| |
| |||||||
Log-Analyse und Auswertung: Windows 8 - 34 Funde mit Malwarebytes, u.a. SFKEX (Trojan.downloader)Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
05.10.2015, 20:42
| #1 |
| |  Windows 8 - 34 Funde mit Malwarebytes, u.a. SFKEX (Trojan.downloader) Habe vorher auf dieser Maschine Malwarebytes laufen lassen. Kam dabei auf 34 Funde, dabei sind teilweise Dateien unbekannter Herkunft. ICh selbst benutze diesen Laptop kaum, kann deshalb nicht viel zur üblichen Nutzung sagen. Die Programme sind nicht alle auf dem neuesten Stand, wie ich gesehen habe. So viel steht fest. Es war auf jeden Fall "Hola Unblocker" als Erweiterung in Firefox installiert, habe es mit Avast entfernt. Außerdem sehe ich DaemonTools im FRST-Scan. Aprospros: Ich habe versucht FRST laufen zu lassen, der Scan bricht ab (friert ein) bei der Untersuchung der Wiederherstellungspunkte, deshalb die unvollständige Addition. Eine FRST.txt und eine Addition.txt habe ich dennoch: FRST.txt Code:
ATTFilter Platform: Windows 8.1 Pro (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Prozesse (Nicht auf der Ausnahmeliste) =================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
(AMD) C:\Windows\System32\atiesrxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
() C:\Program Files (x86)\Lexware\AAVUpdateManager\aavus.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S60RPB.EXE
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(iAnywhere Solutions, Inc.) C:\Program Files (x86)\SQL Anywhere 12\Bin32\dbsrv12.exe
(Haufe-Lexware GmbH & Co. KG) C:\Program Files (x86)\Lexware\Update Service\Hmg.InstallationService.Service.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\epson\MyEpson Portal\mepService.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(DEVGURU Co., LTD.) C:\Program Files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe
(DTools LIMITED) C:\ProgramData\tWdsManProt\WdsManPro.exe
(Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\epson\MyEpson Portal\mep.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\epson\MyEpson Portal\64DriverLoad.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\ng\ngtool.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\ng\ngtool.exe
(Microsoft Corporation) C:\Windows\System32\SrTasks.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_IATILGE.EXE
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
(Haufe-Lexware GmbH & Co. KG) C:\Program Files (x86)\Lexware\services\Haufe.FabricHostService.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.3.9600.17709_none_fa7932f59afc2e40\TiWorker.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
==================== Registry (Nicht auf der Ausnahmeliste) ===========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2917176 2012-09-13] (Synaptics Incorporated)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [170256 2015-08-13] (Apple Inc.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [6111824 2015-08-26] (AVAST Software)
HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311616 2015-02-24] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [LexwareInfoService] => C:\Program Files (x86)\Lexware\Update Manager\LxUpdateManager.exe [208424 2013-10-17] (Haufe-Lexware GmbH & Co. KG)
HKLM-x32\...\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [1065968 2015-07-23] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-40867682-1087133493-2937002368-1001\...\Run: [Spotify Web Helper] => C:\Users\XXXXXX\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171000 2014-05-08] (Spotify Ltd)
HKU\S-1-5-21-40867682-1087133493-2937002368-1001\...\Run: [Spotify] => C:\Users\XXXXXX\AppData\Roaming\Spotify\spotify.exe [6087224 2014-05-08] (Spotify Ltd)
HKU\S-1-5-21-40867682-1087133493-2937002368-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8455960 2015-08-20] (Piriform Ltd)
HKU\S-1-5-21-40867682-1087133493-2937002368-1001\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2015-04-26] (Apple Inc.)
HKU\S-1-5-21-40867682-1087133493-2937002368-1001\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [43816 2015-04-26] (Apple Inc.)
HKU\S-1-5-21-40867682-1087133493-2937002368-1001\...\Run: [iCloudDrive] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe [43816 2015-04-26] (Apple Inc.)
