| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Verdacht auf Viren: Secure Eraser kann Dateien nicht löschenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
20.06.2015, 07:18
| #16 |
| /// the machine /// TB-Ausbilder    |  Verdacht auf Viren: Secure Eraser kann Dateien nicht löschen Lass ESET weg und mach das: Lade Dir bitte von hier  Emsisoft Emergency Kit herunter.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
20.06.2015, 13:03
| #17 |
 |  Verdacht auf Viren: Secure Eraser kann Dateien nicht löschen Nun aber: Hier die Emisoft
__________________Code:
ATTFilter Emsisoft Emergency Kit - Version 10.0
Letztes Update: 20.06.2015 13:26:44
Benutzerkonto: Anja-PC\Anja
Scan-Einstellungen:
Scan-Methode: Malware-Scan
Objekte: Rootkits, Speicher, Traces, Dateien
PUPs-Erkennung: An
Archiv-Scan: Aus
ADS Scan: An
Dateitypen-Filter: Aus
Erweitertes Caching: An
Direkter Festplattenzugriff: Aus
Scan-Beginn: 20.06.2015 13:27:42
C:\Users\Anja\Desktop\EuroGrand Casino.lnk Gefunden: Application.Win32.CasOnline (A)
Key: HKEY_USERS\S-1-5-21-809830661-3849426339-1780571292-1000\SOFTWARE\EUROGRAND CASINO Gefunden: Application.Win32.CasOnline (A)
Value: HKEY_USERS\S-1-5-21-809830661-3849426339-1780571292-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLETASKMGR Gefunden: Setting.DisableTaskMgr (A)
Value: HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLEREGISTRYTOOLS Gefunden: Setting.DisableRegistryTools (A)
Value: HKEY_USERS\S-1-5-21-809830661-3849426339-1780571292-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLEREGISTRYTOOLS Gefunden: Setting.DisableRegistryTools (A)
Gescannt: 67412
Gefunden 5
Scan-Ende: 20.06.2015 13:31:14
Scan-Zeit: 0:03:32
Value: HKEY_USERS\S-1-5-21-809830661-3849426339-1780571292-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLEREGISTRYTOOLS Gelöscht Setting.DisableRegistryTools (A)
Value: HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLEREGISTRYTOOLS Gelöscht Setting.DisableRegistryTools (A)
Value: HKEY_USERS\S-1-5-21-809830661-3849426339-1780571292-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLETASKMGR Gelöscht Setting.DisableTaskMgr (A)
Key: HKEY_USERS\S-1-5-21-809830661-3849426339-1780571292-1000\SOFTWARE\EUROGRAND CASINO Gelöscht Application.Win32.CasOnline (A)
C:\Users\Anja\Desktop\EuroGrand Casino.lnk Gelöscht Application.Win32.CasOnline (A)
Gelöscht 5
Code:
ATTFilter Results of screen317's Security Check version 1.002
Windows Vista Service Pack 2 x86 (UAC is enabled)
Internet Explorer 9
Internet Explorer 8
``````````````Antivirus/Firewall Check:``````````````
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
Java 8 Update 40
Java version 32-bit out of Date!
Adobe Flash Player 18.0.0.160
Adobe Reader 10.1.14 Adobe Reader out of Date!
Mozilla Firefox 36.0.3 Firefox out of Date!
Google Chrome (43.0.2357.124)
Google Chrome (43.0.2357.81)
````````Process Check: objlist.exe by Laurent````````
Bitdefender Antivirus Free Edition gzserv.exe
Bitdefender Antivirus Free Edition gziface.exe
Bitdefender 60-Second Virus Scanner pdscan.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: %
````````````````````End of Log``````````````````````
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 13-06-2015
Ran by Anja (administrator) on ANJA-PC on 20-06-2015 13:45:39
Running from C:\Users\Anja\Downloads
Loaded Profiles: Anja (Available Profiles: Anja)
Platform: Microsoft® Windows Vista™ Home Basic Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Bitdefender) C:\Program Files\Bitdefender\Antivirus Free Edition\gzserv.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Bitdefender) C:\Program Files\Bitdefender\Antivirus Free Edition\gziface.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Wondershare) C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
(Bitdefender) C:\Program Files\Bitdefender\60-Second Virus Scanner\pdscan.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Fujitsu Technology Solutions) C:\Program Files\Fujitsu\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
(Glarysoft Ltd) C:\Program Files\Glary Utilities 5\Integrator.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
() C:\Users\Anja\Downloads\SecurityCheck.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [Skytel] => C:\Program Files\Realtek\Audio\HDA\Skytel.exe [1833504 2008-10-31] (Realtek Semiconductor Corp.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [6609440 2008-10-31] (Realtek Semiconductor)
HKLM\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [1994752 2014-02-20] (Wondershare)
HKU\S-1-5-21-809830661-3849426339-1780571292-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [30877280 2014-12-11] (Skype Technologies S.A.)
HKU\S-1-5-21-809830661-3849426339-1780571292-1000\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-21] (Microsoft Corporation)
HKU\S-1-5-21-809830661-3849426339-1780571292-1000\...\Run: [pdiface] => C:\Program Files\Bitdefender\60-Second Virus Scanner\pdiface.exe [261984 2013-10-30] (Bitdefender)
HKU\S-1-5-21-809830661-3849426339-1780571292-1000\...\Run: [GUDelayStartup] => C:\Program Files\Glary Utilities 5\StartupManager.exe [37152 2015-05-25] (Glarysoft Ltd)
HKU\S-1-5-21-809830661-3849426339-1780571292-1000\...\Run: [GoogleChromeAutoLaunch_50EA6731804A0FA2B2DE051BEA45E463] => C:\Program Files\Google\Chrome\Application\chrome.exe [813896 2015-06-05] (Google Inc.)
HKU\S-1-5-21-809830661-3849426339-1780571292-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\PhotoScreensaver.scr [704512 2009-04-11] (Microsoft Corporation)
HKU\S-1-5-18\...\Run: [Picasa Media Detector] => C:\Program Files\Picasa2\PicasaMediaDetector.exe [443968 2008-02-26] (Google Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk [2013-08-15]
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
BootExecute: autocheck autochk *
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-809830661-3849426339-1780571292-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled
ProxyServer: [.DEFAULT] => http=127.0.0.1:52068;https=127.0.0.1:52068
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-809830661-3849426339-1780571292-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-809830661-3849426339-1780571292-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-809830661-3849426339-1780571292-1000 -> {443789B7-F39C-4b5c-9287-DA72D38F4FE6} URL =
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_40\bin\ssv.dll [2015-03-23] (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_40\bin\jp2ssv.dll [2015-03-23] (Oracle Corporation)
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll [2007-06-08] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 80.69.100.102 80.69.100.230
FireFox:
========
FF ProfilePath: C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default
FF Homepage: about:home
FF NetworkProxy: "ftp", "123.110.49.119"
FF NetworkProxy: "ftp_port", 8088
FF NetworkProxy: "gopher", "5.135.193.216"
FF NetworkProxy: "gopher_port", 8089
FF NetworkProxy: "http", "123.110.49.119"
FF NetworkProxy: "http_port", 8088
FF NetworkProxy: "no_proxies_on", ""
FF NetworkProxy: "socks", "123.110.49.119"
FF NetworkProxy: "socks_port", 8088
FF NetworkProxy: "socks_remote_dns", true
FF NetworkProxy: "ssl", "123.110.49.119"
FF NetworkProxy: "ssl_port", 8088
FF NetworkProxy: "type", 2
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_18_0_0_160.dll [2015-06-18] ()
FF Plugin: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files\Picasa2\npPicasa3.dll [2014-08-13] (Google, Inc.)
FF Plugin: @java.com/DTPlugin,version=11.40.2 -> C:\Program Files\Java\jre1.8.0_40\bin\dtplugin\npDeployJava1.dll [2015-03-23] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-03-23] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-17] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-17] (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-02-05] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-02-05] (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2015-04-30] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2015-04-30] (Adobe Systems Inc.)
FF Extension: FoxyProxy Standard - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\foxyproxy@eric.h.jung [2015-03-23]
FF Extension: Youtube Downloader - 4K Download - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\paulsaintuzb@gmail.com [2015-03-06]
FF Extension: No Name - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\{0b5130a9-cc50-4ced-99d5-cda8cc12ae48} [2013-12-16]
FF Extension: Proxy-Listen.de - Proxyswitcher - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\admin@proxy-listen.de.xpi [2012-09-27]
FF Extension: Best Proxy Switcher - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\bestproxyswitcher@bestproxyswitcher.com.xpi [2014-07-08]
FF Extension: Elite Proxy Switcher - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\eliteproxyswitcher@my-proxy.com.xpi [2015-03-21]
FF Extension: Video Downloader Professional - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\ffext_basicvideoext@startpage24.xpi [2013-10-25]
FF Extension: ZenMate Security & Privacy VPN - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\firefox@zenmate.com.xpi [2015-03-21]
FF Extension: Awesome screenshot: Capture and Annotate - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\jid0-GXjLLfbCoAx0LcltEdFrEkQdQPI@jetpack.xpi [2014-04-12]
FF Extension: Translate This! - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\jid0-k75TfRGfOXPHfEZmJ9cKu5eCgLc@jetpack.xpi [2013-11-06]
FF Extension: One Click Proxy - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\jid0-zXo3XFGyiDalgkeEO4UYJTUwo2I@jetpack.xpi [2014-07-08]
FF Extension: Nimbus Screen Capture - editable screenshots. - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\nimbusscreencaptureff@everhelper.me.xpi [2014-02-02]
FF Extension: Priv3+ - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\priv3plus@icsi.berkeley.edu.xpi [2015-03-21]
FF Extension: Proxy Tool - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\proxytool@proxylist.co.xpi [2012-12-11]
FF Extension: Google Translator for Firefox - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\translator@zoli.bod.xpi [2013-11-06]
FF Extension: Casino Toolbar - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\wagerlogic.xpi [2012-05-15]
FF Extension: ImTranslator - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\{9AA46F4F-4DC7-4c06-97AF-5035170634FE}.xpi [2012-04-26]
FF Extension: Adblock Plus - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-06-20]
FF Extension: QuickProxy - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\{d5ea4520-61a1-11da-8cd6-0800200c9a66}.xpi [2014-07-08]
FF Extension: Hotspot Shield Helper (Please allow this installation) - C:\Program Files\Mozilla Firefox\extensions\afurladvisor@anchorfree.com [2015-03-21]
FF Extension: Word Layers - C:\Program Files\Mozilla Firefox\extensions\ugnraew@jqhljqmpngx.net [2015-03-21]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2012-04-26]
FF Extension: No Name - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\extensions\support@tubedimmerapp.com [not found]
Chrome:
=======
CHR Profile: C:\Users\Anja\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-06-15]
CHR Extension: (Google Docs) - C:\Users\Anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-15]
CHR Extension: (Google Drive) - C:\Users\Anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-15]
CHR Extension: (Webpage Screenshot) - C:\Users\Anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdfnieppndfdhcgbmhfdlgdjegclkomk [2015-03-01]
CHR Extension: (YouTube) - C:\Users\Anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-15]
CHR Extension: (Google Search) - C:\Users\Anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-15]
CHR Extension: (CyberGhost VPN - Free Proxy) - C:\Users\Anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\fcbnikgemihknccdjaihjnfbapinljpi [2015-04-06]
CHR Extension: (ZenMate Security, Privacy & Unblock VPN) - C:\Users\Anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdcgdnkidjaadafnichfpabhfomcebme [2015-03-30]
CHR Extension: (Google Sheets) - C:\Users\Anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-06-15]
CHR Extension: (AdBlock) - C:\Users\Anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2015-06-15]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-14]
CHR Extension: (Google Wallet) - C:\Users\Anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-03-03]
CHR Extension: (Gmail) - C:\Users\Anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-15]
CHR HKLM\...\Chrome\Extension: [aobbhmkkplckkcbnbcdbkneemiooegoc] - No Path Or update_url value
CHR HKU\S-1-5-21-809830661-3849426339-1780571292-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [aobbhmkkplckkcbnbcdbkneemiooegoc] - No Path Or update_url value
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 gzserv; C:\Program Files\Bitdefender\Antivirus Free Edition\gzserv.exe [57520 2013-10-23] (Bitdefender)
R3 hpqcxs08; C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll [225280 2007-01-25] (Hewlett-Packard Co.) [File not signed]
R2 hpqddsvc; C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll [131072 2007-01-25] (Hewlett-Packard Co.) [File not signed]
S2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [44032 2010-08-06] (Hewlett-Packard) [File not signed]
R2 pdserv; C:\Program Files\Bitdefender\60-Second Virus Scanner\pdscan.exe [1221384 2013-11-11] (Bitdefender)
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53760 2010-08-06] (Hewlett-Packard) [File not signed]
R2 TestHandler; C:\Program Files\Fujitsu\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe [341264 2009-02-19] (Fujitsu Technology Solutions)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-21] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S4 ahcix86s; C:\Windows\system32\drivers\ahcix86s.sys [173576 2008-05-27] (AMD Technologies Inc.)
