iSCSIAgent.exe [2015-02-25] ()
Task: {0A8BEC4D-B503-4720-8171-D9C419114A9D} - System32\Tasks\Microsoft\Windows\Setup\gwx\runappraiser => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
Task: {3122BEB9-7F60-4790-8852-D0ACD62CD986} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {35A2376D-FFCC-4E23-8AAD-43B1D68FDDF7} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-07-23] (Piriform Ltd)
Task: {407224FD-0811-4FCD-83C1-CC82D76FB3AC} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-03-25] (Microsoft Corporation)
Task: {7670CFAC-7A91-4436-B09E-DBCAC18BCE25} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
Task: {BCB6987B-D616-4829-A477-EAE852BA1FAC} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-16] (Adobe Systems Incorporated)
Task: {DFB84816-384E-46F5-899E-D90803D59DD8} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxcontent => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) ==============
2015-05-13 20:57 - 2015-05-13 20:57 - 00043008 _____ () c:\users\papa\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpv9jk43.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00750080 _____ () C:\Users\Papa\AppData\Roaming\Dropbox\bin\libGLESv2.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00047616 _____ () C:\Users\Papa\AppData\Roaming\Dropbox\bin\libEGL.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00865280 _____ () C:\Users\Papa\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00200704 _____ () C:\Users\Papa\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll
2015-01-17 16:25 - 2015-02-25 08:15 - 01739952 _____ () C:\Program Files\QNAP\Qfinder\iSCSIAgent.exe
2014-03-31 21:35 - 2014-03-31 21:35 - 00282304 _____ () C:\Program Files\Windows Live\Writer\de\WindowsLive.Writer.Localization.resources.dll
2015-04-16 11:34 - 2015-04-16 11:34 - 16863920 _____ () C:\Windows\system32\Macromed\Flash\NPSWF32_17_0_0_169.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, the associated entry will be removed from the registry.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-638442100-2917554848-3055500443-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Boss\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
HKU\S-1-5-21-638442100-2917554848-3055500443-1003\Control Panel\Desktop\\Wallpaper ->
DNS Servers: 192.168.178.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
==================== FirewallRules (whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{DBB8CF3A-16F2-4CC0-9060-99FCE4D8BD76}] => (Allow) C:\Program Files\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{66352015-F38D-454F-988A-9F78FD497257}] => (Allow) LPort=2869
FirewallRules: [{8223D6A9-A0B0-40BF-B456-B59E6B3AF9CD}] => (Allow) LPort=1900
FirewallRules: [{FEA0FCAF-534E-4787-8A53-119F1A08CD0B}] => (Allow) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
FirewallRules: [{02F30D98-EA7D-4CBE-91F4-17BDBF1B5670}] => (Allow) C:\Program Files\Skype\Phone\Skype.exe
FirewallRules: [{4AD1446A-5C2B-4213-B7A1-18E85160D0EF}] => (Allow) C:\Program Files\Microsoft LifeCam\LifeCam.exe
FirewallRules: [{BBB3FC36-BAA8-4CDE-A747-A9684F3881D6}] => (Allow) C:\Program Files\Microsoft LifeCam\LifeCam.exe
FirewallRules: [{56DB8066-5909-414D-B1FB-B20EA7E8F6A2}] => (Allow) C:\Program Files\Microsoft LifeCam\LifeEnC2.exe
FirewallRules: [{F1332063-E7F2-466A-9CE9-C2EA2DB37125}] => (Allow) C:\Program Files\Microsoft LifeCam\LifeEnC2.exe
FirewallRules: [{8658ABE9-FCB7-4855-BD61-EAE44E28F1BC}] => (Allow) C:\Program Files\Microsoft LifeCam\LifeExp.exe
FirewallRules: [{A155F6B4-64CF-4A42-BDC1-4B8A817D58F0}] => (Allow) C:\Program Files\Microsoft LifeCam\LifeExp.exe
FirewallRules: [{9B2122CE-A939-4906-A827-80F40CB69728}] => (Allow) C:\Program Files\Microsoft LifeCam\LifeTray.exe
FirewallRules: [{13481C4C-AA22-4EA1-AA52-5C54CA65E071}] => (Allow) C:\Program Files\Microsoft LifeCam\LifeTray.exe
FirewallRules: [TCP Query User{B42186AC-37B5-42E2-89BC-BA645A745B20}C:\program files\qnap\qfinder\qfinder.exe] => (Allow) C:\program files\qnap\qfinder\qfinder.exe
FirewallRules: [UDP Query User{B818E706-1AA3-476F-8A4E-6CDA8CB5D472}C:\program files\qnap\qfinder\qfinder.exe] => (Allow) C:\program files\qnap\qfinder\qfinder.exe
FirewallRules: [{2A4599AC-9DEA-44E4-8F87-421CBD3187E2}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{1DD2CA93-EB8E-42DB-9329-D87D154DF2AF}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{5A3B61DB-CFF5-4DED-A980-6869C9F26F92}C:\users\papa\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\papa\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [UDP Query User{3A7F5060-E0D3-441A-9710-D6C211189ECC}C:\users\papa\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\papa\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [{A72EE390-C1FC-4A14-9EAB-23A4A00E7594}] => (Allow) C:\Users\Papa\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{E3E8BDF5-34F1-4693-A247-98E41004F359}] => (Allow) C:\Users\Papa\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [TCP Query User{2826F32C-2020-4759-8E66-B629D7DE577B}C:\program files\mozilla firefox\firefox.exe] => (Block) C:\program files\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{14B2ED73-9D4E-4953-BFC5-D6091E105B5A}C:\program files\mozilla firefox\firefox.exe] => (Block) C:\program files\mozilla firefox\firefox.exe
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (05/13/2015 09:09:24 PM) (Source: MsiInstaller) (EventID: 1024) (User: MARLENE)
Description: Produkt: Adobe Reader XI (11.0.10) - Deutsch - Update "{AC76BA86-7AD7-0000-2550-7A8C40011011}" konnte nicht installiert werden. Fehlercode 1625. Windows Installer kann Protokolle erstellen, um bei der Problembehandlung betreffend der Installation von Softwarepaketen behilflich zu sein. Verwenden Sie folgenden Link, um Anweisungen zur Aktivierung der Protokollierungsunterstützung zu erhalten: hxxp://go.microsoft.com/fwlink/?LinkId=23127
Error: (05/13/2015 08:45:03 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (05/13/2015 08:44:52 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (05/13/2015 08:44:52 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (05/13/2015 08:44:52 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (05/12/2015 08:58:40 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (05/12/2015 08:58:25 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (05/12/2015 08:58:25 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (05/12/2015 08:58:25 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (05/11/2015 10:03:50 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
System errors:
=============
Error: (05/13/2015 08:20:34 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80080005 fehlgeschlagen: Sicherheitsupdate für Windows 7 (KB3046002)
Error: (05/13/2015 08:20:34 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {752073A1-23F2-4396-85F0-8FDB879ED0ED}
Error: (05/10/2015 01:06:42 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {76D0CB12-7604-4048-B83C-1005C7DDC503}
Error: (05/10/2015 00:43:25 PM) (Source: volsnap) (EventID: 29) (User: )
Description: Die Schattenkopien von Volume "C:" wurde während der Ermittlung abgebrochen.
Error: (05/10/2015 00:43:25 PM) (Source: volsnap) (EventID: 6) (User: )
Description: Die Schattenkopie von Volume "C:" konnte kein neues Pageheap erstellen. Dem System steht nicht ausreichend virtueller Speicher zur Verfügung.
Error: (05/05/2015 07:47:37 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst lmhosts erreicht.
Error: (05/01/2015 08:56:53 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}
Error: (04/30/2015 08:47:39 PM) (Source: WMPNetworkSvc) (EventID: 14365) (User: )
Description: 0x80004004-1
Error: (04/29/2015 05:17:05 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst lmhosts erreicht.
Error: (04/29/2015 05:17:05 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}
Microsoft Office Sessions:
=========================
Error: (05/13/2015 09:09:24 PM) (Source: MsiInstaller) (EventID: 1024) (User: MARLENE)
Description: Adobe Reader XI (11.0.10) - Deutsch{AC76BA86-7AD7-0000-2550-7A8C40011011}1625(NULL)(NULL)(NULL)
Error: (05/13/2015 08:45:03 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\ati technologies\ATI.ACE\core-static\SLSTaskbar64.exe
Error: (05/13/2015 08:44:52 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\ati technologies\hydravision\HydraMD64.exe
Error: (05/13/2015 08:44:52 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\ati technologies\hydravision\HydraDM64.exe
Error: (05/13/2015 08:44:52 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\ati technologies\hydravision\Grid64.exe
Error: (05/12/2015 08:58:40 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\ati technologies\ATI.ACE\core-static\SLSTaskbar64.exe
Error: (05/12/2015 08:58:25 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\ati technologies\hydravision\HydraMD64.exe
Error: (05/12/2015 08:58:25 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\ati technologies\hydravision\HydraDM64.exe
Error: (05/12/2015 08:58:25 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\ati technologies\hydravision\Grid64.exe
Error: (05/11/2015 10:03:50 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\ati technologies\ATI.ACE\core-static\SLSTaskbar64.exe
==================== Memory info ===========================
Processor: Intel(R) Core(TM)2 Duo CPU E7300 @ 2.66GHz
Percentage of memory in use: 42%
Total physical RAM: 3583.12 MB
Available physical RAM: 2070.24 MB
Total Pagefile: 7164.55 MB
Available Pagefile: 4979.58 MB
Total Virtual: 2047.88 MB
Available Virtual: 1889.59 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:232.87 GB) (Free:186.74 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive e: (Medium) (Fixed) (Total:74.52 GB) (Free:35.61 GB) NTFS
Drive f: (Software) (Fixed) (Total:158.36 GB) (Free:94.29 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: 1BE02E2A)
Partition 1: (Not Active) - (Size=993 KB) - (Type=42)
Partition 2: (Active) - (Size=232.9 GB) - (Type=42)
Partition 3: (Not Active) - (Size=11 MB) - (Type=42)
========================================================
Disk: 1 (Size: 232.9 GB) (Disk ID: 7AFDC950)
Partition 1: (Not Active) - (Size=74.5 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=158.4 GB) - (Type=07 NTFS)
========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: C857D49A)
Partition 1: (Not Active) - (Size=1008 KB) - (Type=42)
Partition 2: (Active) - (Size=232.9 GB) - (Type=42)
Partition 3: (Not Active) - (Size=11 MB) - (Type=42)
==================== End Of Log ============================
GMER: Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-05-13 21:54:25
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-1 WDC_WD2500AAJS-62B4A0 rev.01.03A01 232,89GB
Running: Gmer-19357.exe; Driver: C:\Users\Boss\AppData\Local\Temp\uxddypod.sys
---- System - GMER 2.1 ----
SSDT 99853D1E ZwCreateSection
SSDT 99853CF6 ZwCreateSymbolicLinkObject
SSDT 99853CFB ZwLoadDriver
SSDT 99853CF1 ZwOpenSection
SSDT 99853D28 ZwRequestWaitReplyPort
SSDT 99853D23 ZwSetContextThread
SSDT 99853D2D ZwSetSecurityObject
SSDT 99853D00 ZwSetSystemInformation
SSDT 99853D32 ZwSystemDebugControl
SSDT 99853CBF ZwTerminateProcess
SSDT 99853CBA ZwWriteVirtualMemory
---- Kernel code sections - GMER 2.1 ----
.text ntkrnlpa.exe!ZwRequestPort + 14AD 82E49BB5 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 82E83B92 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text ntkrnlpa.exe!KeRemoveQueueEx + 11F7 82E8B0BC 4 Bytes [1E, 3D, 85, 99]
.text ntkrnlpa.exe!KeRemoveQueueEx + 11FF 82E8B0C4 4 Bytes [F6, 3C, 85, 99]
.text ntkrnlpa.exe!KeRemoveQueueEx + 1313 82E8B1D8 4 Bytes [FB, 3C, 85, 99] {STI ; CMP AL, 0x85; CDQ }
.text ntkrnlpa.exe!KeRemoveQueueEx + 13AF 82E8B274 4 Bytes [F1, 3C, 85, 99] {INT1 ; CMP AL, 0x85; CDQ }
.text ntkrnlpa.exe!KeRemoveQueueEx + 1553 82E8B418 4 Bytes [28, 3D, 85, 99]
.text ...
.text C:\Windows\system32\DRIVERS\atikmdag.sys section is writeable [0x9A810000, 0x174C8A, 0xE8000020]
---- Registry - GMER 2.1 ----
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\Module\Microsoft.NET/Framework/v2.0.50727/mscorwks.dll
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\Module\Microsoft.NET/Framework/v2.0.50727/mscorwks.dll@\Device\HarddiskVolume3\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 0xB3 0x29 0x4F 0xC1 ...
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\Module\Microsoft.NET/Framework/v2.0.50727/mscorwks.dll@\Device\HarddiskVolume3\Windows\System32\GfxUI.exe 0x9D 0x30 0x2C 0xEC ...
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\Module\Microsoft.NET/Framework/v2.0.50727/mscorwks.dll@\Device\HarddiskVolume3\Program Files\Windows Live\Mail\wlmail.exe 0x89 0x62 0x90 0xD1 ...
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\Module\Microsoft.NET/Framework/v2.0.50727/mscorwks.dll@\Device\HarddiskVolume3\Windows\System32\sdiagnhost.exe 0x25 0x7D 0xAC 0x20 ...
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\Module\Microsoft.NET/Framework/v2.0.50727/mscorwks.dll@\Device\HarddiskVolume3\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe 0x04 0x52 0x57 0x25 ...
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\Module\Microsoft.NET/Framework/v2.0.50727/mscorwks.dll@\Device\HarddiskVolume3\Windows\Microsoft.NET\Framework\v3.5\AddInUtil.exe 0x8A 0xC9 0xE5 0xDB ...
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\Module\Microsoft.NET/Framework/v2.0.50727/mscorwks.dll@\Device\HarddiskVolume3\Users\Papa\Desktop\TrojanerBoard\FRST(1).exe 0xC8 0x72 0xF6 0xEC ...
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\Module\Microsoft.NET/Framework/v4.0.30319/clr.dll
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\Module\Microsoft.NET/Framework/v4.0.30319/clr.dll@\Device\HarddiskVolume3\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe 0x14 0xB8 0x4D 0x5F ...
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\Module\Microsoft.NET/Framework/v4.0.30319/clr.dll@\Device\HarddiskVolume3\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 0x44 0xBD 0x80 0x81 ...
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\Module\Microsoft.NET/Framework/v4.0.30319/clr.dll@\Device\HarddiskVolume3\Program Files\Avira\My Avira\Avira.OE.Systray.exe 0xC1 0x53 0xA6 0x96 ...
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\Module\Microsoft.NET/Framework/v4.0.30319/clr.dll@\Device\HarddiskVolume3\Windows\System32\CompatTel\wicainventory.exe 0x5F 0x0E 0xFF 0x12 ...
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\Module\Microsoft.NET/Framework/v4.0.30319/clr.dll@\Device\HarddiskVolume3\Windows\System32\rundll32.exe 0x9A 0x24 0xF3 0x88 ...
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\Module\Microsoft.NET/Framework/v4.0.30319/clr.dll@\Device\HarddiskVolume3\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCCInstall.exe 0xA3 0x56 0x20 0x81 ...
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\Module\Microsoft.NET/Framework/v4.0.30319/clr.dll@\Device\HarddiskVolume3\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe 0x16 0x5C 0xD2 0x91 ...
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\Module\Microsoft.NET/Framework/v4.0.30319/clr.dll@\Device\HarddiskVolume3\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe 0xBB 0xC1 0xBE 0xA6 ...
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\Module\Microsoft.NET/Framework/v4.0.30319/clr.dll@\Device\HarddiskVolume3\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLI.exe 0x75 0x8E 0xE2 0xA7 ...
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\Module\Microsoft.NET/Framework/v4.0.30319/clr.dll@\Device\HarddiskVolume3\Windows\System32\msiexec.exe 0x50 0x61 0xF5 0xAA ...
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\Module\Microsoft.NET/Framework/v4.0.30319/clr.dll@\Device\HarddiskVolume3\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe 0xAA 0x0D 0x18 0x89 ...
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\Module\Microsoft.NET/Framework/v4.0.30319/clr.dll@\Device\HarddiskVolume3\Users\Papa\Desktop\TrojanerBoard\FRST(1).exe 0xDE 0x6E 0x20 0xEA ...