HKU\S-1-5-21-40867682-1087133493-2937002368-1001\...\Run: [EPLTarget\P0000000000000001] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_IATILGE.EXE [297024 2013-01-24] (SEIKO EPSON CORPORATION)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2015-08-23] (AVAST Software)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk [2014-03-30]
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
==================== Internet (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
Hosts: Es ist mehr als ein Eintrag in der Hosts Datei zu finden. Siehe Hosts-Bereich in Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1
Tcpip\..\Interfaces\{60987A8A-A713-41A0-BEE4-C07A31F2F5C8}: [DhcpNameServer] 192.168.2.1 192.168.2.1
Tcpip\..\Interfaces\{6393F436-33BB-4687-AE61-9B8246FDA941}: [DhcpNameServer] 10.57.1.1
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.google.com/?trackid=sp-006
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\S-1-5-21-40867682-1087133493-2937002368-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
HKU\S-1-5-21-40867682-1087133493-2937002368-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.google.com/?trackid=sp-006
HKU\S-1-5-21-40867682-1087133493-2937002368-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://t.de.msn.com/
HKU\S-1-5-21-40867682-1087133493-2937002368-1001\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxps://www.google.com/?trackid=sp-006
SearchScopes: HKLM -> DefaultScope {3EEF9C9E-68CA-4372-A6E9-DB9D05EDAC28} URL = hxxp://www.startseite24.net/?q={searchTerms}
SearchScopes: HKLM -> {39118170-7B07-4BC5-8B47-C62B1DC1DC99} URL = hxxp://www.bing.com/search?FORM=INCOH1&PC=IC02&q={searchTerms}
SearchScopes: HKLM -> {3EEF9C9E-68CA-4372-A6E9-DB9D05EDAC28} URL = hxxp://www.startseite24.net/?q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
SearchScopes: HKLM-x32 -> {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
SearchScopes: HKLM-x32 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-40867682-1087133493-2937002368-1001 -> DefaultScope {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
SearchScopes: HKU\S-1-5-21-40867682-1087133493-2937002368-1001 -> {39118170-7B07-4BC5-8B47-C62B1DC1DC99} URL = hxxp://www.bing.com/search?FORM=INCOH1&PC=IC02&q={searchTerms}
SearchScopes: HKU\S-1-5-21-40867682-1087133493-2937002368-1001 -> {3EEF9C9E-68CA-4372-A6E9-DB9D05EDAC28} URL = hxxp://www.startseite24.net/?q={searchTerms}
SearchScopes: HKU\S-1-5-21-40867682-1087133493-2937002368-1001 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-08-23] (AVAST Software)
BHO: Easy Photo Print -> {9421DD08-935F-4701-A9CA-22DF90AC4EA6} -> C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll [2015-07-31] (Seiko Epson Corporation)
BHO-x32: E-Web Print -> {201CF130-E29C-4E5C-A73F-CD197DEFA6AE} -> C:\Program Files (x86)\Epson Software\E-Web Print\ewps_tb.dll [2014-11-27] (SEIKO EPSON CORPORATION)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-08-23] (AVAST Software)
Toolbar: HKLM - Kein Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - Keine Datei
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll [2015-07-31] (Seiko Epson Corporation)
Toolbar: HKLM-x32 - E-Web Print - {201CF130-E29C-4E5C-A73F-CD197DEFA6AE} - C:\Program Files (x86)\Epson Software\E-Web Print\ewps_tb.dll [2014-11-27] (SEIKO EPSON CORPORATION)
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
FireFox:
========
FF ProfilePath: C:\Users\XXXXXX\AppData\Roaming\Mozilla\Firefox\Profiles\jspupy6y.default
FF NewTab: about:blank
FF DefaultSearchEngine: DisconnectSearch
FF SearchEngineOrder.2: Google
FF Homepage: hxxps://search.disconnect.me/
FF Keyword.URL:
FF NetworkProxy: "autoconfig_url", "data:text/javascript,function FindProxyForURL(url, host) {if ((url.indexOf(\"proxmate=us\") != -1)
(shExpMatch(url, \"https://www.netflix.com*\"))
(shExpMatch(url, \"hxxp://www.netflix.com*\"))
(host == \"netflix.com\")
(host == \"www.netflix.com\")
(host == \"cbp-us.nccp.netflix.com\")
(host == \"secure.netflix.com\")
(host == \"api-global.netflix.com\")) { return 'PROXY us10.sq.proxmate.me:8000; PROXY us08.sq.proxmate.me:8000; PROXY us05.sq.proxmate.me:8000; PROXY us12.sq.proxmate.me:8000; PROXY us09.sq.proxmate.me:8000; PROXY us11.sq.proxmate.me:8000; PROXY us07.sq.proxmate.me:8000; PROXY us02.sq.proxmate.me:8000; PROXY us14.sq.proxmate.me:8000; PROXY us01.sq.proxmate.me:8000; PROXY us06.sq.proxmate.me:8000; PROXY us03.sq.proxmate.me:8000; PROXY us13.sq.proxmate.me:8000' } else { return 'DIRECT'; }}"
FF NetworkProxy: "type", 2
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_18_0_0_232.dll [2015-08-12] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_232.dll [2015-08-12] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-07-30] ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-18] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-18] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF SearchPlugin: C:\Users\XXXXXX\AppData\Roaming\Mozilla\Firefox\Profiles\jspupy6y.default\searchplugins\disconnectsearch.xml [2015-09-07]
