W32/Confick-O Datei rkqunq.z in System32

peinedaniel · 27.05.2015, 10:49

Die Unterbrechungen wären jetzt nicht das Problem, hauptsache der Kram wird bereinigt. Wir sichern lediglich Daten vom DC und würden bei einem Ausfall einen neuen DC aufsetzen und die Daten einspielen.

cosinus · 27.05.2015, 10:50

Na gut

wenn alle Daten eh gesichert sind, kannst ja mal CF auf deinen DC loslassen:

Dann bitte jetzt Combofix ausführen:

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

peinedaniel · 27.05.2015, 10:53

Kann die Software das System kaputt machen, sodass ich es danach eventuell nicht mehr starten kann? (abgesehen von den Daten jetzt) Dann würde ich heute Abend lieber eine Vollsicherung mit Acronis durchführen^^

cosinus · 27.05.2015, 11:09

Klar, wenn du komplett zurückwillst musst du vorher ein Abbild des Systems machen.
Sowas geht auch im laufenden Betrieb mit der kleinen Software Drivesnapshot - einfach nur die EXE starten, keine Installation notwendig. Find ich viel übersichtlicher und handlicher als Acronis.

peinedaniel · 27.05.2015, 11:13

Ok, dann mach ich das so, danke Dir. Bei mir läuft im Moment noch das Conficker-Removal-Tool. Das lasse ich noch eben durchlaufen und dann mach ich deine Schritte. Das Removal Tool hat auch schon einiges gefunden:

Mehrere Dateien, mit der Beschreibung Mal/Conficker-A und die Dateien heißen jwgkvsq.vmx
Ich dachte .vmx sind immer virtuelle Maschinen

cosinus · 27.05.2015, 11:23

Normalerweise steht die Endung für Vmware, ja.
Aber das ist ja nicht in Stein gemeißelt und zB eine reine Textdatei kann eine völlig andere Endung haben. Ist halt nur ein Zusatz zum Dateinamen, nur Windows macht sehr vieles davon abhängig.

peinedaniel · 27.05.2015, 14:41

ja, natürlich. Das war ja auch nur Ironie

ich werde mich dann gleich nochmal melden, wenn alles durch ist

Soo, das Removal Tool hat jetzt einiges gefunden und ich denke auch mal gelöscht.
Jetzt wollte ich ComboFix durchlaufen lassen, allerings scheint die Software nicht für Server geeignet zu sein. Ich bekomme folgende Meldung: "ComboFix" This operating system is not supported! ComboFix is no meant for Servers.

cosinus · 27.05.2015, 14:46

Ich habs schon fast befürchtet

Windows 2008 R2 ist die Server-Version von Windows 7, war ein Versuch wert.

Poste mal die Logs des Removal Tools.

peinedaniel · 27.05.2015, 14:49

Das Teil macht irgendwie keine logs ;D , war einfach nur ein DOS-Fenster, das aufgeht und gesucht hat.

cosinus · 27.05.2015, 14:53

Wie heißt das Tool genau? Von welchem Hersteller?

peinedaniel · 27.05.2015, 14:57

hxxp://www.chip.de/downloads/Conficker-Removal-Tool_35992873.html

ah das stehts doch, von Sophos?

cosinus · 27.05.2015, 15:08

Schau mal bitte direkt auf C: nach. Wenn es dort nicht liegt, dann evtl. im selben Verzeichnis wie die ausführbare Datei des Removal Tools.

Und frische FRST-Logs bitte.

peinedaniel · 27.05.2015, 15:55

Auf C: direkt liegt es nicht, habe die Datei aus dem Internet Explorer direkt gestartet, nirgends extra abgespeichert. Aber ich schau mal ob ich in den temporären Ordnern nach.

Ne, finde die log einfach nicht.

cosinus · 27.05.2015, 21:51

Neue FRST-Logs?

Und da bitte endlich mal darauf achten, das Tool vom Desktop auszuführen.

peinedaniel · 28.05.2015, 07:54

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 27-05-2015 01
Ran by administrator (administrator) on DC on 28-05-2015 08:52:15
Running from C:\Users\Administrator\Desktop
Loaded Profiles: administrator (Available Profiles:administrator & Classic .NET AppPool)
Platform: Windows Server 2008 R2 Standard Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-

recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Windows\System32\LogonUI.exe
(Microsoft Corporation) C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exe
(Symantec Corporation) C:\Program Files\Symantec\Backup Exec\beremote.exe
(Symantec Corporation) C:\Program Files\Symantec\Backup Exec\bedbg.exe
(Hewlett-Packard Company) C:\Program Files\HP\Cissesrv\cissesrv.exe
() C:\Program Files (x86)\Citrix\Licensing\LS\lmadmin.exe
(Hewlett-Packard Company) C:\hp\hpsmh\data\cgi-bin\vcagent\vcagent.exe
(Citrix Systems, Inc) C:\Program Files (x86)\Citrix\Licensing\LS\CITRIX.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\Licensing\LS\CtxLSPortSvc.exe
(Microsoft Corporation) C:\Windows\System32\dfsrs.exe
(Microsoft Corporation) C:\Windows\System32\dns.exe
(DocuWare AG) C:\Program Files (x86)\DocuWare\Desktop\DocuWare.DesktopService.exe
(DocuWare AG) D:\Programme\DocuWare\Imaging Server\DWImagingService.exe
(DocuWare AG) D:\Programme\DocuWare\Job Processor\DocuWare.JobProcessor.exe
() D:\Programme\DocuWare\DWDatabase\bin\mysqld-nt.exe
(DocuWare AG) D:\Programme\DocuWare\OCR Service\DWOCRService.exe
(Apache Software Foundation) D:\Programme\DocuWare\Full-Text Server\bin\tomcat7.exe
(DocuWare AG) D:\Programme\DocuWare\Web Service Server\DWWebService.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Windows\System32\PrintIsolationHost.exe
(Microsoft Corporation) C:\Windows\System32\inetsrv\inetinfo.exe
(Microsoft Corporation) C:\Windows\System32\ismserv.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\iLO 3\service\ProLiantMonitor.exe
(Microsoft Corporation) C:\Windows\System32\snmp.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Remote Management System\ManagementAgentNT.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Remote Management System\RouterNT.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Hewlett-Packard Company) C:\hp\hpsmh\bin\smhstart.exe
(Microsoft) C:\Program Files (x86)\Trilead\Trilead VMX\VMXService.exe
(Hewlett-Packard Company) C:\hp\hpsmh\bin\hpsmhd.exe
(VMware, Inc.) C:\Program Files (x86)\VMware\VMware vCenter Converter Standalone\vmware-converter-a.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
(Hewlett-Packard Company) C:\hp\hpsmh\bin\rotatelogs.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
(Hewlett-Packard Company) C:\hp\hpsmh\bin\rotatelogs.exe
(Hewlett-Packard Company) C:\hp\hpsmh\bin\hpsmhd.exe
(Hewlett-Packard Company) C:\hp\hpsmh\bin\rotatelogs.exe
(VMware, Inc.) C:\Program Files (x86)\VMware\VMware vCenter Converter Standalone\vmware-converter.exe
(VMware, Inc.) C:\Program Files (x86)\VMware\VMware vCenter Converter Standalone\vmware-converter.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
(Hewlett-Packard Company) C:\hp\hpsmh\bin\rotatelogs.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
(Hewlett-Packard Company) C:\hp\hpsmh\bin\rotatelogs.exe
(Microsoft Corporation) C:\Windows\System32\WINS.EXE
(Symantec Corporation) C:\Program Files\Symantec\Backup Exec\pvlsvr.exe
(Hewlett-Packard Company) C:\Windows\System32\CPQNiMgt\cpqnimgt.exe
(Hewlett-Packard Company) C:\Windows\System32\CpqMgmt\cqmgserv\cqmgserv.exe
(Hewlett-Packard Company) C:\Windows\System32\CpqMgmt\cqmgstor\cqmgstor.exe
(Microsoft Corporation) C:\Windows\System32\dfssvc.exe
(DocuWare AG) D:\Programme\DocuWare\Authentication Server\DWAuthenticationServer.exe
(DocuWare AG) D:\Programme\DocuWare\Content Server\DWContentServer.exe
(DocuWare AG) D:\Programme\DocuWare\Notification Server\DWNotificationServer.exe
(DocuWare AG) D:\Programme\DocuWare\Thumbnail Server\DWThumbnailService.exe
(DocuWare AG) C:\Program Files (x86)\DocuWare\Upload Service\DWUploadServiceSvc.exe
(DocuWare AG) D:\Programme\DocuWare\Workflow Server\DWWorkflowServer.exe
(Symantec Corporation) C:\Program Files\Symantec\Backup Exec\beserver.exe
(Symantec Corporation) C:\Program Files\Symantec\Backup Exec\benetns.exe
(Symantec Corporation) C:\Program Files\Symantec\Backup Exec\bengine.exe
(Hewlett-Packard Company) C:\Windows\System32\CpqMgmt\cqmghost\cqmghost.exe
(Microsoft Corporation) C:\Windows\System32\vds.exe
(Microsoft Corporation) C:\Windows\SysWOW64\inetsrv\w3wp.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rdpclip.exe
(Hewlett-Packard Company) C:\Program Files\HP\NCU\cpqteam.exe
(DocuWare AG) C:\DW4\Tm2start.exe
(DocuWare AG) C:\Program Files (x86)\DocuWare\Desktop\DocuWare.Desktop.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\concentr.exe
(DocuWare AG) D:\Programme\DocuWare\Service Control\DocuWare.ServiceControl.exe
(Samsung) C:\Program Files (x86)\Samsung\NetworkScan\NSCSysTrayUI.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\Receiver\Receiver.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe
(DocuWare AG) C:\Program Files (x86)\DocuWare\Desktop\Plugins\Scanner\DocuWare.Desktop.CaptureService.Host.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe
(Microsoft Corporation) C:\Windows\System32\srmhost.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe
(Microsoft Corporation) C:\Windows\System32\UI0Detect.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Windows\System32\PrintIsolationHost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be 