R0 aswKbd; C:\Windows\system32\Drivers\aswKbd.sys [21576 2013-03-07] (AVAST Software)
R0 avc3; C:\Windows\System32\DRIVERS\avc3.sys [633344 2013-04-17] (BitDefender)
S3 avckf; C:\Windows\System32\DRIVERS\avckf.sys [486536 2013-04-17] (BitDefender)
R1 bdftdif; C:\Program Files\Bitdefender\Antivirus Free Edition\bdftdif.sys [148600 2013-04-17] (Bitdefender SRL)
R1 bdselfpr; C:\Program Files\Bitdefender\Antivirus Free Edition\bdselfpr.sys [135472 2013-07-16] (BitDefender LLC)
S3 eapihdrv; C:\Users\Anja\AppData\Local\Temp\ehdrv.sys [135760 2015-06-19] (ESET)
R1 epp32; C:\Windows\System32\DRIVERS\epp32.sys [111368 2015-06-20] (Emsisoft GmbH)
R1 gzflt; C:\Windows\System32\DRIVERS\gzflt.sys [164952 2013-04-22] (BitDefender LLC)
S4 JRAID; C:\Windows\system32\drivers\jraid.sys [76688 2008-04-03] (JMicron Technology Corp.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2015-04-14] (Malwarebytes Corporation)
R0 trufos; C:\Windows\System32\DRIVERS\trufos.sys [355744 2013-05-28] (BitDefender S.R.L.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Anja\AppData\Local\Temp\catchme.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20080829.024\NAVENG.SYS [X]
S3 NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20080829.024\NAVEX15.SYS [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S1 SRTSP; \??\C:\Windows\system32\drivers\NIS\1000000.07D\SRTSP.SYS [X]
S1 SRTSPX; \??\C:\Windows\system32\drivers\NIS\1000000.07D\SRTSPX.SYS [X]
S3 taphss; system32\DRIVERS\taphss.sys [X]
S3 taphss6; system32\DRIVERS\taphss6.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-06-20 13:45 - 2015-06-20 13:45 - 00018718 _____ C:\Users\Anja\Downloads\FRST.txt
2015-06-20 13:38 - 2015-06-20 13:38 - 00852639 _____ C:\Users\Anja\Downloads\SecurityCheck.exe
2015-06-20 13:20 - 2015-06-20 13:21 - 00000000 ____D C:\EEK
2015-06-20 13:20 - 2015-06-20 13:20 - 00000697 _____ C:\Users\Anja\Desktop\Start Emsisoft Emergency Kit.lnk
2015-06-20 13:20 - 2015-06-20 00:14 - 00111368 _____ (Emsisoft GmbH) C:\Windows\system32\Drivers\epp32.sys
2015-06-20 13:13 - 2015-06-20 13:15 - 158665168 _____ C:\Users\Anja\Downloads\EmsisoftEmergencyKit.exe
2015-06-19 19:15 - 2015-06-19 19:15 - 00000000 ____D C:\Users\Anja\Tran
2015-06-19 10:43 - 2015-06-19 10:43 - 00000000 ____D C:\Program Files\ESET
2015-06-18 22:30 - 2015-06-18 22:30 - 00000000 ____H C:\K1.013
2015-06-17 15:57 - 2015-06-19 20:29 - 00002401 _____ C:\Users\Anja\Desktop\RoulettePilot.lnk
2015-06-17 15:57 - 2015-06-18 20:54 - 00000000 ____D C:\ProgramData\RoulettePilot
2015-06-17 15:57 - 2015-06-17 15:57 - 00001954 _____ C:\Users\Anja\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RoulettePilot.lnk
2015-06-17 15:57 - 2015-06-17 15:57 - 00000000 ____D C:\Program Files\RoulettePilot
2015-06-17 15:54 - 2015-06-17 15:54 - 02624000 _____ C:\Users\Anja\Downloads\Install_RoulettePilot.msi
2015-06-17 13:12 - 2015-06-17 13:12 - 00001159 _____ C:\Users\Public\Desktop\Kingsoft Writer.lnk
2015-06-17 13:12 - 2015-06-17 13:12 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kingsoft Writer
2015-06-17 13:11 - 2015-06-17 13:12 - 00000000 ____D C:\Users\Anja\AppData\Roaming\Kingsoft
2015-06-17 13:11 - 2015-06-17 13:11 - 00000000 ____D C:\ProgramData\Kingsoft
2015-06-17 13:10 - 2015-06-17 13:10 - 01197344 _____ C:\Users\Anja\Downloads\Kingsoft Writer Free 2012 - CHIP-Installer.exe
2015-06-16 21:23 - 2015-06-16 21:23 - 00000000 ____D C:\Users\Anja\Downloads\FRST-OlderVersion
2015-06-16 21:13 - 2015-06-16 21:13 - 00000207 _____ C:\Windows\tweaking.com-regbackup-ANJA-PC-Windows-Vista-(TM)-Home-Basic-(32-bit).dat
2015-06-16 21:13 - 2015-06-16 21:13 - 00000000 ____D C:\RegBackup
2015-06-16 21:12 - 2015-06-16 21:12 - 02945901 _____ (Thisisu) C:\Users\Anja\Downloads\JRT.exe
2015-06-16 20:52 - 2015-06-16 21:04 - 00000000 ____D C:\AdwCleaner
2015-06-16 20:51 - 2015-06-16 20:51 - 02231296 _____ C:\Users\Anja\Downloads\AdwCleaner_4.206.exe
2015-06-16 18:50 - 2015-06-17 13:03 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-06-16 18:50 - 2015-06-16 18:50 - 00000865 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-06-16 18:50 - 2015-06-16 18:50 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-06-16 18:50 - 2015-06-16 18:50 - 00000000 ____D C:\Program Files\ Malwarebytes Anti-Malware
2015-06-16 18:50 - 2015-04-14 09:37 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-06-16 18:50 - 2015-04-14 09:37 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-06-16 18:50 - 2015-04-14 09:37 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-06-16 18:45 - 2015-06-16 18:49 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Anja\Downloads\mbam-setup-2.1.6.1022.exe
2015-06-15 20:39 - 2015-06-15 20:39 - 00000000 ____D C:\Users\Anja\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-06-15 20:34 - 2015-06-15 20:34 - 00035696 _____ C:\ComboFix.txt
2015-06-15 20:25 - 2015-06-18 16:55 - 00002408 _____ C:\Windows\PFRO.log
2015-06-15 20:10 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2015-06-15 20:10 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2015-06-15 20:10 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-06-15 20:10 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-06-15 20:10 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-06-15 20:10 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2015-06-15 20:10 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2015-06-15 20:10 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2015-06-15 20:09 - 2015-06-15 20:35 - 00000000 ____D C:\Qoobox
2015-06-15 20:09 - 2015-06-15 20:31 - 00000000 ____D C:\Windows\erdnt
2015-06-15 20:04 - 2015-06-15 20:04 - 05628161 ____R (Swearware) C:\Users\Anja\Downloads\ComboFix.exe
2015-06-14 17:15 - 2015-06-14 17:15 - 00015762 _____ C:\Users\Anja\Downloads\Sparda Bank Kapitalerträge.tif
2015-06-14 16:30 - 2015-06-14 16:30 - 00001023 _____ C:\Users\Anja\Desktop\Revo Uninstaller.lnk
2015-06-14 16:30 - 2015-06-14 16:30 - 00000000 ____D C:\Program Files\VS Revo Group
2015-06-14 16:27 - 2015-06-14 16:27 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Anja\Downloads\revosetup95.exe
2015-06-11 18:08 - 2015-06-11 18:09 - 00030501 _____ C:\Users\Anja\Downloads\Addition.txt
2015-06-11 18:06 - 2015-06-20 13:45 - 00000000 ____D C:\FRST
2015-06-11 18:06 - 2015-06-16 21:23 - 01148416 _____ (Farbar) C:\Users\Anja\Downloads\FRST.exe
2015-06-11 16:47 - 2015-05-21 16:22 - 02066432 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-06-11 16:47 - 2015-05-09 01:08 - 00894464 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-06-11 16:47 - 2015-04-24 17:54 - 00532480 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2015-06-11 16:34 - 2015-06-11 16:47 - 00000000 ____D C:\Windows\system32\MRT
2015-06-11 16:29 - 2015-05-05 00:50 - 00007680 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-06-11 16:28 - 2015-05-05 00:51 - 10628608 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-06-11 16:28 - 2015-05-05 00:50 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-06-11 16:28 - 2015-05-05 00:50 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-06-11 16:28 - 2015-05-04 23:21 - 08147456 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2015-06-10 10:46 - 2015-06-10 10:46 - 00000000 ____D C:\Program Files\NoVirusThanks
2015-06-10 10:45 - 2015-06-10 10:45 - 01937000 _____ (NoVirusThanks Company Srl ) C:\Users\Anja\Downloads\filegovernor Löschdatei_setup.exe
2015-06-10 09:40 - 2015-05-31 01:54 - 00367616 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-06-10 09:40 - 2015-05-31 01:53 - 09750528 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-06-10 09:40 - 2015-05-31 01:50 - 01139712 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-06-10 09:40 - 2015-05-31 01:49 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-06-10 09:40 - 2015-05-31 01:49 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-06-10 09:40 - 2015-05-31 01:49 - 00718336 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-06-10 09:40 - 2015-05-31 01:49 - 00421888 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-06-10 09:40 - 2015-05-31 01:48 - 01804288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-06-10 09:40 - 2015-05-31 01:48 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-06-10 09:40 - 2015-05-31 01:48 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-06-10 09:40 - 2015-05-31 01:48 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2015-06-10 09:40 - 2015-05-31 01:48 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-06-10 09:40 - 2015-05-31 01:48 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-06-10 09:40 - 2015-05-31 01:48 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-06-10 09:40 - 2015-05-31 01:48 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2015-06-10 09:40 - 2015-05-31 01:47 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-06-10 09:40 - 2015-05-31 01:47 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-06-10 09:40 - 2015-05-31 01:47 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2015-06-10 09:40 - 2015-05-31 01:47 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2015-06-10 09:39 - 2015-05-31 02:03 - 12385280 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-06-10 09:39 - 2015-05-31 01:55 - 01809920 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-06-10 09:39 - 2015-05-31 01:47 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-06-09 19:06 - 2015-06-10 09:56 - 00000000 ____D C:\Program Files\Unlocker
2015-06-09 13:15 - 2015-06-11 17:03 - 00000000 ____D C:\Users\Anja\Documents\Norisbank
2015-06-08 23:23 - 2015-06-08 23:23 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\K-Lite Codec Pack
2015-06-08 23:19 - 2015-06-08 23:22 - 36499753 _____ ( ) C:\Users\Anja\Downloads\K-Lite_Codec_Pack_1120_Full.exe
2015-06-08 20:09 - 2015-06-08 20:11 - 14929318 _____ ( ) C:\Users\Anja\Downloads\klcp_update_1121_20150605.exe
2015-06-05 16:41 - 2015-06-05 16:41 - 00000855 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Utilities 5.lnk
2015-06-05 16:41 - 2015-06-05 16:41 - 00000843 _____ C:\Users\Public\Desktop\Glary Utilities 5.lnk
2015-06-05 16:41 - 2015-06-05 16:41 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Utilities 5
2015-06-05 16:40 - 2015-06-05 16:40 - 00017472 _____ (Glarysoft Ltd) C:\Windows\system32\Drivers\GUBootStartup.sys