FF SearchPlugin: C:\Users\XXXXXX\AppData\Roaming\Mozilla\Firefox\Profiles\jspupy6y.default\searchplugins\google-avast.xml [2015-06-13]
FF Extension: WOT - C:\Users\XXXXXX\AppData\Roaming\Mozilla\Firefox\Profiles\jspupy6y.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2015-07-12]
FF Extension: Ghostery - C:\Users\XXXXXX\AppData\Roaming\Mozilla\Firefox\Profiles\jspupy6y.default\Extensions\firefox@ghostery.com.xpi [2015-08-12]
FF Extension: ProxMate - C:\Users\XXXXXX\AppData\Roaming\Mozilla\Firefox\Profiles\jspupy6y.default\Extensions\jid1-QpHD8URtZWJC2A@jetpack.xpi [2014-07-28]
FF Extension: Adblock Plus - C:\Users\XXXXXX\AppData\Roaming\Mozilla\Firefox\Profiles\jspupy6y.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-07-28]
FF Extension: BetterPrivacy - C:\Users\XXXXXX\AppData\Roaming\Mozilla\Firefox\Profiles\jspupy6y.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi [2014-07-28]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-01-26]
FF HKLM-x32\...\Firefox\Extensions: [e-webprint@epson.com] - C:\Program Files (x86)\Epson Software\E-Web Print\Firefox Add-on
FF Extension: E-Web Print - C:\Program Files (x86)\Epson Software\E-Web Print\Firefox Add-on [2015-09-18]
Chrome:
=======
CHR Profile: C:\Users\XXXXXX\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - C:\Users\XXXXXX\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-06-12]
CHR Extension: (Google Docs) - C:\Users\XXXXXX\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-06-12]
CHR Extension: (Google Drive) - C:\Users\XXXXXX\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-06-12]
CHR Extension: (YouTube) - C:\Users\XXXXXX\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-06-12]
CHR Extension: (Google-Suche) - C:\Users\XXXXXX\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-06-12]
CHR Extension: (Google Tabellen) - C:\Users\XXXXXX\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-06-12]
CHR Extension: (Google Text & Tabellen Offline) - C:\Users\XXXXXX\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-09-05]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\XXXXXX\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-06-12]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\XXXXXX\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-06-12]
CHR Extension: (Google Mail) - C:\Users\XXXXXX\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-06-12]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-06-12]
==================== Dienste (Nicht auf der Ausnahmeliste) ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R2 AAV UpdateService; C:\Program Files (x86)\Lexware\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-05-29] (Apple Inc.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [146600 2015-08-23] (AVAST Software)
R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4047768 2015-08-23] (Avast Software)
R2 EpsonScanSvc; C:\WINDOWS\system32\EscSvc64.exe [144560 2012-05-17] (Seiko Epson Corporation)
R2 EPSON_PM_RPCV4_06; C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S60RPB.EXE [152640 2013-04-15] (SEIKO EPSON CORPORATION)
R2 Haufe FabricHostService; C:\Program Files (x86)\Lexware\services\Haufe.FabricHostService.exe [14848 2013-10-10] (Haufe-Lexware GmbH & Co. KG) [Datei ist nicht signiert]
R2 Lexware_Datenbank_Plus; C:\Program Files (x86)\SQL Anywhere 12\Bin32\dbsrv12.exe [141176 2012-06-01] (iAnywhere Solutions, Inc.)
R2 Lexware_Update_Service; C:\Program Files (x86)\Lexware\Update Service\Hmg.InstallationService.Service.exe [49664 2013-10-08] (Haufe-Lexware GmbH & Co. KG) [Datei ist nicht signiert]
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
R2 MyEpson Portal Service; C:\Program Files (x86)\EPSON\MyEpson Portal\mepService.exe [703984 2014-09-22] (SEIKO EPSON CORPORATION)
S2 Net Driver HPZ12; C:\Windows\System32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [Datei ist nicht signiert]
S2 Pml Driver HPZ12; C:\Windows\System32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [Datei ist nicht signiert]
S3 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia)
R2 ss_conn_service; C:\Program Files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe [743688 2014-10-13] (DEVGURU Co., LTD.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation)
R2 WdsManPro; C:\ProgramData\tWdsManProt\WdsManPro.exe [709288 2015-09-06] (DTools LIMITED)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation)
===================== Treiber (Nicht auf der Ausnahmeliste) ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [28656 2015-09-24] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [90968 2015-09-24] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-09-24] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65224 2015-09-24] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1049880 2015-09-24] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [448968 2015-09-24] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [153744 2015-09-24] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [274808 2015-09-24] (AVAST Software)
S3 AtiDCM; C:\AMD\WU-CCC2\ccc2_install\Support64\atdcm64a.sys [28416 2014-03-13] (Advanced Micro Devices, Inc.)