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\System\Active
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\System\Active@F8EC7704 259
---- EOF - GMER 2.1 ----
|
|
14.05.2015, 06:39
| #2 |
| /// the machine /// TB-Ausbilder    | PDF mit Trojaner geöffnet, Windows 7 hi,
__________________Downloade dir bitte  Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers Downloade dir bitte  TDSSKiller.exe und speichere diese Datei auf dem Desktop
__________________ |
|
14.05.2015, 07:25
| #3 |
| | PDF mit Trojaner geöffnet, Windows 7 MBAR:
__________________Code:
ATTFilter Malwarebytes Anti-Rootkit BETA 1.09.1.1004
www.malwarebytes.org
Database version:
main: v2015.05.14.01
rootkit: v2015.04.21.01
Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 11.0.9600.17801
Boss :: MARLENE [administrator]
14.05.2015 07:51:56
mbar-log-2015-05-14 (07-51-56).txt
Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 407343
Time elapsed: 15 minute(s), 19 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
Physical Sectors Detected: 0
(No malicious items detected)
(end)
Code:
ATTFilter 08:20:16.0963 0x1638 TDSS rootkit removing tool 3.0.0.44 Jan 22 2015 08:27:04
08:20:21.0423 0x1638 ============================================================
08:20:21.0423 0x1638 Current date / time: 2015/05/14 08:20:21.0423
08:20:21.0423 0x1638 SystemInfo:
08:20:21.0423 0x1638
08:20:21.0423 0x1638 OS Version: 6.1.7601 ServicePack: 1.0
08:20:21.0423 0x1638 Product type: Workstation
08:20:21.0424 0x1638 ComputerName: MARLENE
08:20:21.0424 0x1638 UserName: Boss
08:20:21.0424 0x1638 Windows directory: C:\Windows
08:20:21.0424 0x1638 System windows directory: C:\Windows
08:20:21.0424 0x1638 Processor architecture: Intel x86
08:20:21.0424 0x1638 Number of processors: 2
08:20:21.0424 0x1638 Page size: 0x1000
08:20:21.0424 0x1638 Boot type: Normal boot
08:20:21.0424 0x1638 ============================================================
08:20:23.0064 0x1638 KLMD registered as C:\Windows\system32\drivers\35045664.sys
08:20:23.0371 0x1638 System UUID: {9D2F823F-6456-2F18-7AB6-E8AC8259EEE3}
08:20:24.0009 0x1638 Drive \Device\Harddisk0\DR0 - Size: 0x3A38B2E000 ( 232.89 Gb ), SectorSize: 0x200, Cylinders: 0x70EA1, SectorsPerTrack: 0x20, TracksPerCylinder: 0x21, Type 'K0', Flags 0x00000050
08:20:24.0024 0x1638 Drive \Device\Harddisk1\DR1 - Size: 0x3A38B2E000 ( 232.89 Gb ), SectorSize: 0x200, Cylinders: 0x76C1, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
08:20:29.0682 0x1638 Drive \Device\Harddisk2\DR2 - Size: 0x3A38B2E000 ( 232.89 Gb ), SectorSize: 0x200, Cylinders: 0x7832F, SectorsPerTrack: 0x20, TracksPerCylinder: 0x1F, Type 'K0', Flags 0x00000050
08:20:29.0683 0x1638 ============================================================
08:20:29.0683 0x1638 \Device\Harddisk0\DR0:
08:20:29.0683 0x1638 MBR partitions:
08:20:29.0683 0x1638 \Device\Harddisk1\DR1:
08:20:29.0699 0x1638 MBR partitions:
08:20:29.0699 0x1638 \Device\Harddisk1\DR1\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x9509800
08:20:29.0699 0x1638 \Device\Harddisk1\DR1\Partition2: MBR, Type 0x7, StartLBA 0x950A000, BlocksNum 0x13CBA800
08:20:29.0699 0x1638 \Device\Harddisk2\DR2:
08:20:29.0699 0x1638 MBR partitions:
08:20:29.0699 0x1638 ============================================================
08:20:29.0719 0x1638 E: <-> \Device\Harddisk1\DR1\Partition1
08:20:29.0755 0x1638 F: <-> \Device\Harddisk1\DR1\Partition2
08:20:29.0755 0x1638 ============================================================
08:20:29.0755 0x1638 Initialize success
08:20:29.0755 0x1638 ============================================================
08:21:14.0040 0x09a8 ============================================================
08:21:14.0040 0x09a8 Scan started
08:21:14.0040 0x09a8 Mode: Manual; SigCheck; TDLFS;
08:21:14.0040 0x09a8 ============================================================
08:21:14.0040 0x09a8 KSN ping started
08:21:27.0565 0x09a8 KSN ping finished: true
08:21:27.0908 0x09a8 ================ Scan system memory ========================
08:21:27.0908 0x09a8 System memory - ok
08:21:27.0924 0x09a8 ================ Scan services =============================
08:21:27.0955 0x09a8 1394ohci - ok
08:21:27.0955 0x09a8 ACPI - ok
08:21:27.0970 0x09a8 AcpiPmi - ok
08:21:27.0986 0x09a8 AdobeARMservice - ok
08:21:28.0002 0x09a8 AdobeFlashPlayerUpdateSvc - ok
08:21:28.0017 0x09a8 adp94xx - ok
08:21:28.0017 0x09a8 adpahci - ok
08:21:28.0017 0x09a8 adpu320 - ok
08:21:28.0033 0x09a8 AeLookupSvc - ok
08:21:28.0033 0x09a8 AFD - ok
08:21:28.0033 0x09a8 agp440 - ok
08:21:28.0048 0x09a8 aic78xx - ok
08:21:28.0064 0x09a8 ALG - ok
08:21:28.0064 0x09a8 aliide - ok
08:21:28.0080 0x09a8 AMD External Events Utility - ok
08:21:28.0080 0x09a8 amdagp - ok
08:21:28.0080 0x09a8 amdide - ok
08:21:28.0095 0x09a8 AmdK8 - ok
08:21:28.0095 0x09a8 amdkmdag - ok
08:21:28.0095 0x09a8 amdkmdap - ok
08:21:28.0095 0x09a8 AmdPPM - ok
08:21:28.0111 0x09a8 amdsata - ok
08:21:28.0126 0x09a8 amdsbs - ok
08:21:28.0126 0x09a8 amdxata - ok
08:21:28.0142 0x09a8 AntiVirMailService - ok
08:21:28.0142 0x09a8 AntiVirSchedulerService - ok
08:21:28.0158 0x09a8 AntiVirService - ok
08:21:28.0173 0x09a8 AntiVirWebService - ok
08:21:28.0173 0x09a8 AppID - ok
08:21:28.0173 0x09a8 AppIDSvc - ok
08:21:28.0189 0x09a8 Appinfo - ok
08:21:28.0189 0x09a8 AppMgmt - ok
08:21:28.0189 0x09a8 arc - ok
08:21:28.0204 0x09a8 arcsas - ok
08:21:28.0220 0x09a8 AsIO - ok
08:21:28.0220 0x09a8 aspnet_state - ok
08:21:28.0236 0x09a8 AsUpIO - ok
08:21:28.0251 0x09a8 AsyncMac - ok
08:21:28.0251 0x09a8 atapi - ok
08:21:28.0267 0x09a8 AtiHDAudioService - ok
08:21:28.0267 0x09a8 AudioEndpointBuilder - ok
08:21:28.0282 0x09a8 Audiosrv - ok
08:21:28.0282 0x09a8 avgntflt - ok
08:21:28.0298 0x09a8 avipbb - ok
08:21:28.0314 0x09a8 Avira.OE.ServiceHost - ok
08:21:28.0314 0x09a8 avkmgr - ok
08:21:28.0329 0x09a8 avnetflt - ok
08:21:28.0345 0x09a8 AxInstSV - ok
08:21:28.0345 0x09a8 b06bdrv - ok
08:21:28.0360 0x09a8 b57nd60x - ok
08:21:28.0360 0x09a8 BDESVC - ok
08:21:28.0360 0x09a8 Beep - ok
08:21:28.0376 0x09a8 BFE - ok
08:21:28.0376 0x09a8 BITS - ok
08:21:28.0376 0x09a8 blbdrive - ok
08:21:28.0392 0x09a8 bowser - ok
08:21:28.0392 0x09a8 BrFiltLo - ok
08:21:28.0392 0x09a8 BrFiltUp - ok
08:21:28.0407 0x09a8 Browser - ok
08:21:28.0407 0x09a8 Brserid - ok
08:21:28.0407 0x09a8 BrSerWdm - ok
08:21:28.0407 0x09a8 BrUsbMdm - ok
08:21:28.0423 0x09a8 BrUsbSer - ok
08:21:28.0423 0x09a8 BTHMODEM - ok
08:21:28.0438 0x09a8 bthserv - ok
08:21:28.0438 0x09a8 cdfs - ok
08:21:28.0454 0x09a8 cdrom - ok
08:21:28.0470 0x09a8 CertPropSvc - ok
08:21:28.0470 0x09a8 circlass - ok
08:21:28.0470 0x09a8 CLFS - ok
08:21:28.0485 0x09a8 clr_optimization_v2.0.50727_32 - ok
08:21:28.0485 0x09a8 clr_optimization_v4.0.30319_32 - ok
08:21:28.0485 0x09a8 CmBatt - ok
08:21:28.0501 0x09a8 cmdide - ok
08:21:28.0501 0x09a8 CNG - ok
08:21:28.0501 0x09a8 Compbatt - ok
08:21:28.0501 0x09a8 CompositeBus - ok
08:21:28.0516 0x09a8 COMSysApp - ok
08:21:28.0516 0x09a8 crcdisk - ok
08:21:28.0532 0x09a8 CryptSvc - ok
08:21:28.0532 0x09a8 CSC - ok
08:21:28.0532 0x09a8 CscService - ok
08:21:28.0548 0x09a8 DcomLaunch - ok
08:21:28.0548 0x09a8 defragsvc - ok
08:21:28.0548 0x09a8 DfsC - ok
08:21:28.0563 0x09a8 Dhcp - ok
08:21:28.0579 0x09a8 DiagTrack - ok
08:21:28.0579 0x09a8 discache - ok
08:21:28.0594 0x09a8 Disk - ok
08:21:28.0594 0x09a8 Dnscache - ok
08:21:28.0594 0x09a8 dot3svc - ok
08:21:28.0610 0x09a8 DPS - ok
08:21:28.0610 0x09a8 drmkaud - ok
08:21:28.0610 0x09a8 DXGKrnl - ok
08:21:28.0626 0x09a8 EapHost - ok
08:21:28.0626 0x09a8 ebdrv - ok
08:21:28.0626 0x09a8 EFS - ok
08:21:28.0641 0x09a8 ehRecvr - ok
08:21:28.0641 0x09a8 ehSched - ok
08:21:28.0641 0x09a8 elxstor - ok
08:21:28.0641 0x09a8 ErrDev - ok
08:21:28.0657 0x09a8 EventSystem - ok
08:21:28.0657 0x09a8 exfat - ok
08:21:28.0657 0x09a8 fastfat - ok
08:21:28.0672 0x09a8 Fax - ok
08:21:28.0672 0x09a8 fdc - ok
08:21:28.0672 0x09a8 fdPHost - ok
08:21:28.0688 0x09a8 FDResPub - ok
08:21:28.0688 0x09a8 FileInfo - ok
08:21:28.0688 0x09a8 Filetrace - ok
08:21:28.0688 0x09a8 flpydisk - ok
08:21:28.0704 0x09a8 FltMgr - ok
08:21:28.0704 0x09a8 FontCache - ok
08:21:28.0704 0x09a8 FontCache3.0.0.0 - ok
08:21:28.0704 0x09a8 FsDepends - ok
08:21:28.0719 0x09a8 Fs_Rec - ok
08:21:28.0719 0x09a8 fvevol - ok
08:21:28.0719 0x09a8 gagp30kx - ok
08:21:28.0719 0x09a8 gpsvc - ok
08:21:28.0735 0x09a8 hcw85cir - ok
08:21:28.0750 0x09a8 HdAudAddService - ok
08:21:28.0750 0x09a8 HDAudBus - ok
08:21:28.0766 0x09a8 HidBatt - ok
08:21:28.0766 0x09a8 HidBth - ok
08:21:28.0782 0x09a8 HidIr - ok
08:21:28.0782 0x09a8 hidserv - ok
08:21:28.0782 0x09a8 HidUsb - ok
08:21:28.0782 0x09a8 hkmsvc - ok
08:21:28.0797 0x09a8 HomeGroupListener - ok
08:21:28.0797 0x09a8 HomeGroupProvider - ok
08:21:28.0797 0x09a8 HpSAMD - ok
08:21:28.0813 0x09a8 HTTP - ok
08:21:28.0813 0x09a8 hwpolicy - ok
08:21:28.0813 0x09a8 i8042prt - ok
08:21:28.0828 0x09a8 iaStorV - ok
08:21:28.0828 0x09a8 idsvc - ok
08:21:28.0844 0x09a8 IEEtwCollectorService - ok
08:21:28.0844 0x09a8 igfx - ok
08:21:28.0860 0x09a8 iirsp - ok
08:21:28.0860 0x09a8 IKEEXT - ok
08:21:28.0875 0x09a8 IntcAzAudAddService - ok
08:21:28.0891 0x09a8 intelide - ok
08:21:28.0891 0x09a8 intelppm - ok
08:21:28.0906 0x09a8 IPBusEnum - ok
08:21:28.0906 0x09a8 IpFilterDriver - ok
08:21:28.0906 0x09a8 iphlpsvc - ok
08:21:28.0906 0x09a8 IPMIDRV - ok
08:21:28.0922 0x09a8 IPNAT - ok
08:21:28.0922 0x09a8 IRENUM - ok
08:21:28.0922 0x09a8 isapnp - ok
08:21:28.0938 0x09a8 iScsiPrt - ok
08:21:28.0938 0x09a8 kbdclass - ok
08:21:28.0953 0x09a8 kbdhid - ok
08:21:28.0953 0x09a8 KeyIso - ok
08:21:28.0953 0x09a8 KSecDD - ok
08:21:28.0969 0x09a8 KSecPkg - ok
08:21:28.0969 0x09a8 KtmRm - ok
08:21:28.0969 0x09a8 L1C - ok
08:21:28.0969 0x09a8 LanmanServer - ok
08:21:28.0984 0x09a8 LanmanWorkstation - ok
08:21:28.0984 0x09a8 lltdio - ok
08:21:28.0984 0x09a8 lltdsvc - ok
08:21:29.0000 0x09a8 lmhosts - ok
08:21:29.0016 0x09a8 LSI_FC - ok
08:21:29.0016 0x09a8 LSI_SAS - ok
08:21:29.0016 0x09a8 LSI_SAS2 - ok
08:21:29.0016 0x09a8 LSI_SCSI - ok
08:21:29.0031 0x09a8 luafv - ok
08:21:29.0031 0x09a8 Mcx2Svc - ok
08:21:29.0031 0x09a8 megasas - ok
08:21:29.0031 0x09a8 MegaSR - ok
08:21:29.0047 0x09a8 MMCSS - ok
08:21:29.0047 0x09a8 Modem - ok
08:21:29.0047 0x09a8 monitor - ok
08:21:29.0047 0x09a8 mouclass - ok
08:21:29.0062 0x09a8 mouhid - ok
08:21:29.0062 0x09a8 mountmgr - ok
08:21:29.0078 0x09a8 MozillaMaintenance - ok
08:21:29.0078 0x09a8 mpio - ok
08:21:29.0094 0x09a8 mpsdrv - ok
08:21:29.0094 0x09a8 MpsSvc - ok
08:21:29.0094 0x09a8 MRxDAV - ok
08:21:29.0109 0x09a8 mrxsmb - ok
08:21:29.0109 0x09a8 mrxsmb10 - ok
08:21:29.0109 0x09a8 mrxsmb20 - ok
08:21:29.0140 0x09a8 msahci - ok
08:21:29.0156 0x09a8 MSCamSvc - ok
08:21:29.0156 0x09a8 msdsm - ok
08:21:29.0172 0x09a8 MSDTC - ok
08:21:29.0172 0x09a8 Msfs - ok
08:21:29.0187 0x09a8 mshidkmdf - ok
08:21:29.0187 0x09a8 msisadrv - ok
08:21:29.0187 0x09a8 MSiSCSI - ok
08:21:29.0187 0x09a8 msiserver - ok
08:21:29.0203 0x09a8 MSKSSRV - ok
08:21:29.0203 0x09a8 MSPCLOCK - ok
08:21:29.0203 0x09a8 MSPQM - ok
08:21:29.0218 0x09a8 MsRPC - ok
08:21:29.0218 0x09a8 mssmbios - ok
08:21:29.0218 0x09a8 MSTEE - ok
08:21:29.0234 0x09a8 MTConfig - ok
08:21:29.0234 0x09a8 MTsensor - ok
08:21:29.0234 0x09a8 Mup - ok
08:21:29.0250 0x09a8 napagent - ok
08:21:29.0250 0x09a8 NativeWifiP - ok
08:21:29.0250 0x09a8 NDIS - ok
08:21:29.0265 0x09a8 NdisCap - ok
08:21:29.0265 0x09a8 NdisTapi - ok
08:21:29.0281 0x09a8 Ndisuio - ok
08:21:29.0281 0x09a8 NdisWan - ok
08:21:29.0281 0x09a8 NDProxy - ok
08:21:29.0296 0x09a8 NetBIOS - ok
08:21:29.0296 0x09a8 NetBT - ok
08:21:29.0296 0x09a8 Netlogon - ok
08:21:29.0296 0x09a8 Netman - ok
08:21:29.0312 0x09a8 NetMsmqActivator - ok
08:21:29.0312 0x09a8 NetPipeActivator - ok
08:21:29.0312 0x09a8 netprofm - ok
08:21:29.0328 0x09a8 NetTcpActivator - ok
08:21:29.0328 0x09a8 NetTcpPortSharing - ok
08:21:29.0343 0x09a8 nfrd960 - ok
08:21:29.0343 0x09a8 NlaSvc - ok
08:21:29.0343 0x09a8 Npfs - ok
08:21:29.0343 0x09a8 nsi - ok
08:21:29.0359 0x09a8 nsiproxy - ok
08:21:29.0359 0x09a8 Ntfs - ok
08:21:29.0359 0x09a8 Null - ok
08:21:29.0374 0x09a8 nvraid - ok
08:21:29.0374 0x09a8 nvstor - ok
08:21:29.0390 0x09a8 nv_agp - ok
08:21:29.0390 0x09a8 ohci1394 - ok
08:21:29.0390 0x09a8 ose - ok
08:21:29.0406 0x09a8 osppsvc - ok
08:21:29.0421 0x09a8 p2pimsvc - ok
08:21:29.0421 0x09a8 p2psvc - ok
08:21:29.0437 0x09a8 Parport - ok
08:21:29.0437 0x09a8 partmgr - ok
08:21:29.0437 0x09a8 Parvdm - ok
08:21:29.0437 0x09a8 PcaSvc - ok
08:21:29.0452 0x09a8 pci - ok
08:21:29.0452 0x09a8 pciide - ok
08:21:29.0452 0x09a8 pcmcia - ok
08:21:29.0452 0x09a8 pcw - ok
08:21:29.0468 0x09a8 PEAUTH - ok
08:21:29.0468 0x09a8 PeerDistSvc - ok
08:21:29.0484 0x09a8 pla - ok
08:21:29.0484 0x09a8 PlugPlay - ok
08:21:29.0499 0x09a8 PNRPAutoReg - ok
08:21:29.0499 0x09a8 PNRPsvc - ok
08:21:29.0515 0x09a8 PolicyAgent - ok
08:21:29.0515 0x09a8 Power - ok
08:21:29.0515 0x09a8 PptpMiniport - ok
08:21:29.0530 0x09a8 Processor - ok
08:21:29.0530 0x09a8 ProfSvc - ok
08:21:29.0530 0x09a8 ProtectedStorage - ok
08:21:29.0530 0x09a8 Psched - ok
08:21:29.0546 0x09a8 ql2300 - ok
08:21:29.0546 0x09a8 ql40xx - ok
08:21:29.0546 0x09a8 QWAVE - ok
08:21:29.0546 0x09a8 QWAVEdrv - ok
08:21:29.0562 0x09a8 RasAcd - ok
08:21:29.0562 0x09a8 RasAgileVpn - ok
08:21:29.0562 0x09a8 RasAuto - ok
08:21:29.0577 0x09a8 Rasl2tp - ok
08:21:29.0577 0x09a8 RasMan - ok
08:21:29.0577 0x09a8 RasPppoe - ok
08:21:29.0577 0x09a8 RasSstp - ok
08:21:29.0593 0x09a8 rdbss - ok
08:21:29.0593 0x09a8 rdpbus - ok
08:21:29.0593 0x09a8 RDPCDD - ok
08:21:29.0593 0x09a8 RDPDR - ok
08:21:29.0608 0x09a8 RDPENCDD - ok
08:21:29.0608 0x09a8 RDPREFMP - ok
08:21:29.0608 0x09a8 RDPWD - ok
08:21:29.0624 0x09a8 rdyboost - ok
08:21:29.0624 0x09a8 RemoteAccess - ok
08:21:29.0624 0x09a8 RemoteRegistry - ok
08:21:29.0624 0x09a8 RpcEptMapper - ok
08:21:29.0640 0x09a8 RpcLocator - ok
08:21:29.0640 0x09a8 RpcSs - ok
08:21:29.0640 0x09a8 rspndr - ok
08:21:29.0640 0x09a8 s3cap - ok
08:21:29.0655 0x09a8 SamSs - ok
08:21:29.0655 0x09a8 sbp2port - ok
08:21:29.0655 0x09a8 SCardSvr - ok
08:21:29.0671 0x09a8 scfilter - ok
08:21:29.0671 0x09a8 Schedule - ok
08:21:29.0671 0x09a8 SCPolicySvc - ok
08:21:29.0671 0x09a8 SDRSVC - ok
08:21:29.0671 0x09a8 secdrv - ok
08:21:29.0686 0x09a8 seclogon - ok
08:21:29.0686 0x09a8 SENS - ok
08:21:29.0686 0x09a8 SensrSvc - ok
08:21:29.0702 0x09a8 Serenum - ok
08:21:29.0702 0x09a8 Serial - ok
08:21:29.0702 0x09a8 sermouse - ok
08:21:29.0718 0x09a8 SessionEnv - ok
08:21:29.0718 0x09a8 sffdisk - ok
08:21:29.0718 0x09a8 sffp_mmc - ok
08:21:29.0733 0x09a8 sffp_sd - ok
08:21:29.0733 0x09a8 sfloppy - ok
08:21:29.0733 0x09a8 SharedAccess - ok
08:21:29.0733 0x09a8 ShellHWDetection - ok
08:21:29.0749 0x09a8 sisagp - ok
08:21:29.0749 0x09a8 SiSRaid2 - ok
08:21:29.0749 0x09a8 SiSRaid4 - ok
08:21:29.0749 0x09a8 SkypeUpdate - ok
08:21:29.0764 0x09a8 Smb - ok
08:21:29.0764 0x09a8 SNMPTRAP - ok
08:21:29.0780 0x09a8 spldr - ok
08:21:29.0780 0x09a8 Spooler - ok
08:21:29.0780 0x09a8 sppsvc - ok
08:21:29.0780 0x09a8 sppuinotify - ok
08:21:29.0796 0x09a8 srv - ok
08:21:29.0796 0x09a8 srv2 - ok
08:21:29.0796 0x09a8 srvnet - ok
08:21:29.0796 0x09a8 SSDPSRV - ok
08:21:29.0811 0x09a8 ssmdrv - ok
08:21:29.0811 0x09a8 SstpSvc - ok
08:21:29.0811 0x09a8 stexstor - ok
08:21:29.0811 0x09a8 StiSvc - ok
08:21:29.0827 0x09a8 storflt - ok
08:21:29.0827 0x09a8 StorSvc - ok
08:21:29.0827 0x09a8 storvsc - ok
08:21:29.0827 0x09a8 swenum - ok
08:21:29.0842 0x09a8 swprv - ok
08:21:29.0842 0x09a8 SysMain - ok
08:21:29.0842 0x09a8 TabletInputService - ok
08:21:29.0842 0x09a8 TapiSrv - ok
08:21:29.0858 0x09a8 TBS - ok
08:21:29.0858 0x09a8 Tcpip - ok
08:21:29.0858 0x09a8 TCPIP6 - ok
08:21:29.0874 0x09a8 tcpipreg - ok
08:21:29.0874 0x09a8 TDPIPE - ok
08:21:29.0874 0x09a8 TDTCP - ok
08:21:29.0889 0x09a8 tdx - ok
08:21:29.0889 0x09a8 TermDD - ok
08:21:29.0889 0x09a8 TermService - ok
08:21:29.0889 0x09a8 Themes - ok
08:21:29.0905 0x09a8 THREADORDER - ok
08:21:29.0905 0x09a8 TrkWks - ok
08:21:29.0905 0x09a8 TrustedInstaller - ok
08:21:29.0920 0x09a8 tssecsrv - ok
08:21:29.0920 0x09a8 TsUsbFlt - ok
08:21:29.0936 0x09a8 tunnel - ok
08:21:29.0936 0x09a8 uagp35 - ok
08:21:29.0936 0x09a8 udfs - ok
08:21:29.0952 0x09a8 UI0Detect - ok
08:21:29.0952 0x09a8 uliagpkx - ok
08:21:29.0952 0x09a8 umbus - ok
08:21:29.0952 0x09a8 UmPass - ok
08:21:29.0967 0x09a8 UmRdpService - ok