2015-06-05 16:37 - 2015-06-05 16:37 - 15121936 _____ C:\Users\Anja\Downloads\Glary_Utilities_v5.26.0.45.exe
2015-05-28 18:22 - 2015-05-29 22:04 - 00000000 ____D C:\Users\Anja\Documents\Roulette-Pilot Kopien nach Test
2015-05-25 17:06 - 2015-05-25 17:06 - 00242504 _____ (BitDefender) C:\Windows\system32\Drivers\avchv.sys
2015-05-24 23:56 - 2015-05-25 00:09 - 00000000 ____D C:\Users\Anja\Documents\Roulette-Pilot Werbepause
2015-05-24 23:24 - 2015-05-24 23:24 - 00001973 _____ C:\Users\Public\Desktop\Bitdefender Antivirus Free Edition.lnk
2015-05-24 23:24 - 2015-05-24 23:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Antivirus Free Edition
2015-05-24 23:22 - 2013-04-17 14:59 - 00633344 _____ (BitDefender) C:\Windows\system32\Drivers\avc3.sys
2015-05-24 23:22 - 2013-04-17 14:59 - 00486536 _____ (BitDefender) C:\Windows\system32\Drivers\avckf.sys
2015-05-24 23:22 - 2009-07-14 23:27 - 01461992 _____ (Microsoft Corporation) C:\Windows\system32\WdfCoInstaller01009.dll
2015-05-24 23:21 - 2013-05-28 12:11 - 00355744 _____ (BitDefender S.R.L.) C:\Windows\system32\Drivers\trufos.sys
2015-05-24 23:21 - 2013-04-22 13:20 - 00164952 _____ (BitDefender LLC) C:\Windows\system32\Drivers\gzflt.sys
2015-05-24 23:20 - 2015-05-24 23:21 - 00000000 ____D C:\Users\Anja\AppData\Roaming\QuickScan
2015-05-24 23:20 - 2015-05-24 23:20 - 09927424 _____ C:\Users\Anja\Downloads\Antivirus_Free_Edition_x86.exe
2015-05-24 23:19 - 2015-05-24 23:19 - 00162208 _____ C:\Users\Anja\Downloads\Antivirus_Free_Edition.exe
2015-05-24 23:07 - 2015-05-24 23:24 - 00000000 ____D C:\Program Files\Bitdefender
2015-05-24 23:07 - 2015-05-24 23:07 - 31571808 _____ C:\Users\Anja\Downloads\60Second_x86.exe
2015-05-24 23:07 - 2015-05-24 23:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bitdefender 60-Second Virus Scanner
2015-05-24 23:07 - 2015-05-24 23:07 - 00000000 ____D C:\ProgramData\Bitdefender
2015-05-24 23:06 - 2015-05-24 23:06 - 00160160 _____ C:\Users\Anja\Downloads\60Second_en_us.exe
2015-05-22 18:32 - 2015-05-22 18:32 - 00000000 _____ C:\Users\Anja\AppData\Local\{4B2FA74C-8229-4EA3-8FB0-5E96B272257C}
2015-05-21 20:13 - 2015-06-17 16:37 - 00000000 ____D C:\Users\Anja\Documents\Roulette Pilot Verschiedene Systeme
2015-05-21 14:00 - 2015-05-21 14:00 - 00000000 _____ C:\Users\Anja\AppData\Local\{AFB11F1F-569B-4CE1-8BCC-931AA1DA58D8}
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-06-20 13:28 - 2012-05-01 21:03 - 00000360 _____ C:\Windows\Tasks\WpsUpdateTask_Anja.job
2015-06-20 13:17 - 2015-05-06 21:54 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-06-20 13:14 - 2012-04-25 19:03 - 00001098 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-06-20 13:14 - 2012-04-25 19:03 - 00001094 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-06-20 13:06 - 2012-04-25 17:53 - 01624452 _____ C:\Windows\WindowsUpdate.log
2015-06-20 13:01 - 2015-05-17 15:23 - 00000000 ____D C:\Program Files\Glary Utilities 5
2015-06-20 13:00 - 2006-11-02 14:58 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-06-20 13:00 - 2006-11-02 14:45 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2015-06-20 13:00 - 2006-11-02 14:45 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2015-06-19 21:59 - 2006-11-02 14:58 - 00032514 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-06-19 19:15 - 2012-04-25 18:06 - 00000000 ____D C:\Users\Anja
2015-06-19 10:43 - 2008-01-21 10:21 - 01567416 _____ C:\Windows\system32\PerfStringBackup.INI
2015-06-18 17:00 - 2014-08-17 15:49 - 00000000 ____D C:\Users\Anja\AppData\Local\Adobe
2015-06-18 17:00 - 2012-05-03 15:32 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-06-18 17:00 - 2012-05-03 15:32 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-06-18 16:55 - 2006-11-02 14:44 - 00295896 _____ C:\Windows\system32\FNTCACHE.DAT
2015-06-17 20:23 - 2015-05-19 21:56 - 00000000 ____D C:\Users\Anja\AppData\Local\Titanbet Casino
2015-06-17 13:13 - 2012-04-25 18:10 - 00070704 _____ C:\Users\Anja\AppData\Local\GDIPFONTCACHEV1.DAT
2015-06-17 13:11 - 2012-05-01 21:02 - 00000000 ____D C:\Program Files\Kingsoft
2015-06-17 13:02 - 2006-11-02 12:23 - 00000179 _____ C:\Windows\win.ini
2015-06-15 20:35 - 2006-11-02 13:18 - 00000000 __RHD C:\Users\Default
2015-06-15 20:34 - 2006-11-02 13:18 - 00000000 ___RD C:\Users\Public
2015-06-15 20:28 - 2006-11-02 12:23 - 00000215 _____ C:\Windows\system.ini
2015-06-12 16:48 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\rescache
2015-06-11 20:54 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\system32\de-DE
2015-06-11 16:33 - 2006-11-02 12:24 - 136900096 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2015-06-11 16:29 - 2013-11-09 12:22 - 00000000 ____D C:\Users\Anja\Documents\Meine Scans
2015-06-10 20:08 - 2014-05-02 12:47 - 03691624 _____ (MetaQuotes Software Corp.) C:\Windows\system32\MetaViewer.dll
2015-06-10 10:19 - 2014-07-09 20:33 - 00001929 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-06-09 18:01 - 2012-06-19 20:30 - 00000000 ____D C:\Users\Anja\AppData\Roaming\vlc
2015-06-08 23:23 - 2015-05-11 19:31 - 00000000 ____D C:\Program Files\K-Lite Codec Pack
2015-06-06 23:08 - 2012-04-28 16:52 - 00000000 ____D C:\Users\Anja\Documents\Roulettesysteme
2015-05-25 17:18 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\system32\spool
2015-05-25 17:14 - 2014-05-24 12:33 - 00000000 ____D C:\Program Files\Common Files\G Data
2015-05-25 17:14 - 2013-04-26 19:25 - 00000000 ____D C:\ProgramData\G Data
2015-05-21 19:54 - 2015-05-08 21:06 - 00000000 ____D C:\Users\Anja\AppData\Local\EuroGrand Casino
==================== Files in the root of some directories =======
2014-05-22 20:13 - 2014-05-22 20:13 - 0000000 _____ () C:\Users\Anja\AppData\Roaming\gdfw.log
2014-05-22 20:12 - 2014-05-24 12:35 - 0000976 _____ () C:\Users\Anja\AppData\Roaming\gdscan.log
2014-09-08 19:28 - 2015-01-06 14:29 - 0000680 _____ () C:\Users\Anja\AppData\Local\d3d9caps.dat
2013-05-06 15:23 - 2013-05-06 15:23 - 0001483 _____ () C:\Users\Anja\AppData\Local\recently-used.xbel
2015-05-22 18:32 - 2015-05-22 18:32 - 0000000 _____ () C:\Users\Anja\AppData\Local\{4B2FA74C-8229-4EA3-8FB0-5E96B272257C}
2015-05-21 14:00 - 2015-05-21 14:00 - 0000000 _____ () C:\Users\Anja\AppData\Local\{AFB11F1F-569B-4CE1-8BCC-931AA1DA58D8}
2013-08-15 17:54 - 2015-02-12 13:45 - 0005078 _____ () C:\ProgramData\hpzinstall.log
2012-04-26 17:55 - 2012-04-26 17:55 - 0000107 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
2012-06-12 20:57 - 2012-06-12 20:57 - 0001534 _____ () C:\ProgramData\ss.ini
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-06-20 13:07
==================== End of log ============================
 Probleme bestehen weiterhin beim Löschen der Dateien über Secure Eraser und dass der Bildschirmschoner nur nach Lust & Laune arbeitet, d.h. in der Mehrzahl eben nicht, trotz lfd. Aktualisierung von Adobe Flash Player. |
|
21.06.2015, 08:29
| #18 |
| /// the machine /// TB-Ausbilder | Verdacht auf Viren: Secure Eraser kann Dateien nicht löschen Java, Adobe und Firefox updaten.
__________________Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter FF NetworkProxy: "ftp", "123.110.49.119"
FF NetworkProxy: "ftp_port", 8088
FF NetworkProxy: "gopher", "5.135.193.216"
FF NetworkProxy: "gopher_port", 8089
FF NetworkProxy: "http", "123.110.49.119"
FF NetworkProxy: "http_port", 8088
FF NetworkProxy: "no_proxies_on", ""
FF NetworkProxy: "socks", "123.110.49.119"
FF NetworkProxy: "socks_port", 8088
FF NetworkProxy: "socks_remote_dns", true
FF NetworkProxy: "ssl", "123.110.49.119"
FF NetworkProxy: "ssl_port", 8088
FF NetworkProxy: "type", 2
RemoveProxy:
Emptytemp:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Nochmal ein frisches FRST log bitte.
__________________ |
|
21.06.2015, 16:44
| #19 |
| |  Verdacht auf Viren: Secure Eraser kann Dateien nicht löschen Bin mir nicht sicher, ob es geklappt hat, weil es einen (Fix) -Button nicht gab, sondern lediglich die fix.txt-Datei:dollblöd: Demzufolge hat er auch keine fixlog.txt-Datei erstellt. Aber schau selbst: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 21-06-2015 01
Ran by Anja (administrator) on ANJA-PC on 21-06-2015 17:19:01
Running from C:\Users\Anja\Downloads
Loaded Profiles: Anja (Available Profiles: Anja)
Platform: Microsoft® Windows Vista™ Home Basic Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Bitdefender) C:\Program Files\Bitdefender\Antivirus Free Edition\gzserv.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Bitdefender) C:\Program Files\Bitdefender\Antivirus Free Edition\gziface.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Wondershare) C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Bitdefender) C:\Program Files\Bitdefender\60-Second Virus Scanner\pdiface.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
(Bitdefender) C:\Program Files\Bitdefender\60-Second Virus Scanner\pdscan.exe
(Fujitsu Technology Solutions) C:\Program Files\Fujitsu\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Glarysoft Ltd) C:\Program Files\Glary Utilities 5\Integrator.exe
(Bitdefender) C:\Program Files\Bitdefender\Antivirus Free Edition\update.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
(Microsoft Corporation) C:\Windows\System32\wermgr.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [Skytel] => C:\Program Files\Realtek\Audio\HDA\Skytel.exe [1833504 2008-10-31] (Realtek Semiconductor Corp.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [6609440 2008-10-31] (Realtek Semiconductor)
HKLM\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [1994752 2014-02-20] (Wondershare)
HKU\S-1-5-21-809830661-3849426339-1780571292-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [30877280 2014-12-11] (Skype Technologies S.A.)
HKU\S-1-5-21-809830661-3849426339-1780571292-1000\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-21] (Microsoft Corporation)
HKU\S-1-5-21-809830661-3849426339-1780571292-1000\...\Run: [pdiface] => C:\Program Files\Bitdefender\60-Second Virus Scanner\pdiface.exe [261984 2013-10-30] (Bitdefender)
HKU\S-1-5-21-809830661-3849426339-1780571292-1000\...\Run: [GUDelayStartup] => C:\Program Files\Glary Utilities 5\StartupManager.exe [37152 2015-05-25] (Glarysoft Ltd)
HKU\S-1-5-21-809830661-3849426339-1780571292-1000\...\Run: [GoogleChromeAutoLaunch_50EA6731804A0FA2B2DE051BEA45E463] => C:\Program Files\Google\Chrome\Application\chrome.exe [813896 2015-06-05] (Google Inc.)