moved.)

HKLM\...\Run: [CPQTEAM] => C:\Program Files\HP\NCU\cpqteam.exe [73728 2010-04-27] (Hewlett-Packard Company)
HKLM\...\Run: [Seagull Drivers] => ssdal_nc.exe startup
HKLM-x32\...\Run: [TM2Start] => C:\DW4\tm2start.exe [40960 2003-10-14] (DocuWare AG)
HKLM-x32\...\Run: [ConnectionCenter] => C:\Program Files (x86)\Citrix\ICA Client\concentr.exe [358336 2011-08-11] (Citrix 

Systems, Inc.)
HKLM-x32\...\Run: [NSCSysTrayUI] => C:\Program Files (x86)\Samsung\NetworkScan\NSCSysTrayUI.exe [270336 2009-04-09] 

(Samsung)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03

-12] (Oracle Corporation)
HKLM-x32\...\Run: [Sophos AutoUpdate Monitor] => C:\Program Files (x86)\Sophos\AutoUpdate\almon.exe [1593640 2015-01-30] 

(Sophos Limited)
Winlogon\Notify\AtiExtEvent: Ati2evxx.dll [X]
HKLM\...\Policies\Explorer: [ShowSuperHidden] 1
HKU\S-1-5-21-2786933937-3664791864-901090552-500\...\MountPoints2: {696c30f9-c176-11df-b2c9-806e6f6e6963} - E:\Browser.exe
AppInit_DLLs: C:\PROGRA~2\Sophos\SOPHOS~1\SOPHOS~2.DLL => C:\Program Files (x86)\Sophos\Sophos Anti-Virus

\sophos_detoured_x64.dll [217672 2015-05-26] (Sophos Limited)
AppInit_DLLs-x32: C:\PROGRA~2\Sophos\SOPHOS~1\SOPHOS~1.DLL => C:\Program Files (x86)\Sophos\Sophos Anti-Virus

\sophos_detoured.dll [275352 2015-05-26] (Sophos Limited)
Lsa: [Notification Packages] scecli rassfm
SecurityProviders: credssp.dll,  pwdssp.dll, pwdssp.dll
Startup: C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BackGroundInfo 

(Autostart).lnk [2014-02-24]
ShortcutTarget: BackGroundInfo (Autostart).lnk -> C:\Program Files\BackGroundInfo\BackGroundInfo.exe (Bryce Cogswell)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\DocuWare Desktop.lnk [2013-08-08]
ShortcutTarget: DocuWare Desktop.lnk -> C:\Program Files (x86)\DocuWare\Desktop\DocuWare.Desktop.exe (DocuWare AG)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\DocuWare ServiceControl.lnk [2011-08-09]
ShortcutTarget: DocuWare ServiceControl.lnk -> C:\Windows\Installer\{209B0652-2701-412D-9914-

6889D95E90F6}\DocuWare.ServiceControl.exe (DocuWare AG)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyServer: [S-1-5-21-2786933937-3664791864-901090552-500] => 10.x.x.x:8080
HKU\S-1-5-21-2786933937-3664791864-901090552-500\Software\Microsoft\Internet Explorer\Main,Start Page = 

https://localhost:8083/
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin

\ssv.dll [2013-07-17] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin

\jp2ssv.dll [2013-07-17] (Oracle Corporation)
DPF: HKLM {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://javadl-esd.sun.com/update/1.4.2/jinstall-1_4-windows-i586.cab
DPF: HKLM-x32 {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} 

hxxp://catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1285946169091
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: hpapp - No CLSID Value
Filter-x32: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client

\IcaMimeFilter.dll [2011-08-11] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA 

Client\IcaMimeFilter.dll [2011-08-11] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix

\ICA Client\IcaMimeFilter.dll [2011-08-11] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA 

Client\IcaMimeFilter.dll [2011-08-11] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA 

Client\IcaMimeFilter.dll [2011-08-11] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA 

Client\IcaMimeFilter.dll [2011-08-11] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA 

Client\IcaMimeFilter.dll [2011-08-11] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA 

Client\IcaMimeFilter.dll [2011-08-11] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA 

Client\IcaMimeFilter.dll [2011-08-11] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix

\ICA Client\IcaMimeFilter.dll [2011-08-11] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA 

Client\IcaMimeFilter.dll [2011-08-11] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA 

Client\IcaMimeFilter.dll [2011-08-11] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA 

Client\IcaMimeFilter.dll [2011-08-11] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA 