08:21:29.0967 0x09a8 upnphost - ok
08:21:29.0983 0x09a8 usbaudio - ok
08:21:29.0983 0x09a8 usbccgp - ok
08:21:29.0983 0x09a8 usbcir - ok
08:21:29.0983 0x09a8 usbehci - ok
08:21:29.0998 0x09a8 usbhub - ok
08:21:29.0998 0x09a8 usbohci - ok
08:21:29.0998 0x09a8 usbprint - ok
08:21:30.0014 0x09a8 usbscan - ok
08:21:30.0014 0x09a8 USBSTOR - ok
08:21:30.0014 0x09a8 usbuhci - ok
08:21:30.0030 0x09a8 UxSms - ok
08:21:30.0030 0x09a8 VaultSvc - ok
08:21:30.0030 0x09a8 vdrvroot - ok
08:21:30.0045 0x09a8 vds - ok
08:21:30.0045 0x09a8 vga - ok
08:21:30.0045 0x09a8 VgaSave - ok
08:21:30.0045 0x09a8 vhdmp - ok
08:21:30.0061 0x09a8 viaagp - ok
08:21:30.0061 0x09a8 ViaC7 - ok
08:21:30.0076 0x09a8 viaide - ok
08:21:30.0076 0x09a8 vmbus - ok
08:21:30.0076 0x09a8 VMBusHID - ok
08:21:30.0076 0x09a8 volmgr - ok
08:21:30.0092 0x09a8 volmgrx - ok
08:21:30.0092 0x09a8 volsnap - ok
08:21:30.0092 0x09a8 vsmraid - ok
08:21:30.0108 0x09a8 VSS - ok
08:21:30.0108 0x09a8 vwifibus - ok
08:21:30.0108 0x09a8 VX1000 - ok
08:21:30.0108 0x09a8 W32Time - ok
08:21:30.0123 0x09a8 WacomPen - ok
08:21:30.0123 0x09a8 WANARP - ok
08:21:30.0123 0x09a8 Wanarpv6 - ok
08:21:30.0139 0x09a8 wbengine - ok
08:21:30.0139 0x09a8 WbioSrvc - ok
08:21:30.0139 0x09a8 wcncsvc - ok
08:21:30.0139 0x09a8 WcsPlugInService - ok
08:21:30.0154 0x09a8 Wd - ok
08:21:30.0154 0x09a8 Wdf01000 - ok
08:21:30.0154 0x09a8 WdiServiceHost - ok
08:21:30.0154 0x09a8 WdiSystemHost - ok
08:21:30.0170 0x09a8 WebClient - ok
08:21:30.0170 0x09a8 Wecsvc - ok
08:21:30.0170 0x09a8 wercplsupport - ok
08:21:30.0170 0x09a8 WerSvc - ok
08:21:30.0186 0x09a8 WfpLwf - ok
08:21:30.0186 0x09a8 WIMMount - ok
08:21:30.0186 0x09a8 WinDefend - ok
08:21:30.0201 0x09a8 WinHttpAutoProxySvc - ok
08:21:30.0201 0x09a8 Winmgmt - ok
08:21:30.0201 0x09a8 WinRM - ok
08:21:30.0217 0x09a8 WinUsb - ok
08:21:30.0232 0x09a8 Wlansvc - ok
08:21:30.0232 0x09a8 wlidsvc - ok
08:21:30.0232 0x09a8 WmiAcpi - ok
08:21:30.0248 0x09a8 wmiApSrv - ok
08:21:30.0248 0x09a8 WMPNetworkSvc - ok
08:21:30.0248 0x09a8 WPCSvc - ok
08:21:30.0248 0x09a8 WPDBusEnum - ok
08:21:30.0264 0x09a8 ws2ifsl - ok
08:21:30.0264 0x09a8 wscsvc - ok
08:21:30.0264 0x09a8 WSearch - ok
08:21:30.0264 0x09a8 wuauserv - ok
08:21:30.0279 0x09a8 WudfPf - ok
08:21:30.0279 0x09a8 WUDFRd - ok
08:21:30.0279 0x09a8 wudfsvc - ok
08:21:30.0295 0x09a8 WwanSvc - ok
08:21:30.0310 0x09a8 ================ Scan global ===============================
08:21:30.0310 0x09a8 [ Global ] - ok
08:21:30.0310 0x09a8 ================ Scan MBR ==================================
08:21:30.0326 0x09a8 [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
08:21:30.0669 0x09a8 \Device\Harddisk0\DR0 - ok
08:21:30.0685 0x09a8 [ 72B8CE41AF0DE751C946802B3ED844B4 ] \Device\Harddisk1\DR1
08:21:30.0747 0x09a8 \Device\Harddisk1\DR1 - ok
08:21:30.0763 0x09a8 [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk2\DR2
08:21:30.0950 0x09a8 \Device\Harddisk2\DR2 - ok
08:21:30.0950 0x09a8 ================ Scan VBR ==================================
08:21:30.0950 0x09a8 [ 6934363B3FEC16BE724C64F6A2E6B630 ] \Device\Harddisk1\DR1\Partition1
08:21:30.0966 0x09a8 \Device\Harddisk1\DR1\Partition1 - ok
08:21:30.0966 0x09a8 [ 84B15D91B563810A9E10E82F01139B4C ] \Device\Harddisk1\DR1\Partition2
08:21:30.0966 0x09a8 \Device\Harddisk1\DR1\Partition2 - ok
08:21:30.0966 0x09a8 ================ Scan generic autorun ======================
08:21:30.0966 0x09a8 RTHDVCPL - ok
08:21:30.0966 0x09a8 IgfxTray - ok
08:21:30.0966 0x09a8 HotKeysCmds - ok
08:21:30.0966 0x09a8 Persistence - ok
08:21:30.0966 0x09a8 avgnt - ok
08:21:30.0966 0x09a8 VX1000 - ok
08:21:30.0966 0x09a8 LifeCam - ok
08:21:30.0981 0x09a8 iSCSIAgent - ok
08:21:30.0981 0x09a8 Avira Systray - ok
08:21:30.0981 0x09a8 StartCCC - ok
08:21:30.0981 0x09a8 Sidebar - ok
08:21:30.0981 0x09a8 mctadmin - ok
08:21:30.0981 0x09a8 Sidebar - ok
08:21:30.0981 0x09a8 mctadmin - ok
08:21:30.0981 0x09a8 HydraVisionDesktopManager - ok
08:21:30.0981 0x09a8 HydraVisionDesktopManager - ok
08:21:31.0106 0x09a8 AV detected via SS2: Avira Antivirus, C:\Program Files\Avira\AntiVir Desktop\wsctool.exe ( 15.0.10.414 ), 0x41000 ( enabled : updated )
08:21:31.0137 0x09a8 Win FW state via NFP2: enabled
08:21:33.0555 0x09a8 ============================================================
08:21:33.0555 0x09a8 Scan finished
08:21:33.0555 0x09a8 ============================================================
08:21:33.0555 0x1510 Detected object count: 0
08:21:33.0555 0x1510 Actual detected object count: 0
Code:
ATTFilter 08:20:16.0963 0x1638 TDSS rootkit removing tool 3.0.0.44 Jan 22 2015 08:27:04
08:20:21.0423 0x1638 ============================================================
08:20:21.0423 0x1638 Current date / time: 2015/05/14 08:20:21.0423
08:20:21.0423 0x1638 SystemInfo:
08:20:21.0423 0x1638
08:20:21.0423 0x1638 OS Version: 6.1.7601 ServicePack: 1.0
08:20:21.0423 0x1638 Product type: Workstation
08:20:21.0424 0x1638 ComputerName: MARLENE
08:20:21.0424 0x1638 UserName: Boss
08:20:21.0424 0x1638 Windows directory: C:\Windows
08:20:21.0424 0x1638 System windows directory: C:\Windows
08:20:21.0424 0x1638 Processor architecture: Intel x86
08:20:21.0424 0x1638 Number of processors: 2
08:20:21.0424 0x1638 Page size: 0x1000
08:20:21.0424 0x1638 Boot type: Normal boot
08:20:21.0424 0x1638 ============================================================
08:20:23.0064 0x1638 KLMD registered as C:\Windows\system32\drivers\35045664.sys
08:20:23.0371 0x1638 System UUID: {9D2F823F-6456-2F18-7AB6-E8AC8259EEE3}
08:20:24.0009 0x1638 Drive \Device\Harddisk0\DR0 - Size: 0x3A38B2E000 ( 232.89 Gb ), SectorSize: 0x200, Cylinders: 0x70EA1, SectorsPerTrack: 0x20, TracksPerCylinder: 0x21, Type 'K0', Flags 0x00000050
08:20:24.0024 0x1638 Drive \Device\Harddisk1\DR1 - Size: 0x3A38B2E000 ( 232.89 Gb ), SectorSize: 0x200, Cylinders: 0x76C1, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
08:20:29.0682 0x1638 Drive \Device\Harddisk2\DR2 - Size: 0x3A38B2E000 ( 232.89 Gb ), SectorSize: 0x200, Cylinders: 0x7832F, SectorsPerTrack: 0x20, TracksPerCylinder: 0x1F, Type 'K0', Flags 0x00000050
08:20:29.0683 0x1638 ============================================================
08:20:29.0683 0x1638 \Device\Harddisk0\DR0:
08:20:29.0683 0x1638 MBR partitions:
08:20:29.0683 0x1638 \Device\Harddisk1\DR1:
08:20:29.0699 0x1638 MBR partitions:
08:20:29.0699 0x1638 \Device\Harddisk1\DR1\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x9509800
08:20:29.0699 0x1638 \Device\Harddisk1\DR1\Partition2: MBR, Type 0x7, StartLBA 0x950A000, BlocksNum 0x13CBA800
08:20:29.0699 0x1638 \Device\Harddisk2\DR2:
08:20:29.0699 0x1638 MBR partitions:
08:20:29.0699 0x1638 ============================================================
08:20:29.0719 0x1638 E: <-> \Device\Harddisk1\DR1\Partition1
08:20:29.0755 0x1638 F: <-> \Device\Harddisk1\DR1\Partition2
08:20:29.0755 0x1638 ============================================================
08:20:29.0755 0x1638 Initialize success
08:20:29.0755 0x1638 ============================================================
08:21:14.0040 0x09a8 ============================================================
08:21:14.0040 0x09a8 Scan started
08:21:14.0040 0x09a8 Mode: Manual; SigCheck; TDLFS;
08:21:14.0040 0x09a8 ============================================================
08:21:14.0040 0x09a8 KSN ping started
08:21:27.0565 0x09a8 KSN ping finished: true
08:21:27.0908 0x09a8 ================ Scan system memory ========================
08:21:27.0908 0x09a8 System memory - ok
08:21:27.0924 0x09a8 ================ Scan services =============================
08:21:27.0955 0x09a8 1394ohci - ok
08:21:27.0955 0x09a8 ACPI - ok
08:21:27.0970 0x09a8 AcpiPmi - ok
08:21:27.0986 0x09a8 AdobeARMservice - ok
08:21:28.0002 0x09a8 AdobeFlashPlayerUpdateSvc - ok
08:21:28.0017 0x09a8 adp94xx - ok
08:21:28.0017 0x09a8 adpahci - ok
08:21:28.0017 0x09a8 adpu320 - ok
08:21:28.0033 0x09a8 AeLookupSvc - ok
08:21:28.0033 0x09a8 AFD - ok
08:21:28.0033 0x09a8 agp440 - ok
08:21:28.0048 0x09a8 aic78xx - ok
08:21:28.0064 0x09a8 ALG - ok
08:21:28.0064 0x09a8 aliide - ok
08:21:28.0080 0x09a8 AMD External Events Utility - ok
08:21:28.0080 0x09a8 amdagp - ok
08:21:28.0080 0x09a8 amdide - ok
08:21:28.0095 0x09a8 AmdK8 - ok
08:21:28.0095 0x09a8 amdkmdag - ok
08:21:28.0095 0x09a8 amdkmdap - ok
08:21:28.0095 0x09a8 AmdPPM - ok
08:21:28.0111 0x09a8 amdsata - ok
08:21:28.0126 0x09a8 amdsbs - ok
08:21:28.0126 0x09a8 amdxata - ok
08:21:28.0142 0x09a8 AntiVirMailService - ok
08:21:28.0142 0x09a8 AntiVirSchedulerService - ok
08:21:28.0158 0x09a8 AntiVirService - ok
08:21:28.0173 0x09a8 AntiVirWebService - ok
08:21:28.0173 0x09a8 AppID - ok
08:21:28.0173 0x09a8 AppIDSvc - ok
08:21:28.0189 0x09a8 Appinfo - ok
08:21:28.0189 0x09a8 AppMgmt - ok
08:21:28.0189 0x09a8 arc - ok
08:21:28.0204 0x09a8 arcsas - ok
08:21:28.0220 0x09a8 AsIO - ok
08:21:28.0220 0x09a8 aspnet_state - ok
08:21:28.0236 0x09a8 AsUpIO - ok
08:21:28.0251 0x09a8 AsyncMac - ok
08:21:28.0251 0x09a8 atapi - ok
08:21:28.0267 0x09a8 AtiHDAudioService - ok
08:21:28.0267 0x09a8 AudioEndpointBuilder - ok
08:21:28.0282 0x09a8 Audiosrv - ok
08:21:28.0282 0x09a8 avgntflt - ok
08:21:28.0298 0x09a8 avipbb - ok
08:21:28.0314 0x09a8 Avira.OE.ServiceHost - ok
08:21:28.0314 0x09a8 avkmgr - ok
08:21:28.0329 0x09a8 avnetflt - ok
08:21:28.0345 0x09a8 AxInstSV - ok
08:21:28.0345 0x09a8 b06bdrv - ok
08:21:28.0360 0x09a8 b57nd60x - ok
08:21:28.0360 0x09a8 BDESVC - ok
08:21:28.0360 0x09a8 Beep - ok
08:21:28.0376 0x09a8 BFE - ok
08:21:28.0376 0x09a8 BITS - ok
08:21:28.0376 0x09a8 blbdrive - ok
08:21:28.0392 0x09a8 bowser - ok
08:21:28.0392 0x09a8 BrFiltLo - ok
08:21:28.0392 0x09a8 BrFiltUp - ok
08:21:28.0407 0x09a8 Browser - ok
08:21:28.0407 0x09a8 Brserid - ok
08:21:28.0407 0x09a8 BrSerWdm - ok
08:21:28.0407 0x09a8 BrUsbMdm - ok
08:21:28.0423 0x09a8 BrUsbSer - ok
08:21:28.0423 0x09a8 BTHMODEM - ok
08:21:28.0438 0x09a8 bthserv - ok
08:21:28.0438 0x09a8 cdfs - ok
08:21:28.0454 0x09a8 cdrom - ok
08:21:28.0470 0x09a8 CertPropSvc - ok
08:21:28.0470 0x09a8 circlass - ok
08:21:28.0470 0x09a8 CLFS - ok
08:21:28.0485 0x09a8 clr_optimization_v2.0.50727_32 - ok
08:21:28.0485 0x09a8 clr_optimization_v4.0.30319_32 - ok
08:21:28.0485 0x09a8 CmBatt - ok
08:21:28.0501 0x09a8 cmdide - ok
08:21:28.0501 0x09a8 CNG - ok
08:21:28.0501 0x09a8 Compbatt - ok
08:21:28.0501 0x09a8 CompositeBus - ok
08:21:28.0516 0x09a8 COMSysApp - ok
08:21:28.0516 0x09a8 crcdisk - ok
08:21:28.0532 0x09a8 CryptSvc - ok
08:21:28.0532 0x09a8 CSC - ok
08:21:28.0532 0x09a8 CscService - ok
08:21:28.0548 0x09a8 DcomLaunch - ok
08:21:28.0548 0x09a8 defragsvc - ok
08:21:28.0548 0x09a8 DfsC - ok
08:21:28.0563 0x09a8 Dhcp - ok
08:21:28.0579 0x09a8 DiagTrack - ok
08:21:28.0579 0x09a8 discache - ok
08:21:28.0594 0x09a8 Disk - ok
08:21:28.0594 0x09a8 Dnscache - ok
08:21:28.0594 0x09a8 dot3svc - ok
08:21:28.0610 0x09a8 DPS - ok
08:21:28.0610 0x09a8 drmkaud - ok
08:21:28.0610 0x09a8 DXGKrnl - ok
08:21:28.0626 0x09a8 EapHost - ok
08:21:28.0626 0x09a8 ebdrv - ok
08:21:28.0626 0x09a8 EFS - ok
08:21:28.0641 0x09a8 ehRecvr - ok
08:21:28.0641 0x09a8 ehSched - ok
08:21:28.0641 0x09a8 elxstor - ok
08:21:28.0641 0x09a8 ErrDev - ok
08:21:28.0657 0x09a8 EventSystem - ok
08:21:28.0657 0x09a8 exfat - ok
08:21:28.0657 0x09a8 fastfat - ok
08:21:28.0672 0x09a8 Fax - ok
08:21:28.0672 0x09a8 fdc - ok
08:21:28.0672 0x09a8 fdPHost - ok
08:21:28.0688 0x09a8 FDResPub - ok
08:21:28.0688 0x09a8 FileInfo - ok
08:21:28.0688 0x09a8 Filetrace - ok
08:21:28.0688 0x09a8 flpydisk - ok
08:21:28.0704 0x09a8 FltMgr - ok
08:21:28.0704 0x09a8 FontCache - ok
08:21:28.0704 0x09a8 FontCache3.0.0.0 - ok
08:21:28.0704 0x09a8 FsDepends - ok
08:21:28.0719 0x09a8 Fs_Rec - ok
08:21:28.0719 0x09a8 fvevol - ok
08:21:28.0719 0x09a8 gagp30kx - ok
08:21:28.0719 0x09a8 gpsvc - ok
08:21:28.0735 0x09a8 hcw85cir - ok
08:21:28.0750 0x09a8 HdAudAddService - ok
08:21:28.0750 0x09a8 HDAudBus - ok
08:21:28.0766 0x09a8 HidBatt - ok
08:21:28.0766 0x09a8 HidBth - ok
08:21:28.0782 0x09a8 HidIr - ok
08:21:28.0782 0x09a8 hidserv - ok
08:21:28.0782 0x09a8 HidUsb - ok
08:21:28.0782 0x09a8 hkmsvc - ok
08:21:28.0797 0x09a8 HomeGroupListener - ok
08:21:28.0797 0x09a8 HomeGroupProvider - ok
08:21:28.0797 0x09a8 HpSAMD - ok
08:21:28.0813 0x09a8 HTTP - ok
08:21:28.0813 0x09a8 hwpolicy - ok
08:21:28.0813 0x09a8 i8042prt - ok
08:21:28.0828 0x09a8 iaStorV - ok
08:21:28.0828 0x09a8 idsvc - ok
08:21:28.0844 0x09a8 IEEtwCollectorService - ok
08:21:28.0844 0x09a8 igfx - ok
08:21:28.0860 0x09a8 iirsp - ok
08:21:28.0860 0x09a8 IKEEXT - ok
08:21:28.0875 0x09a8 IntcAzAudAddService - ok
08:21:28.0891 0x09a8 intelide - ok
08:21:28.0891 0x09a8 intelppm - ok
08:21:28.0906 0x09a8 IPBusEnum - ok
08:21:28.0906 0x09a8 IpFilterDriver - ok
08:21:28.0906 0x09a8 iphlpsvc - ok
08:21:28.0906 0x09a8 IPMIDRV - ok
08:21:28.0922 0x09a8 IPNAT - ok
08:21:28.0922 0x09a8 IRENUM - ok
08:21:28.0922 0x09a8 isapnp - ok
08:21:28.0938 0x09a8 iScsiPrt - ok
08:21:28.0938 0x09a8 kbdclass - ok
08:21:28.0953 0x09a8 kbdhid - ok
08:21:28.0953 0x09a8 KeyIso - ok
08:21:28.0953 0x09a8 KSecDD - ok
08:21:28.0969 0x09a8 KSecPkg - ok
08:21:28.0969 0x09a8 KtmRm - ok
08:21:28.0969 0x09a8 L1C - ok
08:21:28.0969 0x09a8 LanmanServer - ok
08:21:28.0984 0x09a8 LanmanWorkstation - ok
08:21:28.0984 0x09a8 lltdio - ok
08:21:28.0984 0x09a8 lltdsvc - ok
08:21:29.0000 0x09a8 lmhosts - ok
08:21:29.0016 0x09a8 LSI_FC - ok
08:21:29.0016 0x09a8 LSI_SAS - ok
08:21:29.0016 0x09a8 LSI_SAS2 - ok
08:21:29.0016 0x09a8 LSI_SCSI - ok
08:21:29.0031 0x09a8 luafv - ok
08:21:29.0031 0x09a8 Mcx2Svc - ok
08:21:29.0031 0x09a8 megasas - ok
08:21:29.0031 0x09a8 MegaSR - ok
08:21:29.0047 0x09a8 MMCSS - ok
08:21:29.0047 0x09a8 Modem - ok
08:21:29.0047 0x09a8 monitor - ok
08:21:29.0047 0x09a8 mouclass - ok
08:21:29.0062 0x09a8 mouhid - ok
08:21:29.0062 0x09a8 mountmgr - ok
08:21:29.0078 0x09a8 MozillaMaintenance - ok
08:21:29.0078 0x09a8 mpio - ok
08:21:29.0094 0x09a8 mpsdrv - ok
08:21:29.0094 0x09a8 MpsSvc - ok
08:21:29.0094 0x09a8 MRxDAV - ok
08:21:29.0109 0x09a8 mrxsmb - ok
08:21:29.0109 0x09a8 mrxsmb10 - ok
08:21:29.0109 0x09a8 mrxsmb20 - ok
08:21:29.0140 0x09a8 msahci - ok
08:21:29.0156 0x09a8 MSCamSvc - ok
08:21:29.0156 0x09a8 msdsm - ok
08:21:29.0172 0x09a8 MSDTC - ok
08:21:29.0172 0x09a8 Msfs - ok
08:21:29.0187 0x09a8 mshidkmdf - ok
08:21:29.0187 0x09a8 msisadrv - ok
08:21:29.0187 0x09a8 MSiSCSI - ok
08:21:29.0187 0x09a8 msiserver - ok
08:21:29.0203 0x09a8 MSKSSRV - ok
08:21:29.0203 0x09a8 MSPCLOCK - ok
08:21:29.0203 0x09a8 MSPQM - ok
08:21:29.0218 0x09a8 MsRPC - ok
08:21:29.0218 0x09a8 mssmbios - ok
08:21:29.0218 0x09a8 MSTEE - ok
08:21:29.0234 0x09a8 MTConfig - ok
08:21:29.0234 0x09a8 MTsensor - ok
08:21:29.0234 0x09a8 Mup - ok
08:21:29.0250 0x09a8 napagent - ok
08:21:29.0250 0x09a8 NativeWifiP - ok
08:21:29.0250 0x09a8 NDIS - ok
08:21:29.0265 0x09a8 NdisCap - ok
08:21:29.0265 0x09a8 NdisTapi - ok
08:21:29.0281 0x09a8 Ndisuio - ok
08:21:29.0281 0x09a8 NdisWan - ok
08:21:29.0281 0x09a8 NDProxy - ok
08:21:29.0296 0x09a8 NetBIOS - ok
08:21:29.0296 0x09a8 NetBT - ok
08:21:29.0296 0x09a8 Netlogon - ok
08:21:29.0296 0x09a8 Netman - ok
08:21:29.0312 0x09a8 NetMsmqActivator - ok
08:21:29.0312 0x09a8 NetPipeActivator - ok
08:21:29.0312 0x09a8 netprofm - ok
08:21:29.0328 0x09a8 NetTcpActivator - ok
08:21:29.0328 0x09a8 NetTcpPortSharing - ok
08:21:29.0343 0x09a8 nfrd960 - ok
08:21:29.0343 0x09a8 NlaSvc - ok
08:21:29.0343 0x09a8 Npfs - ok
08:21:29.0343 0x09a8 nsi - ok
08:21:29.0359 0x09a8 nsiproxy - ok
08:21:29.0359 0x09a8 Ntfs - ok
08:21:29.0359 0x09a8 Null - ok
08:21:29.0374 0x09a8 nvraid - ok
08:21:29.0374 0x09a8 nvstor - ok
08:21:29.0390 0x09a8 nv_agp - ok
08:21:29.0390 0x09a8 ohci1394 - ok
08:21:29.0390 0x09a8 ose - ok
08:21:29.0406 0x09a8 osppsvc - ok
08:21:29.0421 0x09a8 p2pimsvc - ok
08:21:29.0421 0x09a8 p2psvc - ok
08:21:29.0437 0x09a8 Parport - ok
08:21:29.0437 0x09a8 partmgr - ok
08:21:29.0437 0x09a8 Parvdm - ok
08:21:29.0437 0x09a8 PcaSvc - ok
08:21:29.0452 0x09a8 pci - ok
08:21:29.0452 0x09a8 pciide - ok
08:21:29.0452 0x09a8 pcmcia - ok
08:21:29.0452 0x09a8 pcw - ok
08:21:29.0468 0x09a8 PEAUTH - ok
08:21:29.0468 0x09a8 PeerDistSvc - ok
08:21:29.0484 0x09a8 pla - ok
08:21:29.0484 0x09a8 PlugPlay - ok
08:21:29.0499 0x09a8 PNRPAutoReg - ok
08:21:29.0499 0x09a8 PNRPsvc - ok
08:21:29.0515 0x09a8 PolicyAgent - ok
08:21:29.0515 0x09a8 Power - ok
08:21:29.0515 0x09a8 PptpMiniport - ok