S3 dtlitescsibus; C:\Windows\System32\drivers\dtlitescsibus.sys [30264 2015-09-06] (Disc Soft Ltd)
S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)
S3 hcw66xxx; C:\Windows\System32\Drivers\hcw66x64.sys [758016 2014-06-03] (Hauppauge Computer Works, Inc.)
S3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-06-18] (Malwarebytes Corporation)
R0 ngvss; C:\Windows\System32\Drivers\ngvss.sys [132656 2015-09-24] (AVAST Software)
S3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-12-06] (Secunia)
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2014-07-28] (Apple, Inc.) [Datei ist nicht signiert]
R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [273824 2015-08-23] (Avast Software)
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44560 2015-07-07] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [270168 2015-07-07] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2015-07-07] (Microsoft Corporation)
==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Ein Monat: Erstellte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2015-10-05 19:47 - 2015-10-05 19:57 - 00022206 _____ C:\Users\XXXXXX\Desktop\FRST.txt
2015-10-05 19:47 - 2015-10-05 19:56 - 00000000 ____D C:\FRST
2015-10-05 19:46 - 2015-10-05 19:46 - 00000482 _____ C:\Users\XXXXXX\Desktop\defogger_disable.log
2015-10-05 19:46 - 2015-10-05 19:46 - 00000000 _____ C:\Users\XXXXXX\defogger_reenable
2015-10-05 19:43 - 2015-10-05 19:43 - 00380416 _____ C:\Users\XXXXXX\Desktop\Gmer-19357.exe
2015-10-05 19:41 - 2015-10-05 19:41 - 00050477 _____ C:\Users\XXXXXX\Desktop\Defogger.exe
2015-10-05 19:40 - 2015-10-05 19:41 - 02193920 _____ (Farbar) C:\Users\XXXXXX\Desktop\FRST64.exe
2015-10-05 19:19 - 2015-10-05 19:21 - 00000000 ____D C:\Users\XXXXXX\Desktop\Pass
2015-10-03 16:14 - 2015-10-03 16:14 - 00000000 ____D C:\New
2015-09-30 19:40 - 2015-09-30 21:01 - 915809568 _____ C:\Users\XXXXXX\Downloads\KristallisationAscorbinsaeure.avi
2015-09-24 19:43 - 2015-09-24 19:43 - 00378880 _____ (AVAST Software) C:\WINDOWS\system32\aswBoot.exe
2015-09-24 19:43 - 2015-09-24 19:43 - 00043112 _____ (AVAST Software) C:\WINDOWS\avastSS.scr
2015-09-24 19:43 - 2015-08-23 13:16 - 01048344 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw6B2D.tmp
2015-09-24 19:43 - 2015-08-23 13:15 - 00447944 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw6BEE.tmp
2015-09-24 19:43 - 2015-08-23 13:15 - 00274808 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw6BFE.tmp
2015-09-24 19:43 - 2015-08-23 13:15 - 00150672 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw6C0F.tmp
2015-09-24 19:43 - 2015-08-23 13:15 - 00115152 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\ngv6A90.tmp
2015-09-24 19:43 - 2015-08-23 13:15 - 00093528 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw6B5D.tmp
2015-09-24 19:43 - 2015-08-23 13:15 - 00090968 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw6BAD.tmp
2015-09-24 19:43 - 2015-08-23 13:15 - 00065224 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw6BDD.tmp
2015-09-24 19:43 - 2015-08-23 13:15 - 00028656 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw6B8D.tmp
2015-09-18 02:40 - 2015-09-18 02:40 - 00002187 _____ C:\Users\Public\Desktop\Epson Easy Photo Print.lnk
2015-09-18 02:40 - 2015-09-18 02:40 - 00000000 ____D C:\ProgramData\Sony Corporation
2015-09-14 15:45 - 2015-09-14 15:45 - 00024576 _____ C:\Users\XXXXXX\Downloads\Adsorption.xls
2015-09-14 15:45 - 2015-09-14 15:45 - 00024070 _____ C:\Users\XXXXXX\Downloads\Adsorption.xlsx
2015-09-10 19:45 - 2015-09-10 19:56 - 00000231 _____ C:\WINDOWS\setupact.log
2015-09-10 19:45 - 2015-09-10 19:45 - 00000000 _____ C:\WINDOWS\setuperr.log
2015-09-09 12:02 - 2015-08-27 04:48 - 00136904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2015-09-09 12:02 - 2015-08-26 20:00 - 00721920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2015-09-09 12:02 - 2015-08-26 20:00 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll
2015-09-09 12:02 - 2015-08-26 20:00 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll
2015-09-09 12:02 - 2015-08-26 20:00 - 00029696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe
2015-09-09 12:02 - 2015-08-26 16:46 - 03705344 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2015-09-09 12:02 - 2015-08-26 16:29 - 02240512 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll
2015-09-09 12:02 - 2015-08-26 16:27 - 00891904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2015-09-09 12:02 - 2015-08-26 16:27 - 00409088 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll
2015-09-09 12:02 - 2015-08-26 16:26 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll
2015-09-09 12:02 - 2015-08-26 16:26 - 00095744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll
2015-09-09 12:02 - 2015-08-26 16:26 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe
2015-09-09 12:02 - 2015-08-22 20:19 - 25188352 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2015-09-09 12:02 - 2015-08-22 19:35 - 02886144 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2015-09-09 12:02 - 2015-08-22 19:34 - 00585216 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2015-09-09 12:02 - 2015-08-22 19:22 - 19856384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2015-09-09 12:02 - 2015-08-22 19:21 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2015-09-09 12:02 - 2015-08-22 19:20 - 05923840 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2015-09-09 12:02 - 2015-08-22 18:55 - 00504832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2015-09-09 12:02 - 2015-08-22 18:50 - 02279424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2015-09-09 12:02 - 2015-08-22 18:50 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2015-09-09 12:02 - 2015-08-22 18:45 - 00665600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2015-09-09 12:02 - 2015-08-22 18:44 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2015-09-09 12:02 - 2015-08-22 18:41 - 14451712 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2015-09-09 12:02 - 2015-08-22 18:41 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2015-09-09 12:02 - 2015-08-22 18:41 - 00720384 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2015-09-09 12:02 - 2015-08-22 18:41 - 00374784 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2015-09-09 12:02 - 2015-08-22 18:39 - 02126336 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2015-09-09 12:02 - 2015-08-22 18:28 - 04520448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2015-09-09 12:02 - 2015-08-22 18:26 - 02427392 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2015-09-09 12:02 - 2015-08-22 18:23 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2015-09-09 12:02 - 2015-08-22 18:22 - 12857344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2015-09-09 12:02 - 2015-08-22 18:20 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2015-09-09 12:02 - 2015-08-22 18:18 - 02052608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2015-09-09 12:02 - 2015-08-22 18:18 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2015-09-09 12:02 - 2015-08-22 18:18 - 00327168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2015-09-09 12:02 - 2015-08-22 18:14 - 01545728 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2015-09-09 12:02 - 2015-08-22 18:01 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2015-09-09 12:02 - 2015-08-22 18:00 - 01951232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2015-09-09 12:02 - 2015-08-22 17:56 - 01310720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2015-09-09 12:02 - 2015-08-22 17:55 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2015-09-09 12:02 - 2015-07-30 19:18 - 00268288 _____ (Microsoft Corporation) C:\WINDOWS\system32\InkEd.dll
2015-09-09 12:02 - 2015-07-30 18:22 - 00230912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InkEd.dll
2015-09-09 12:01 - 2015-09-02 04:56 - 04175872 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2015-09-09 12:01 - 2015-09-02 04:55 - 00358912 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll
2015-09-09 12:01 - 2015-09-02 04:50 - 00044032 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll
2015-09-09 12:01 - 2015-09-02 04:17 - 00301568 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll
2015-09-09 12:01 - 2015-09-02 04:13 - 00035840 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll
2015-09-09 12:01 - 2015-08-03 23:15 - 00074928 _____ (Microsoft Corporation) C:\WINDOWS\system32\appidapi.dll
2015-09-09 12:01 - 2015-08-03 23:15 - 00065600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\appidapi.dll
2015-09-09 12:01 - 2015-08-01 16:22 - 00039936 _____ (Microsoft Corporation) C:\WINDOWS\system32\appidsvc.dll
2015-09-09 12:01 - 2015-08-01 05:47 - 00229376 _____ (Microsoft Corporation) C:\WINDOWS\system32\schtasks.exe