Client\IcaMimeFilter.dll [2011-08-11] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA 

Client\IcaMimeFilter.dll [2011-08-11] (Citrix Systems, Inc.)
Filter-x32: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll 

[2011-08-11] (Citrix Systems, Inc.)
Winsock: Catalog9 01 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [126760 2015-05-26] (Sophos Limited)
Winsock: Catalog9 02 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [126760 2015-05-26] (Sophos Limited)
Winsock: Catalog9 03 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [126760 2015-05-26] (Sophos Limited)
Winsock: Catalog9 04 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [126760 2015-05-26] (Sophos Limited)
Winsock: Catalog9 05 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [126760 2015-05-26] (Sophos Limited)
Winsock: Catalog9 06 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [126760 2015-05-26] (Sophos Limited)
Winsock: Catalog9 07 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [126760 2015-05-26] (Sophos Limited)
Winsock: Catalog9 08 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [126760 2015-05-26] (Sophos Limited)
Winsock: Catalog9 19 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [126760 2015-05-26] (Sophos Limited)
Winsock: Catalog9-x64 01 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [173864 2015-05-26] (Sophos Limited)
Winsock: Catalog9-x64 02 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [173864 2015-05-26] (Sophos Limited)
Winsock: Catalog9-x64 03 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [173864 2015-05-26] (Sophos Limited)
Winsock: Catalog9-x64 04 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [173864 2015-05-26] (Sophos Limited)
Winsock: Catalog9-x64 05 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [173864 2015-05-26] (Sophos Limited)
Winsock: Catalog9-x64 06 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [173864 2015-05-26] (Sophos Limited)
Winsock: Catalog9-x64 07 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [173864 2015-05-26] (Sophos Limited)
Winsock: Catalog9-x64 08 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [173864 2015-05-26] (Sophos Limited)
Winsock: Catalog9-x64 19 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [173864 2015-05-26] (Sophos Limited)
Tcpip\..\Interfaces\{21072504-8B08-48CB-B084-C90577A620E5}: [NameServer] 127.0.0.1,10.x.x.x

FireFox:
========
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll [2013-09-13] 

( Microsoft Corporation)
FF Plugin: @microsoft.com/wpi,version=1.0 -> C:\Program Files\Microsoft\Web Platform Installer\\npwpidetector.dll [2010-05

-14] (Microsoft Corp)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\SysWOW64\npDeployJava1.dll [2013-07-17] (Oracle 

Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2013-07-17] 

(Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll 

[2013-09-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/wpi,version=1.1 -> C:\Program Files\Microsoft\Web Platform Installer\\npwpidetector.dll 

[2010-05-14] (Microsoft Corp)
FF Plugin-x32: @vmware.com/vmrc,version=5.1.0.00000 -> C:\Program Files (x86)\Common Files\VMware\VMware Remote Console 

Plug-in 5.1\Firefox\np-vmware-vmrc.dll [2013-03-19] (VMware, Inc.)

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed 

separately.)

R2 ADWS; C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exe [487424 2013-01-25] (Microsoft Corporation)
R2 BackupExecAgentAccelerator; C:\Program Files\Symantec\Backup Exec\beremote.exe [1816696 2010-12-08] (Symantec 

Corporation)
R2 BackupExecAgentBrowser; C:\Program Files\Symantec\Backup Exec\benetns.exe [542536 2010-06-29] (Symantec Corporation)
R2 BackupExecDeviceMediaService; C:\Program Files\Symantec\Backup Exec\pvlsvr.exe [2492784 2011-04-11] (Symantec 

Corporation)
R2 BackupExecJobEngine; C:\Program Files\Symantec\Backup Exec\bengine.exe [10835312 2011-06-27] (Symantec Corporation)
S3 BackupExecManagementService; C:\Program Files\Symantec\Backup Exec\BackupExecManagementService.exe [124232 2010-07-08] 

(Symantec Corporation)
R2 BackupExecRPCService; C:\Program Files\Symantec\Backup Exec\beserver.exe [11384688 2011-05-23] (Symantec Corporation)
R2 bedbg; C:\Program Files\Symantec\Backup Exec\bedbg.exe [359240 2010-06-29] (Symantec Corporation)
S4 CIMnotify; C:\Windows\system32\CIMntfy\cimntfy.exe [268392 2010-05-26] (Hewlett-Packard Company)
R2 Cissesrv; C:\Program Files\HP\Cissesrv\cissesrv.exe [167424 2010-03-19] (Hewlett-Packard Company) [File not signed]
R2 Citrix Licensing; C:\Program Files (x86)\Citrix\Licensing\LS\lmadmin.exe [6907144 2009-07-02] ()
S3 Citrix_GTLicensingProv; C:\Program Files (x86)\Citrix\Licensing\LicWMI\Citrix_GTLicensingProv.exe [1836464 2010-02-22] 

(Citrix Systems, Inc.)
R2 CpqNicMgmt; C:\Windows\system32\CPQNiMgt\cpqnimgt.exe [9728 2010-04-28] (Hewlett-Packard Company) [File not signed]
R2 CpqRcmc3; C:\Program Files\Hewlett-Packard\iLO 3\service\ProLiantMonitor.exe [267880 2010-05-26] (Hewlett-Packard 

Company)
R2 cpqvcagent; C:\hp\hpsmh\data\cgi-bin\vcagent\vcagent.exe [1307648 2010-03-25] (Hewlett-Packard Company) [File not 

signed]
R2 CqMgHost; C:\Windows\system32\CpqMgmt\cqmghost\cqmghost.exe [15464 2010-05-26] (Hewlett-Packard Company)
R2 CqMgServ; C:\Windows\system32\CpqMgmt\cqmgserv\cqmgserv.exe [15464 2010-05-26] (Hewlett-Packard Company)
R2 CqMgStor; C:\Windows\system32\CpqMgmt\cqmgstor\cqmgstor.exe [20992 2010-04-09] (Hewlett-Packard Company) [File not 

signed]
R2 CtxLSPortSvc; C:\Program Files (x86)\Citrix\Licensing\LS\CtxLSPortSvc.exe [58800 2010-02-22] (Citrix Systems, Inc.)
R2 Dfs; C:\Windows\system32\dfssvc.exe [377344 2010-11-20] (Microsoft Corporation)
R2 DFSR; C:\Windows\system32\DFSRs.exe [4518400 2010-11-20] (Microsoft Corporation)
R2 DHCPServer; C:\Windows\System32\dhcpssvc.dll [729088 2010-11-20] (Microsoft Corporation)
R2 DNS; C:\Windows\system32\dns.exe [696832 2011-12-26] (Microsoft Corporation)
R2 DWAuthenticationServer; D:\Programme\DocuWare\Authentication Server\DWAuthenticationServer.exe [24576 2013-07-02] 

(DocuWare AG) [File not signed]
R2 DWContentServer; D:\Programme\DocuWare\Content Server\DWContentServer.exe [20480 2013-07-02] (DocuWare AG) [File not 

signed]
R2 DWDesktopService; C:\Program Files (x86)\DocuWare\Desktop\DocuWare.DesktopService.exe [26112 2013-07-02] (DocuWare AG) 