08:21:29.0530 0x09a8 Processor - ok
08:21:29.0530 0x09a8 ProfSvc - ok
08:21:29.0530 0x09a8 ProtectedStorage - ok
08:21:29.0530 0x09a8 Psched - ok
08:21:29.0546 0x09a8 ql2300 - ok
08:21:29.0546 0x09a8 ql40xx - ok
08:21:29.0546 0x09a8 QWAVE - ok
08:21:29.0546 0x09a8 QWAVEdrv - ok
08:21:29.0562 0x09a8 RasAcd - ok
08:21:29.0562 0x09a8 RasAgileVpn - ok
08:21:29.0562 0x09a8 RasAuto - ok
08:21:29.0577 0x09a8 Rasl2tp - ok
08:21:29.0577 0x09a8 RasMan - ok
08:21:29.0577 0x09a8 RasPppoe - ok
08:21:29.0577 0x09a8 RasSstp - ok
08:21:29.0593 0x09a8 rdbss - ok
08:21:29.0593 0x09a8 rdpbus - ok
08:21:29.0593 0x09a8 RDPCDD - ok
08:21:29.0593 0x09a8 RDPDR - ok
08:21:29.0608 0x09a8 RDPENCDD - ok
08:21:29.0608 0x09a8 RDPREFMP - ok
08:21:29.0608 0x09a8 RDPWD - ok
08:21:29.0624 0x09a8 rdyboost - ok
08:21:29.0624 0x09a8 RemoteAccess - ok
08:21:29.0624 0x09a8 RemoteRegistry - ok
08:21:29.0624 0x09a8 RpcEptMapper - ok
08:21:29.0640 0x09a8 RpcLocator - ok
08:21:29.0640 0x09a8 RpcSs - ok
08:21:29.0640 0x09a8 rspndr - ok
08:21:29.0640 0x09a8 s3cap - ok
08:21:29.0655 0x09a8 SamSs - ok
08:21:29.0655 0x09a8 sbp2port - ok
08:21:29.0655 0x09a8 SCardSvr - ok
08:21:29.0671 0x09a8 scfilter - ok
08:21:29.0671 0x09a8 Schedule - ok
08:21:29.0671 0x09a8 SCPolicySvc - ok
08:21:29.0671 0x09a8 SDRSVC - ok
08:21:29.0671 0x09a8 secdrv - ok
08:21:29.0686 0x09a8 seclogon - ok
08:21:29.0686 0x09a8 SENS - ok
08:21:29.0686 0x09a8 SensrSvc - ok
08:21:29.0702 0x09a8 Serenum - ok
08:21:29.0702 0x09a8 Serial - ok
08:21:29.0702 0x09a8 sermouse - ok
08:21:29.0718 0x09a8 SessionEnv - ok
08:21:29.0718 0x09a8 sffdisk - ok
08:21:29.0718 0x09a8 sffp_mmc - ok
08:21:29.0733 0x09a8 sffp_sd - ok
08:21:29.0733 0x09a8 sfloppy - ok
08:21:29.0733 0x09a8 SharedAccess - ok
08:21:29.0733 0x09a8 ShellHWDetection - ok
08:21:29.0749 0x09a8 sisagp - ok
08:21:29.0749 0x09a8 SiSRaid2 - ok
08:21:29.0749 0x09a8 SiSRaid4 - ok
08:21:29.0749 0x09a8 SkypeUpdate - ok
08:21:29.0764 0x09a8 Smb - ok
08:21:29.0764 0x09a8 SNMPTRAP - ok
08:21:29.0780 0x09a8 spldr - ok
08:21:29.0780 0x09a8 Spooler - ok
08:21:29.0780 0x09a8 sppsvc - ok
08:21:29.0780 0x09a8 sppuinotify - ok
08:21:29.0796 0x09a8 srv - ok
08:21:29.0796 0x09a8 srv2 - ok
08:21:29.0796 0x09a8 srvnet - ok
08:21:29.0796 0x09a8 SSDPSRV - ok
08:21:29.0811 0x09a8 ssmdrv - ok
08:21:29.0811 0x09a8 SstpSvc - ok
08:21:29.0811 0x09a8 stexstor - ok
08:21:29.0811 0x09a8 StiSvc - ok
08:21:29.0827 0x09a8 storflt - ok
08:21:29.0827 0x09a8 StorSvc - ok
08:21:29.0827 0x09a8 storvsc - ok
08:21:29.0827 0x09a8 swenum - ok
08:21:29.0842 0x09a8 swprv - ok
08:21:29.0842 0x09a8 SysMain - ok
08:21:29.0842 0x09a8 TabletInputService - ok
08:21:29.0842 0x09a8 TapiSrv - ok
08:21:29.0858 0x09a8 TBS - ok
08:21:29.0858 0x09a8 Tcpip - ok
08:21:29.0858 0x09a8 TCPIP6 - ok
08:21:29.0874 0x09a8 tcpipreg - ok
08:21:29.0874 0x09a8 TDPIPE - ok
08:21:29.0874 0x09a8 TDTCP - ok
08:21:29.0889 0x09a8 tdx - ok
08:21:29.0889 0x09a8 TermDD - ok
08:21:29.0889 0x09a8 TermService - ok
08:21:29.0889 0x09a8 Themes - ok
08:21:29.0905 0x09a8 THREADORDER - ok
08:21:29.0905 0x09a8 TrkWks - ok
08:21:29.0905 0x09a8 TrustedInstaller - ok
08:21:29.0920 0x09a8 tssecsrv - ok
08:21:29.0920 0x09a8 TsUsbFlt - ok
08:21:29.0936 0x09a8 tunnel - ok
08:21:29.0936 0x09a8 uagp35 - ok
08:21:29.0936 0x09a8 udfs - ok
08:21:29.0952 0x09a8 UI0Detect - ok
08:21:29.0952 0x09a8 uliagpkx - ok
08:21:29.0952 0x09a8 umbus - ok
08:21:29.0952 0x09a8 UmPass - ok
08:21:29.0967 0x09a8 UmRdpService - ok
08:21:29.0967 0x09a8 upnphost - ok
08:21:29.0983 0x09a8 usbaudio - ok
08:21:29.0983 0x09a8 usbccgp - ok
08:21:29.0983 0x09a8 usbcir - ok
08:21:29.0983 0x09a8 usbehci - ok
08:21:29.0998 0x09a8 usbhub - ok
08:21:29.0998 0x09a8 usbohci - ok
08:21:29.0998 0x09a8 usbprint - ok
08:21:30.0014 0x09a8 usbscan - ok
08:21:30.0014 0x09a8 USBSTOR - ok
08:21:30.0014 0x09a8 usbuhci - ok
08:21:30.0030 0x09a8 UxSms - ok
08:21:30.0030 0x09a8 VaultSvc - ok
08:21:30.0030 0x09a8 vdrvroot - ok
08:21:30.0045 0x09a8 vds - ok
08:21:30.0045 0x09a8 vga - ok
08:21:30.0045 0x09a8 VgaSave - ok
08:21:30.0045 0x09a8 vhdmp - ok
08:21:30.0061 0x09a8 viaagp - ok
08:21:30.0061 0x09a8 ViaC7 - ok
08:21:30.0076 0x09a8 viaide - ok
08:21:30.0076 0x09a8 vmbus - ok
08:21:30.0076 0x09a8 VMBusHID - ok
08:21:30.0076 0x09a8 volmgr - ok
08:21:30.0092 0x09a8 volmgrx - ok
08:21:30.0092 0x09a8 volsnap - ok
08:21:30.0092 0x09a8 vsmraid - ok
08:21:30.0108 0x09a8 VSS - ok
08:21:30.0108 0x09a8 vwifibus - ok
08:21:30.0108 0x09a8 VX1000 - ok
08:21:30.0108 0x09a8 W32Time - ok
08:21:30.0123 0x09a8 WacomPen - ok
08:21:30.0123 0x09a8 WANARP - ok
08:21:30.0123 0x09a8 Wanarpv6 - ok
08:21:30.0139 0x09a8 wbengine - ok
08:21:30.0139 0x09a8 WbioSrvc - ok
08:21:30.0139 0x09a8 wcncsvc - ok
08:21:30.0139 0x09a8 WcsPlugInService - ok
08:21:30.0154 0x09a8 Wd - ok
08:21:30.0154 0x09a8 Wdf01000 - ok
08:21:30.0154 0x09a8 WdiServiceHost - ok
08:21:30.0154 0x09a8 WdiSystemHost - ok
08:21:30.0170 0x09a8 WebClient - ok
08:21:30.0170 0x09a8 Wecsvc - ok
08:21:30.0170 0x09a8 wercplsupport - ok
08:21:30.0170 0x09a8 WerSvc - ok
08:21:30.0186 0x09a8 WfpLwf - ok
08:21:30.0186 0x09a8 WIMMount - ok
08:21:30.0186 0x09a8 WinDefend - ok
08:21:30.0201 0x09a8 WinHttpAutoProxySvc - ok
08:21:30.0201 0x09a8 Winmgmt - ok
08:21:30.0201 0x09a8 WinRM - ok
08:21:30.0217 0x09a8 WinUsb - ok
08:21:30.0232 0x09a8 Wlansvc - ok
08:21:30.0232 0x09a8 wlidsvc - ok
08:21:30.0232 0x09a8 WmiAcpi - ok
08:21:30.0248 0x09a8 wmiApSrv - ok
08:21:30.0248 0x09a8 WMPNetworkSvc - ok
08:21:30.0248 0x09a8 WPCSvc - ok
08:21:30.0248 0x09a8 WPDBusEnum - ok
08:21:30.0264 0x09a8 ws2ifsl - ok
08:21:30.0264 0x09a8 wscsvc - ok
08:21:30.0264 0x09a8 WSearch - ok
08:21:30.0264 0x09a8 wuauserv - ok
08:21:30.0279 0x09a8 WudfPf - ok
08:21:30.0279 0x09a8 WUDFRd - ok
08:21:30.0279 0x09a8 wudfsvc - ok
08:21:30.0295 0x09a8 WwanSvc - ok
08:21:30.0310 0x09a8 ================ Scan global ===============================
08:21:30.0310 0x09a8 [ Global ] - ok
08:21:30.0310 0x09a8 ================ Scan MBR ==================================
08:21:30.0326 0x09a8 [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
08:21:30.0669 0x09a8 \Device\Harddisk0\DR0 - ok
08:21:30.0685 0x09a8 [ 72B8CE41AF0DE751C946802B3ED844B4 ] \Device\Harddisk1\DR1
08:21:30.0747 0x09a8 \Device\Harddisk1\DR1 - ok
08:21:30.0763 0x09a8 [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk2\DR2
08:21:30.0950 0x09a8 \Device\Harddisk2\DR2 - ok
08:21:30.0950 0x09a8 ================ Scan VBR ==================================
08:21:30.0950 0x09a8 [ 6934363B3FEC16BE724C64F6A2E6B630 ] \Device\Harddisk1\DR1\Partition1
08:21:30.0966 0x09a8 \Device\Harddisk1\DR1\Partition1 - ok
08:21:30.0966 0x09a8 [ 84B15D91B563810A9E10E82F01139B4C ] \Device\Harddisk1\DR1\Partition2
08:21:30.0966 0x09a8 \Device\Harddisk1\DR1\Partition2 - ok
08:21:30.0966 0x09a8 ================ Scan generic autorun ======================
08:21:30.0966 0x09a8 RTHDVCPL - ok
08:21:30.0966 0x09a8 IgfxTray - ok
08:21:30.0966 0x09a8 HotKeysCmds - ok
08:21:30.0966 0x09a8 Persistence - ok
08:21:30.0966 0x09a8 avgnt - ok
08:21:30.0966 0x09a8 VX1000 - ok
08:21:30.0966 0x09a8 LifeCam - ok
08:21:30.0981 0x09a8 iSCSIAgent - ok
08:21:30.0981 0x09a8 Avira Systray - ok
08:21:30.0981 0x09a8 StartCCC - ok
08:21:30.0981 0x09a8 Sidebar - ok
08:21:30.0981 0x09a8 mctadmin - ok
08:21:30.0981 0x09a8 Sidebar - ok
08:21:30.0981 0x09a8 mctadmin - ok
08:21:30.0981 0x09a8 HydraVisionDesktopManager - ok
08:21:30.0981 0x09a8 HydraVisionDesktopManager - ok
08:21:31.0106 0x09a8 AV detected via SS2: Avira Antivirus, C:\Program Files\Avira\AntiVir Desktop\wsctool.exe ( 15.0.10.414 ), 0x41000 ( enabled : updated )
08:21:31.0137 0x09a8 Win FW state via NFP2: enabled
08:21:33.0555 0x09a8 ============================================================
08:21:33.0555 0x09a8 Scan finished
08:21:33.0555 0x09a8 ============================================================
08:21:33.0555 0x1510 Detected object count: 0
08:21:33.0555 0x1510 Actual detected object count: 0
08:23:13.0256 0x13d4 Deinitialize success
|
|
14.05.2015, 17:17
| #4 |
| /// the machine /// TB-Ausbilder | PDF mit Trojaner geöffnet, Windows 7 hi, Scan mit Combofix
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
15.05.2015, 14:26
| #5 |
| | PDF mit Trojaner geöffnet, Windows 7 Moin Schrauber, ich habe Combofix heute früh gemäß Anweisung gestartet und den Rechner dann laufen lassen. Als ich nach einer Ewigkeit (ca. 6 Stunden) wieder nachgeschaut habe, war nur noch das unten eingefügte logfile offen: ComboFix Code:
ATTFilter ComboFix 15-05-13.01 - Boss 15.05.2015 9:12.1.2 - x86
Microsoft Windows 7 Professional 6.1.7601.1.1252.49.1031.18.3583.2385 [GMT 2:00]
ausgeführt von:: c:\users\Papa\Desktop\TrojanerBoard\ComboFix.exe
AV: Avira Antivirus *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Antivirus *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((( Dateien erstellt von 2015-04-15 bis 2015-05-15 ))))))))))))))))))))))))))))))
.
.
2015-05-15 07:18 . 2015-05-15 07:18 -------- d-----w- c:\users\Mama\AppData\Local\temp
2015-05-15 07:18 . 2015-05-15 07:18 -------- d-----w- c:\users\Default\AppData\Local\temp
2015-05-15 05:47 . 2015-05-15 05:47 62576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{137C0CE6-CA2B-42CB-BCC1-E931493138E1}\offreg.dll
2015-05-15 05:46 . 2015-04-04 06:39 9201616 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{137C0CE6-CA2B-42CB-BCC1-E931493138E1}\mpengine.dll
2015-05-14 05:51 . 2015-05-14 06:18 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable)
2015-05-13 19:33 . 2015-05-13 19:35 -------- d-----w- C:\FRST
2015-05-13 18:29 . 2015-05-01 13:16 102608 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 06:08 . 2015-03-04 04:11 5120 ----a-w- c:\windows\system32\shimeng.dll
2015-05-10 18:57 . 2015-05-10 18:57 -------- d-----w- c:\users\Mama\AppData\Roaming\ATI
2015-05-10 18:57 . 2015-05-10 18:57 -------- d-----w- c:\users\Mama\AppData\Local\ATI
2015-05-10 10:53 . 2015-05-10 10:53 -------- d-----w- c:\program files\13-9_win7_win8_32-64_hydravision
2015-05-10 10:50 . 2015-05-10 10:50 -------- d-----w- c:\program files\Sapphire TRIXX
2015-05-10 10:48 . 2015-05-10 10:48 -------- d-----w- c:\users\Papa\AppData\Roaming\ATI
2015-05-10 10:48 . 2015-05-10 10:48 -------- d-----w- c:\users\Papa\AppData\Local\ATI
2015-05-10 10:48 . 2015-05-10 10:48 -------- d-----w- c:\programdata\ATI
2015-05-10 10:48 . 2015-05-10 10:48 0 ----a-w- c:\windows\ativpsrm.bin
2015-05-10 10:46 . 2015-05-10 10:46 -------- d-----w- c:\programdata\AMD
2015-05-10 10:46 . 2015-05-10 10:46 -------- d-----w- c:\program files\AMD AVT
2015-05-10 10:44 . 2015-05-10 10:44 -------- d-----w- c:\program files\AMD
2015-05-10 10:44 . 2015-05-10 10:44 -------- d-----w- c:\program files\Common Files\ATI Technologies
2015-05-10 10:43 . 2015-05-10 10:43 -------- d-----w- c:\program files\ATI
2015-05-10 10:42 . 2015-05-10 10:53 -------- d-----w- c:\program files\ATI Technologies
2015-05-10 10:41 . 2015-05-10 10:41 -------- d-----w- c:\program files\AMD-Catalyst-14-9-win7-win8.1-32Bit-dd-ccc-whql
2015-05-08 19:36 . 2015-05-09 12:21 -------- d-----w- c:\users\Papa\AppData\Roaming\XnView
2015-05-08 19:35 . 2015-05-08 19:35 -------- d-----w- c:\program files\XnView
2015-04-15 18:22 . 2015-04-15 18:22 -------- d-----w- c:\program files\Common Files\Skype
2015-04-15 18:22 . 2015-04-15 18:22 -------- d-----r- c:\program files\Skype
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-05-14 05:51 . 2015-03-15 15:58 119512 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-05-14 05:50 . 2015-03-15 15:57 92888 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2015-05-07 15:49 . 2014-06-22 18:07 37896 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2015-05-07 15:49 . 2014-06-22 18:07 136216 ----a-w- c:\windows\system32\drivers\avipbb.sys
2015-05-07 15:49 . 2014-06-22 18:07 107400 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2015-04-16 09:34 . 2014-06-22 17:25 778416 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2015-04-16 09:34 . 2014-06-22 17:25 142512 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2015-04-14 01:38 . 2015-04-14 01:38 1217192 ----a-w- c:\windows\system32\FM20.DLL
2015-03-05 12:37 . 2014-06-22 18:07 37896 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2015-03-04 04:10 . 2015-05-13 06:08 470528 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2015-03-04 04:10 . 2015-05-13 06:08 2178560 ----a-w- c:\windows\apppatch\AcGenral.dll
2015-03-04 04:06 . 2015-05-13 06:08 2560 ----a-w- c:\windows\apppatch\AcRes.dll
2015-02-24 02:23 . 2015-03-24 19:21 246920 ------w- c:\windows\system32\MpSigStub.exe
2015-02-20 04:13 . 2015-03-11 05:25 26624 ----a-w- c:\windows\system32\lpk.dll
2015-02-20 04:13 . 2015-03-11 05:25 70656 ----a-w- c:\windows\system32\fontsub.dll
2015-02-20 04:13 . 2015-03-11 05:25 10240 ----a-w- c:\windows\system32\dciman32.dll
2015-02-20 04:13 . 2015-03-11 05:25 34304 ----a-w- c:\windows\system32\atmlib.dll
2015-02-20 03:09 . 2015-03-11 05:25 299008 ----a-w- c:\windows\system32\atmfd.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt1"]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12 152544 ----a-w- c:\users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt2"]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12 152544 ----a-w- c:\users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt3"]
@="{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12 152544 ----a-w- c:\users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt4"]
@="{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12 152544 ----a-w- c:\users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt5"]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12 152544 ----a-w- c:\users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt6"]
@="{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12 152544 ----a-w- c:\users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt7"]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12 152544 ----a-w- c:\users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt8"]
@="{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12 152544 ----a-w- c:\users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2011-06-28 10127976]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-02-11 137752]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-02-11 171032]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-02-11 172568]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2015-05-07 728312]
"VX1000"="c:\windows\vVX1000.exe" [2010-05-20 762736]
"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2010-05-20 119152]
"iSCSIAgent"="c:\program files\QNAP\Qfinder\iSCSIAgent.exe" [2015-02-25 1739952]
"Avira Systray"="c:\program files\Avira\My Avira\Avira.OE.Systray.exe" [2015-03-16 129272]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\x86\CLIStart.exe" [2014-09-15 748256]
.
c:\users\Papa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files\Microsoft Office\Office14\ONENOTEM.EXE /tsr [2013-6-25 228552]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableSecureUIAPath"= 1 (0x1)
.
R2 AntiVirMailService;Avira Email-Schutz;c:\program files\Avira\AntiVir Desktop\avmailc7.exe [2015-05-07 827640]
R2 AntiVirWebService;Avira Browser-Schutz;c:\program files\Avira\AntiVir Desktop\avwebg7.exe [2015-05-07 1185584]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2014-12-11 315496]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2015-04-21 102912]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
S1 AsUpIO;AsUpIO;c:\windows\system32\drivers\AsUpIO.sys [2009-07-06 11448]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2015-05-07 37896]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2014-09-15 208896]
S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2015-05-07 434424]
S2 Avira.OE.ServiceHost;Avira Service Host;c:\program files\Avira\My Avira\Avira.OE.ServiceHost.exe [2015-03-16 201008]
S2 avnetflt;avnetflt;c:\windows\system32\DRIVERS\avnetflt.sys [2015-03-05 37896]
S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe [2009-07-14 20992]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [2014-06-21 77824]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x86.sys [2011-03-22 69232]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - 86009014
*Deregistered* - 86009014
*Deregistered* - uxddypod
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
utcsvc REG_MULTI_SZ DiagTrack
.