2015-09-09 12:01 - 2015-08-01 05:45 - 00182784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schtasks.exe
2015-09-09 12:01 - 2015-08-01 05:38 - 01265152 _____ (Microsoft Corporation) C:\WINDOWS\system32\schedsvc.dll
2015-09-09 12:01 - 2015-08-01 05:37 - 00468992 _____ (Microsoft Corporation) C:\WINDOWS\system32\taskeng.exe
2015-09-09 12:01 - 2015-08-01 05:37 - 00359936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\taskeng.exe
2015-09-09 12:01 - 2015-07-22 16:34 - 02775552 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll
2015-09-09 12:01 - 2015-07-22 16:33 - 01728000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Immersive.dll
2015-09-09 12:01 - 2015-07-22 16:25 - 02461184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll
2015-09-09 12:01 - 2015-07-22 16:25 - 01546752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Immersive.dll
2015-09-09 12:01 - 2015-07-18 20:31 - 00194048 _____ (Microsoft Corporation) C:\WINDOWS\system32\shacct.dll
2015-09-09 12:01 - 2015-07-18 20:29 - 00655872 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSync.dll
2015-09-09 12:01 - 2015-07-18 20:29 - 00148480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shacct.dll
2015-09-09 12:01 - 2015-07-18 20:27 - 00520192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSync.dll
2015-09-09 11:56 - 2015-07-14 05:27 - 00063488 _____ (Microsoft Corporation) C:\WINDOWS\system32\tzsync.exe
2015-09-07 18:44 - 2015-09-07 18:45 - 00000000 ____D C:\Users\XXXXXX\Desktop\Tor Browser
2015-09-07 18:25 - 2015-09-07 18:26 - 44189320 _____ C:\Users\XXXXXX\Downloads\torbrowser-install-5.0.2_de.exe
2015-09-06 23:44 - 2015-09-06 23:44 - 00000022 _____ C:\Users\XXXXXX\Downloads\USBFormat(1).zip
2015-09-06 22:57 - 2015-09-06 22:57 - 06667640 _____ (Piriform Ltd) C:\Users\XXXXXX\Downloads\ccsetup509.exe
2015-09-06 22:18 - 2015-09-06 22:43 - 00000000 ____D C:\AdwCleaner
2015-09-06 22:13 - 2015-09-06 22:13 - 01654784 _____ C:\Users\XXXXXX\Downloads\adwcleaner_5.006.exe
2015-09-06 22:12 - 2015-09-06 22:12 - 00000000 ____D C:\Users\XXXXXX\AppData\Local\Disc_Soft_Ltd
2015-09-06 17:56 - 2015-09-06 17:56 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\USB Disk Storage Format Tool 5.1
2015-09-06 17:56 - 2015-09-06 17:56 - 00000000 ____D C:\Program Files\USB Disk Storage Format Tool
2015-09-06 17:51 - 2015-09-06 17:51 - 00561105 _____ (Authorsoft Corporation ) C:\Users\XXXXXX\Downloads\USBFormatToolSetup.exe
2015-09-06 17:34 - 2015-09-06 17:34 - 00000000 ____D C:\Users\Public\Documents\Daemon Tools Images
2015-09-06 17:25 - 2015-09-06 22:43 - 00000000 ____D C:\Program Files (x86)\SFK
2015-09-06 17:25 - 2015-09-06 17:26 - 00000000 ____D C:\ProgramData\tWdsManProt
2015-09-06 17:25 - 2015-09-06 17:25 - 00000102 _____ C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
2015-09-06 17:23 - 2015-09-06 23:01 - 00000000 ____D C:\Users\XXXXXX\AppData\Roaming\DAEMON Tools Lite
2015-09-06 17:23 - 2015-09-06 17:23 - 00030264 _____ (Disc Soft Ltd) C:\WINDOWS\system32\Drivers\dtlitescsibus.sys
2015-09-06 17:22 - 2015-09-06 17:22 - 00000000 ____D C:\ProgramData\DAEMON Tools Lite
2015-09-06 17:20 - 2015-09-06 17:20 - 01709792 _____ (Disc Soft Ltd.) C:\Users\XXXXXX\Downloads\DTLiteInstaller.exe
2015-09-06 17:16 - 2015-09-06 17:16 - 00000000 ____D C:\Users\XXXXXX\Downloads\Hirens.BootCD.15.2
2015-09-06 17:14 - 2015-10-05 19:20 - 00000000 ____D C:\Users\XXXXXX\Desktop\grub4dos
2015-09-06 17:05 - 2015-09-06 17:11 - 00000022 _____ C:\Users\XXXXXX\Downloads\USBFormat.zip
2015-09-06 17:02 - 2015-09-06 17:10 - 621283886 _____ C:\Users\XXXXXX\Downloads\Hirens.BootCD.15.2.zip
==================== Ein Monat: Geänderte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2015-10-05 19:56 - 2015-02-28 13:56 - 00000931 _____ C:\WINDOWS\Tasks\EPSON XP-215 217 Series Update {0DC39B17-B1B9-4D7D-AD98-A8B7CD5DC70F}.job
2015-10-05 19:56 - 2015-02-28 13:56 - 00000745 _____ C:\WINDOWS\Tasks\EPSON XP-215 217 Series Invitation {0DC39B17-B1B9-4D7D-AD98-A8B7CD5DC70F}.job
2015-10-05 19:53 - 2015-02-07 11:25 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-10-05 19:52 - 2014-01-26 15:35 - 00003596 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-40867682-1087133493-2937002368-1001
2015-10-05 19:52 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\AppReadiness
2015-10-05 19:46 - 2014-05-30 11:36 - 00000000 ____D C:\Users\XXXXXX
2015-10-05 19:27 - 2014-08-05 15:24 - 00000000 ____D C:\Users\XXXXXX\Desktop\Security