[File not signed]
R2 DWImagingService; D:\Programme\DocuWare\Imaging Server\DWImagingService.exe [14336 2013-07-02] (DocuWare AG) [File not 

signed]
R2 DWJobProcessor; D:\Programme\DocuWare\Job Processor\DocuWare.JobProcessor.exe [15360 2013-07-02] (DocuWare AG) [File not 

signed]
R2 DWMySQL; D:\Programme\DocuWare\DWDatabase\bin\mysqld-nt.exe [5799936 2009-07-08] () [File not signed]
R2 DWNotificationServer; D:\Programme\DocuWare\Notification Server\DWNotificationServer.exe [9216 2013-07-02] (DocuWare AG) 

[File not signed]
R2 DWOCRService; D:\Programme\DocuWare\OCR Service\DWOCRService.exe [14848 2013-07-02] (DocuWare AG) [File not signed]
R2 DWThumbnailServer; D:\Programme\DocuWare\Thumbnail Server\DWThumbnailService.exe [8704 2013-07-02] (DocuWare AG) [File 

not signed]
R2 DWTomcat; D:\Programme\DocuWare\Full-Text Server\bin\tomcat7.exe [74240 2011-01-10] (Apache Software Foundation) [File 

not signed]
R2 DWUploadService; C:\Program Files (x86)\DocuWare\Upload Service\DWUploadServiceSvc.exe [104960 2013-07-02] (DocuWare AG) 

[File not signed]
R2 DWWebService; D:\Programme\DocuWare\Web Service Server\DWWebService.exe [11776 2013-07-02] (DocuWare AG) [File not 

signed]
R2 DWWorkflowServer; D:\Programme\DocuWare\Workflow Server\DWWorkflowServer.exe [20480 2013-07-02] (DocuWare AG) [File not 

signed]
S3 FCRegSvc; C:\Windows\system32\FCRegSvc.dll [25600 2009-07-14] (Microsoft Corporation)
R2 IISADMIN; C:\Windows\system32\inetsrv\inetinfo.exe [15872 2010-11-20] (Microsoft Corporation)
R2 IsmServ; C:\Windows\System32\ismserv.exe [59392 2010-11-20] (Microsoft Corporation)
R2 kdc; C:\Windows\System32\lsass.exe [30720 2013-09-25] (Microsoft Corporation)
S3 LiveUpdate; C:\Program Files (x86)\Symantec\LiveUpdate\LuComServer_3_3.EXE [3093880 2009-08-18] (Symantec Corporation)
R2 MSSQL$BKUPEXEC; C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] 

(Microsoft Corporation)
R2 NTDS; C:\Windows\System32\lsass.exe [30720 2013-09-25] (Microsoft Corporation)
S4 NtFrs; C:\Windows\system32\ntfrs.exe [1020416 2010-11-20] (Microsoft Corporation)
R2 ProLiantMonitor; C:\Program Files\Hewlett-Packard\iLO 3\service\ProLiantMonitor.exe [267880 2010-05-26] (Hewlett-Packard 

Company)
S3 RSoPProv; C:\Windows\system32\RSoPProv.exe [91648 2009-07-14] (Microsoft Corporation)
S3 sacsvr; C:\Windows\system32\sacsvr.dll [14848 2009-07-14] (Microsoft Corporation)
S3 Samsung UPD Service2; C:\Windows\System32\SUPDSvc2.exe [158208 2012-04-06] (Samsung Electronics) [File not signed]
R2 SAVAdminService; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe [288552 2015-05-26] (Sophos 

Limited)
R2 SAVService; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe [208168 2015-05-26] (Sophos Limited)
R2 SNMP; C:\Windows\System32\snmp.exe [49664 2010-11-20] (Microsoft Corporation)
R2 SNMP; C:\Windows\SysWOW64\snmp.exe [47616 2010-11-20] (Microsoft Corporation)
R2 Sophos Agent; C:\Program Files (x86)\Sophos\Remote Management System\ManagementAgentNT.exe [395560 2015-05-26] (Sophos 

Limited)
R2 Sophos AutoUpdate Service; C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe [340776 2015-01-30] (Sophos Limited)
R2 Sophos Message Router; C:\Program Files (x86)\Sophos\Remote Management System\RouterNT.exe [1069864 2015-05-26] (Sophos 

Limited)
R2 Sophos Web Control Service; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe [341800 2015-05

-26] (Sophos Limited)
R3 SrmReports; C:\Windows\system32\srmhost.exe [76288 2010-11-20] (Microsoft Corporation)
R2 SrmSvc; C:\Windows\system32\srmsvc.dll [3489792 2010-11-20] (Microsoft Corporation)
R2 swi_service; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe [3278632 2015-05-26] 

(Sophos Limited)
S2 swi_update_64; C:\ProgramData\Sophos\Web Intelligence\swi_update_64.exe [2081064 2015-05-26] (Sophos Limited)
R2 sysdown; C:\Program Files\Hewlett-Packard\iLO 3\service\ProLiantMonitor.exe [267880 2010-05-26] (Hewlett-Packard 

Company)
R2 SysMgmtHp; C:\hp\hpsmh\bin\smhstart.exe [2041856 2010-01-28] (Hewlett-Packard Company) [File not signed]
R2 TermServLicensing; C:\Windows\System32\lserver.dll [694784 2010-11-20] (Microsoft Corporation)
R2 TrileadVMXService; C:\Program Files (x86)\Trilead\Trilead VMX\VMXService.exe [4136344 2014-01-07] (Microsoft)
R2 vmware-converter-agent; C:\Program Files (x86)\VMware\VMware vCenter Converter Standalone\vmware-converter-a.exe [479824 

2013-04-09] (VMware, Inc.)
R2 vmware-converter-server; C:\Program Files (x86)\VMware\VMware vCenter Converter Standalone\vmware-converter.exe [479824 

2013-04-09] (VMware, Inc.)
R2 vmware-converter-worker; C:\Program Files (x86)\VMware\VMware vCenter Converter Standalone\vmware-converter.exe [479824 

2013-04-09] (VMware, Inc.)
R2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [453120 2010-11-20] (Microsoft Corporation)
R2 WINS; C:\Windows\System32\wins.exe [287744 2011-08-09] (Microsoft Corporation)
S2 DWCONNECTtoToshiba; "D:\Programme\DocuWare\Client\Client Modules\CONNECT to Toshiba\CONNECTtoToshibaServer

\DWCONNECTtoToshiba.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed 

separately.)