Inhalt des "geplante Tasks" Ordners
.
2015-05-15 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-06-22 09:34]
.
.
------- Zusätzlicher Suchlauf -------
.
mStart Page = about:blank
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\Boss\AppData\Roaming\Mozilla\Firefox\Profiles\ussg0rg9.default\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
c:\users\Papa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk - c:\users\Boss\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-638442100-2917554848-3055500443-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-638442100-2917554848-3055500443-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_USERS\S-1-5-21-638442100-2917554848-3055500443-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-638442100-2917554848-3055500443-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'lsass.exe'(604)
c:\windows\system32\keyiso.dll
.
- - - - - - - > 'Explorer.exe'(3320)
c:\program files\ATI Technologies\HydraVision\HydraDMH.dll
.
Zeit der Fertigstellung: 2015-05-15 09:22:06
ComboFix-quarantined-files.txt 2015-05-15 07:22
.
Vor Suchlauf: 7 Verzeichnis(se), 198.776.152.064 Bytes frei
Nach Suchlauf: 13 Verzeichnis(se), 199.341.776.896 Bytes frei
.
- - End Of File - - ECC4D49A5D132193652D351A897DCAC1
A36C5E4F47E84449FF07ED3517B43A31
Frage: Hat es einen Einfluss, dass ich mich nie als Admin anmelde? Für das Ausführen selber sollte das unproblematisch sein, da ich dann "Ausführen als Admin" wähle...aber für Aktionen im Neustart? |
|
16.05.2015, 06:33
| #6 |
| /// the machine /// TB-Ausbilder | PDF mit Trojaner geöffnet, Windows 7 Als Admin wäre schon besser  Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ --> PDF mit Trojaner geöffnet, Windows 7 |
|
16.05.2015, 16:59
| #7 |
| | PDF mit Trojaner geöffnet, Windows 7 Ich habe ComboFix nochmal als Admin laufen lassen...also richtig als Admin angemeldet. Wie aus dem Log ersichtluch hat er am Ende die "c:\users\Boss\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll" gelöscht. Dann kam der Hinweis auf Neustart und es tauchte eine Fehlermeldung auf (in etwa): Avira.. hat einen Fehler verursacht, der Befehl/Zugriff in xxxx read auf xxxx konnte nicht ausgeführt werden. Diese Fehlermeldung halt, wenn etwas auf einen Speicherbereich zugreifen möchte, wo er nicht darf. Code:
ATTFilter ComboFix 15-05-13.01 - Boss 16.05.2015 14:14:50.2.2 - x86
Microsoft Windows 7 Professional 6.1.7601.1.1252.49.1031.18.3583.2557 [GMT 2:00]
ausgeführt von:: c:\users\Papa\Desktop\TrojanerBoard\ComboFix.exe
AV: Avira Antivirus *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Antivirus *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Boss\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
.
.
((((((((((((((((((((((( Dateien erstellt von 2015-04-16 bis 2015-05-16 ))))))))))))))))))))))))))))))
.
.
2015-05-16 12:22 . 2015-05-16 12:24 -------- d-----w- c:\users\Boss\AppData\Local\temp
2015-05-16 12:22 . 2015-05-16 12:22 -------- d-----w- c:\users\Papa\AppData\Local\temp
2015-05-16 12:22 . 2015-05-16 12:22 -------- d-----w- c:\users\Mama\AppData\Local\temp
2015-05-16 12:22 . 2015-05-16 12:22 -------- d-----w- c:\users\Default\AppData\Local\temp
2015-05-16 12:22 . 2015-05-16 12:22 -------- d-----w- c:\users\Administrator\AppData\Local\temp
2015-05-15 05:46 . 2015-04-04 06:39 9201616 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{137C0CE6-CA2B-42CB-BCC1-E931493138E1}\mpengine.dll
2015-05-14 05:51 . 2015-05-14 06:18 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable)
2015-05-13 19:33 . 2015-05-13 19:35 -------- d-----w- C:\FRST
2015-05-13 18:29 . 2015-05-01 13:16 102608 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 06:08 . 2015-03-04 04:11 5120 ----a-w- c:\windows\system32\shimeng.dll
2015-05-10 18:57 . 2015-05-10 18:57 -------- d-----w- c:\users\Mama\AppData\Roaming\ATI
2015-05-10 18:57 . 2015-05-10 18:57 -------- d-----w- c:\users\Mama\AppData\Local\ATI
2015-05-10 10:53 . 2015-05-10 10:53 -------- d-----w- c:\program files\13-9_win7_win8_32-64_hydravision
2015-05-10 10:50 . 2015-05-10 10:50 -------- d-----w- c:\program files\Sapphire TRIXX
2015-05-10 10:48 . 2015-05-10 10:48 -------- d-----w- c:\users\Papa\AppData\Roaming\ATI
2015-05-10 10:48 . 2015-05-10 10:48 -------- d-----w- c:\users\Papa\AppData\Local\ATI
2015-05-10 10:48 . 2015-05-10 10:48 -------- d-----w- c:\programdata\ATI
2015-05-10 10:48 . 2015-05-10 10:48 0 ----a-w- c:\windows\ativpsrm.bin
2015-05-10 10:46 . 2015-05-10 10:46 -------- d-----w- c:\programdata\AMD
2015-05-10 10:46 . 2015-05-10 10:46 -------- d-----w- c:\program files\AMD AVT
2015-05-10 10:44 . 2015-05-10 10:44 -------- d-----w- c:\program files\AMD
2015-05-10 10:44 . 2015-05-10 10:44 -------- d-----w- c:\program files\Common Files\ATI Technologies
2015-05-10 10:43 . 2015-05-10 10:43 -------- d-----w- c:\program files\ATI
2015-05-10 10:42 . 2015-05-10 10:53 -------- d-----w- c:\program files\ATI Technologies
2015-05-10 10:41 . 2015-05-10 10:41 -------- d-----w- c:\program files\AMD-Catalyst-14-9-win7-win8.1-32Bit-dd-ccc-whql
2015-05-08 19:36 . 2015-05-09 12:21 -------- d-----w- c:\users\Papa\AppData\Roaming\XnView
2015-05-08 19:35 . 2015-05-08 19:35 -------- d-----w- c:\program files\XnView
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-05-14 05:51 . 2015-03-15 15:58 119512 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-05-14 05:50 . 2015-03-15 15:57 92888 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2015-05-07 15:49 . 2014-06-22 18:07 37896 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2015-05-07 15:49 . 2014-06-22 18:07 136216 ----a-w- c:\windows\system32\drivers\avipbb.sys
2015-05-07 15:49 . 2014-06-22 18:07 107400 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2015-04-16 09:34 . 2014-06-22 17:25 778416 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2015-04-16 09:34 . 2014-06-22 17:25 142512 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2015-04-14 01:38 . 2015-04-14 01:38 1217192 ----a-w- c:\windows\system32\FM20.DLL
2015-03-25 03:00 . 2015-04-15 09:04 92672 ----a-w- c:\windows\system32\wudriver.dll
2015-03-25 03:00 . 2015-04-15 09:04 566784 ----a-w- c:\windows\system32\wuapi.dll
2015-03-25 03:00 . 2015-04-15 09:04 35328 ----a-w- c:\windows\system32\wups2.dll
2015-03-25 03:00 . 2015-04-15 09:04 3088384 ----a-w- c:\windows\system32\wucltux.dll
2015-03-25 03:00 . 2015-04-15 09:04 29696 ----a-w- c:\windows\system32\wups.dll
2015-03-25 03:00 . 2015-04-15 09:04 2020864 ----a-w- c:\windows\system32\wuaueng.dll
2015-03-25 03:00 . 2015-04-15 09:04 173056 ----a-w- c:\windows\system32\wuwebv.dll
2015-03-25 03:00 . 2015-04-15 09:04 50176 ----a-w- c:\windows\system32\WinSetupUI.dll
2015-03-25 03:00 . 2015-04-15 09:04 11776 ----a-w- c:\windows\system32\wu.upgrade.ps.dll
2015-03-25 03:00 . 2015-04-15 09:04 33792 ----a-w- c:\windows\system32\wuapp.exe
2015-03-25 03:00 . 2015-04-15 09:04 131584 ----a-w- c:\windows\system32\wuauclt.exe
2015-03-23 03:06 . 2015-04-15 09:04 576000 ----a-w- c:\windows\system32\generaltel.dll
2015-03-23 03:06 . 2015-04-15 09:04 630784 ----a-w- c:\windows\system32\invagent.dll
2015-03-23 03:06 . 2015-04-15 09:04 331264 ----a-w- c:\windows\system32\devinv.dll
2015-03-23 03:06 . 2015-04-15 09:04 860160 ----a-w- c:\windows\system32\appraiser.dll
2015-03-23 03:06 . 2015-04-15 09:04 26112 ----a-w- c:\windows\system32\acmigration.dll
2015-03-23 03:06 . 2015-04-15 09:04 202752 ----a-w- c:\windows\system32\aepdu.dll
2015-03-23 03:06 . 2015-04-15 09:04 159744 ----a-w- c:\windows\system32\aepic.dll
2015-03-23 02:59 . 2015-04-15 09:04 896000 ----a-w- c:\windows\system32\aeinv.dll
2015-03-10 03:08 . 2015-04-15 09:04 1237504 ----a-w- c:\windows\system32\msxml3.dll
2015-03-10 03:05 . 2015-04-15 09:04 2048 ----a-w- c:\windows\system32\msxml3r.dll
2015-03-05 12:37 . 2014-06-22 18:07 37896 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2015-03-05 04:06 . 2015-04-15 09:04 305152 ----a-w- c:\windows\system32\gdi32.dll
2015-03-04 04:16 . 2015-04-15 09:04 249784 ----a-w- c:\windows\system32\clfs.sys
2015-03-04 04:10 . 2015-04-15 09:04 58880 ----a-w- c:\windows\system32\clfsw32.dll
2015-03-04 04:10 . 2015-05-13 06:08 470528 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2015-03-04 04:10 . 2015-05-13 06:08 2178560 ----a-w- c:\windows\apppatch\AcGenral.dll
2015-03-04 04:06 . 2015-05-13 06:08 2560 ----a-w- c:\windows\apppatch\AcRes.dll
2015-02-25 03:03 . 2015-04-15 09:04 514560 ----a-w- c:\windows\system32\drivers\http.sys
2015-02-24 02:23 . 2015-03-24 19:21 246920 ------w- c:\windows\system32\MpSigStub.exe
2015-02-20 04:13 . 2015-03-11 05:25 26624 ----a-w- c:\windows\system32\lpk.dll
2015-02-20 04:13 . 2015-03-11 05:25 70656 ----a-w- c:\windows\system32\fontsub.dll
2015-02-20 04:13 . 2015-03-11 05:25 10240 ----a-w- c:\windows\system32\dciman32.dll
2015-02-20 04:13 . 2015-03-11 05:25 34304 ----a-w- c:\windows\system32\atmlib.dll
2015-02-20 03:09 . 2015-03-11 05:25 299008 ----a-w- c:\windows\system32\atmfd.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt1"]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12 152544 ----a-w- c:\users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt2"]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12 152544 ----a-w- c:\users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt3"]
@="{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12 152544 ----a-w- c:\users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt4"]
@="{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12 152544 ----a-w- c:\users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt5"]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12 152544 ----a-w- c:\users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt6"]
@="{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12 152544 ----a-w- c:\users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt7"]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12 152544 ----a-w- c:\users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt8"]
@="{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12 152544 ----a-w- c:\users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HydraVisionDesktopManager"="c:\program files\ATI Technologies\HydraVision\HydraDM.exe" [2013-08-30 389120]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2011-06-28 10127976]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-02-11 137752]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-02-11 171032]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-02-11 172568]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2015-05-07 728312]
"VX1000"="c:\windows\vVX1000.exe" [2010-05-20 762736]
"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2010-05-20 119152]
"iSCSIAgent"="c:\program files\QNAP\Qfinder\iSCSIAgent.exe" [2015-02-25 1739952]
"Avira Systray"="c:\program files\Avira\My Avira\Avira.OE.Systray.exe" [2015-03-16 129272]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\x86\CLIStart.exe" [2014-09-15 748256]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2014-12-19 1022152]
.
c:\users\Papa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files\Microsoft Office\Office14\ONENOTEM.EXE /tsr [2013-6-25 228552]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableSecureUIAPath"= 1 (0x1)
.
R2 AntiVirMailService;Avira Email-Schutz;c:\program files\Avira\AntiVir Desktop\avmailc7.exe [2015-05-07 827640]
R2 AntiVirWebService;Avira Browser-Schutz;c:\program files\Avira\AntiVir Desktop\avwebg7.exe [2015-05-07 1185584]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2014-12-11 315496]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2015-04-21 102912]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
S1 AsUpIO;AsUpIO;c:\windows\system32\drivers\AsUpIO.sys [2009-07-06 11448]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2015-05-07 37896]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2014-09-15 208896]
S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2015-05-07 434424]
S2 Avira.OE.ServiceHost;Avira Service Host;c:\program files\Avira\My Avira\Avira.OE.ServiceHost.exe [2015-03-16 201008]
S2 avnetflt;avnetflt;c:\windows\system32\DRIVERS\avnetflt.sys [2015-03-05 37896]
S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe [2009-07-14 20992]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [2014-06-21 77824]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x86.sys [2011-03-22 69232]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
utcsvc REG_MULTI_SZ DiagTrack
.
Inhalt des "geplante Tasks" Ordners
.
2015-05-16 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-06-22 09:34]
.
.
------- Zusätzlicher Suchlauf -------
.
mStart Page = about:blank
IE: Client auf Monitor & öffnen1 - c:\windows\web\AOpenClient.htm
IE: Client auf Monitor & öffnen2 - c:\windows\web\AOpenClient.htm
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\Boss\AppData\Roaming\Mozilla\Firefox\Profiles\ussg0rg9.default\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
c:\users\Papa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk - c:\users\Boss\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-638442100-2917554848-3055500443-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-638442100-2917554848-3055500443-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'Explorer.exe'(5792)
c:\program files\ATI Technologies\HydraVision\HydraDMH.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\atieclxx.exe
c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Microsoft LifeCam\MSCamS32.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\windows\system32\taskhost.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\windows\system32\conhost.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\DllHost.exe
c:\windows\system32\sppsvc.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2015-05-16 14:27:58 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2015-05-16 12:27
ComboFix2.txt 2015-05-15 07:22
.
Vor Suchlauf: 11 Verzeichnis(se), 198.105.440.256 Bytes frei
Nach Suchlauf: 12 Verzeichnis(se), 197.926.051.840 Bytes frei
.
- - End Of File - - 9D4796BB8611948E65719A20D945B13F
A36C5E4F47E84449FF07ED3517B43A31
MBAM: Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 16.05.2015 Suchlauf-Zeit: 14:36:45 Logdatei: mbam.txt Administrator: Ja Version: 2.01.6.1022 Malware Datenbank: v2015.05.16.02 Rootkit Datenbank: v2015.05.14.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x86 Dateisystem: NTFS Benutzer: Boss Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 425746 Verstrichene Zeit: 13 Min, 1 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (Keine schädliche Elemente gefunden) Module: 0 (Keine schädliche Elemente gefunden) Registrierungsschlüssel: 0 (Keine schädliche Elemente gefunden) Registrierungswerte: 0 (Keine schädliche Elemente gefunden) Registrierungsdaten: 0 (Keine schädliche Elemente gefunden) Ordner: 0 (Keine schädliche Elemente gefunden) Dateien: 0 (Keine schädliche Elemente gefunden) Physische Sektoren: 0 (Keine schädliche Elemente gefunden) (end) Code:
ATTFilter # AdwCleaner v4.204 - Bericht erstellt 16/05/2015 um 17:26:21
# Aktualisiert 12/05/2015 von Xplode
# Datenbank : 2015-05-12.2 [Server]
# Betriebssystem : Windows 7 Professional Service Pack 1 (x86)
# Benutzername : Boss - MARLENE
# Gestarted von : C:\Users\Boss\Desktop\AdwCleaner_4.204.exe
# Option : Suchlauf
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
***** [ Geplante Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
***** [ Internetbrowser ] *****
-\\ Internet Explorer v11.0.9600.17801
-\\ Mozilla Firefox v37.0.2 (x86 de)
*************************
AdwCleaner[R0].txt - [653 Bytes] - [16/05/2015 17:26:21]
########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [711 Bytes] ##########
Adw S0 Code:
ATTFilter # AdwCleaner v4.204 - Bericht erstellt 16/05/2015 um 17:28:20
# Aktualisiert 12/05/2015 von Xplode
# Datenbank : 2015-05-12.2 [Server]
# Betriebssystem : Windows 7 Professional Service Pack 1 (x86)
# Benutzername : Boss - MARLENE
# Gestarted von : C:\Users\Boss\Desktop\AdwCleaner_4.204.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
***** [ Geplante Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
***** [ Internetbrowser ] *****
-\\ Internet Explorer v11.0.9600.17801
-\\ Mozilla Firefox v37.0.2 (x86 de)
*************************
AdwCleaner[R0].txt - [789 Bytes] - [16/05/2015 17:26:21]
AdwCleaner[S0].txt - [710 Bytes] - [16/05/2015 17:28:20]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [768 Bytes] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.7.2 (05.15.2015:1)
OS: Windows 7 Professional x86
Ran by Boss on 16.05.2015 at 17:37:01,50
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Tasks
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 16.05.2015 at 17:38:31,01
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 16-05-2015 02
Ran by Boss (administrator) on MARLENE on 16-05-2015 17:46:01
Running from C:\Users\Papa\Desktop\TrojanerBoard
Loaded Profiles: Boss & Papa & Mama (Available profiles: Boss & Papa & Mama)
Platform: Microsoft Windows 7 Professional Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [10127976 2011-06-28] (Realtek Semiconductor)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [728312 2015-05-07] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [VX1000] => C:\Windows\vVX1000.exe [762736 2010-05-20] (Microsoft Corporation)
HKLM\...\Run: [LifeCam] => C:\Program Files\Microsoft LifeCam\LifeExp.exe [119152 2010-05-20] (Microsoft Corporation)
HKLM\...\Run: [iSCSIAgent] => C:\Program Files\QNAP\Qfinder\iSCSIAgent.exe [1739952 2015-02-25] ()
HKLM\...\Run: [Avira Systray] => C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe [129272 2015-03-16] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\x86\CLIStart.exe [748256 2014-09-15] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKU\S-1-5-21-638442100-2917554848-3055500443-1001\...\Run: [HydraVisionDesktopManager] => C:\Program Files\ATI Technologies\HydraVision\HydraDM.exe [389120 2013-08-30] (AMD)
HKU\S-1-5-21-638442100-2917554848-3055500443-1004\...\Run: [HydraVisionDesktopManager] => C:\Program Files\ATI Technologies\HydraVision\HydraDM.exe [389120 2013-08-30] (AMD)
Startup: C:\Users\Papa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk [2014-12-23]
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-638442100-2917554848-3055500443-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-638442100-2917554848-3055500443-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-638442100-2917554848-3055500443-1003\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKU\S-1-5-21-638442100-2917554848-3055500443-1004\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_31\bin\ssv.dll [2015-01-22] (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-22] (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Boss\AppData\Roaming\Mozilla\Firefox\Profiles\ussg0rg9.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-16] ()
FF Plugin: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-22] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-22] (Oracle Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF Extension: Adblock Plus - C:\Users\Boss\AppData\Roaming\Mozilla\Firefox\Profiles\ussg0rg9.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-06-22]
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S2 AntiVirMailService; C:\Program Files\Avira\AntiVir Desktop\avmailc7.exe [827640 2015-05-07] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [434424 2015-05-07] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [434424 2015-05-07] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe [1185584 2015-05-07] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [201008 2015-03-16] (Avira Operations GmbH & Co. KG)
R2 DiagTrack; C:\Windows\system32\diagtrack.dll [851456 2015-04-27] (Microsoft Corporation)
S2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R1 AsIO; C:\Windows\System32\drivers\AsIO.sys [11296 2009-08-04] ()
R1 AsUpIO; C:\Windows\System32\drivers\AsUpIO.sys [11448 2009-07-06] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [107400 2015-05-07] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2015-05-07] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37896 2015-05-07] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [37896 2015-03-05] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2015-04-14] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [13216 2009-07-16] ()
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2014-05-27] (Avira GmbH)
S3 VX1000; C:\Windows\System32\DRIVERS\VX1000.sys [1961072 2010-05-20] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Boss\AppData\Local\Temp\catchme.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-05-16 17:38 - 2015-05-16 17:38 - 00000599 _____ () C:\Users\Boss\Desktop\JRT.txt
2015-05-16 17:37 - 2015-05-16 17:37 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-MARLENE-Windows-7-Professional-(32-bit).dat
2015-05-16 17:37 - 2015-05-16 17:37 - 00000000 ____D () C:\RegBackup
2015-05-16 17:26 - 2015-05-16 17:33 - 00000000 ____D () C:\AdwCleaner
2015-05-16 17:25 - 2015-05-16 17:25 - 00001209 _____ () C:\Users\Boss\Desktop\mbam.txt
2015-05-16 14:34 - 2015-05-16 14:34 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Boss\Desktop\mbam-setup-2.1.6.1022.exe
2015-05-16 14:34 - 2015-05-16 14:34 - 02719698 _____ (Thisisu) C:\Users\Boss\Desktop\JRT.exe
2015-05-16 14:34 - 2015-05-16 14:34 - 02209792 _____ () C:\Users\Boss\Desktop\AdwCleaner_4.204.exe
2015-05-16 14:27 - 2015-05-16 14:27 - 00015819 _____ () C:\ComboFix.txt
2015-05-16 14:11 - 2015-05-16 14:11 - 00000000 ____D () C:\Users\Boss\AppData\Roaming\ATI
2015-05-16 14:11 - 2015-05-16 14:11 - 00000000 ____D () C:\Users\Boss\AppData\Local\ATI
2015-05-15 09:11 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-05-15 09:11 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-05-15 09:11 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-05-15 09:11 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-05-15 09:11 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-05-15 09:11 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2015-05-15 09:11 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2015-05-15 09:11 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2015-05-15 09:10 - 2015-05-16 14:28 - 00000000 ____D () C:\Qoobox
2015-05-15 09:10 - 2015-05-16 14:22 - 00000000 ____D () C:\Windows\erdnt
2015-05-14 07:51 - 2015-05-14 08:18 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-05-14 07:50 - 2015-05-14 08:18 - 00000000 ____D () C:\Users\Papa\Desktop\mbar
2015-05-13 21:33 - 2015-05-16 17:46 - 00000000 ____D () C:\FRST
2015-05-13 21:33 - 2015-05-13 21:33 - 00000000 _____ () C:\Users\Boss\defogger_reenable
2015-05-13 21:32 - 2015-05-16 17:43 - 00000000 ____D () C:\Users\Papa\Desktop\TrojanerBoard
2015-05-13 20:29 - 2015-05-01 15:16 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 08:09 - 2015-05-05 03:12 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-05-13 08:09 - 2015-04-27 21:11 - 03989440 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2015-05-13 08:09 - 2015-04-27 21:11 - 03934144 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-05-13 08:09 - 2015-04-27 21:11 - 00137664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-05-13 08:09 - 2015-04-27 21:11 - 00067520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-05-13 08:09 - 2015-04-27 21:08 - 01307648 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-05-13 08:09 - 2015-04-27 21:05 - 00851456 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-05-13 08:09 - 2015-04-27 21:05 - 00635392 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-05-13 08:09 - 2015-04-27 21:05 - 00400896 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-05-13 08:09 - 2015-04-27 21:05 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-05-13 08:09 - 2015-04-27 21:05 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-05-13 08:09 - 2015-04-27 21:05 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-05-13 08:09 - 2015-04-27 21:05 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-05-13 08:09 - 2015-04-27 21:05 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll
2015-05-13 08:09 - 2015-04-27 21:05 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-05-13 08:09 - 2015-04-27 21:05 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-05-13 08:09 - 2015-04-27 21:05 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-05-13 08:09 - 2015-04-27 21:05 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-05-13 08:09 - 2015-04-27 21:04 - 01061376 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-05-13 08:09 - 2015-04-27 21:04 - 00641536 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-05-13 08:09 - 2015-04-27 21:04 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-05-13 08:09 - 2015-04-27 21:04 - 00364544 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe
2015-05-13 08:09 - 2015-04-27 21:04 - 00262656 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-05-13 08:09 - 2015-04-27 21:04 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2015-05-13 08:09 - 2015-04-27 21:04 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-05-13 08:09 - 2015-04-27 21:04 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe
2015-05-13 08:09 - 2015-04-27 21:04 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-05-13 08:09 - 2015-04-27 21:04 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe
2015-05-13 08:09 - 2015-04-27 21:04 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-05-13 08:09 - 2015-04-27 21:04 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-05-13 08:09 - 2015-04-27 21:03 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-05-13 08:09 - 2015-04-27 21:03 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe
2015-05-13 08:09 - 2015-04-27 21:01 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-05-13 08:09 - 2015-04-27 21:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-05-13 08:09 - 2015-04-27 20:59 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-05-13 08:09 - 2015-04-27 20:59 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-05-13 08:09 - 2015-04-27 20:00 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-05-13 08:09 - 2015-04-22 03:48 - 00342736 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-05-13 08:09 - 2015-04-21 18:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-05-13 08:09 - 2015-04-21 18:25 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-05-13 08:09 - 2015-04-21 18:24 - 19691008 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-05-13 08:09 - 2015-04-21 18:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-05-13 08:09 - 2015-04-21 18:11 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-05-13 08:09 - 2015-04-21 18:10 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-05-13 08:09 - 2015-04-21 18:09 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-05-13 08:09 - 2015-04-21 18:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-05-13 08:09 - 2015-04-21 18:04 - 02278400 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-05-13 08:09 - 2015-04-21 18:03 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-05-13 08:09 - 2015-04-21 18:02 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-05-13 08:09 - 2015-04-21 18:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-05-13 08:09 - 2015-04-21 17:58 - 00664576 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-05-13 08:09 - 2015-04-21 17:58 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-05-13 08:09 - 2015-04-21 17:58 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-05-13 08:09 - 2015-04-21 17:57 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-05-13 08:09 - 2015-04-21 17:51 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-05-13 08:09 - 2015-04-21 17:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-05-13 08:09 - 2015-04-21 17:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-05-13 08:09 - 2015-04-21 17:39 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-05-13 08:09 - 2015-04-21 17:38 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-05-13 08:09 - 2015-04-21 17:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-05-13 08:09 - 2015-04-21 17:31 - 04305920 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-05-13 08:09 - 2015-04-21 17:26 - 00688640 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-05-13 08:09 - 2015-04-21 17:26 - 00685568 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-05-13 08:09 - 2015-04-21 17:25 - 02052608 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-05-13 08:09 - 2015-04-21 17:24 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-05-13 08:09 - 2015-04-21 17:17 - 12828672 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-05-13 08:09 - 2015-04-21 17:02 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-05-13 08:09 - 2015-04-21 16:58 - 01310208 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-05-13 08:09 - 2015-04-21 16:56 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-05-13 08:09 - 2015-04-20 04:56 - 01250816 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-05-13 08:09 - 2015-04-20 04:56 - 00909312 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-05-13 08:09 - 2015-04-20 04:03 - 02382336 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-05-13 08:09 - 2015-04-18 04:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-05-13 08:09 - 2015-04-13 05:19 - 00259072 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-05-13 08:09 - 2015-01-29 05:02 - 02311168 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll
2015-05-13 08:08 - 2015-04-08 05:14 - 00216064 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-05-13 08:08 - 2015-04-08 05:14 - 00019968 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-05-13 08:08 - 2015-03-04 06:11 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\shimeng.dll
2015-05-13 08:08 - 2015-03-04 06:10 - 00295936 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2015-05-13 08:08 - 2015-03-04 06:10 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\aelupsvc.dll
2015-05-13 08:08 - 2015-03-04 06:10 - 00020992 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2015-05-13 08:08 - 2015-02-18 09:06 - 00123904 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2015-05-10 20:57 - 2015-05-10 20:57 - 00000000 ____D () C:\Users\Mama\AppData\Roaming\ATI
2015-05-10 20:57 - 2015-05-10 20:57 - 00000000 ____D () C:\Users\Mama\AppData\Local\ATI
2015-05-10 12:53 - 2015-05-10 12:53 - 00000000 ____D () C:\Program Files\13-9_win7_win8_32-64_hydravision
2015-05-10 12:50 - 2015-05-10 12:50 - 00000000 ____D () C:\Program Files\Sapphire TRIXX
2015-05-10 12:48 - 2015-05-10 12:48 - 00000000 ____D () C:\Users\Papa\AppData\Roaming\ATI
2015-05-10 12:48 - 2015-05-10 12:48 - 00000000 ____D () C:\Users\Papa\AppData\Local\ATI
2015-05-10 12:48 - 2015-05-10 12:48 - 00000000 ____D () C:\ProgramData\ATI
2015-05-10 12:48 - 2015-05-10 12:48 - 00000000 _____ () C:\Windows\ativpsrm.bin
2015-05-10 12:46 - 2015-05-10 12:46 - 00054924 _____ () C:\Windows\system32\CCCInstall_201505101246249548.log
2015-05-10 12:46 - 2015-05-10 12:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center
2015-05-10 12:46 - 2015-05-10 12:46 - 00000000 ____D () C:\ProgramData\AMD
2015-05-10 12:46 - 2015-05-10 12:46 - 00000000 ____D () C:\Program Files\AMD AVT
2015-05-10 12:44 - 2015-05-10 12:44 - 00000000 ____D () C:\Program Files\Common Files\ATI Technologies
2015-05-10 12:44 - 2015-05-10 12:44 - 00000000 ____D () C:\Program Files\AMD
2015-05-10 12:43 - 2015-05-10 12:43 - 00000000 ____D () C:\Program Files\ATI
2015-05-10 12:42 - 2015-05-10 12:53 - 00000000 ____D () C:\Program Files\ATI Technologies
2015-05-10 12:41 - 2015-05-10 12:41 - 00000000 ____D () C:\Program Files\AMD-Catalyst-14-9-win7-win8.1-32Bit-dd-ccc-whql
2015-05-10 12:40 - 2015-05-10 12:40 - 27185683 _____ () C:\Users\Papa\Downloads\13-9_win7_win8_32-64_hydravision_635163290847474865.zip
2015-05-10 12:37 - 2015-05-10 12:37 - 03650806 _____ () C:\Users\Papa\Downloads\TRIXX_installer_635456807114954507.zip
2015-05-10 12:31 - 2015-05-10 12:34 - 210810949 _____ () C:\Users\Papa\Downloads\amd-catalyst-14-9-win7-win8.1-32bit-dd-ccc-whql_635476727041970015.zip
2015-05-08 21:36 - 2015-05-09 14:21 - 00000000 ____D () C:\Users\Papa\AppData\Roaming\XnView
2015-05-08 21:35 - 2015-05-08 21:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XnView
2015-05-08 21:35 - 2015-05-08 21:35 - 00000000 ____D () C:\Program Files\XnView
2015-05-08 21:33 - 2015-05-08 21:33 - 05062128 _____ (Gougelet Pierre-e ) C:\Users\Papa\Downloads\XnView-win.exe
2015-05-08 21:08 - 2015-05-08 21:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QNAP
2015-05-08 21:07 - 2015-05-09 14:38 - 00000000 ____D () C:\Users\Papa\Desktop\Entwickeln
2015-05-08 21:06 - 2015-05-08 21:07 - 31496600 _____ (Igor Pavlov) C:\Users\Papa\Downloads\QNAPQfinderWindows-5.0.1.0225.exe
2015-05-07 21:04 - 2015-05-07 21:48 - 00016760 _____ () C:\Users\Papa\Downloads\planungSiedlungsfest.xlsx
2015-04-29 18:05 - 2015-04-29 18:16 - 00000000 ____D () C:\Users\Papa\Desktop\Neuer Ordner
2015-04-24 14:29 - 2015-04-24 14:29 - 00000000 ____D () C:\Program Files\Mozilla Firefox
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-05-16 17:44 - 2009-07-14 06:34 - 00025328 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-05-16 17:44 - 2009-07-14 06:34 - 00025328 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-05-16 17:34 - 2015-01-15 16:26 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-05-16 17:34 - 2014-06-20 21:07 - 01818626 _____ () C:\Windows\WindowsUpdate.log
2015-05-16 17:29 - 2014-08-09 22:30 - 00017982 _____ () C:\Windows\setupact.log
2015-05-16 17:29 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-16 14:36 - 2015-03-15 17:58 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-05-16 14:36 - 2015-03-15 17:57 - 00001060 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-05-16 14:36 - 2015-03-15 17:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-05-16 14:36 - 2015-03-15 17:57 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware
2015-05-16 14:24 - 2009-07-14 04:04 - 00000215 _____ () C:\Windows\system.ini
2015-05-16 14:22 - 2014-08-09 22:30 - 00204436 _____ () C:\Windows\PFRO.log
2015-05-16 14:17 - 2014-06-22 20:13 - 00000000 ____D () C:\Users\Boss\AppData\Roaming\Avira
2015-05-16 14:10 - 2015-01-23 16:22 - 00000000 ___RD () C:\Users\Papa\Dropbox
2015-05-16 14:10 - 2015-01-23 16:17 - 00000000 ____D () C:\Users\Papa\AppData\Roaming\Dropbox
2015-05-15 22:40 - 2014-07-01 20:16 - 00000000 ____D () C:\Users\Papa\AppData\Roaming\Canon
2015-05-15 22:07 - 2014-07-01 20:38 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-05-15 09:22 - 2009-07-14 04:37 - 00000000 __RHD () C:\Users\Default
2015-05-15 09:22 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public
2015-05-14 08:52 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2015-05-14 07:37 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2015-05-14 03:02 - 2009-07-14 10:57 - 00000000 ____D () C:\Program Files\Windows Journal
2015-05-13 21:33 - 2014-06-20 22:54 - 00000000 ____D () C:\Users\Boss
2015-05-13 21:00 - 2014-06-20 22:56 - 01618320 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-05-13 20:55 - 2009-07-14 06:33 - 00334288 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-05-13 20:53 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2015-05-13 20:53 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\AdvancedInstallers
2015-05-13 20:30 - 2014-08-11 16:46 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-05-13 20:28 - 2014-06-22 10:37 - 00000000 ____D () C:\Windows\system32\MRT
2015-05-13 20:24 - 2014-06-22 10:37 - 137310008 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-05-10 12:43 - 2014-06-22 20:05 - 00000000 ____D () C:\ProgramData\Package Cache
2015-05-09 08:42 - 2015-01-23 16:19 - 00000000 ____D () C:\Users\Papa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-05-07 17:50 - 2014-06-22 20:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-05-07 17:49 - 2014-06-22 20:07 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-05-07 17:49 - 2014-06-22 20:07 - 00107400 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-05-07 17:49 - 2014-06-22 20:07 - 00037896 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2015-04-30 21:07 - 2014-08-20 20:19 - 00000000 ____D () C:\Users\Mama\AppData\Roaming\Canon
2015-04-26 20:15 - 2014-06-21 09:05 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2015-04-16 19:30 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\AppCompat
2015-04-16 11:34 - 2014-06-22 19:25 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-04-16 11:34 - 2014-06-22 19:25 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
Some content of TEMP:
====================
C:\Users\Boss\AppData\Local\temp\avgnt.exe
C:\Users\Papa\AppData\Local\temp\avgnt.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-05-14 08:43
==================== End Of Log ============================
--- --- --- --- --- --- ADDITION: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 16-05-2015 02
Ran by Boss at 2015-05-16 17:46:21
Running from C:\Users\Papa\Desktop\TrojanerBoard
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-638442100-2917554848-3055500443-500 - Administrator - Disabled)
Boss (S-1-5-21-638442100-2917554848-3055500443-1001 - Administrator - Enabled) => C:\Users\Boss
Gast (S-1-5-21-638442100-2917554848-3055500443-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-638442100-2917554848-3055500443-1002 - Limited - Enabled)
Mama (S-1-5-21-638442100-2917554848-3055500443-1004 - Limited - Enabled) => C:\Users\Mama
Papa (S-1-5-21-638442100-2917554848-3055500443-1003 - Limited - Enabled) => C:\Users\Papa
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Antivirus (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Antivirus (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Flash Player 17 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.11) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.11 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\...\{319271B3-E2AA-F623-928E-245C9EBF16F7}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 1.0.2.43 - Atheros Communications Inc.)
Avira (HKLM\...\{b5675cc4-ab8b-4945-8c1d-4c5479556d6a}) (Version: 1.1.34.19732 - Avira Operations GmbH & Co. KG)
Avira (Version: 1.1.34.19732 - Avira Operations GmbH & Co. KG) Hidden
Avira Antivirus (HKLM\...\Avira Antivirus) (Version: 15.0.10.434 - Avira Operations GmbH & Co. KG)
Canon MP Navigator 2.0 (HKLM\...\MP Navigator 2.0) (Version: - )
Canon MP150 (HKLM\...\{CA9A3609-3ECC-4574-8824-A8161A71A603}) (Version: - )
CCleaner (HKLM\...\CCleaner) (Version: 4.16 - Piriform)
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
Dropbox (HKU\S-1-5-21-638442100-2917554848-3055500443-1003\...\Dropbox) (Version: 3.4.6 - Dropbox, Inc.)
ESET Online Scanner v3 (HKLM\...\ESET Online Scanner) (Version: - )
Fotogalerie (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
HydraVision (Version: 4.2.252.0 - Advanced Micro Devices, Inc.) Hidden
Java 8 Update 31 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
Junk Mail filter update (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Malwarebytes Anti-Malware Version 2.1.6.1022 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft LifeCam (HKLM\...\{5FC7AB5C-61FC-42DF-A923-5139BCF10D42}) (Version: 3.22.270.0 - Microsoft Corporation)
Microsoft Office Home and Student 2010 (HKLM\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x86) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Movie Maker (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 37.0.2 (x86 de) (HKLM\...\Mozilla Firefox 37.0.2 (x86 de)) (Version: 37.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 30.0 - Mozilla)
ProjectLibre (HKLM\...\{E29A4ED9-3192-4D72-A2E2-9C32B512714D}) (Version: 1.5.19.0 - ProjectLibre)
QNAP Qfinder (HKLM\...\QNAP_FINDER) (Version: 5.0.1.0225 - QNAP Systems, Inc.)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6402 - Realtek Semiconductor Corp.)
Sapphire TRIXX (HKLM\...\Sapphire TRIXX) (Version: - )
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Skype™ 7.0 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
VisiPics V1.31 (HKLM\...\VisiPics_is1) (Version: - Ozone)
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Win32DiskImager version 0.9.5 (HKLM\...\{D074CE74-912A-4AD3-A0BF-3937D9D01F17}_is1) (Version: 0.9.5 - ImageWriter Developers)
Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
XnView 2.32 (HKLM\...\XnView_is1) (Version: 2.32 - Gougelet Pierre-e)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-638442100-2917554848-3055500443-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Papa\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-638442100-2917554848-3055500443-1001_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-638442100-2917554848-3055500443-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-638442100-2917554848-3055500443-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-638442100-2917554848-3055500443-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-638442100-2917554848-3055500443-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-638442100-2917554848-3055500443-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-638442100-2917554848-3055500443-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-638442100-2917554848-3055500443-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-638442100-2917554848-3055500443-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
==================== Restore Points =========================
10-05-2015 12:43:25 Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727
12-05-2015 08:35:08 Windows Update
13-05-2015 20:16:41 Windows Update
14-05-2015 03:00:30 Windows Update
16-05-2015 14:12:50 ComboFix created restore point
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {01AD3CEB-9D22-4855-8AB3-762E5C495DB0} - System32\Tasks\iSCSIAgentAutoStartup => C:\Program Files\QNAP\Qfinder\iSCSIAgent.exe [2015-02-25] ()
Task: {0A8BEC4D-B503-4720-8171-D9C419114A9D} - System32\Tasks\Microsoft\Windows\Setup\gwx\runappraiser => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
Task: {3122BEB9-7F60-4790-8852-D0ACD62CD986} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {35A2376D-FFCC-4E23-8AAD-43B1D68FDDF7} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-07-23] (Piriform Ltd)
Task: {407224FD-0811-4FCD-83C1-CC82D76FB3AC} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-03-25] (Microsoft Corporation)
Task: {7670CFAC-7A91-4436-B09E-DBCAC18BCE25} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
Task: {BCB6987B-D616-4829-A477-EAE852BA1FAC} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-16] (Adobe Systems Incorporated)
Task: {DFB84816-384E-46F5-899E-D90803D59DD8} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxcontent => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (Whitelisted) ==============
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (Whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, the associated entry will be removed from the registry.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-638442100-2917554848-3055500443-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Boss\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
HKU\S-1-5-21-638442100-2917554848-3055500443-1003\Control Panel\Desktop\\Wallpaper ->
HKU\S-1-5-21-638442100-2917554848-3055500443-1004\Control Panel\Desktop\\Wallpaper -> C:\Users\Mama\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.178.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{DBB8CF3A-16F2-4CC0-9060-99FCE4D8BD76}] => (Allow) C:\Program Files\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{66352015-F38D-454F-988A-9F78FD497257}] => (Allow) LPort=2869
FirewallRules: [{8223D6A9-A0B0-40BF-B456-B59E6B3AF9CD}] => (Allow) LPort=1900
FirewallRules: [{FEA0FCAF-534E-4787-8A53-119F1A08CD0B}] => (Allow) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
FirewallRules: [{02F30D98-EA7D-4CBE-91F4-17BDBF1B5670}] => (Allow) C:\Program Files\Skype\Phone\Skype.exe
FirewallRules: [{4AD1446A-5C2B-4213-B7A1-18E85160D0EF}] => (Allow) C:\Program Files\Microsoft LifeCam\LifeCam.exe
FirewallRules: [{BBB3FC36-BAA8-4CDE-A747-A9684F3881D6}] => (Allow) C:\Program Files\Microsoft LifeCam\LifeCam.exe
FirewallRules: [{56DB8066-5909-414D-B1FB-B20EA7E8F6A2}] => (Allow) C:\Program Files\Microsoft LifeCam\LifeEnC2.exe
FirewallRules: [{F1332063-E7F2-466A-9CE9-C2EA2DB37125}] => (Allow) C:\Program Files\Microsoft LifeCam\LifeEnC2.exe
FirewallRules: [{8658ABE9-FCB7-4855-BD61-EAE44E28F1BC}] => (Allow) C:\Program Files\Microsoft LifeCam\LifeExp.exe
FirewallRules: [{A155F6B4-64CF-4A42-BDC1-4B8A817D58F0}] => (Allow) C:\Program Files\Microsoft LifeCam\LifeExp.exe
FirewallRules: [{9B2122CE-A939-4906-A827-80F40CB69728}] => (Allow) C:\Program Files\Microsoft LifeCam\LifeTray.exe
FirewallRules: [{13481C4C-AA22-4EA1-AA52-5C54CA65E071}] => (Allow) C:\Program Files\Microsoft LifeCam\LifeTray.exe
FirewallRules: [TCP Query User{B42186AC-37B5-42E2-89BC-BA645A745B20}C:\program files\qnap\qfinder\qfinder.exe] => (Allow) C:\program files\qnap\qfinder\qfinder.exe
FirewallRules: [UDP Query User{B818E706-1AA3-476F-8A4E-6CDA8CB5D472}C:\program files\qnap\qfinder\qfinder.exe] => (Allow) C:\program files\qnap\qfinder\qfinder.exe
FirewallRules: [{2A4599AC-9DEA-44E4-8F87-421CBD3187E2}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{1DD2CA93-EB8E-42DB-9329-D87D154DF2AF}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{5A3B61DB-CFF5-4DED-A980-6869C9F26F92}C:\users\papa\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\papa\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [UDP Query User{3A7F5060-E0D3-441A-9710-D6C211189ECC}C:\users\papa\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\papa\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [{A72EE390-C1FC-4A14-9EAB-23A4A00E7594}] => (Allow) C:\Users\Papa\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{E3E8BDF5-34F1-4693-A247-98E41004F359}] => (Allow) C:\Users\Papa\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [TCP Query User{2826F32C-2020-4759-8E66-B629D7DE577B}C:\program files\mozilla firefox\firefox.exe] => (Block) C:\program files\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{14B2ED73-9D4E-4953-BFC5-D6091E105B5A}C:\program files\mozilla firefox\firefox.exe] => (Block) C:\program files\mozilla firefox\firefox.exe
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (05/16/2015 05:31:00 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: CCC.exe, Version: 4.5.0.0, Zeitstempel: 0x53ad0dcc
Name des fehlerhaften Moduls: amdmantle32.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x541762c0
Ausnahmecode: 0xc0000005
Fehleroffset: 0x600f85cc
ID des fehlerhaften Prozesses: 0xdcc
Startzeit der fehlerhaften Anwendung: 0xCCC.exe0
Pfad der fehlerhaften Anwendung: CCC.exe1
Pfad des fehlerhaften Moduls: CCC.exe2
Berichtskennung: CCC.exe3
Error: (05/16/2015 05:30:54 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: CCC.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund eines Ausnahmefehlers beendet.