2015-10-05 19:25 - 2014-11-18 20:59 - 00000000 ____D C:\XXXXXX
2015-10-05 19:19 - 2014-10-26 22:36 - 00000000 ____D C:\Users\XXXXXX\AppData\Roaming\vlc
2015-10-05 19:16 - 2015-08-12 21:16 - 00000931 _____ C:\WINDOWS\Tasks\EPSON XP-215 217 Series Update {D6BC7D1D-A0FC-439E-9733-496E5434A800}.job
2015-10-05 19:16 - 2015-08-12 21:16 - 00000745 _____ C:\WINDOWS\Tasks\EPSON XP-215 217 Series Invitation {D6BC7D1D-A0FC-439E-9733-496E5434A800}.job
2015-10-05 19:12 - 2015-06-12 20:43 - 00001130 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-10-05 19:12 - 2014-12-21 10:06 - 01177477 _____ C:\WINDOWS\WindowsUpdate.log
2015-10-05 19:12 - 2014-03-19 23:12 - 00000931 _____ C:\WINDOWS\Tasks\EPSON XP-215 217 Series Update {52007BB5-1292-40E7-962D-B6276578095F}.job
2015-10-05 19:12 - 2014-03-19 23:12 - 00000745 _____ C:\WINDOWS\Tasks\EPSON XP-215 217 Series Invitation {52007BB5-1292-40E7-962D-B6276578095F}.job
2015-10-05 18:21 - 2014-07-25 13:33 - 00113880 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-10-05 18:21 - 2014-01-28 13:13 - 00000000 ____D C:\Users\XXXXXX\AppData\Roaming\Macromedia
2015-10-05 18:12 - 2015-06-12 20:43 - 00001126 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-10-05 18:00 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\system32\sru
2015-10-05 17:54 - 2015-05-15 19:21 - 00000000 ____D C:\Users\XXXXXX\AppData\Roaming\FileAdvisor
2015-10-05 17:52 - 2014-07-25 13:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-10-05 17:52 - 2014-07-25 13:33 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-10-04 22:08 - 2015-05-03 22:08 - 00003518 _____ C:\WINDOWS\System32\Tasks\FileAdvisorCheck
2015-10-04 22:08 - 2015-05-03 22:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\File Type Advisor
2015-10-04 22:08 - 2015-05-03 22:08 - 00000000 ____D C:\Program Files (x86)\File Type Advisor
2015-10-04 14:33 - 2015-06-12 20:43 - 00000000 ____D C:\Users\XXXXXX\AppData\Local\Google
2015-10-04 10:37 - 2015-08-12 17:45 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-10-04 10:37 - 2014-07-25 12:50 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-09-24 19:44 - 2014-01-26 15:40 - 00003924 _____ C:\WINDOWS\System32\Tasks\avast! Emergency Update
2015-09-24 19:43 - 2015-08-23 13:16 - 00132656 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\ngvss.sys
2015-09-24 19:43 - 2014-06-11 21:05 - 00028656 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswHwid.sys
2015-09-24 19:43 - 2014-01-26 15:40 - 01049880 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSnx.sys
2015-09-24 19:43 - 2014-01-26 15:40 - 00448968 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSP.sys
2015-09-24 19:43 - 2014-01-26 15:40 - 00274808 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswVmm.sys
2015-09-24 19:43 - 2014-01-26 15:40 - 00153744 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswStm.sys
2015-09-24 19:43 - 2014-01-26 15:40 - 00093528 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRdr2.sys
2015-09-24 19:43 - 2014-01-26 15:40 - 00090968 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswMonFlt.sys
2015-09-24 19:43 - 2014-01-26 15:40 - 00065224 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRvrt.sys
2015-09-22 01:14 - 2012-07-26 09:59 - 00000000 ____D C:\WINDOWS\CbsTemp
2015-09-20 02:57 - 2014-03-18 12:04 - 01776918 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2015-09-20 02:57 - 2014-03-18 11:25 - 00765582 _____ C:\WINDOWS\system32\perfh007.dat
2015-09-20 02:57 - 2014-03-18 11:25 - 00159366 _____ C:\WINDOWS\system32\perfc007.dat
2015-09-18 18:07 - 2015-06-12 20:43 - 00004102 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2015-09-18 18:07 - 2015-06-12 20:43 - 00003866 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2015-09-18 02:43 - 2014-03-19 23:14 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2015-09-18 02:43 - 2014-03-19 23:13 - 00000000 ____D C:\Program Files (x86)\epson
2015-09-18 02:43 - 2014-03-19 22:55 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON Software
2015-09-18 02:43 - 2014-03-19 22:55 - 00000000 ____D C:\Program Files (x86)\EPSON Software
2015-09-17 19:04 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\system32\NDF
2015-09-15 03:18 - 2015-07-23 17:36 - 00812008 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-09-15 03:18 - 2015-07-23 17:36 - 00178152 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-09-11 16:30 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\rescache