R3 ati2mtag; C:\Windows\System32\DRIVERS\ati2mtag.sys [2210816 2009-06-24] (ATI Technologies Inc.)
S3 bmdrvr; C:\Windows\SysWow64\drivers\bmdrvr.sys [75344 2013-02-22] (VMware, Inc.)
S3 CPQTeam; C:\Windows\System32\DRIVERS\cpqteam.sys [225792 2010-02-24] (Hewlett-Packard Company)
R3 CPQTeamMP; C:\Windows\System32\DRIVERS\cpqteam.sys [225792 2010-02-24] (Hewlett-Packard Company)
R0 Datascrn; C:\Windows\System32\drivers\datascrn.sys [79936 2009-07-14] (Microsoft Corporation)
R1 DfsDriver; C:\Windows\System32\drivers\dfs.sys [51776 2009-07-14] (Microsoft Corporation)
R0 DfsrRo; C:\Windows\System32\drivers\dfsrro.sys [66944 2010-11-20] (Microsoft Corporation)
R0 HpCISSs2; C:\Windows\System32\DRIVERS\HpCISSs2.sys [156776 2010-02-22] (Hewlett-Packard Company)
R3 hplto; C:\Windows\System32\DRIVERS\hplto.sys [16384 2009-05-14] (Hewlett-Packard)
R3 hpqilo3chif; C:\Windows\System32\DRIVERS\hpqilo3chif.sys [43112 2010-04-28] (Hewlett-Packard Company)
R3 hpqilo3core; C:\Windows\System32\DRIVERS\hpqilo3core.sys [44648 2010-05-09] (Hewlett-Packard Company)
R0 hpqilo3whea; C:\Windows\System32\DRIVERS\hpqilo3whea.sys [18472 2010-02-12] (Hewlett-Packard Company)
S3 ioatdma; C:\Windows\System32\Drivers\qd260x64.sys [35328 2009-06-10] (Intel Corporation)
R3 l2nd; C:\Windows\System32\DRIVERS\bxnd60a.sys [83496 2010-04-30] (Broadcom Corporation)
R0 Quota; C:\Windows\System32\drivers\quota.sys [168016 2009-07-14] (Microsoft Corporation)
S0 sacdrv; C:\Windows\System32\DRIVERS\sacdrv.sys [96320 2009-07-14] (Microsoft Corporation)
R1 SAVOnAccess; C:\Windows\System32\DRIVERS\savonaccess.sys [158976 2015-05-26] (Sophos Limited)
R1 SCSIChanger; C:\Windows\System32\DRIVERS\scsichng.sys [28208 2007-08-23] (Symantec Corporation)
S3 sdcfilter; C:\Windows\System32\DRIVERS\sdcfilter.sys [38144 2015-05-26] (Sophos Limited)
S4 SophosBootDriver; C:\Windows\System32\DRIVERS\SophosBootDriver.sys [27904 2015-05-26] (Sophos Limited)
U5 Tape; C:\Windows\System32\Drivers\Tape.sys [29184 2009-07-14] (Microsoft Corporation)
R3 tpfilter; C:\Windows\System32\DRIVERS\tpfilter.sys [43568 2010-05-27] (Symantec Corporation)
U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] ()
R2 vstor2-mntapi20-shared; C:\Windows\SysWow64\drivers\vstor2-mntapi20-shared.sys [33872 2013-02-22] (VMware, Inc.)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed 

separately.)