Ausnahmeinformationen: Ausnahmecode c0000005, Ausnahmeadresse 600F85CC
Error: (05/16/2015 01:25:15 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (05/16/2015 01:25:07 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (05/16/2015 01:25:07 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (05/16/2015 01:25:07 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (05/15/2015 05:10:45 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (05/15/2015 05:10:37 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (05/15/2015 05:10:37 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (05/15/2015 05:10:37 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
System errors:
=============
Error: (05/16/2015 05:37:23 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Software Protection" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (05/16/2015 05:37:23 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Media Player-Netzwerkfreigabedienst" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (05/16/2015 05:37:22 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Avira Service Host" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 10000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (05/16/2015 05:37:22 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "MSCamSvc" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (05/16/2015 05:37:22 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Adobe Acrobat Update Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (05/16/2015 05:37:22 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Druckwarteschlange" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (05/16/2015 05:37:22 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "AMD External Events Utility" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (05/16/2015 05:28:50 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows Media Player-Netzwerkfreigabedienst" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069
Error: (05/16/2015 05:28:50 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "WMPNetworkSvc" konnte sich nicht als "NT AUTHORITY\NetworkService" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:
%%50
Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).
Error: (05/16/2015 05:28:49 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069
Microsoft Office Sessions:
=========================
Error: (05/16/2015 05:31:00 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: CCC.exe4.5.0.053ad0dccamdmantle32.dll_unloaded0.0.0.0541762c0c0000005600f85ccdcc01d08fed2c556402C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exeamdmantle32.dll8d59bd53-fbe0-11e4-848a-386077c4b35b
Error: (05/16/2015 05:30:54 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: CCC.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund eines Ausnahmefehlers beendet.
Ausnahmeinformationen: Ausnahmecode c0000005, Ausnahmeadresse 600F85CC
Error: (05/16/2015 01:25:15 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\ati technologies\ATI.ACE\core-static\SLSTaskbar64.exe
Error: (05/16/2015 01:25:07 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\ati technologies\hydravision\HydraMD64.exe
Error: (05/16/2015 01:25:07 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\ati technologies\hydravision\HydraDM64.exe
Error: (05/16/2015 01:25:07 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\ati technologies\hydravision\Grid64.exe
Error: (05/15/2015 05:10:45 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\ati technologies\ATI.ACE\core-static\SLSTaskbar64.exe
Error: (05/15/2015 05:10:37 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\ati technologies\hydravision\HydraMD64.exe
Error: (05/15/2015 05:10:37 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\ati technologies\hydravision\HydraDM64.exe
Error: (05/15/2015 05:10:37 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\ati technologies\hydravision\Grid64.exe
==================== Memory info ===========================
Processor: Intel(R) Core(TM)2 Duo CPU E7300 @ 2.66GHz
Percentage of memory in use: 31%
Total physical RAM: 3583.12 MB
Available physical RAM: 2461.97 MB
Total Pagefile: 7164.55 MB
Available Pagefile: 5710.48 MB
Total Virtual: 2047.88 MB
Available Virtual: 1896.44 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:232.87 GB) (Free:183.94 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive e: (Medium) (Fixed) (Total:74.52 GB) (Free:35.78 GB) NTFS
Drive f: (Software) (Fixed) (Total:158.36 GB) (Free:94.55 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: 1BE02E2A)
Partition 1: (Not Active) - (Size=993 KB) - (Type=42)
Partition 2: (Active) - (Size=232.9 GB) - (Type=42)
Partition 3: (Not Active) - (Size=11 MB) - (Type=42)
========================================================
Disk: 1 (Size: 232.9 GB) (Disk ID: 7AFDC950)
Partition 1: (Not Active) - (Size=74.5 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=158.4 GB) - (Type=07 NTFS)
========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: C857D49A)
Partition 1: (Not Active) - (Size=1008 KB) - (Type=42)
Partition 2: (Active) - (Size=232.9 GB) - (Type=42)
Partition 3: (Not Active) - (Size=11 MB) - (Type=42)
==================== End Of Log ============================
Gibts denn schon irgendwelche Hinweise auf nen Befall? |
|
17.05.2015, 08:06
| #8 |
| /// the machine /// TB-Ausbilder | PDF mit Trojaner geöffnet, Windows 7 Sieht gut aus. Noch nen Onlinescan und wir räumen auf ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
17.05.2015, 08:30
| #9 |
| | PDF mit Trojaner geöffnet, Windows 7 Moin moin, Bei ESET habe ich den roten Pfeil so interpretiert, dass ich den setzten soll. Zumindest hat er ja auch was gefunden (Wenngleich es nicht ein Trojaner ist). ESET: Code:
ATTFilter C:\Users\All Users\Avira\My Avira\Temp\antivirus.exe Variante von Win32/Bundled.Toolbar.Ask.D potenziell unsichere Anwendung
\\Marlene\Users\All Users\Avira\My Avira\Temp\antivirus.exe Variante von Win32/Bundled.Toolbar.Ask.D potenziell unsichere Anwendung
\\Marlene\Users\Papa\Downloads\ccsetup416.exe Win32/Bundled.Toolbar.Google.D potenziell unsichere Anwendung
\\Marlene\Users\Papa\Downloads\FreeAudioCDBurner_2.0.28.806.exe Variante von Win32/OpenCandy.C potenziell unsichere Anwendung
C:\ProgramData\Avira\My Avira\Temp\antivirus.exe Variante von Win32/Bundled.Toolbar.Ask.D potenziell unsichere Anwendung gelöscht - in Quarantäne kopiert
C:\Users\Papa\Downloads\ccsetup416.exe Win32/Bundled.Toolbar.Google.D potenziell unsichere Anwendung gelöscht - in Quarantäne kopiert
C:\Users\Papa\Downloads\FreeAudioCDBurner_2.0.28.806.exe Variante von Win32/OpenCandy.C potenziell unsichere Anwendung gelöscht - in Quarantäne kopiert
F:\Doreen\zzz.exe Win32/OpenCandy potenziell unsichere Anwendung gelöscht - in Quarantäne kopiert
Code:
ATTFilter Results of screen317's Security Check version 1.001
Windows 7 Service Pack 1 x86 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Avira Antivirus
Antivirus up to date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
CCleaner
Java 8 Update 31
Java version 32-bit out of Date!
Adobe Flash Player 17.0.0.169
Adobe Reader XI
Mozilla Firefox (37.0.2)
````````Process Check: objlist.exe by Laurent````````
Avira Antivir avgnt.exe
Avira Antivir avguard.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 16-05-2015 02
Ran by Boss (administrator) on MARLENE on 17-05-2015 09:23:37
Running from C:\Users\Boss\Desktop
Loaded Profiles: Boss & Papa & Mama (Available profiles: Boss & Papa & Mama)
Platform: Microsoft Windows 7 Professional Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corporation) C:\Program Files\Microsoft LifeCam\MSCamS32.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
() C:\Program Files\QNAP\Qfinder\iSCSIAgent.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Windows\vVX1000.exe
(Microsoft Corporation) C:\Program Files\Microsoft LifeCam\LifeExp.exe
(AMD) C:\Program Files\ATI Technologies\HydraVision\HydraDM.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [10127976 2011-06-28] (Realtek Semiconductor)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [728312 2015-05-07] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [VX1000] => C:\Windows\vVX1000.exe [762736 2010-05-20] (Microsoft Corporation)
HKLM\...\Run: [LifeCam] => C:\Program Files\Microsoft LifeCam\LifeExp.exe [119152 2010-05-20] (Microsoft Corporation)
HKLM\...\Run: [iSCSIAgent] => C:\Program Files\QNAP\Qfinder\iSCSIAgent.exe [1739952 2015-02-25] ()
HKLM\...\Run: [Avira Systray] => C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe [129272 2015-03-16] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\x86\CLIStart.exe [748256 2014-09-15] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKU\S-1-5-21-638442100-2917554848-3055500443-1001\...\Run: [HydraVisionDesktopManager] => C:\Program Files\ATI Technologies\HydraVision\HydraDM.exe [389120 2013-08-30] (AMD)
HKU\S-1-5-21-638442100-2917554848-3055500443-1004\...\Run: [HydraVisionDesktopManager] => C:\Program Files\ATI Technologies\HydraVision\HydraDM.exe [389120 2013-08-30] (AMD)
Startup: C:\Users\Papa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk [2014-12-23]
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-638442100-2917554848-3055500443-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-638442100-2917554848-3055500443-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-638442100-2917554848-3055500443-1003\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKU\S-1-5-21-638442100-2917554848-3055500443-1004\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_31\bin\ssv.dll [2015-01-22] (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-22] (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Boss\AppData\Roaming\Mozilla\Firefox\Profiles\ussg0rg9.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-16] ()
FF Plugin: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-22] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-22] (Oracle Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF Extension: Adblock Plus - C:\Users\Boss\AppData\Roaming\Mozilla\Firefox\Profiles\ussg0rg9.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-06-22]
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S2 AntiVirMailService; C:\Program Files\Avira\AntiVir Desktop\avmailc7.exe [827640 2015-05-07] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [434424 2015-05-07] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [434424 2015-05-07] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe [1185584 2015-05-07] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [201008 2015-03-16] (Avira Operations GmbH & Co. KG)
R2 DiagTrack; C:\Windows\system32\diagtrack.dll [851456 2015-04-27] (Microsoft Corporation)
S2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R1 AsIO; C:\Windows\System32\drivers\AsIO.sys [11296 2009-08-04] ()
R1 AsUpIO; C:\Windows\System32\drivers\AsUpIO.sys [11448 2009-07-06] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [107400 2015-05-07] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2015-05-07] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37896 2015-05-07] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [37896 2015-03-05] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2015-04-14] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [13216 2009-07-16] ()
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2014-05-27] (Avira GmbH)
S3 VX1000; C:\Windows\System32\DRIVERS\VX1000.sys [1961072 2010-05-20] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Boss\AppData\Local\Temp\catchme.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-05-17 09:23 - 2015-05-17 09:23 - 00011705 _____ () C:\Users\Boss\Desktop\FRST.txt
2015-05-17 09:23 - 2015-05-17 09:23 - 00002125 _____ () C:\Users\Boss\Desktop\Neues Textdokument.txt
2015-05-17 09:14 - 2015-05-17 09:14 - 00000839 _____ () C:\Users\Boss\Desktop\checkup.txt
2015-05-17 07:54 - 2015-05-17 07:54 - 00001041 _____ () C:\Users\Boss\Desktop\ESET.txt
2015-05-16 22:11 - 2015-05-16 22:11 - 00000000 ____D () C:\Users\Boss\Desktop\2015_05_16
2015-05-16 22:08 - 2015-05-16 22:11 - 00000000 ____D () C:\Users\Boss\AppData\Roaming\Canon
2015-05-16 21:40 - 2015-05-16 21:40 - 02347384 _____ (ESET) C:\Users\Boss\Desktop\esetsmartinstaller_deu.exe
2015-05-16 21:40 - 2015-05-16 21:40 - 00852630 _____ () C:\Users\Boss\Desktop\SecurityCheck.exe
2015-05-16 17:43 - 2015-05-16 17:43 - 01146368 _____ (Farbar) C:\Users\Boss\Desktop\FRST.exe
2015-05-16 17:38 - 2015-05-16 17:38 - 00000599 _____ () C:\Users\Boss\Desktop\JRT.txt
2015-05-16 17:37 - 2015-05-16 17:37 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-MARLENE-Windows-7-Professional-(32-bit).dat
2015-05-16 17:37 - 2015-05-16 17:37 - 00000000 ____D () C:\RegBackup
2015-05-16 17:26 - 2015-05-16 17:33 - 00000000 ____D () C:\AdwCleaner
2015-05-16 17:25 - 2015-05-16 17:25 - 00001209 _____ () C:\Users\Boss\Desktop\mbam.txt
2015-05-16 14:34 - 2015-05-16 14:34 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Boss\Desktop\mbam-setup-2.1.6.1022.exe
2015-05-16 14:34 - 2015-05-16 14:34 - 02719698 _____ (Thisisu) C:\Users\Boss\Desktop\JRT.exe
2015-05-16 14:34 - 2015-05-16 14:34 - 02209792 _____ () C:\Users\Boss\Desktop\AdwCleaner_4.204.exe
2015-05-16 14:27 - 2015-05-16 14:27 - 00015819 _____ () C:\ComboFix.txt
2015-05-16 14:11 - 2015-05-16 14:11 - 00000000 ____D () C:\Users\Boss\AppData\Roaming\ATI
2015-05-16 14:11 - 2015-05-16 14:11 - 00000000 ____D () C:\Users\Boss\AppData\Local\ATI
2015-05-15 09:11 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-05-15 09:11 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-05-15 09:11 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-05-15 09:11 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-05-15 09:11 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-05-15 09:11 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2015-05-15 09:11 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2015-05-15 09:11 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2015-05-15 09:10 - 2015-05-16 14:28 - 00000000 ____D () C:\Qoobox
2015-05-15 09:10 - 2015-05-16 14:22 - 00000000 ____D () C:\Windows\erdnt
2015-05-14 07:51 - 2015-05-14 08:18 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-05-14 07:50 - 2015-05-14 08:18 - 00000000 ____D () C:\Users\Papa\Desktop\mbar
2015-05-13 21:33 - 2015-05-17 09:23 - 00000000 ____D () C:\FRST
2015-05-13 21:33 - 2015-05-13 21:33 - 00000000 _____ () C:\Users\Boss\defogger_reenable
2015-05-13 21:32 - 2015-05-17 09:23 - 00000000 ____D () C:\Users\Papa\Desktop\TrojanerBoard
2015-05-13 20:29 - 2015-05-01 15:16 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 08:09 - 2015-05-05 03:12 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-05-13 08:09 - 2015-04-27 21:11 - 03989440 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2015-05-13 08:09 - 2015-04-27 21:11 - 03934144 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-05-13 08:09 - 2015-04-27 21:11 - 00137664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-05-13 08:09 - 2015-04-27 21:11 - 00067520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-05-13 08:09 - 2015-04-27 21:08 - 01307648 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-05-13 08:09 - 2015-04-27 21:05 - 00851456 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-05-13 08:09 - 2015-04-27 21:05 - 00635392 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-05-13 08:09 - 2015-04-27 21:05 - 00400896 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-05-13 08:09 - 2015-04-27 21:05 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-05-13 08:09 - 2015-04-27 21:05 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-05-13 08:09 - 2015-04-27 21:05 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-05-13 08:09 - 2015-04-27 21:05 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-05-13 08:09 - 2015-04-27 21:05 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll
2015-05-13 08:09 - 2015-04-27 21:05 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-05-13 08:09 - 2015-04-27 21:05 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-05-13 08:09 - 2015-04-27 21:05 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-05-13 08:09 - 2015-04-27 21:05 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-05-13 08:09 - 2015-04-27 21:04 - 01061376 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-05-13 08:09 - 2015-04-27 21:04 - 00641536 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-05-13 08:09 - 2015-04-27 21:04 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-05-13 08:09 - 2015-04-27 21:04 - 00364544 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe
2015-05-13 08:09 - 2015-04-27 21:04 - 00262656 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-05-13 08:09 - 2015-04-27 21:04 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2015-05-13 08:09 - 2015-04-27 21:04 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-05-13 08:09 - 2015-04-27 21:04 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe
2015-05-13 08:09 - 2015-04-27 21:04 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-05-13 08:09 - 2015-04-27 21:04 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe
2015-05-13 08:09 - 2015-04-27 21:04 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-05-13 08:09 - 2015-04-27 21:04 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-05-13 08:09 - 2015-04-27 21:03 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-05-13 08:09 - 2015-04-27 21:03 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe
2015-05-13 08:09 - 2015-04-27 21:01 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-05-13 08:09 - 2015-04-27 21:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-05-13 08:09 - 2015-04-27 20:59 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-05-13 08:09 - 2015-04-27 20:59 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-05-13 08:09 - 2015-04-27 20:00 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-05-13 08:09 - 2015-04-22 03:48 - 00342736 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-05-13 08:09 - 2015-04-21 18:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-05-13 08:09 - 2015-04-21 18:25 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-05-13 08:09 - 2015-04-21 18:24 - 19691008 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-05-13 08:09 - 2015-04-21 18:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-05-13 08:09 - 2015-04-21 18:11 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-05-13 08:09 - 2015-04-21 18:10 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-05-13 08:09 - 2015-04-21 18:09 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-05-13 08:09 - 2015-04-21 18:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-05-13 08:09 - 2015-04-21 18:04 - 02278400 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-05-13 08:09 - 2015-04-21 18:03 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-05-13 08:09 - 2015-04-21 18:02 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-05-13 08:09 - 2015-04-21 18:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-05-13 08:09 - 2015-04-21 17:58 - 00664576 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-05-13 08:09 - 2015-04-21 17:58 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-05-13 08:09 - 2015-04-21 17:58 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-05-13 08:09 - 2015-04-21 17:57 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-05-13 08:09 - 2015-04-21 17:51 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-05-13 08:09 - 2015-04-21 17:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-05-13 08:09 - 2015-04-21 17:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-05-13 08:09 - 2015-04-21 17:39 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-05-13 08:09 - 2015-04-21 17:38 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-05-13 08:09 - 2015-04-21 17:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-05-13 08:09 - 2015-04-21 17:31 - 04305920 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-05-13 08:09 - 2015-04-21 17:26 - 00688640 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-05-13 08:09 - 2015-04-21 17:26 - 00685568 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-05-13 08:09 - 2015-04-21 17:25 - 02052608 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-05-13 08:09 - 2015-04-21 17:24 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-05-13 08:09 - 2015-04-21 17:17 - 12828672 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-05-13 08:09 - 2015-04-21 17:02 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-05-13 08:09 - 2015-04-21 16:58 - 01310208 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-05-13 08:09 - 2015-04-21 16:56 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-05-13 08:09 - 2015-04-20 04:56 - 01250816 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-05-13 08:09 - 2015-04-20 04:56 - 00909312 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-05-13 08:09 - 2015-04-20 04:03 - 02382336 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-05-13 08:09 - 2015-04-18 04:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-05-13 08:09 - 2015-04-13 05:19 - 00259072 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-05-13 08:09 - 2015-01-29 05:02 - 02311168 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll
2015-05-13 08:08 - 2015-04-08 05:14 - 00216064 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-05-13 08:08 - 2015-04-08 05:14 - 00019968 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-05-13 08:08 - 2015-03-04 06:11 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\shimeng.dll
2015-05-13 08:08 - 2015-03-04 06:10 - 00295936 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2015-05-13 08:08 - 2015-03-04 06:10 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\aelupsvc.dll
2015-05-13 08:08 - 2015-03-04 06:10 - 00020992 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2015-05-13 08:08 - 2015-02-18 09:06 - 00123904 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2015-05-10 20:57 - 2015-05-10 20:57 - 00000000 ____D () C:\Users\Mama\AppData\Roaming\ATI
2015-05-10 20:57 - 2015-05-10 20:57 - 00000000 ____D () C:\Users\Mama\AppData\Local\ATI
2015-05-10 12:53 - 2015-05-10 12:53 - 00000000 ____D () C:\Program Files\13-9_win7_win8_32-64_hydravision
2015-05-10 12:50 - 2015-05-10 12:50 - 00000000 ____D () C:\Program Files\Sapphire TRIXX
2015-05-10 12:48 - 2015-05-10 12:48 - 00000000 ____D () C:\Users\Papa\AppData\Roaming\ATI
2015-05-10 12:48 - 2015-05-10 12:48 - 00000000 ____D () C:\Users\Papa\AppData\Local\ATI
2015-05-10 12:48 - 2015-05-10 12:48 - 00000000 ____D () C:\ProgramData\ATI
2015-05-10 12:48 - 2015-05-10 12:48 - 00000000 _____ () C:\Windows\ativpsrm.bin
2015-05-10 12:46 - 2015-05-10 12:46 - 00054924 _____ () C:\Windows\system32\CCCInstall_201505101246249548.log
2015-05-10 12:46 - 2015-05-10 12:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center
2015-05-10 12:46 - 2015-05-10 12:46 - 00000000 ____D () C:\ProgramData\AMD
2015-05-10 12:46 - 2015-05-10 12:46 - 00000000 ____D () C:\Program Files\AMD AVT
2015-05-10 12:44 - 2015-05-10 12:44 - 00000000 ____D () C:\Program Files\Common Files\ATI Technologies
2015-05-10 12:44 - 2015-05-10 12:44 - 00000000 ____D () C:\Program Files\AMD
2015-05-10 12:43 - 2015-05-10 12:43 - 00000000 ____D () C:\Program Files\ATI