HKU\S-1-5-21-809830661-3849426339-1780571292-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\PhotoScreensaver.scr [704512 2009-04-11] (Microsoft Corporation)
HKU\S-1-5-18\...\Run: [Picasa Media Detector] => C:\Program Files\Picasa2\PicasaMediaDetector.exe [443968 2008-02-26] (Google Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk [2013-08-15]
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
BootExecute: autocheck autochk *
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-809830661-3849426339-1780571292-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled
ProxyServer: [.DEFAULT] => http=127.0.0.1:52068;https=127.0.0.1:52068
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-809830661-3849426339-1780571292-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-809830661-3849426339-1780571292-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-809830661-3849426339-1780571292-1000 -> {443789B7-F39C-4b5c-9287-DA72D38F4FE6} URL =
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_40\bin\ssv.dll [2015-03-23] (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_40\bin\jp2ssv.dll [2015-03-23] (Oracle Corporation)
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll [2007-06-08] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 80.69.100.102 80.69.100.230
FireFox:
========
FF ProfilePath: C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default
FF Homepage: about:home
FF NetworkProxy: "ftp", "123.110.49.119"
FF NetworkProxy: "ftp_port", 8088
FF NetworkProxy: "gopher", "5.135.193.216"
FF NetworkProxy: "gopher_port", 8089
FF NetworkProxy: "http", "123.110.49.119"
FF NetworkProxy: "http_port", 8088
FF NetworkProxy: "no_proxies_on", ""
FF NetworkProxy: "socks", "123.110.49.119"
FF NetworkProxy: "socks_port", 8088
FF NetworkProxy: "socks_remote_dns", true
FF NetworkProxy: "ssl", "123.110.49.119"
FF NetworkProxy: "ssl_port", 8088
FF NetworkProxy: "type", 2
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_18_0_0_160.dll [2015-06-18] ()
FF Plugin: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files\Picasa2\npPicasa3.dll [2014-08-13] (Google, Inc.)
FF Plugin: @java.com/DTPlugin,version=11.40.2 -> C:\Program Files\Java\jre1.8.0_40\bin\dtplugin\npDeployJava1.dll [2015-03-23] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-03-23] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-17] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-17] (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-02-05] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-02-05] (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2015-04-30] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2015-04-30] (Adobe Systems Inc.)
FF Extension: FoxyProxy Standard - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\foxyproxy@eric.h.jung [2015-03-23]
FF Extension: Youtube Downloader - 4K Download - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\paulsaintuzb@gmail.com [2015-03-06]
FF Extension: No Name - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\{0b5130a9-cc50-4ced-99d5-cda8cc12ae48} [2013-12-16]
FF Extension: Proxy-Listen.de - Proxyswitcher - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\admin@proxy-listen.de.xpi [2012-09-27]
FF Extension: Best Proxy Switcher - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\bestproxyswitcher@bestproxyswitcher.com.xpi [2014-07-08]
FF Extension: Elite Proxy Switcher - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\eliteproxyswitcher@my-proxy.com.xpi [2015-03-21]
FF Extension: Video Downloader Professional - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\ffext_basicvideoext@startpage24.xpi [2013-10-25]
FF Extension: ZenMate Security & Privacy VPN - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\firefox@zenmate.com.xpi [2015-03-21]
FF Extension: Awesome screenshot: Capture and Annotate - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\jid0-GXjLLfbCoAx0LcltEdFrEkQdQPI@jetpack.xpi [2014-04-12]
FF Extension: Translate This! - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\jid0-k75TfRGfOXPHfEZmJ9cKu5eCgLc@jetpack.xpi [2013-11-06]
FF Extension: One Click Proxy - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\jid0-zXo3XFGyiDalgkeEO4UYJTUwo2I@jetpack.xpi [2014-07-08]
FF Extension: Nimbus Screen Capture - editable screenshots. - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\nimbusscreencaptureff@everhelper.me.xpi [2014-02-02]
FF Extension: Priv3+ - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\priv3plus@icsi.berkeley.edu.xpi [2015-03-21]
FF Extension: Proxy Tool - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\proxytool@proxylist.co.xpi [2012-12-11]
FF Extension: Google Translator for Firefox - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\translator@zoli.bod.xpi [2013-11-06]
FF Extension: Casino Toolbar - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\wagerlogic.xpi [2012-05-15]
FF Extension: ImTranslator - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\{9AA46F4F-4DC7-4c06-97AF-5035170634FE}.xpi [2012-04-26]
FF Extension: Adblock Plus - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-06-20]
FF Extension: QuickProxy - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\{d5ea4520-61a1-11da-8cd6-0800200c9a66}.xpi [2014-07-08]
FF Extension: Hotspot Shield Helper (Please allow this installation) - C:\Program Files\Mozilla Firefox\extensions\afurladvisor@anchorfree.com [2015-03-21]
FF Extension: Word Layers - C:\Program Files\Mozilla Firefox\extensions\ugnraew@jqhljqmpngx.net [2015-03-21]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2012-04-26]
FF Extension: No Name - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\extensions\support@tubedimmerapp.com [not found]
Chrome:
=======
CHR Profile: C:\Users\Anja\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-06-15]
CHR Extension: (Google Docs) - C:\Users\Anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-15]
CHR Extension: (Google Drive) - C:\Users\Anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-15]
CHR Extension: (Webpage Screenshot) - C:\Users\Anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdfnieppndfdhcgbmhfdlgdjegclkomk [2015-03-01]
CHR Extension: (YouTube) - C:\Users\Anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-15]
CHR Extension: (Google Search) - C:\Users\Anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-15]
CHR Extension: (CyberGhost VPN - Free Proxy) - C:\Users\Anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\fcbnikgemihknccdjaihjnfbapinljpi [2015-04-06]
CHR Extension: (ZenMate Security, Privacy & Unblock VPN) - C:\Users\Anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdcgdnkidjaadafnichfpabhfomcebme [2015-03-30]
CHR Extension: (Google Sheets) - C:\Users\Anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-06-15]
CHR Extension: (AdBlock) - C:\Users\Anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2015-06-15]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-14]
CHR Extension: (Google Wallet) - C:\Users\Anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-03-03]
CHR Extension: (Gmail) - C:\Users\Anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-15]
CHR HKLM\...\Chrome\Extension: [aobbhmkkplckkcbnbcdbkneemiooegoc] - No Path Or update_url value
CHR HKU\S-1-5-21-809830661-3849426339-1780571292-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [aobbhmkkplckkcbnbcdbkneemiooegoc] - No Path Or update_url value
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 gzserv; C:\Program Files\Bitdefender\Antivirus Free Edition\gzserv.exe [57520 2013-10-23] (Bitdefender)
S3 hpqcxs08; C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll [225280 2007-01-25] (Hewlett-Packard Co.) [File not signed]
S2 hpqddsvc; C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll [131072 2007-01-25] (Hewlett-Packard Co.) [File not signed]
S2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [44032 2010-08-06] (Hewlett-Packard) [File not signed]
R2 pdserv; C:\Program Files\Bitdefender\60-Second Virus Scanner\pdscan.exe [1221384 2013-11-11] (Bitdefender)
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53760 2010-08-06] (Hewlett-Packard) [File not signed]
R2 TestHandler; C:\Program Files\Fujitsu\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe [341264 2009-02-19] (Fujitsu Technology Solutions)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-21] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S4 ahcix86s; C:\Windows\system32\drivers\ahcix86s.sys [173576 2008-05-27] (AMD Technologies Inc.)
R0 aswKbd; C:\Windows\system32\Drivers\aswKbd.sys [21576 2013-03-07] (AVAST Software)
R0 avc3; C:\Windows\System32\DRIVERS\avc3.sys [633344 2013-04-17] (BitDefender)
S3 avckf; C:\Windows\System32\DRIVERS\avckf.sys [486536 2013-04-17] (BitDefender)
R1 bdftdif; C:\Program Files\Bitdefender\Antivirus Free Edition\bdftdif.sys [148600 2013-04-17] (Bitdefender SRL)
R1 bdselfpr; C:\Program Files\Bitdefender\Antivirus Free Edition\bdselfpr.sys [135472 2013-07-16] (BitDefender LLC)
S3 eapihdrv; C:\Users\Anja\AppData\Local\Temp\ehdrv.sys [135760 2015-06-19] (ESET)
R1 epp32; C:\Windows\System32\DRIVERS\epp32.sys [111368 2015-06-20] (Emsisoft GmbH)
R1 gzflt; C:\Windows\System32\DRIVERS\gzflt.sys [164952 2013-04-22] (BitDefender LLC)
S4 JRAID; C:\Windows\system32\drivers\jraid.sys [76688 2008-04-03] (JMicron Technology Corp.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2015-04-14] (Malwarebytes Corporation)
R0 trufos; C:\Windows\System32\DRIVERS\trufos.sys [355744 2013-05-28] (BitDefender S.R.L.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Anja\AppData\Local\Temp\catchme.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20080829.024\NAVENG.SYS [X]
S3 NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20080829.024\NAVEX15.SYS [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S1 SRTSP; \??\C:\Windows\system32\drivers\NIS\1000000.07D\SRTSP.SYS [X]
S1 SRTSPX; \??\C:\Windows\system32\drivers\NIS\1000000.07D\SRTSPX.SYS [X]
S3 taphss; system32\DRIVERS\taphss.sys [X]
S3 taphss6; system32\DRIVERS\taphss6.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-06-21 17:19 - 2015-06-21 17:19 - 00018865 _____ C:\Users\Anja\Downloads\FRST.txt
2015-06-21 17:15 - 2015-06-21 17:15 - 00000515 _____ C:\Users\Anja\Downloads\fixlist.txt
2015-06-20 13:38 - 2015-06-20 13:38 - 00852639 _____ C:\Users\Anja\Downloads\SecurityCheck.exe
2015-06-20 13:20 - 2015-06-20 13:21 - 00000000 ____D C:\EEK
2015-06-20 13:20 - 2015-06-20 13:20 - 00000697 _____ C:\Users\Anja\Desktop\Start Emsisoft Emergency Kit.lnk
2015-06-20 13:20 - 2015-06-20 00:14 - 00111368 _____ (Emsisoft GmbH) C:\Windows\system32\Drivers\epp32.sys
2015-06-20 13:13 - 2015-06-20 13:15 - 158665168 _____ C:\Users\Anja\Downloads\EmsisoftEmergencyKit.exe
2015-06-19 19:15 - 2015-06-19 19:15 - 00000000 ____D C:\Users\Anja\Tran
2015-06-19 10:43 - 2015-06-19 10:43 - 00000000 ____D C:\Program Files\ESET
2015-06-18 22:30 - 2015-06-18 22:30 - 00000000 ____H C:\K1.013
2015-06-17 15:57 - 2015-06-20 19:45 - 00002401 _____ C:\Users\Anja\Desktop\RoulettePilot.lnk
2015-06-17 15:57 - 2015-06-18 20:54 - 00000000 ____D C:\ProgramData\RoulettePilot
2015-06-17 15:57 - 2015-06-17 15:57 - 00001954 _____ C:\Users\Anja\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RoulettePilot.lnk
2015-06-17 15:57 - 2015-06-17 15:57 - 00000000 ____D C:\Program Files\RoulettePilot
2015-06-17 15:54 - 2015-06-17 15:54 - 02624000 _____ C:\Users\Anja\Downloads\Install_RoulettePilot.msi
2015-06-17 13:12 - 2015-06-17 13:12 - 00001159 _____ C:\Users\Public\Desktop\Kingsoft Writer.lnk
2015-06-17 13:12 - 2015-06-17 13:12 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kingsoft Writer
2015-06-17 13:11 - 2015-06-17 13:12 - 00000000 ____D C:\Users\Anja\AppData\Roaming\Kingsoft
2015-06-17 13:11 - 2015-06-17 13:11 - 00000000 ____D C:\ProgramData\Kingsoft
2015-06-17 13:10 - 2015-06-17 13:10 - 01197344 _____ C:\Users\Anja\Downloads\Kingsoft Writer Free 2012 - CHIP-Installer.exe
2015-06-16 21:23 - 2015-06-21 17:18 - 00000000 ____D C:\Users\Anja\Downloads\FRST-OlderVersion
2015-06-16 21:13 - 2015-06-16 21:13 - 00000207 _____ C:\Windows\tweaking.com-regbackup-ANJA-PC-Windows-Vista-(TM)-Home-Basic-(32-bit).dat
2015-06-16 21:13 - 2015-06-16 21:13 - 00000000 ____D C:\RegBackup
2015-06-16 21:12 - 2015-06-16 21:12 - 02945901 _____ (Thisisu) C:\Users\Anja\Downloads\JRT.exe
2015-06-16 20:52 - 2015-06-16 21:04 - 00000000 ____D C:\AdwCleaner
2015-06-16 20:51 - 2015-06-16 20:51 - 02231296 _____ C:\Users\Anja\Downloads\AdwCleaner_4.206.exe
2015-06-16 18:50 - 2015-06-17 13:03 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-06-16 18:50 - 2015-06-16 18:50 - 00000865 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-06-16 18:50 - 2015-06-16 18:50 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-06-16 18:50 - 2015-06-16 18:50 - 00000000 ____D C:\Program Files\ Malwarebytes Anti-Malware
2015-06-16 18:50 - 2015-04-14 09:37 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-06-16 18:50 - 2015-04-14 09:37 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-06-16 18:50 - 2015-04-14 09:37 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-06-16 18:45 - 2015-06-16 18:49 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Anja\Downloads\mbam-setup-2.1.6.1022.exe