NETSVC: sacsvr -> C:\Windows\system32\sacsvr.dll (Microsoft Corporation)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-05-28 08:52 - 2015-05-28 08:53 - 00030545 _____ () C:\Users\Administrator\Desktop\FRST.txt
2015-05-28 08:51 - 2015-05-28 08:51 - 02108928 _____ (Farbar) C:\Users\Administrator\Desktop\FRST64.exe
2015-05-28 08:41 - 2015-05-28 08:41 - 00001852 _____ () C:\Windows\System32\Tasks\At57
2015-05-28 08:41 - 2015-05-28 08:41 - 00000348 _____ () C:\Windows\Tasks\At57.job
2015-05-28 08:23 - 2015-05-28 08:23 - 00001852 _____ () C:\Windows\System32\Tasks\At56
2015-05-28 08:23 - 2015-05-28 08:23 - 00000348 _____ () C:\Windows\Tasks\At56.job
2015-05-28 07:59 - 2015-05-28 08:00 - 00000348 _____ () C:\Windows\Tasks\At55.job
2015-05-28 07:59 - 2015-05-28 07:59 - 00001852 _____ () C:\Windows\System32\Tasks\At55
2015-05-28 07:30 - 2015-05-28 08:00 - 00000348 _____ () C:\Windows\Tasks\At54.job
2015-05-28 07:30 - 2015-05-28 07:30 - 00001852 _____ () C:\Windows\System32\Tasks\At54
2015-05-28 07:17 - 2015-05-28 08:00 - 00000350 _____ () C:\Windows\Tasks\At53.job
2015-05-28 07:17 - 2015-05-28 07:17 - 00001854 _____ () C:\Windows\System32\Tasks\At53
2015-05-28 06:38 - 2015-05-28 07:00 - 00000350 _____ () C:\Windows\Tasks\At52.job
2015-05-28 06:38 - 2015-05-28 06:38 - 00001854 _____ () C:\Windows\System32\Tasks\At52
2015-05-28 06:36 - 2015-05-28 07:00 - 00000348 _____ () C:\Windows\Tasks\At51.job
2015-05-28 06:36 - 2015-05-28 06:36 - 00001852 _____ () C:\Windows\System32\Tasks\At51
2015-05-28 05:54 - 2015-05-28 06:00 - 00000346 _____ () C:\Windows\Tasks\At50.job
2015-05-28 05:54 - 2015-05-28 05:54 - 00001850 _____ () C:\Windows\System32\Tasks\At50
2015-05-28 05:48 - 2015-05-28 06:00 - 00000352 _____ () C:\Windows\Tasks\At49.job
2015-05-28 05:48 - 2015-05-28 05:48 - 00001856 _____ () C:\Windows\System32\Tasks\At49
2015-05-28 05:13 - 2015-05-28 06:00 - 00000346 _____ () C:\Windows\Tasks\At48.job
2015-05-28 05:13 - 2015-05-28 05:13 - 00001850 _____ () C:\Windows\System32\Tasks\At48
2015-05-28 04:59 - 2015-05-28 05:00 - 00000352 _____ () C:\Windows\Tasks\At47.job
2015-05-28 04:59 - 2015-05-28 04:59 - 00001856 _____ () C:\Windows\System32\Tasks\At47
2015-05-28 04:32 - 2015-05-28 05:00 - 00000348 _____ () C:\Windows\Tasks\At46.job
2015-05-28 04:32 - 2015-05-28 04:32 - 00001852 _____ () C:\Windows\System32\Tasks\At46
2015-05-28 04:09 - 2015-05-28 05:00 - 00000348 _____ () C:\Windows\Tasks\At45.job
2015-05-28 04:09 - 2015-05-28 04:09 - 00001852 _____ () C:\Windows\System32\Tasks\At45
2015-05-28 03:51 - 2015-05-28 04:00 - 00000346 _____ () C:\Windows\Tasks\At44.job
2015-05-28 03:51 - 2015-05-28 03:51 - 00001850 _____ () C:\Windows\System32\Tasks\At44
2015-05-28 03:20 - 2015-05-28 04:00 - 00000350 _____ () C:\Windows\Tasks\At43.job
2015-05-28 03:20 - 2015-05-28 03:20 - 00001854 _____ () C:\Windows\System32\Tasks\At43
2015-05-28 03:09 - 2015-05-28 04:00 - 00000346 _____ () C:\Windows\Tasks\At42.job
2015-05-28 03:09 - 2015-05-28 03:09 - 00001850 _____ () C:\Windows\System32\Tasks\At42
2015-05-28 02:30 - 2015-05-28 03:00 - 00000350 _____ () C:\Windows\Tasks\At41.job
2015-05-28 02:30 - 2015-05-28 02:30 - 00001854 _____ () C:\Windows\System32\Tasks\At41
2015-05-28 02:28 - 2015-05-28 03:00 - 00000348 _____ () C:\Windows\Tasks\At40.job
2015-05-28 02:28 - 2015-05-28 02:28 - 00001852 _____ () C:\Windows\System32\Tasks\At40
2015-05-28 01:47 - 2015-05-28 02:00 - 00000346 _____ () C:\Windows\Tasks\At39.job
2015-05-28 01:47 - 2015-05-28 01:47 - 00001850 _____ () C:\Windows\System32\Tasks\At39
2015-05-28 01:41 - 2015-05-28 02:00 - 00000352 _____ () C:\Windows\Tasks\At38.job
2015-05-28 01:41 - 2015-05-28 01:41 - 00001856 _____ () C:\Windows\System32\Tasks\At38
2015-05-28 01:06 - 2015-05-28 02:00 - 00000350 _____ () C:\Windows\Tasks\At37.job
2015-05-28 01:06 - 2015-05-28 01:06 - 00001854 _____ () C:\Windows\System32\Tasks\At37
2015-05-28 00:51 - 2015-05-28 01:00 - 00000350 _____ () C:\Windows\Tasks\At36.job
2015-05-28 00:51 - 2015-05-28 00:51 - 00001854 _____ () C:\Windows\System32\Tasks\At36
2015-05-28 00:24 - 2015-05-28 01:00 - 00000346 _____ () C:\Windows\Tasks\At35.job
2015-05-28 00:24 - 2015-05-28 00:24 - 00001850 _____ () C:\Windows\System32\Tasks\At35
2015-05-28 00:02 - 2015-05-28 01:00 - 00000346 _____ () C:\Windows\Tasks\At34.job
2015-05-28 00:02 - 2015-05-28 00:02 - 00001850 _____ () C:\Windows\System32\Tasks\At34
2015-05-27 23:43 - 2015-05-28 00:00 - 00000352 _____ () C:\Windows\Tasks\At33.job
2015-05-27 23:43 - 2015-05-27 23:43 - 00001856 _____ () C:\Windows\System32\Tasks\At33
2015-05-27 23:12 - 2015-05-28 00:00 - 00000348 _____ () C:\Windows\Tasks\At32.job
2015-05-27 23:12 - 2015-05-27 23:12 - 00001852 _____ () C:\Windows\System32\Tasks\At32
2015-05-27 23:02 - 2015-05-28 00:00 - 00000352 _____ () C:\Windows\Tasks\At31.job
2015-05-27 23:02 - 2015-05-27 23:02 - 00001856 _____ () C:\Windows\System32\Tasks\At31
2015-05-27 22:23 - 2015-05-27 23:00 - 00000350 _____ () C:\Windows\Tasks\At30.job
2015-05-27 22:23 - 2015-05-27 22:23 - 00001854 _____ () C:\Windows\System32\Tasks\At30
2015-05-27 22:21 - 2015-05-27 23:00 - 00000346 _____ () C:\Windows\Tasks\At29.job
2015-05-27 22:21 - 2015-05-27 22:21 - 00001850 _____ () C:\Windows\System32\Tasks\At29
2015-05-27 21:39 - 2015-05-27 22:00 - 00000348 _____ () C:\Windows\Tasks\At28.job
2015-05-27 21:39 - 2015-05-27 21:39 - 00001852 _____ () C:\Windows\System32\Tasks\At28
2015-05-27 21:33 - 2015-05-27 22:00 - 00000352 _____ () C:\Windows\Tasks\At27.job
2015-05-27 21:33 - 2015-05-27 21:33 - 00001856 _____ () C:\Windows\System32\Tasks\At27
2015-05-27 20:58 - 2015-05-27 21:00 - 00000346 _____ () C:\Windows\Tasks\At26.job
2015-05-27 20:58 - 2015-05-27 20:58 - 00001850 _____ () C:\Windows\System32\Tasks\At26
2015-05-27 20:44 - 2015-05-27 21:00 - 00000352 _____ () C:\Windows\Tasks\At25.job