2015-05-10 12:42 - 2015-05-10 12:53 - 00000000 ____D () C:\Program Files\ATI Technologies
2015-05-10 12:41 - 2015-05-10 12:41 - 00000000 ____D () C:\Program Files\AMD-Catalyst-14-9-win7-win8.1-32Bit-dd-ccc-whql
2015-05-10 12:40 - 2015-05-10 12:40 - 27185683 _____ () C:\Users\Papa\Downloads\13-9_win7_win8_32-64_hydravision_635163290847474865.zip
2015-05-10 12:37 - 2015-05-10 12:37 - 03650806 _____ () C:\Users\Papa\Downloads\TRIXX_installer_635456807114954507.zip
2015-05-10 12:31 - 2015-05-10 12:34 - 210810949 _____ () C:\Users\Papa\Downloads\amd-catalyst-14-9-win7-win8.1-32bit-dd-ccc-whql_635476727041970015.zip
2015-05-08 21:36 - 2015-05-09 14:21 - 00000000 ____D () C:\Users\Papa\AppData\Roaming\XnView
2015-05-08 21:35 - 2015-05-08 21:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XnView
2015-05-08 21:35 - 2015-05-08 21:35 - 00000000 ____D () C:\Program Files\XnView
2015-05-08 21:33 - 2015-05-08 21:33 - 05062128 _____ (Gougelet Pierre-e ) C:\Users\Papa\Downloads\XnView-win.exe
2015-05-08 21:08 - 2015-05-08 21:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QNAP
2015-05-08 21:07 - 2015-05-09 14:38 - 00000000 ____D () C:\Users\Papa\Desktop\Entwickeln
2015-05-08 21:06 - 2015-05-08 21:07 - 31496600 _____ (Igor Pavlov) C:\Users\Papa\Downloads\QNAPQfinderWindows-5.0.1.0225.exe
2015-05-07 21:04 - 2015-05-07 21:48 - 00016760 _____ () C:\Users\Papa\Downloads\planungSiedlungsfest.xlsx
2015-04-29 18:05 - 2015-04-29 18:16 - 00000000 ____D () C:\Users\Papa\Desktop\Neuer Ordner
2015-04-24 14:29 - 2015-04-24 14:29 - 00000000 ____D () C:\Program Files\Mozilla Firefox
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-05-17 09:08 - 2014-06-20 21:07 - 01882382 _____ () C:\Windows\WindowsUpdate.log
2015-05-17 08:34 - 2015-01-15 16:26 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-05-17 08:09 - 2009-07-14 06:34 - 00025328 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-05-17 08:09 - 2009-07-14 06:34 - 00025328 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-05-17 08:00 - 2014-08-09 22:30 - 00205736 _____ () C:\Windows\PFRO.log
2015-05-17 08:00 - 2014-08-09 22:30 - 00018094 _____ () C:\Windows\setupact.log
2015-05-17 08:00 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-16 22:11 - 2014-10-21 17:43 - 00000000 ____D () C:\Users\Boss\AppData\Local\Adobe
2015-05-16 22:11 - 2014-06-22 19:56 - 00000000 ____D () C:\Users\Boss\AppData\Roaming\Adobe
2015-05-16 14:36 - 2015-03-15 17:58 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-05-16 14:36 - 2015-03-15 17:57 - 00001060 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-05-16 14:36 - 2015-03-15 17:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-05-16 14:36 - 2015-03-15 17:57 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware
2015-05-16 14:24 - 2009-07-14 04:04 - 00000215 _____ () C:\Windows\system.ini
2015-05-16 14:17 - 2014-06-22 20:13 - 00000000 ____D () C:\Users\Boss\AppData\Roaming\Avira
2015-05-16 14:10 - 2015-01-23 16:22 - 00000000 ___RD () C:\Users\Papa\Dropbox
2015-05-16 14:10 - 2015-01-23 16:17 - 00000000 ____D () C:\Users\Papa\AppData\Roaming\Dropbox
2015-05-15 22:40 - 2014-07-01 20:16 - 00000000 ____D () C:\Users\Papa\AppData\Roaming\Canon
2015-05-15 22:07 - 2014-07-01 20:38 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-05-15 09:22 - 2009-07-14 04:37 - 00000000 __RHD () C:\Users\Default
2015-05-15 09:22 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public
2015-05-14 08:52 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2015-05-14 07:37 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2015-05-14 03:02 - 2009-07-14 10:57 - 00000000 ____D () C:\Program Files\Windows Journal
2015-05-13 21:33 - 2014-06-20 22:54 - 00000000 ____D () C:\Users\Boss
2015-05-13 21:00 - 2014-06-20 22:56 - 01618320 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-05-13 20:55 - 2009-07-14 06:33 - 00334288 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-05-13 20:53 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2015-05-13 20:53 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\AdvancedInstallers
2015-05-13 20:30 - 2014-08-11 16:46 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-05-13 20:28 - 2014-06-22 10:37 - 00000000 ____D () C:\Windows\system32\MRT
2015-05-13 20:24 - 2014-06-22 10:37 - 137310008 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-05-10 12:43 - 2014-06-22 20:05 - 00000000 ____D () C:\ProgramData\Package Cache
2015-05-09 08:42 - 2015-01-23 16:19 - 00000000 ____D () C:\Users\Papa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-05-07 17:50 - 2014-06-22 20:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-05-07 17:49 - 2014-06-22 20:07 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-05-07 17:49 - 2014-06-22 20:07 - 00107400 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-05-07 17:49 - 2014-06-22 20:07 - 00037896 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2015-04-30 21:07 - 2014-08-20 20:19 - 00000000 ____D () C:\Users\Mama\AppData\Roaming\Canon
2015-04-26 20:15 - 2014-06-21 09:05 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
Some content of TEMP:
====================
C:\Users\Boss\AppData\Local\temp\avgnt.exe
C:\Users\Papa\AppData\Local\temp\avgnt.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-05-14 08:43
==================== End Of Log ============================
--- --- --- Addition: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 16-05-2015 02
Ran by Boss at 2015-05-17 09:24:07
Running from C:\Users\Boss\Desktop
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-638442100-2917554848-3055500443-500 - Administrator - Disabled)
Boss (S-1-5-21-638442100-2917554848-3055500443-1001 - Administrator - Enabled) => C:\Users\Boss
Gast (S-1-5-21-638442100-2917554848-3055500443-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-638442100-2917554848-3055500443-1002 - Limited - Enabled)
Mama (S-1-5-21-638442100-2917554848-3055500443-1004 - Limited - Enabled) => C:\Users\Mama
Papa (S-1-5-21-638442100-2917554848-3055500443-1003 - Limited - Enabled) => C:\Users\Papa
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Antivirus (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Antivirus (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Flash Player 17 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.11) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.11 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\...\{319271B3-E2AA-F623-928E-245C9EBF16F7}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 1.0.2.43 - Atheros Communications Inc.)
Avira (HKLM\...\{b5675cc4-ab8b-4945-8c1d-4c5479556d6a}) (Version: 1.1.34.19732 - Avira Operations GmbH & Co. KG)
Avira (Version: 1.1.34.19732 - Avira Operations GmbH & Co. KG) Hidden
Avira Antivirus (HKLM\...\Avira Antivirus) (Version: 15.0.10.434 - Avira Operations GmbH & Co. KG)
Canon MP Navigator 2.0 (HKLM\...\MP Navigator 2.0) (Version: - )
Canon MP150 (HKLM\...\{CA9A3609-3ECC-4574-8824-A8161A71A603}) (Version: - )
CCleaner (HKLM\...\CCleaner) (Version: 4.16 - Piriform)
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
Dropbox (HKU\S-1-5-21-638442100-2917554848-3055500443-1003\...\Dropbox) (Version: 3.4.6 - Dropbox, Inc.)
Fotogalerie (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
HydraVision (Version: 4.2.252.0 - Advanced Micro Devices, Inc.) Hidden
Java 8 Update 31 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
Junk Mail filter update (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Malwarebytes Anti-Malware Version 2.1.6.1022 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft LifeCam (HKLM\...\{5FC7AB5C-61FC-42DF-A923-5139BCF10D42}) (Version: 3.22.270.0 - Microsoft Corporation)
Microsoft Office Home and Student 2010 (HKLM\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x86) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Movie Maker (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 37.0.2 (x86 de) (HKLM\...\Mozilla Firefox 37.0.2 (x86 de)) (Version: 37.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 30.0 - Mozilla)
ProjectLibre (HKLM\...\{E29A4ED9-3192-4D72-A2E2-9C32B512714D}) (Version: 1.5.19.0 - ProjectLibre)
QNAP Qfinder (HKLM\...\QNAP_FINDER) (Version: 5.0.1.0225 - QNAP Systems, Inc.)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6402 - Realtek Semiconductor Corp.)
Sapphire TRIXX (HKLM\...\Sapphire TRIXX) (Version: - )
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Skype™ 7.0 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
VisiPics V1.31 (HKLM\...\VisiPics_is1) (Version: - Ozone)
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Win32DiskImager version 0.9.5 (HKLM\...\{D074CE74-912A-4AD3-A0BF-3937D9D01F17}_is1) (Version: 0.9.5 - ImageWriter Developers)
Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
XnView 2.32 (HKLM\...\XnView_is1) (Version: 2.32 - Gougelet Pierre-e)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-638442100-2917554848-3055500443-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Papa\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-638442100-2917554848-3055500443-1001_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-638442100-2917554848-3055500443-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-638442100-2917554848-3055500443-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-638442100-2917554848-3055500443-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-638442100-2917554848-3055500443-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-638442100-2917554848-3055500443-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-638442100-2917554848-3055500443-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-638442100-2917554848-3055500443-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-638442100-2917554848-3055500443-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Papa\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
==================== Restore Points =========================
10-05-2015 12:43:25 Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727
12-05-2015 08:35:08 Windows Update
13-05-2015 20:16:41 Windows Update
14-05-2015 03:00:30 Windows Update
16-05-2015 14:12:50 ComboFix created restore point
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {01AD3CEB-9D22-4855-8AB3-762E5C495DB0} - System32\Tasks\iSCSIAgentAutoStartup => C:\Program Files\QNAP\Qfinder\iSCSIAgent.exe [2015-02-25] ()
Task: {0A8BEC4D-B503-4720-8171-D9C419114A9D} - System32\Tasks\Microsoft\Windows\Setup\gwx\runappraiser => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
Task: {3122BEB9-7F60-4790-8852-D0ACD62CD986} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {35A2376D-FFCC-4E23-8AAD-43B1D68FDDF7} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-07-23] (Piriform Ltd)
Task: {407224FD-0811-4FCD-83C1-CC82D76FB3AC} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-03-25] (Microsoft Corporation)
Task: {7670CFAC-7A91-4436-B09E-DBCAC18BCE25} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
Task: {BCB6987B-D616-4829-A477-EAE852BA1FAC} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-16] (Adobe Systems Incorporated)
Task: {DFB84816-384E-46F5-899E-D90803D59DD8} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxcontent => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (Whitelisted) ==============
2015-01-17 16:25 - 2015-02-25 08:15 - 01739952 _____ () C:\Program Files\QNAP\Qfinder\iSCSIAgent.exe
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (Whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, the associated entry will be removed from the registry.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-638442100-2917554848-3055500443-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Boss\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
HKU\S-1-5-21-638442100-2917554848-3055500443-1003\Control Panel\Desktop\\Wallpaper ->
HKU\S-1-5-21-638442100-2917554848-3055500443-1004\Control Panel\Desktop\\Wallpaper -> C:\Users\Mama\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.178.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{DBB8CF3A-16F2-4CC0-9060-99FCE4D8BD76}] => (Allow) C:\Program Files\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{66352015-F38D-454F-988A-9F78FD497257}] => (Allow) LPort=2869
FirewallRules: [{8223D6A9-A0B0-40BF-B456-B59E6B3AF9CD}] => (Allow) LPort=1900
FirewallRules: [{FEA0FCAF-534E-4787-8A53-119F1A08CD0B}] => (Allow) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
FirewallRules: [{02F30D98-EA7D-4CBE-91F4-17BDBF1B5670}] => (Allow) C:\Program Files\Skype\Phone\Skype.exe
FirewallRules: [{4AD1446A-5C2B-4213-B7A1-18E85160D0EF}] => (Allow) C:\Program Files\Microsoft LifeCam\LifeCam.exe
FirewallRules: [{BBB3FC36-BAA8-4CDE-A747-A9684F3881D6}] => (Allow) C:\Program Files\Microsoft LifeCam\LifeCam.exe
FirewallRules: [{56DB8066-5909-414D-B1FB-B20EA7E8F6A2}] => (Allow) C:\Program Files\Microsoft LifeCam\LifeEnC2.exe
FirewallRules: [{F1332063-E7F2-466A-9CE9-C2EA2DB37125}] => (Allow) C:\Program Files\Microsoft LifeCam\LifeEnC2.exe
FirewallRules: [{8658ABE9-FCB7-4855-BD61-EAE44E28F1BC}] => (Allow) C:\Program Files\Microsoft LifeCam\LifeExp.exe
FirewallRules: [{A155F6B4-64CF-4A42-BDC1-4B8A817D58F0}] => (Allow) C:\Program Files\Microsoft LifeCam\LifeExp.exe
FirewallRules: [{9B2122CE-A939-4906-A827-80F40CB69728}] => (Allow) C:\Program Files\Microsoft LifeCam\LifeTray.exe
FirewallRules: [{13481C4C-AA22-4EA1-AA52-5C54CA65E071}] => (Allow) C:\Program Files\Microsoft LifeCam\LifeTray.exe
FirewallRules: [TCP Query User{B42186AC-37B5-42E2-89BC-BA645A745B20}C:\program files\qnap\qfinder\qfinder.exe] => (Allow) C:\program files\qnap\qfinder\qfinder.exe
FirewallRules: [UDP Query User{B818E706-1AA3-476F-8A4E-6CDA8CB5D472}C:\program files\qnap\qfinder\qfinder.exe] => (Allow) C:\program files\qnap\qfinder\qfinder.exe
FirewallRules: [{2A4599AC-9DEA-44E4-8F87-421CBD3187E2}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{1DD2CA93-EB8E-42DB-9329-D87D154DF2AF}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{5A3B61DB-CFF5-4DED-A980-6869C9F26F92}C:\users\papa\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\papa\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [UDP Query User{3A7F5060-E0D3-441A-9710-D6C211189ECC}C:\users\papa\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\papa\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [{A72EE390-C1FC-4A14-9EAB-23A4A00E7594}] => (Allow) C:\Users\Papa\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{E3E8BDF5-34F1-4693-A247-98E41004F359}] => (Allow) C:\Users\Papa\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [TCP Query User{2826F32C-2020-4759-8E66-B629D7DE577B}C:\program files\mozilla firefox\firefox.exe] => (Block) C:\program files\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{14B2ED73-9D4E-4953-BFC5-D6091E105B5A}C:\program files\mozilla firefox\firefox.exe] => (Block) C:\program files\mozilla firefox\firefox.exe
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (05/17/2015 00:30:02 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (05/17/2015 00:29:55 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (05/17/2015 00:29:55 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (05/17/2015 00:29:54 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (05/16/2015 05:31:00 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: CCC.exe, Version: 4.5.0.0, Zeitstempel: 0x53ad0dcc
Name des fehlerhaften Moduls: amdmantle32.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x541762c0
Ausnahmecode: 0xc0000005
Fehleroffset: 0x600f85cc
ID des fehlerhaften Prozesses: 0xdcc
Startzeit der fehlerhaften Anwendung: 0xCCC.exe0
Pfad der fehlerhaften Anwendung: CCC.exe1
Pfad des fehlerhaften Moduls: CCC.exe2
Berichtskennung: CCC.exe3
Error: (05/16/2015 05:30:54 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: CCC.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund eines Ausnahmefehlers beendet.
Ausnahmeinformationen: Ausnahmecode c0000005, Ausnahmeadresse 600F85CC
Error: (05/16/2015 01:25:15 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (05/16/2015 01:25:07 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (05/16/2015 01:25:07 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (05/16/2015 01:25:07 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
System errors:
=============
Error: (05/16/2015 05:37:23 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Software Protection" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (05/16/2015 05:37:23 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Media Player-Netzwerkfreigabedienst" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (05/16/2015 05:37:22 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Avira Service Host" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 10000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (05/16/2015 05:37:22 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "MSCamSvc" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (05/16/2015 05:37:22 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Adobe Acrobat Update Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (05/16/2015 05:37:22 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Druckwarteschlange" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (05/16/2015 05:37:22 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "AMD External Events Utility" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (05/16/2015 05:28:50 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows Media Player-Netzwerkfreigabedienst" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069
Error: (05/16/2015 05:28:50 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "WMPNetworkSvc" konnte sich nicht als "NT AUTHORITY\NetworkService" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:
%%50
Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).
Error: (05/16/2015 05:28:49 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069
Microsoft Office Sessions:
=========================
Error: (05/17/2015 00:30:02 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\ati technologies\ATI.ACE\core-static\SLSTaskbar64.exe
Error: (05/17/2015 00:29:55 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\ati technologies\hydravision\HydraMD64.exe
Error: (05/17/2015 00:29:55 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\ati technologies\hydravision\HydraDM64.exe
Error: (05/17/2015 00:29:54 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\ati technologies\hydravision\Grid64.exe
Error: (05/16/2015 05:31:00 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: CCC.exe4.5.0.053ad0dccamdmantle32.dll_unloaded0.0.0.0541762c0c0000005600f85ccdcc01d08fed2c556402C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exeamdmantle32.dll8d59bd53-fbe0-11e4-848a-386077c4b35b
Error: (05/16/2015 05:30:54 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: CCC.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund eines Ausnahmefehlers beendet.
Ausnahmeinformationen: Ausnahmecode c0000005, Ausnahmeadresse 600F85CC
Error: (05/16/2015 01:25:15 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\ati technologies\ATI.ACE\core-static\SLSTaskbar64.exe
Error: (05/16/2015 01:25:07 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\ati technologies\hydravision\HydraMD64.exe
Error: (05/16/2015 01:25:07 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\ati technologies\hydravision\HydraDM64.exe
Error: (05/16/2015 01:25:07 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\ati technologies\hydravision\Grid64.exe
==================== Memory info ===========================
Processor: Intel(R) Core(TM)2 Duo CPU E7300 @ 2.66GHz
Percentage of memory in use: 24%
Total physical RAM: 3583.12 MB
Available physical RAM: 2706.52 MB
Total Pagefile: 7164.55 MB
Available Pagefile: 5812.43 MB
Total Virtual: 2047.88 MB
Available Virtual: 1896.63 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:232.87 GB) (Free:184 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive e: (Medium) (Fixed) (Total:74.52 GB) (Free:35.78 GB) NTFS
Drive f: (Software) (Fixed) (Total:158.36 GB) (Free:94.55 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: 1BE02E2A)
Partition 1: (Not Active) - (Size=993 KB) - (Type=42)
Partition 2: (Active) - (Size=232.9 GB) - (Type=42)
Partition 3: (Not Active) - (Size=11 MB) - (Type=42)
========================================================
Disk: 1 (Size: 232.9 GB) (Disk ID: 7AFDC950)
Partition 1: (Not Active) - (Size=74.5 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=158.4 GB) - (Type=07 NTFS)
========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: C857D49A)
Partition 1: (Not Active) - (Size=1008 KB) - (Type=42)
Partition 2: (Active) - (Size=232.9 GB) - (Type=42)
Partition 3: (Not Active) - (Size=11 MB) - (Type=42)
==================== End Of Log ============================
UND: In einem anderen Beitrag habe ich gelesen, dass du von Avira nicht sehr begeistert bist. Was wäre denn besser? |
|
17.05.2015, 11:53
| #10 |
| /// the machine /// TB-Ausbilder | PDF mit Trojaner geöffnet, Windows 7 Hat sich nix eingenistet Ich empfehle immer Emsisoft, ich arbeite aber auch da Java updaten.  Cleanup: (Die Reihenfolge ist hier entscheidend) Falls Defogger verwendet wurde: Erneut starten und auf Re-enable klicken. Falls Combofix verwendet wurde:  Combofix deinstallieren
Alle Logs gepostet? Dann lade Dir bitte  DelFix herunter.
Hinweis: DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst. Starte Deinen Rechner abschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen. Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...  und/oder das Forum mit einer kleinen Spende  unterstützen.   Absicherung: Beim Betriebsystem Windows die automatischen Updates aktivieren. Auch die sicherheitsrelevante Software sollte immer nur in der aktuellsten Version vorliegen: Browser Java Flash-Player PDF-Reader Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren. Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen. Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig. Verwende ein Antivirusprogramm mit Echtzeitscanner und stets aktueller Signaturendatenbank. Meine Empfehlung:  Emsisoft Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware und ESET scannen. Optional:  NoScript verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen. Malwarebytes Anti Exploit: Schützt die Anwendungen des Computers vor der Ausnutzung bekannter Schwachstellen.Lade Software von einem sauberen Portal wie  .Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen. Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwcleaner . Abschließend noch ein paar grundsätzliche Bemerkungen: Ändere regelmäßig Deine wichtigen Online-Passwörter und erstelle regelmäßig Backups Deiner wichtigen Dateien oder des Systems. Der Nutzen von Registry-Cleanern, Optimizern usw. zur Performancesteigerung ist umstritten. Ich empfehle deshalb, die Finger von der Registry zu lassen und lieber die windowseigene Datenträgerbereinigung zu verwenden.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu PDF mit Trojaner geöffnet, Windows 7 |
| adware, anhang, antivir, antivirus, askbar, avira, browser, cpu, defender, desktop, firefox, flash player, helper, installation, launch, mozilla, realtek, registry, rundll, scan, secur, security, svchost.exe, system, trojaner, udp, virus, wickel, windows |
WARNUNG an die MITLESER: 
+ R Taste und schreibe Combofix /Uninstall in das 
Linear-Darstellung