2015-06-15 20:39 - 2015-06-15 20:39 - 00000000 ____D C:\Users\Anja\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-06-15 20:34 - 2015-06-15 20:34 - 00035696 _____ C:\ComboFix.txt
2015-06-15 20:25 - 2015-06-18 16:55 - 00002408 _____ C:\Windows\PFRO.log
2015-06-15 20:10 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2015-06-15 20:10 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2015-06-15 20:10 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-06-15 20:10 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-06-15 20:10 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-06-15 20:10 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2015-06-15 20:10 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2015-06-15 20:10 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2015-06-15 20:09 - 2015-06-15 20:35 - 00000000 ____D C:\Qoobox
2015-06-15 20:09 - 2015-06-15 20:31 - 00000000 ____D C:\Windows\erdnt
2015-06-15 20:04 - 2015-06-15 20:04 - 05628161 ____R (Swearware) C:\Users\Anja\Downloads\ComboFix.exe
2015-06-14 17:15 - 2015-06-14 17:15 - 00015762 _____ C:\Users\Anja\Downloads\Sparda Bank Kapitalerträge.tif
2015-06-14 16:30 - 2015-06-14 16:30 - 00001023 _____ C:\Users\Anja\Desktop\Revo Uninstaller.lnk
2015-06-14 16:30 - 2015-06-14 16:30 - 00000000 ____D C:\Program Files\VS Revo Group
2015-06-14 16:27 - 2015-06-14 16:27 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Anja\Downloads\revosetup95.exe
2015-06-11 18:08 - 2015-06-11 18:09 - 00030501 _____ C:\Users\Anja\Downloads\Addition.txt
2015-06-11 18:06 - 2015-06-21 17:19 - 00000000 ____D C:\FRST
2015-06-11 18:06 - 2015-06-21 17:18 - 01148928 _____ (Farbar) C:\Users\Anja\Downloads\FRST.exe
2015-06-11 16:47 - 2015-05-21 16:22 - 02066432 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-06-11 16:47 - 2015-05-09 01:08 - 00894464 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-06-11 16:47 - 2015-04-24 17:54 - 00532480 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2015-06-11 16:34 - 2015-06-11 16:47 - 00000000 ____D C:\Windows\system32\MRT
2015-06-11 16:29 - 2015-05-05 00:50 - 00007680 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-06-11 16:28 - 2015-05-05 00:51 - 10628608 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-06-11 16:28 - 2015-05-05 00:50 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-06-11 16:28 - 2015-05-05 00:50 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-06-11 16:28 - 2015-05-04 23:21 - 08147456 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2015-06-10 10:46 - 2015-06-10 10:46 - 00000000 ____D C:\Program Files\NoVirusThanks
2015-06-10 10:45 - 2015-06-10 10:45 - 01937000 _____ (NoVirusThanks Company Srl ) C:\Users\Anja\Downloads\filegovernor Löschdatei_setup.exe
2015-06-10 09:40 - 2015-05-31 01:54 - 00367616 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-06-10 09:40 - 2015-05-31 01:53 - 09750528 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-06-10 09:40 - 2015-05-31 01:50 - 01139712 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-06-10 09:40 - 2015-05-31 01:49 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-06-10 09:40 - 2015-05-31 01:49 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-06-10 09:40 - 2015-05-31 01:49 - 00718336 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-06-10 09:40 - 2015-05-31 01:49 - 00421888 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-06-10 09:40 - 2015-05-31 01:48 - 01804288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-06-10 09:40 - 2015-05-31 01:48 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-06-10 09:40 - 2015-05-31 01:48 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-06-10 09:40 - 2015-05-31 01:48 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2015-06-10 09:40 - 2015-05-31 01:48 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-06-10 09:40 - 2015-05-31 01:48 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-06-10 09:40 - 2015-05-31 01:48 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-06-10 09:40 - 2015-05-31 01:48 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2015-06-10 09:40 - 2015-05-31 01:47 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-06-10 09:40 - 2015-05-31 01:47 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-06-10 09:40 - 2015-05-31 01:47 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2015-06-10 09:40 - 2015-05-31 01:47 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2015-06-10 09:39 - 2015-05-31 02:03 - 12385280 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-06-10 09:39 - 2015-05-31 01:55 - 01809920 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-06-10 09:39 - 2015-05-31 01:47 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-06-09 19:06 - 2015-06-10 09:56 - 00000000 ____D C:\Program Files\Unlocker
2015-06-09 13:15 - 2015-06-11 17:03 - 00000000 ____D C:\Users\Anja\Documents\Norisbank
2015-06-08 23:23 - 2015-06-08 23:23 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\K-Lite Codec Pack
2015-06-08 23:19 - 2015-06-08 23:22 - 36499753 _____ ( ) C:\Users\Anja\Downloads\K-Lite_Codec_Pack_1120_Full.exe
2015-06-08 20:09 - 2015-06-08 20:11 - 14929318 _____ ( ) C:\Users\Anja\Downloads\klcp_update_1121_20150605.exe
2015-06-05 16:41 - 2015-06-05 16:41 - 00000855 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Utilities 5.lnk
2015-06-05 16:41 - 2015-06-05 16:41 - 00000843 _____ C:\Users\Public\Desktop\Glary Utilities 5.lnk
2015-06-05 16:41 - 2015-06-05 16:41 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Utilities 5
2015-06-05 16:40 - 2015-06-05 16:40 - 00017472 _____ (Glarysoft Ltd) C:\Windows\system32\Drivers\GUBootStartup.sys
2015-06-05 16:37 - 2015-06-05 16:37 - 15121936 _____ C:\Users\Anja\Downloads\Glary_Utilities_v5.26.0.45.exe
2015-05-28 18:22 - 2015-05-29 22:04 - 00000000 ____D C:\Users\Anja\Documents\Roulette-Pilot Kopien nach Test
2015-05-25 17:06 - 2015-05-25 17:06 - 00242504 _____ (BitDefender) C:\Windows\system32\Drivers\avchv.sys
2015-05-24 23:56 - 2015-05-25 00:09 - 00000000 ____D C:\Users\Anja\Documents\Roulette-Pilot Werbepause
2015-05-24 23:24 - 2015-05-24 23:24 - 00001973 _____ C:\Users\Public\Desktop\Bitdefender Antivirus Free Edition.lnk
2015-05-24 23:24 - 2015-05-24 23:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Antivirus Free Edition
2015-05-24 23:22 - 2013-04-17 14:59 - 00633344 _____ (BitDefender) C:\Windows\system32\Drivers\avc3.sys
2015-05-24 23:22 - 2013-04-17 14:59 - 00486536 _____ (BitDefender) C:\Windows\system32\Drivers\avckf.sys
2015-05-24 23:22 - 2009-07-14 23:27 - 01461992 _____ (Microsoft Corporation) C:\Windows\system32\WdfCoInstaller01009.dll
2015-05-24 23:21 - 2013-05-28 12:11 - 00355744 _____ (BitDefender S.R.L.) C:\Windows\system32\Drivers\trufos.sys
2015-05-24 23:21 - 2013-04-22 13:20 - 00164952 _____ (BitDefender LLC) C:\Windows\system32\Drivers\gzflt.sys
2015-05-24 23:20 - 2015-05-24 23:21 - 00000000 ____D C:\Users\Anja\AppData\Roaming\QuickScan
2015-05-24 23:20 - 2015-05-24 23:20 - 09927424 _____ C:\Users\Anja\Downloads\Antivirus_Free_Edition_x86.exe
2015-05-24 23:19 - 2015-05-24 23:19 - 00162208 _____ C:\Users\Anja\Downloads\Antivirus_Free_Edition.exe
2015-05-24 23:07 - 2015-05-24 23:24 - 00000000 ____D C:\Program Files\Bitdefender
2015-05-24 23:07 - 2015-05-24 23:07 - 31571808 _____ C:\Users\Anja\Downloads\60Second_x86.exe
2015-05-24 23:07 - 2015-05-24 23:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bitdefender 60-Second Virus Scanner
2015-05-24 23:07 - 2015-05-24 23:07 - 00000000 ____D C:\ProgramData\Bitdefender
2015-05-24 23:06 - 2015-05-24 23:06 - 00160160 _____ C:\Users\Anja\Downloads\60Second_en_us.exe
2015-05-22 18:32 - 2015-05-22 18:32 - 00000000 _____ C:\Users\Anja\AppData\Local\{4B2FA74C-8229-4EA3-8FB0-5E96B272257C}
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-06-21 17:17 - 2015-05-06 21:54 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-06-21 17:14 - 2012-04-25 19:03 - 00001098 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-06-21 17:05 - 2012-04-25 17:53 - 01650085 _____ C:\Windows\WindowsUpdate.log
2015-06-21 17:04 - 2013-11-09 12:22 - 00000000 ____D C:\Users\Anja\Documents\Meine Scans
2015-06-21 16:59 - 2015-05-17 15:23 - 00000000 ____D C:\Program Files\Glary Utilities 5
2015-06-21 16:58 - 2012-04-25 19:03 - 00001094 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-06-21 16:58 - 2006-11-02 14:58 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-06-21 16:58 - 2006-11-02 14:45 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2015-06-21 16:58 - 2006-11-02 14:45 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2015-06-20 23:04 - 2006-11-02 14:58 - 00032514 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-06-20 22:27 - 2012-05-01 21:03 - 00000360 _____ C:\Windows\Tasks\WpsUpdateTask_Anja.job
2015-06-20 21:21 - 2015-05-21 20:13 - 00000000 ____D C:\Users\Anja\Documents\Roulette Pilot Verschiedene Systeme
2015-06-19 19:15 - 2012-04-25 18:06 - 00000000 ____D C:\Users\Anja
2015-06-19 10:43 - 2008-01-21 10:21 - 01567416 _____ C:\Windows\system32\PerfStringBackup.INI
2015-06-18 17:00 - 2014-08-17 15:49 - 00000000 ____D C:\Users\Anja\AppData\Local\Adobe
2015-06-18 17:00 - 2012-05-03 15:32 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-06-18 17:00 - 2012-05-03 15:32 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-06-18 16:55 - 2006-11-02 14:44 - 00295896 _____ C:\Windows\system32\FNTCACHE.DAT
2015-06-17 20:23 - 2015-05-19 21:56 - 00000000 ____D C:\Users\Anja\AppData\Local\Titanbet Casino
2015-06-17 13:13 - 2012-04-25 18:10 - 00070704 _____ C:\Users\Anja\AppData\Local\GDIPFONTCACHEV1.DAT
2015-06-17 13:11 - 2012-05-01 21:02 - 00000000 ____D C:\Program Files\Kingsoft
2015-06-17 13:02 - 2006-11-02 12:23 - 00000179 _____ C:\Windows\win.ini
2015-06-15 20:35 - 2006-11-02 13:18 - 00000000 __RHD C:\Users\Default
2015-06-15 20:34 - 2006-11-02 13:18 - 00000000 ___RD C:\Users\Public
2015-06-15 20:28 - 2006-11-02 12:23 - 00000215 _____ C:\Windows\system.ini
2015-06-12 16:48 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\rescache
2015-06-11 20:54 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\system32\de-DE
2015-06-11 16:33 - 2006-11-02 12:24 - 136900096 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2015-06-10 20:08 - 2014-05-02 12:47 - 03691624 _____ (MetaQuotes Software Corp.) C:\Windows\system32\MetaViewer.dll
2015-06-10 10:19 - 2014-07-09 20:33 - 00001929 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-06-09 18:01 - 2012-06-19 20:30 - 00000000 ____D C:\Users\Anja\AppData\Roaming\vlc
2015-06-08 23:23 - 2015-05-11 19:31 - 00000000 ____D C:\Program Files\K-Lite Codec Pack
2015-06-06 23:08 - 2012-04-28 16:52 - 00000000 ____D C:\Users\Anja\Documents\Roulettesysteme
2015-05-25 17:18 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\system32\spool
2015-05-25 17:14 - 2014-05-24 12:33 - 00000000 ____D C:\Program Files\Common Files\G Data
2015-05-25 17:14 - 2013-04-26 19:25 - 00000000 ____D C:\ProgramData\G Data
==================== Files in the root of some directories =======
2014-05-22 20:13 - 2014-05-22 20:13 - 0000000 _____ () C:\Users\Anja\AppData\Roaming\gdfw.log
2014-05-22 20:12 - 2014-05-24 12:35 - 0000976 _____ () C:\Users\Anja\AppData\Roaming\gdscan.log
2014-09-08 19:28 - 2015-01-06 14:29 - 0000680 _____ () C:\Users\Anja\AppData\Local\d3d9caps.dat
2013-05-06 15:23 - 2013-05-06 15:23 - 0001483 _____ () C:\Users\Anja\AppData\Local\recently-used.xbel
2015-05-22 18:32 - 2015-05-22 18:32 - 0000000 _____ () C:\Users\Anja\AppData\Local\{4B2FA74C-8229-4EA3-8FB0-5E96B272257C}
2015-05-21 14:00 - 2015-05-21 14:00 - 0000000 _____ () C:\Users\Anja\AppData\Local\{AFB11F1F-569B-4CE1-8BCC-931AA1DA58D8}
2013-08-15 17:54 - 2015-02-12 13:45 - 0005078 _____ () C:\ProgramData\hpzinstall.log
2012-04-26 17:55 - 2012-04-26 17:55 - 0000107 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
2012-06-12 20:57 - 2012-06-12 20:57 - 0001534 _____ () C:\ProgramData\ss.ini
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-06-21 17:05
==================== End of log ============================
|
|
22.06.2015, 11:44
| #20 |
| /// the machine /// TB-Ausbilder | Verdacht auf Viren: Secure Eraser kann Dateien nicht löschen Sicher gibt es nen Fix button in FRST 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
23.06.2015, 18:18
| #21 |
| |  Verdacht auf Viren: Secure Eraser kann Dateien nicht löschen Ja im FRST hab ich den Fix-Button nun auch gefunden - ich suchte den separat im Downloadbereich......... Code:
ATTFilter Fix result of Farbar Recovery Scan Tool (x86) Version: 21-06-2015 01
Ran by Anja at 2015-06-23 19:07:37 Run:1
Running from C:\Users\Anja\Downloads
Loaded Profiles: Anja (Available Profiles: Anja)
Boot Mode: Normal
==============================================
fixlist content:
*****************
FF NetworkProxy: "ftp", "123.110.49.119" FF NetworkProxy: "ftp_port", 8088 FF NetworkProxy: "gopher", "5.135.193.216" FF NetworkProxy: "gopher_port", 8089 FF NetworkProxy: "http", "123.110.49.119" FF NetworkProxy: "http_port", 8088 FF NetworkProxy: "no_proxies_on", "" FF NetworkProxy: "socks", "123.110.49.119" FF NetworkProxy: "socks_port", 8088 FF NetworkProxy: "socks_remote_dns", true FF NetworkProxy: "ssl", "123.110.49.119" FF NetworkProxy: "ssl_port", 8088 FF NetworkProxy: "type", 2 RemoveProxy: Emptytemp:
*****************
Firefox Proxy settings were reset.