2015-05-27 20:44 - 2015-05-27 20:44 - 00001856 _____ () C:\Windows\System32\Tasks\At25
2015-05-27 20:17 - 2015-05-27 21:00 - 00000352 _____ () C:\Windows\Tasks\At24.job
2015-05-27 20:17 - 2015-05-27 20:17 - 00001856 _____ () C:\Windows\System32\Tasks\At24
2015-05-27 19:54 - 2015-05-27 20:00 - 00000350 _____ () C:\Windows\Tasks\At23.job
2015-05-27 19:54 - 2015-05-27 19:54 - 00001854 _____ () C:\Windows\System32\Tasks\At23
2015-05-27 19:35 - 2015-05-27 20:00 - 00000346 _____ () C:\Windows\Tasks\At22.job
2015-05-27 19:35 - 2015-05-27 19:35 - 00001850 _____ () C:\Windows\System32\Tasks\At22
2015-05-27 19:04 - 2015-05-27 20:00 - 00000350 _____ () C:\Windows\Tasks\At21.job
2015-05-27 19:04 - 2015-05-27 19:04 - 00001854 _____ () C:\Windows\System32\Tasks\At21
2015-05-27 18:54 - 2015-05-27 19:00 - 00000350 _____ () C:\Windows\Tasks\At20.job
2015-05-27 18:54 - 2015-05-27 18:54 - 00001854 _____ () C:\Windows\System32\Tasks\At20
2015-05-27 18:15 - 2015-05-27 19:00 - 00000348 _____ () C:\Windows\Tasks\At19.job
2015-05-27 18:15 - 2015-05-27 18:15 - 00001852 _____ () C:\Windows\System32\Tasks\At19
2015-05-27 17:58 - 2015-05-27 18:00 - 00000352 _____ () C:\Windows\Tasks\At18.job
2015-05-27 17:58 - 2015-05-27 17:58 - 00001856 _____ () C:\Windows\System32\Tasks\At18
2015-05-27 17:16 - 2015-05-27 18:00 - 00000350 _____ () C:\Windows\Tasks\At17.job
2015-05-27 17:16 - 2015-05-27 17:16 - 00001854 _____ () C:\Windows\System32\Tasks\At17
2015-05-27 16:36 - 2015-05-27 17:00 - 00000348 _____ () C:\Windows\Tasks\At16.job
2015-05-27 16:36 - 2015-05-27 16:36 - 00001852 _____ () C:\Windows\System32\Tasks\At16
2015-05-27 16:13 - 2015-05-27 17:00 - 00000352 _____ () C:\Windows\Tasks\At15.job
2015-05-27 16:13 - 2015-05-27 16:13 - 00001856 _____ () C:\Windows\System32\Tasks\At15
2015-05-27 15:38 - 2015-05-27 15:38 - 05628291 _____ (Swearware) C:\Users\Administrator\Downloads\ComboFix.exe
2015-05-27 15:33 - 2015-05-27 16:00 - 00000348 _____ () C:\Windows\Tasks\At14.job
2015-05-27 15:33 - 2015-05-27 15:33 - 00001852 _____ () C:\Windows\System32\Tasks\At14
2015-05-27 15:05 - 2015-05-27 16:00 - 00000346 _____ () C:\Windows\Tasks\At13.job
2015-05-27 15:05 - 2015-05-27 15:05 - 00001850 _____ () C:\Windows\System32\Tasks\At13
2015-05-27 15:00 - 2015-05-28 08:53 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Temp\2
2015-05-27 14:48 - 2015-05-27 15:00 - 00000348 _____ () C:\Windows\Tasks\At12.job
2015-05-27 14:48 - 2015-05-27 14:48 - 00001852 _____ () C:\Windows\System32\Tasks\At12
2015-05-27 14:09 - 2015-05-27 15:00 - 00000352 _____ () C:\Windows\Tasks\At11.job
2015-05-27 14:09 - 2015-05-27 14:09 - 00001856 _____ () C:\Windows\System32\Tasks\At11
2015-05-27 14:06 - 2015-05-27 15:00 - 00000352 _____ () C:\Windows\Tasks\At10.job
2015-05-27 14:06 - 2015-05-27 14:06 - 00001856 _____ () C:\Windows\System32\Tasks\At10
2015-05-27 13:15 - 2015-05-27 14:53 - 00000352 _____ () C:\Windows\Tasks\At9.job
2015-05-27 13:15 - 2015-05-27 13:15 - 00001856 _____ () C:\Windows\System32\Tasks\At9
2015-05-27 13:08 - 2015-05-27 14:53 - 00000348 _____ () C:\Windows\Tasks\At8.job
2015-05-27 13:08 - 2015-05-27 13:08 - 00001852 _____ () C:\Windows\System32\Tasks\At8
2015-05-27 12:29 - 2015-05-27 14:53 - 00000350 _____ () C:\Windows\Tasks\At7.job
2015-05-27 12:29 - 2015-05-27 12:29 - 00001854 _____ () C:\Windows\System32\Tasks\At7
2015-05-27 12:11 - 2015-05-27 14:53 - 00000346 _____ () C:\Windows\Tasks\At6.job
2015-05-27 12:11 - 2015-05-27 12:11 - 00001850 _____ () C:\Windows\System32\Tasks\At6
2015-05-27 11:43 - 2015-05-27 14:53 - 00000350 _____ () C:\Windows\Tasks\At5.job
2015-05-27 11:43 - 2015-05-27 11:43 - 00001854 _____ () C:\Windows\System32\Tasks\At5
2015-05-27 11:20 - 2015-05-28 08:52 - 00000000 ____D () C:\FRST
2015-05-27 11:14 - 2015-05-27 14:53 - 00000350 _____ () C:\Windows\Tasks\At4.job
2015-05-27 11:14 - 2015-05-27 11:14 - 00001854 _____ () C:\Windows\System32\Tasks\At4
2015-05-27 11:01 - 2015-05-27 14:53 - 00000352 _____ () C:\Windows\Tasks\At3.job
2015-05-27 11:01 - 2015-05-27 11:01 - 00001856 _____ () C:\Windows\System32\Tasks\At3
2015-05-27 10:19 - 2015-05-27 14:53 - 00000348 _____ () C:\Windows\Tasks\At2.job
2015-05-27 10:19 - 2015-05-27 10:19 - 00001852 _____ () C:\Windows\System32\Tasks\At2
2015-05-27 10:17 - 2015-05-27 14:53 - 00000352 _____ () C:\Windows\Tasks\At1.job
2015-05-27 10:17 - 2015-05-27 10:17 - 00001856 _____ () C:\Windows\System32\Tasks\At1
2015-05-27 09:34 - 2015-05-27 09:34 - 00002759 _____ () C:\Users\Public\Desktop\Sophos Virus Removal Tool.lnk
2015-05-26 23:50 - 2015-05-27 23:59 - 00000000 _____ () C:\Windows\system32\vireng.log
2015-05-26 14:07 - 2015-05-26 14:05 - 00035624 _____ (Sophos Limited) C:\Windows\system32\SophosBootTasks.exe
2015-05-26 14:06 - 2015-05-27 09:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sophos
2015-05-26 14:06 - 2015-05-26 14:06 - 00176120 _____ (Sophos Limited) C:\Windows\system32\sdccoinstaller.dll
2015-05-26 14:06 - 2015-05-26 14:06 - 00038144 _____ (Sophos Limited) C:\Windows\system32\Drivers\sdcfilter.sys
2015-05-26 14:06 - 2015-05-26 14:06 - 00027904 _____ (Sophos Limited) C:\Windows\system32\Drivers\SophosBootDriver.sys
2015-05-26 14:05 - 2015-05-27 09:35 - 00000000 ____D () C:\ProgramData\Sophos
2015-05-26 14:05 - 2015-05-27 09:34 - 00000000 ____D () C:\Program Files (x86)\Sophos
2015-05-26 14:05 - 2015-05-26 14:05 - 00312895 _____ () C:\Users\Administrator\AppData\Local\Temp\avremove.log
2015-05-26 14:05 - 2015-05-26 14:05 - 00158976 _____ (Sophos Limited) C:\Windows\system32\Drivers\savonaccess.sys
2015-05-26 14:05 - 2015-05-26 14:05 - 00018695 _____ () C:\Users\Administrator\AppData\Local\Temp\Sophos ES setup.log
2015-05-26 14:05 - 2015-05-26 14:05 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Temp\crt