==== End of Fixlog 19:07:37 ====
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 21-06-2015 01
Ran by Anja (administrator) on ANJA-PC on 23-06-2015 19:08:33
Running from C:\Users\Anja\Downloads
Loaded Profiles: Anja (Available Profiles: Anja)
Platform: Microsoft® Windows Vista™ Home Basic Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Bitdefender) C:\Program Files\Bitdefender\Antivirus Free Edition\gzserv.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Bitdefender) C:\Program Files\Bitdefender\Antivirus Free Edition\gziface.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Wondershare) C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Bitdefender) C:\Program Files\Bitdefender\60-Second Virus Scanner\pdscan.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Bitdefender) C:\Program Files\Bitdefender\60-Second Virus Scanner\pdiface.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
(Fujitsu Technology Solutions) C:\Program Files\Fujitsu\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Glarysoft Ltd) C:\Program Files\Glary Utilities 5\Integrator.exe
(Microsoft Corporation) C:\Windows\System32\UI0Detect.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [Skytel] => C:\Program Files\Realtek\Audio\HDA\Skytel.exe [1833504 2008-10-31] (Realtek Semiconductor Corp.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [6609440 2008-10-31] (Realtek Semiconductor)
HKLM\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [1994752 2014-02-20] (Wondershare)
HKU\S-1-5-21-809830661-3849426339-1780571292-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [30877280 2014-12-11] (Skype Technologies S.A.)
HKU\S-1-5-21-809830661-3849426339-1780571292-1000\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-21] (Microsoft Corporation)
HKU\S-1-5-21-809830661-3849426339-1780571292-1000\...\Run: [pdiface] => C:\Program Files\Bitdefender\60-Second Virus Scanner\pdiface.exe [261984 2013-10-30] (Bitdefender)
HKU\S-1-5-21-809830661-3849426339-1780571292-1000\...\Run: [GUDelayStartup] => C:\Program Files\Glary Utilities 5\StartupManager.exe [37152 2015-05-25] (Glarysoft Ltd)
HKU\S-1-5-21-809830661-3849426339-1780571292-1000\...\Run: [GoogleChromeAutoLaunch_50EA6731804A0FA2B2DE051BEA45E463] => C:\Program Files\Google\Chrome\Application\chrome.exe [813896 2015-06-05] (Google Inc.)
HKU\S-1-5-21-809830661-3849426339-1780571292-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\PhotoScreensaver.scr [704512 2009-04-11] (Microsoft Corporation)
HKU\S-1-5-18\...\Run: [Picasa Media Detector] => C:\Program Files\Picasa2\PicasaMediaDetector.exe [443968 2008-02-26] (Google Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk [2013-08-15]
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
BootExecute: autocheck autochk *
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-809830661-3849426339-1780571292-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled
ProxyServer: [.DEFAULT] => http=127.0.0.1:52068;https=127.0.0.1:52068
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-809830661-3849426339-1780571292-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-809830661-3849426339-1780571292-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-809830661-3849426339-1780571292-1000 -> {443789B7-F39C-4b5c-9287-DA72D38F4FE6} URL =
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_40\bin\ssv.dll [2015-03-23] (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_40\bin\jp2ssv.dll [2015-03-23] (Oracle Corporation)
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll [2007-06-08] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 80.69.100.102 80.69.100.230
FireFox:
========
FF ProfilePath: C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default
FF Homepage: about:home
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_18_0_0_160.dll [2015-06-18] ()
FF Plugin: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files\Picasa2\npPicasa3.dll [2014-08-13] (Google, Inc.)
FF Plugin: @java.com/DTPlugin,version=11.40.2 -> C:\Program Files\Java\jre1.8.0_40\bin\dtplugin\npDeployJava1.dll [2015-03-23] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-03-23] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-17] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-17] (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-02-05] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-02-05] (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2015-04-30] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2015-04-30] (Adobe Systems Inc.)
FF Extension: FoxyProxy Standard - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\foxyproxy@eric.h.jung [2015-03-23]
FF Extension: Youtube Downloader - 4K Download - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\paulsaintuzb@gmail.com [2015-03-06]
FF Extension: No Name - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\{0b5130a9-cc50-4ced-99d5-cda8cc12ae48} [2013-12-16]
FF Extension: Proxy-Listen.de - Proxyswitcher - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\admin@proxy-listen.de.xpi [2012-09-27]
FF Extension: Best Proxy Switcher - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\bestproxyswitcher@bestproxyswitcher.com.xpi [2014-07-08]
FF Extension: Elite Proxy Switcher - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\eliteproxyswitcher@my-proxy.com.xpi [2015-03-21]
FF Extension: Video Downloader Professional - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\ffext_basicvideoext@startpage24.xpi [2013-10-25]
FF Extension: ZenMate Security & Privacy VPN - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\firefox@zenmate.com.xpi [2015-03-21]
FF Extension: Awesome screenshot: Capture and Annotate - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\jid0-GXjLLfbCoAx0LcltEdFrEkQdQPI@jetpack.xpi [2014-04-12]
FF Extension: Translate This! - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\jid0-k75TfRGfOXPHfEZmJ9cKu5eCgLc@jetpack.xpi [2013-11-06]
FF Extension: One Click Proxy - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\jid0-zXo3XFGyiDalgkeEO4UYJTUwo2I@jetpack.xpi [2014-07-08]
FF Extension: Nimbus Screen Capture - editable screenshots. - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\nimbusscreencaptureff@everhelper.me.xpi [2014-02-02]
FF Extension: Priv3+ - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\priv3plus@icsi.berkeley.edu.xpi [2015-03-21]
FF Extension: Proxy Tool - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\proxytool@proxylist.co.xpi [2012-12-11]
FF Extension: Google Translator for Firefox - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\translator@zoli.bod.xpi [2013-11-06]
FF Extension: Casino Toolbar - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\wagerlogic.xpi [2012-05-15]
FF Extension: ImTranslator - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\{9AA46F4F-4DC7-4c06-97AF-5035170634FE}.xpi [2012-04-26]
FF Extension: Adblock Plus - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-06-20]
FF Extension: QuickProxy - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\Extensions\{d5ea4520-61a1-11da-8cd6-0800200c9a66}.xpi [2014-07-08]
FF Extension: Hotspot Shield Helper (Please allow this installation) - C:\Program Files\Mozilla Firefox\extensions\afurladvisor@anchorfree.com [2015-03-21]
FF Extension: Word Layers - C:\Program Files\Mozilla Firefox\extensions\ugnraew@jqhljqmpngx.net [2015-03-21]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2012-04-26]
FF Extension: No Name - C:\Users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\yaiw8gqm.default\extensions\support@tubedimmerapp.com [not found]
Chrome:
=======
CHR Profile: C:\Users\Anja\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-06-15]
CHR Extension: (Google Docs) - C:\Users\Anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-15]
CHR Extension: (Google Drive) - C:\Users\Anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-15]
CHR Extension: (Webpage Screenshot) - C:\Users\Anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdfnieppndfdhcgbmhfdlgdjegclkomk [2015-03-01]
CHR Extension: (YouTube) - C:\Users\Anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-15]
CHR Extension: (Google Search) - C:\Users\Anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-15]
CHR Extension: (CyberGhost VPN - Free Proxy) - C:\Users\Anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\fcbnikgemihknccdjaihjnfbapinljpi [2015-04-06]
CHR Extension: (ZenMate Security, Privacy & Unblock VPN) - C:\Users\Anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdcgdnkidjaadafnichfpabhfomcebme [2015-03-30]
CHR Extension: (Google Sheets) - C:\Users\Anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-06-15]
CHR Extension: (AdBlock) - C:\Users\Anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2015-06-15]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-14]
CHR Extension: (Google Wallet) - C:\Users\Anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-03-03]
CHR Extension: (Gmail) - C:\Users\Anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-15]
CHR HKLM\...\Chrome\Extension: [aobbhmkkplckkcbnbcdbkneemiooegoc] - No Path Or update_url value
CHR HKU\S-1-5-21-809830661-3849426339-1780571292-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [aobbhmkkplckkcbnbcdbkneemiooegoc] - No Path Or update_url value
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 gzserv; C:\Program Files\Bitdefender\Antivirus Free Edition\gzserv.exe [57520 2013-10-23] (Bitdefender)
R3 hpqcxs08; C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll [225280 2007-01-25] (Hewlett-Packard Co.) [File not signed]
R2 hpqddsvc; C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll [131072 2007-01-25] (Hewlett-Packard Co.) [File not signed]
S2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [44032 2010-08-06] (Hewlett-Packard) [File not signed]
R2 pdserv; C:\Program Files\Bitdefender\60-Second Virus Scanner\pdscan.exe [1221384 2013-11-11] (Bitdefender)
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53760 2010-08-06] (Hewlett-Packard) [File not signed]
R2 TestHandler; C:\Program Files\Fujitsu\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe [341264 2009-02-19] (Fujitsu Technology Solutions)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-21] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S4 ahcix86s; C:\Windows\system32\drivers\ahcix86s.sys [173576 2008-05-27] (AMD Technologies Inc.)
R0 aswKbd; C:\Windows\system32\Drivers\aswKbd.sys [21576 2013-03-07] (AVAST Software)
R0 avc3; C:\Windows\System32\DRIVERS\avc3.sys [633344 2013-04-17] (BitDefender)
S3 avckf; C:\Windows\System32\DRIVERS\avckf.sys [486536 2013-04-17] (BitDefender)
R1 bdftdif; C:\Program Files\Bitdefender\Antivirus Free Edition\bdftdif.sys [148600 2013-04-17] (Bitdefender SRL)
R1 bdselfpr; C:\Program Files\Bitdefender\Antivirus Free Edition\bdselfpr.sys [135472 2013-07-16] (BitDefender LLC)
S3 eapihdrv; C:\Users\Anja\AppData\Local\Temp\ehdrv.sys [135760 2015-06-19] (ESET)
R1 epp32; C:\Windows\System32\DRIVERS\epp32.sys [111368 2015-06-20] (Emsisoft GmbH)
R1 gzflt; C:\Windows\System32\DRIVERS\gzflt.sys [164952 2013-04-22] (BitDefender LLC)
S4 JRAID; C:\Windows\system32\drivers\jraid.sys [76688 2008-04-03] (JMicron Technology Corp.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2015-04-14] (Malwarebytes Corporation)
R0 trufos; C:\Windows\System32\DRIVERS\trufos.sys [355744 2013-05-28] (BitDefender S.R.L.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Anja\AppData\Local\Temp\catchme.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20080829.024\NAVENG.SYS [X]
S3 NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20080829.024\NAVEX15.SYS [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S1 SRTSP; \??\C:\Windows\system32\drivers\NIS\1000000.07D\SRTSP.SYS [X]
S1 SRTSPX; \??\C:\Windows\system32\drivers\NIS\1000000.07D\SRTSPX.SYS [X]
S3 taphss; system32\DRIVERS\taphss.sys [X]
S3 taphss6; system32\DRIVERS\taphss6.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-06-23 19:08 - 2015-06-23 19:08 - 00018085 _____ C:\Users\Anja\Downloads\FRST.txt
2015-06-23 11:32 - 2015-06-23 11:32 - 00000000 ____D C:\Windows\LastGood
2015-06-20 13:38 - 2015-06-20 13:38 - 00852639 _____ C:\Users\Anja\Downloads\SecurityCheck.exe
2015-06-20 13:20 - 2015-06-20 13:21 - 00000000 ____D C:\EEK
2015-06-20 13:20 - 2015-06-20 13:20 - 00000697 _____ C:\Users\Anja\Desktop\Start Emsisoft Emergency Kit.lnk
2015-06-20 13:20 - 2015-06-20 00:14 - 00111368 _____ (Emsisoft GmbH) C:\Windows\system32\Drivers\epp32.sys
2015-06-20 13:13 - 2015-06-20 13:15 - 158665168 _____ C:\Users\Anja\Downloads\EmsisoftEmergencyKit.exe
2015-06-19 19:15 - 2015-06-19 19:15 - 00000000 ____D C:\Users\Anja\Tran
2015-06-19 10:43 - 2015-06-19 10:43 - 00000000 ____D C:\Program Files\ESET
2015-06-18 22:30 - 2015-06-18 22:30 - 00000000 ____H C:\K1.013
2015-06-17 15:57 - 2015-06-22 12:31 - 00002401 _____ C:\Users\Anja\Desktop\RoulettePilot.lnk
2015-06-17 15:57 - 2015-06-21 23:26 - 00000000 ____D C:\ProgramData\RoulettePilot
2015-06-17 15:57 - 2015-06-17 15:57 - 00001954 _____ C:\Users\Anja\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RoulettePilot.lnk
2015-06-17 15:57 - 2015-06-17 15:57 - 00000000 ____D C:\Program Files\RoulettePilot
2015-06-17 15:54 - 2015-06-17 15:54 - 02624000 _____ C:\Users\Anja\Downloads\Install_RoulettePilot.msi
2015-06-17 13:12 - 2015-06-17 13:12 - 00001159 _____ C:\Users\Public\Desktop\Kingsoft Writer.lnk
2015-06-17 13:12 - 2015-06-17 13:12 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kingsoft Writer
2015-06-17 13:11 - 2015-06-17 13:12 - 00000000 ____D C:\Users\Anja\AppData\Roaming\Kingsoft
2015-06-17 13:11 - 2015-06-17 13:11 - 00000000 ____D C:\ProgramData\Kingsoft
2015-06-17 13:10 - 2015-06-17 13:10 - 01197344 _____ C:\Users\Anja\Downloads\Kingsoft Writer Free 2012 - CHIP-Installer.exe
2015-06-16 21:23 - 2015-06-21 17:18 - 00000000 ____D C:\Users\Anja\Downloads\FRST-OlderVersion
2015-06-16 21:13 - 2015-06-16 21:13 - 00000207 _____ C:\Windows\tweaking.com-regbackup-ANJA-PC-Windows-Vista-(TM)-Home-Basic-(32-bit).dat
2015-06-16 21:13 - 2015-06-16 21:13 - 00000000 ____D C:\RegBackup
2015-06-16 21:12 - 2015-06-16 21:12 - 02945901 _____ (Thisisu) C:\Users\Anja\Downloads\JRT.exe
2015-06-16 20:52 - 2015-06-16 21:04 - 00000000 ____D C:\AdwCleaner
2015-06-16 20:51 - 2015-06-16 20:51 - 02231296 _____ C:\Users\Anja\Downloads\AdwCleaner_4.206.exe
2015-06-16 18:50 - 2015-06-17 13:03 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-06-16 18:50 - 2015-06-16 18:50 - 00000865 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-06-16 18:50 - 2015-06-16 18:50 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-06-16 18:50 - 2015-06-16 18:50 - 00000000 ____D C:\Program Files\ Malwarebytes Anti-Malware
2015-06-16 18:50 - 2015-04-14 09:37 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-06-16 18:50 - 2015-04-14 09:37 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-06-16 18:50 - 2015-04-14 09:37 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-06-16 18:45 - 2015-06-16 18:49 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Anja\Downloads\mbam-setup-2.1.6.1022.exe
2015-06-15 20:39 - 2015-06-15 20:39 - 00000000 ____D C:\Users\Anja\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-06-15 20:34 - 2015-06-15 20:34 - 00035696 _____ C:\ComboFix.txt
2015-06-15 20:25 - 2015-06-18 16:55 - 00002408 _____ C:\Windows\PFRO.log
2015-06-15 20:10 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2015-06-15 20:10 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2015-06-15 20:10 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-06-15 20:10 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-06-15 20:10 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-06-15 20:10 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2015-06-15 20:10 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2015-06-15 20:10 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2015-06-15 20:09 - 2015-06-15 20:35 - 00000000 ____D C:\Qoobox
2015-06-15 20:09 - 2015-06-15 20:31 - 00000000 ____D C:\Windows\erdnt
2015-06-15 20:04 - 2015-06-15 20:04 - 05628161 ____R (Swearware) C:\Users\Anja\Downloads\ComboFix.exe
2015-06-14 16:30 - 2015-06-14 16:30 - 00001023 _____ C:\Users\Anja\Desktop\Revo Uninstaller.lnk
2015-06-14 16:30 - 2015-06-14 16:30 - 00000000 ____D C:\Program Files\VS Revo Group
2015-06-14 16:27 - 2015-06-14 16:27 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Anja\Downloads\revosetup95.exe
2015-06-11 18:08 - 2015-06-11 18:09 - 00030501 _____ C:\Users\Anja\Downloads\Addition.txt
2015-06-11 18:06 - 2015-06-23 19:08 - 00000000 ____D C:\FRST
2015-06-11 18:06 - 2015-06-21 17:18 - 01148928 _____ (Farbar) C:\Users\Anja\Downloads\FRST.exe
2015-06-11 16:47 - 2015-05-21 16:22 - 02066432 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-06-11 16:47 - 2015-05-09 01:08 - 00894464 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-06-11 16:47 - 2015-04-24 17:54 - 00532480 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2015-06-11 16:34 - 2015-06-11 16:47 - 00000000 ____D C:\Windows\system32\MRT
2015-06-11 16:29 - 2015-05-05 00:50 - 00007680 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-06-11 16:28 - 2015-05-05 00:51 - 10628608 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-06-11 16:28 - 2015-05-05 00:50 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-06-11 16:28 - 2015-05-05 00:50 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-06-11 16:28 - 2015-05-04 23:21 - 08147456 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2015-06-10 10:46 - 2015-06-10 10:46 - 00000000 ____D C:\Program Files\NoVirusThanks
2015-06-10 10:45 - 2015-06-10 10:45 - 01937000 _____ (NoVirusThanks Company Srl ) C:\Users\Anja\Downloads\filegovernor Löschdatei_setup.exe
2015-06-10 09:40 - 2015-05-31 01:54 - 00367616 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-06-10 09:40 - 2015-05-31 01:53 - 09750528 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-06-10 09:40 - 2015-05-31 01:50 - 01139712 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-06-10 09:40 - 2015-05-31 01:49 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-06-10 09:40 - 2015-05-31 01:49 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-06-10 09:40 - 2015-05-31 01:49 - 00718336 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-06-10 09:40 - 2015-05-31 01:49 - 00421888 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-06-10 09:40 - 2015-05-31 01:48 - 01804288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-06-10 09:40 - 2015-05-31 01:48 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-06-10 09:40 - 2015-05-31 01:48 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-06-10 09:40 - 2015-05-31 01:48 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2015-06-10 09:40 - 2015-05-31 01:48 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-06-10 09:40 - 2015-05-31 01:48 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-06-10 09:40 - 2015-05-31 01:48 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-06-10 09:40 - 2015-05-31 01:48 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2015-06-10 09:40 - 2015-05-31 01:47 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-06-10 09:40 - 2015-05-31 01:47 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-06-10 09:40 - 2015-05-31 01:47 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2015-06-10 09:40 - 2015-05-31 01:47 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2015-06-10 09:39 - 2015-05-31 02:03 - 12385280 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-06-10 09:39 - 2015-05-31 01:55 - 01809920 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-06-10 09:39 - 2015-05-31 01:47 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-06-09 19:06 - 2015-06-10 09:56 - 00000000 ____D C:\Program Files\Unlocker
2015-06-09 13:15 - 2015-06-11 17:03 - 00000000 ____D C:\Users\Anja\Documents\Norisbank
2015-06-08 23:23 - 2015-06-08 23:23 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\K-Lite Codec Pack
2015-06-08 23:19 - 2015-06-08 23:22 - 36499753 _____ ( ) C:\Users\Anja\Downloads\K-Lite_Codec_Pack_1120_Full.exe
2015-06-08 20:09 - 2015-06-08 20:11 - 14929318 _____ ( ) C:\Users\Anja\Downloads\klcp_update_1121_20150605.exe
2015-06-05 16:41 - 2015-06-05 16:41 - 00000855 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Utilities 5.lnk
2015-06-05 16:41 - 2015-06-05 16:41 - 00000843 _____ C:\Users\Public\Desktop\Glary Utilities 5.lnk
2015-06-05 16:41 - 2015-06-05 16:41 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Utilities 5
2015-06-05 16:40 - 2015-06-05 16:40 - 00017472 _____ (Glarysoft Ltd) C:\Windows\system32\Drivers\GUBootStartup.sys
2015-06-05 16:37 - 2015-06-05 16:37 - 15121936 _____ C:\Users\Anja\Downloads\Glary_Utilities_v5.26.0.45.exe
2015-05-28 18:22 - 2015-05-29 22:04 - 00000000 ____D C:\Users\Anja\Documents\Roulette-Pilot Kopien nach Test
2015-05-25 17:06 - 2015-05-25 17:06 - 00242504 _____ (BitDefender) C:\Windows\system32\Drivers\avchv.sys
2015-05-24 23:56 - 2015-05-25 00:09 - 00000000 ____D C:\Users\Anja\Documents\Roulette-Pilot Werbepause
2015-05-24 23:24 - 2015-05-24 23:24 - 00001973 _____ C:\Users\Public\Desktop\Bitdefender Antivirus Free Edition.lnk
2015-05-24 23:24 - 2015-05-24 23:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Antivirus Free Edition
2015-05-24 23:22 - 2013-04-17 14:59 - 00633344 _____ (BitDefender) C:\Windows\system32\Drivers\avc3.sys
2015-05-24 23:22 - 2013-04-17 14:59 - 00486536 _____ (BitDefender) C:\Windows\system32\Drivers\avckf.sys