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-05-28 08:37 - 2012-12-03 15:18 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-05-28 07:58 - 2010-10-25 20:22 - 23608259 _____ () C:\Windows\system32\besnmp.TRC
2015-05-28 07:54 - 2011-03-11 14:47 - 00000000 ____D () C:\Windows\system32\dhcp
2015-05-28 01:43 - 2010-11-04 22:30 - 00000000 ___HD () C:\Backup Exec AOFO Store
2015-05-28 01:43 - 2010-09-21 16:30 - 00000000 ____D () C:\Windows\NTDS
2015-05-28 01:43 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\inetsrv
2015-05-28 01:42 - 2010-09-29 10:53 - 00000000 ____D () C:\Windows\system32\wins
2015-05-28 01:42 - 2010-09-29 10:42 - 00000000 ____D () C:\Windows\system32\lserver
2015-05-27 18:57 - 2010-09-16 11:44 - 01717758 _____ () C:\Windows\WindowsUpdate.log
2015-05-27 15:05 - 2009-07-14 06:49 - 00014816 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-

1.C7483456-A289-439d-8115-601632D005A0
2015-05-27 15:05 - 2009-07-14 06:49 - 00014816 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-

0.C7483456-A289-439d-8115-601632D005A0
2015-05-27 15:01 - 2009-09-18 03:52 - 00940408 _____ () C:\Windows\system32\perfh00A.dat
2015-05-27 15:01 - 2009-09-18 03:52 - 00234070 _____ () C:\Windows\system32\perfc00A.dat
2015-05-27 15:01 - 2009-09-18 03:45 - 00903584 _____ () C:\Windows\system32\perfh007.dat
2015-05-27 15:01 - 2009-09-18 03:45 - 00222124 _____ () C:\Windows\system32\perfc007.dat
2015-05-27 15:01 - 2009-09-18 03:39 - 00931962 _____ () C:\Windows\system32\perfh010.dat
2015-05-27 15:01 - 2009-09-18 03:39 - 00219332 _____ () C:\Windows\system32\perfc010.dat
2015-05-27 15:01 - 2009-09-18 03:33 - 00941504 _____ () C:\Windows\system32\perfh00C.dat
2015-05-27 15:01 - 2009-09-18 03:33 - 00223464 _____ () C:\Windows\system32\perfc00C.dat
2015-05-27 15:01 - 2009-07-14 07:10 - 05664028 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-05-27 14:54 - 2010-10-06 11:18 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Temp\hsperfdata_Administrator
2015-05-27 14:54 - 2010-09-21 16:35 - 00006392 _____ () C:\Windows\system32\config\netlogon.dnb
2015-05-27 14:54 - 2010-09-21 16:35 - 00002293 _____ () C:\Windows\system32\config\netlogon.dns
2015-05-27 14:54 - 2010-09-20 19:57 - 00000000 ____D () C:\Windows\system32\dns
2015-05-27 14:53 - 2009-07-14 07:06 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-27 10:16 - 2010-10-25 20:09 - 00000000 ____D () C:\ProgramData\Symantec
2015-05-27 10:08 - 2010-10-25 20:31 - 25060350 _____ () C:\Windows\system32\Dashboard.log
2015-05-26 14:08 - 2011-08-09 11:36 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Temp\WEC
2015-05-18 17:24 - 2010-10-02 15:48 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\VMware
2015-05-13 14:52 - 2010-09-16 23:08 - 00240764 _____ () C:\Users\Administrator\Desktop\ADMIN-KONSOLE.msc
2015-05-06 14:55 - 2010-09-27 16:31 - 00012168 _____ () C:\Users\Administrator\volshext.log

==================== Files in the root of some directories =======

2013-08-13 09:56 - 2013-08-13 09:56 - 0646498 _____ () C:\Users\Administrator\AppData\Local\dd_ReportViewerMSI5F5F.txt
2013-08-13 09:56 - 2013-08-13 09:56 - 0031136 _____ () C:\Users\Administrator\AppData\Local\dd_ReportViewerUI5F5F.txt
2013-08-13 10:05 - 2013-08-13 10:06 - 0431252 _____ () C:\Users\Administrator\AppData\Local\dd_vcredistMSI660B.txt
2013-08-13 10:06 - 2013-08-13 10:07 - 0441992 _____ () C:\Users\Administrator\AppData\Local\dd_vcredistMSI66CF.txt
2013-08-13 10:05 - 2013-08-13 10:06 - 0029772 _____ () C:\Users\Administrator\AppData\Local\dd_vcredistUI660B.txt
2013-08-13 10:06 - 2013-08-13 10:07 - 0029708 _____ () C:\Users\Administrator\AppData\Local\dd_vcredistUI66CF.txt
2011-08-09 15:25 - 2011-08-09 15:25 - 0000064 _____ () C:\Users\Administrator\AppData\Local\DW5ReportSettings.xml
2010-09-16 23:10 - 2010-09-16 23:10 - 0007605 _____ () C:\Users\Administrator\AppData\Local\Resmon.ResmonCfg
2013-06-03 12:16 - 2013-06-03 12:16 - 0000057 _____ () C:\ProgramData\Ament.ini

Files to move or delete:
====================
C:\Windows\Tasks\At1.job
C:\Windows\Tasks\At10.job
C:\Windows\Tasks\At11.job
C:\Windows\Tasks\At12.job
C:\Windows\Tasks\At13.job
C:\Windows\Tasks\At14.job
C:\Windows\Tasks\At15.job
C:\Windows\Tasks\At16.job
C:\Windows\Tasks\At17.job
C:\Windows\Tasks\At18.job
C:\Windows\Tasks\At19.job
C:\Windows\Tasks\At2.job
C:\Windows\Tasks\At20.job
C:\Windows\Tasks\At21.job
C:\Windows\Tasks\At22.job
C:\Windows\Tasks\At23.job
C:\Windows\Tasks\At24.job
C:\Windows\Tasks\At25.job
C:\Windows\Tasks\At26.job
C:\Windows\Tasks\At27.job
C:\Windows\Tasks\At28.job
C:\Windows\Tasks\At29.job
C:\Windows\Tasks\At3.job
C:\Windows\Tasks\At30.job
C:\Windows\Tasks\At31.job
C:\Windows\Tasks\At32.job
C:\Windows\Tasks\At33.job
C:\Windows\Tasks\At34.job
C:\Windows\Tasks\At35.job
C:\Windows\Tasks\At36.job
C:\Windows\Tasks\At37.job
C:\Windows\Tasks\At38.job
C:\Windows\Tasks\At39.job
C:\Windows\Tasks\At4.job
C:\Windows\Tasks\At40.job
C:\Windows\Tasks\At41.job
C:\Windows\Tasks\At42.job
C:\Windows\Tasks\At43.job
C:\Windows\Tasks\At44.job
C:\Windows\Tasks\At45.job
C:\Windows\Tasks\At46.job
C:\Windows\Tasks\At47.job
C:\Windows\Tasks\At48.job
C:\Windows\Tasks\At49.job
C:\Windows\Tasks\At5.job
C:\Windows\Tasks\At50.job
C:\Windows\Tasks\At51.job
C:\Windows\Tasks\At52.job
C:\Windows\Tasks\At53.job
C:\Windows\Tasks\At54.job
C:\Windows\Tasks\At55.job
C:\Windows\Tasks\At56.job
C:\Windows\Tasks\At57.job
C:\Windows\Tasks\At6.job
C:\Windows\Tasks\At7.job
C:\Windows\Tasks\At8.job
C:\Windows\Tasks\At9.job


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-05-24 00:02

==================== End of log ============================

27.05.2015, 11:09	#34
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	W32/Confick-O Datei rkqunq.z in System32 Klar, wenn du komplett zurückwillst musst du vorher ein Abbild des Systems machen. Sowas geht auch im laufenden Betrieb mit der kleinen Software Drivesnapshot - einfach nur die EXE starten, keine Installation notwendig. Find ich viel übersichtlicher und handlicher als Acronis. __________________ Logfiles bitte immer in CODE-Tags posten

27.05.2015, 11:23	#36
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	W32/Confick-O Datei rkqunq.z in System32 Normalerweise steht die Endung für Vmware, ja. Aber das ist ja nicht in Stein gemeißelt und zB eine reine Textdatei kann eine völlig andere Endung haben. Ist halt nur ein Zusatz zum Dateinamen, nur Windows macht sehr vieles davon abhängig. __________________ --> W32/Confick-O Datei rkqunq.z in System32

27.05.2015, 14:46	#38
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	W32/Confick-O Datei rkqunq.z in System32 Ich habs schon fast befürchtet Windows 2008 R2 ist die Server-Version von Windows 7, war ein Versuch wert. Poste mal die Logs des Removal Tools. __________________ Logfiles bitte immer in CODE-Tags posten

27.05.2015, 14:53	#40
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	W32/Confick-O Datei rkqunq.z in System32 Wie heißt das Tool genau? Von welchem Hersteller? __________________ Logfiles bitte immer in CODE-Tags posten

27.05.2015, 15:08	#42
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	W32/Confick-O Datei rkqunq.z in System32 Schau mal bitte direkt auf C: nach. Wenn es dort nicht liegt, dann evtl. im selben Verzeichnis wie die ausführbare Datei des Removal Tools. Und frische FRST-Logs bitte. __________________ Logfiles bitte immer in CODE-Tags posten

W32/Confick-O Datei rkqunq.z in System32

Antiviren-, Firewall- und andere Schutzprogramme: W32/Confick-O Datei rkqunq.z in System32