2015-05-24 23:22 - 2009-07-14 23:27 - 01461992 _____ (Microsoft Corporation) C:\Windows\system32\WdfCoInstaller01009.dll
2015-05-24 23:21 - 2013-05-28 12:11 - 00355744 _____ (BitDefender S.R.L.) C:\Windows\system32\Drivers\trufos.sys
2015-05-24 23:21 - 2013-04-22 13:20 - 00164952 _____ (BitDefender LLC) C:\Windows\system32\Drivers\gzflt.sys
2015-05-24 23:20 - 2015-05-24 23:21 - 00000000 ____D C:\Users\Anja\AppData\Roaming\QuickScan
2015-05-24 23:20 - 2015-05-24 23:20 - 09927424 _____ C:\Users\Anja\Downloads\Antivirus_Free_Edition_x86.exe
2015-05-24 23:19 - 2015-05-24 23:19 - 00162208 _____ C:\Users\Anja\Downloads\Antivirus_Free_Edition.exe
2015-05-24 23:07 - 2015-05-24 23:24 - 00000000 ____D C:\Program Files\Bitdefender
2015-05-24 23:07 - 2015-05-24 23:07 - 31571808 _____ C:\Users\Anja\Downloads\60Second_x86.exe
2015-05-24 23:07 - 2015-05-24 23:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bitdefender 60-Second Virus Scanner
2015-05-24 23:07 - 2015-05-24 23:07 - 00000000 ____D C:\ProgramData\Bitdefender
2015-05-24 23:06 - 2015-05-24 23:06 - 00160160 _____ C:\Users\Anja\Downloads\60Second_en_us.exe
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-06-23 18:28 - 2012-05-01 21:03 - 00000360 _____ C:\Windows\Tasks\WpsUpdateTask_Anja.job
2015-06-23 18:17 - 2015-05-06 21:54 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-06-23 18:13 - 2012-04-25 19:03 - 00001098 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-06-23 18:01 - 2012-06-19 20:30 - 00000000 ____D C:\Users\Anja\AppData\Roaming\vlc
2015-06-23 18:01 - 2012-04-25 17:53 - 01704672 _____ C:\Windows\WindowsUpdate.log
2015-06-23 17:32 - 2006-11-02 14:45 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2015-06-23 17:32 - 2006-11-02 14:45 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2015-06-23 13:17 - 2015-04-24 17:54 - 00000000 ____D C:\Users\Anja\Documents\Unitymedia
2015-06-23 13:14 - 2012-04-25 19:03 - 00001094 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-06-23 12:19 - 2014-07-09 20:33 - 00001929 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-06-23 11:34 - 2015-05-17 15:23 - 00000000 ____D C:\Program Files\Glary Utilities 5
2015-06-23 11:34 - 2006-11-02 12:23 - 00000179 _____ C:\Windows\win.ini
2015-06-23 11:32 - 2006-11-02 14:58 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-06-22 20:44 - 2006-11-02 14:58 - 00032514 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-06-22 16:00 - 2015-05-21 20:13 - 00000000 ____D C:\Users\Anja\Documents\Roulette Pilot Verschiedene Systeme
2015-06-21 17:04 - 2013-11-09 12:22 - 00000000 ____D C:\Users\Anja\Documents\Meine Scans
2015-06-19 19:15 - 2012-04-25 18:06 - 00000000 ____D C:\Users\Anja
2015-06-19 10:43 - 2008-01-21 10:21 - 01567416 _____ C:\Windows\system32\PerfStringBackup.INI
2015-06-18 17:00 - 2014-08-17 15:49 - 00000000 ____D C:\Users\Anja\AppData\Local\Adobe
2015-06-18 17:00 - 2012-05-03 15:32 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-06-18 17:00 - 2012-05-03 15:32 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-06-18 16:55 - 2006-11-02 14:44 - 00295896 _____ C:\Windows\system32\FNTCACHE.DAT
2015-06-17 20:23 - 2015-05-19 21:56 - 00000000 ____D C:\Users\Anja\AppData\Local\Titanbet Casino
2015-06-17 13:13 - 2012-04-25 18:10 - 00070704 _____ C:\Users\Anja\AppData\Local\GDIPFONTCACHEV1.DAT
2015-06-17 13:11 - 2012-05-01 21:02 - 00000000 ____D C:\Program Files\Kingsoft
2015-06-15 20:35 - 2006-11-02 13:18 - 00000000 __RHD C:\Users\Default
2015-06-15 20:34 - 2006-11-02 13:18 - 00000000 ___RD C:\Users\Public
2015-06-15 20:28 - 2006-11-02 12:23 - 00000215 _____ C:\Windows\system.ini
2015-06-12 16:48 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\rescache
2015-06-11 20:54 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\system32\de-DE
2015-06-11 16:33 - 2006-11-02 12:24 - 136900096 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2015-06-10 20:08 - 2014-05-02 12:47 - 03691624 _____ (MetaQuotes Software Corp.) C:\Windows\system32\MetaViewer.dll
2015-06-08 23:23 - 2015-05-11 19:31 - 00000000 ____D C:\Program Files\K-Lite Codec Pack
2015-06-06 23:08 - 2012-04-28 16:52 - 00000000 ____D C:\Users\Anja\Documents\Roulettesysteme
2015-05-25 17:18 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\system32\spool
2015-05-25 17:14 - 2014-05-24 12:33 - 00000000 ____D C:\Program Files\Common Files\G Data
2015-05-25 17:14 - 2013-04-26 19:25 - 00000000 ____D C:\ProgramData\G Data
==================== Files in the root of some directories =======
2014-05-22 20:13 - 2014-05-22 20:13 - 0000000 _____ () C:\Users\Anja\AppData\Roaming\gdfw.log
2014-05-22 20:12 - 2014-05-24 12:35 - 0000976 _____ () C:\Users\Anja\AppData\Roaming\gdscan.log
2014-09-08 19:28 - 2015-01-06 14:29 - 0000680 _____ () C:\Users\Anja\AppData\Local\d3d9caps.dat
2013-05-06 15:23 - 2013-05-06 15:23 - 0001483 _____ () C:\Users\Anja\AppData\Local\recently-used.xbel
2015-05-22 18:32 - 2015-05-22 18:32 - 0000000 _____ () C:\Users\Anja\AppData\Local\{4B2FA74C-8229-4EA3-8FB0-5E96B272257C}
2015-05-21 14:00 - 2015-05-21 14:00 - 0000000 _____ () C:\Users\Anja\AppData\Local\{AFB11F1F-569B-4CE1-8BCC-931AA1DA58D8}
2013-08-15 17:54 - 2015-02-12 13:45 - 0005078 _____ () C:\ProgramData\hpzinstall.log
2012-04-26 17:55 - 2012-04-26 17:55 - 0000107 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
2012-06-12 20:57 - 2012-06-12 20:57 - 0001534 _____ () C:\ProgramData\ss.ini
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-06-23 11:40
==================== End of log ============================
|
|
24.06.2015, 08:58
| #22 |
| /// the machine /// TB-Ausbilder | Verdacht auf Viren: Secure Eraser kann Dateien nicht löschen Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter RemoveProxy:
Emptytemp:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
24.06.2015, 17:40
| #23 |
| | Verdacht auf Viren: Secure Eraser kann Dateien nicht löschenCode:
ATTFilter Fix result of Farbar Recovery Scan Tool (x86) Version: 21-06-2015 01
Ran by Anja at 2015-06-24 18:21:52 Run:2
Running from C:\Users\Anja\Downloads
Loaded Profiles: Anja (Available Profiles: Anja)
Boot Mode: Normal
==============================================
fixlist content:
*****************
RemoveProxy: Emptytemp:
*****************
========= RemoveProxy: =========
"HKU\S-1-5-21-809830661-3849426339-1780571292-1000\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfully.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => value removed successfully.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value removed successfully.
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully.
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully.
HKU\S-1-5-21-809830661-3849426339-1780571292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully.
HKU\S-1-5-21-809830661-3849426339-1780571292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully.
========= End of RemoveProxy: =========
==== End of Fixlog 18:21:53 ====
Der Bildschirmschoner arbeitet nur nach manueller Aufforderung im Menü "Übernehmen" und nicht selbsttätig. Weiterhin das Lösch-Problem bei Secure Eraser. |
|
24.06.2015, 20:53
| #24 |
| | Update: :huepp: Secure Eraser hat nun doch bis auf 7 Dateien alles gelöscht -  - von vormals 18 (!) Seiten Ausdrucken, die angeblich nicht zu löschen waren.  Problem gelöst - das mit dem Bildschirmschoner ist nicht so wichtig.  Spende via Banküberweisung ist veranlasst.Gruß, Ecart |
|
25.06.2015, 18:54
| #25 |
| /// the machine /// TB-Ausbilder | Verdacht auf Viren: Secure Eraser kann Dateien nicht löschen Cleanup: (Die Reihenfolge ist hier entscheidend) Falls Defogger verwendet wurde: Erneut starten und auf Re-enable klicken. Falls Combofix verwendet wurde:  Combofix deinstallieren
Alle Logs gepostet? Dann lade Dir bitte  DelFix herunter.
Hinweis: DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst. Starte Deinen Rechner abschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen. Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst... und/oder das Forum mit einer kleinen Spende  unterstützen.   Absicherung: Beim Betriebsystem Windows die automatischen Updates aktivieren. Auch die sicherheitsrelevante Software sollte immer nur in der aktuellsten Version vorliegen: Browser Java Flash-Player PDF-Reader Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren. Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen. Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig. Verwende ein Antivirusprogramm mit Echtzeitscanner und stets aktueller Signaturendatenbank. Meine Empfehlung:  Emsisoft Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware und ESET scannen. Optional:  NoScript verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen. Malwarebytes Anti Exploit: Schützt die Anwendungen des Computers vor der Ausnutzung bekannter Schwachstellen.Lade Software von einem sauberen Portal wie  .Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen. Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwcleaner . Abschließend noch ein paar grundsätzliche Bemerkungen: Ändere regelmäßig Deine wichtigen Online-Passwörter und erstelle regelmäßig Backups Deiner wichtigen Dateien oder des Systems. Der Nutzen von Registry-Cleanern, Optimizern usw. zur Performancesteigerung ist umstritten. Ich empfehle deshalb, die Finger von der Registry zu lassen und lieber die windowseigene Datenträgerbereinigung zu verwenden.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
25.06.2015, 22:04
| #26 |
| |  Bildschirmschoner funktioniert nun auch...... Die Registry-Reinigung hatte ich übrigens bei Secure Eraser nicht gemacht, sondern immer nur die Festplatte bereinigt. Dass eine Registry-Reinigung Schaden anrichten kann, wusste ich - und dass der Nutzen angezweifelt werden kann auch, da der Rechner sie zum Booten nicht braucht/nicht abklappert. Mir ging es vorrangig um das sichere Löschen von Dateien, nach der Gutman-Methode, 35-fach - und da wäre Silverlight von Windows nicht gründlich genug. Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...und/oder das Forum mit einer kleinen Spende unterstützen. Hab ich gern gemacht, guckst du hier.... http://www.trojaner-board.de/168236-...emloesung.html ....und die Spende hab ich sowieso schon gestern Abend veranlasst, weil es nicht alles so selbstverständlich ist - guckst du in Post. #24. Müsste morgen drauf sein, ich halte meine Versprechen.  Gruß, Ecart |
|
26.06.2015, 10:04
| #27 |
| /// the machine /// TB-Ausbilder | Verdacht auf Viren: Secure Eraser kann Dateien nicht löschen Danke und gern Geschehen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Verdacht auf Viren: Secure Eraser kann Dateien nicht löschen |
| bitdefender, conduitsearch, conduitsearch entfernen, defender, eingeschränkt, infiziert, kann dateien nicht löschen, langsamer, nicht löschen, programm, pup.optional.babylon.a, pup.optional.conduit.a, pup.optional.conduittb.gen, pup.optional.dvdvideosofttb.a, pup.optional.spigot.a, pup.optional.sweetpacks.a, pup.optional.systemspeedup, registry, verdacht, verdacht auf viren |
+ R Taste und schreibe Combofix /Uninstall in das 
Linear-Darstellung