2015-09-10 19:56 - 2013-08-22 16:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2015-09-10 11:20 - 2013-08-22 16:44 - 00371648 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2015-09-10 02:48 - 2013-08-22 15:25 - 00262144 ___SH C:\WINDOWS\system32\config\BBI
2015-09-10 02:47 - 2014-03-18 11:40 - 00000000 ____D C:\Program Files\Windows Journal
2015-09-10 02:47 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\PolicyDefinitions
2015-09-09 12:15 - 2014-01-27 18:07 - 00000000 ____D C:\WINDOWS\system32\MRT
2015-09-06 22:59 - 2014-03-29 19:46 - 00000000 ____D C:\Program Files\CCleaner
2015-09-06 22:43 - 2015-06-12 20:44 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-09-06 22:43 - 2014-07-25 12:50 - 00001077 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
2014-03-30 14:13 - 2014-03-30 15:28 - 0001829 _____ () C:\ProgramData\hpzinstall.log
2015-09-06 17:25 - 2015-09-06 17:25 - 0000102 _____ () C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
Dateien, die verschoben oder gelöscht werden sollten:
====================
C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
Einige Dateien in TEMP:
====================
C:\Users\XXXXXX\AppData\Local\Temp\{5F893DC1-07C4-4D9D-9533-F819F1AB24C5}-45.0.2454.101_45.0.2454.99_chrome_updater.exe
==================== Bamital & volsnap =================
(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert
C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert
C:\WINDOWS\explorer.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert
C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert
C:\WINDOWS\system32\services.exe => Datei ist digital signiert
C:\WINDOWS\system32\User32.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert
C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert
C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert
C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert
Code:
ATTFilter Windows 8.1 Pro (X64) (2014-05-30 19:26:55)
Start-Modus: Normal
==========================================================
==================== Konten: =============================
Administrator (S-1-5-21-40867682-1087133493-2937002368-500 - Administrator - Disabled)
Gast (S-1-5-21-40867682-1087133493-2937002368-501 - Limited - Disabled)
XXXXXXX (S-1-5-21-40867682-1087133493-2937002368-1001 - Administrator - Enabled) => C:\Users\XXXXXXX
==================== Sicherheits-Center ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
AV: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
==================== Installierte Programme ======================
(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
4660_4680_Help (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
64 Bit HP CIO Components Installer (Version: 7.2.8 - Hewlett-Packard) Hidden
AAVUpdateManager (HKLM-x32\...\{AFA42FE1-A5C3-485F-9180-BFCF5BF1F1C3}) (Version: 18.00.0000 - Wolters Kluwer Deutschland GmbH)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\{1D55DE93-486D-40F7-88F3-CF08578F82AA}) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 18 NPAPI (HKLM-x32\...\{A580818A-6519-4120-AB1C-F4F6FCFAA7D0}) (Version: 18.0.0.232 - Adobe Systems Incorporated)
Apple Application Support (32-Bit) (HKLM-x32\...\{7FE25256-B7C1-480D-B736-10A67A833AEA}) (Version: 3.2 - Apple Inc.)
Apple Application Support (64-Bit) (HKLM\...\{B255D495-4734-4E9B-B4F5-96702FD4A7B9}) (Version: 3.2 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{5D61F006-168C-4B8B-B7FD-F113C10AE0E4}) (Version: 8.2.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.4.2233 - AVAST Software)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
bpd_scan (x32 Version: 3.00.0000 - Hewlett-Packard) Hidden
BPDSoftware (x32 Version: 140.0.001.000 - Hewlett-Packard) Hidden
BPDSoftware_Ini (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
BufferChm (x32 Version: 140.0.298.000 - Hewlett-Packard) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 5.09 - Piriform)
Destinations (x32 Version: 140.0.253.000 - Hewlett-Packard) Hidden
DeviceDiscovery (x32 Version: 140.0.298.000 - Hewlett-Packard) Hidden
DocProc (x32 Version: 140.0.185.000 - Hewlett-Packard) Hidden
Epson Easy Photo Print 2 (HKLM-x32\...\{07AA1C7F-E8CA-4FDC-B975-BC9EBC22B6DE}) (Version: 2.7.0.0 - SEIKO EPSON CORPORATION)
Epson Event Manager (HKLM-x32\...\{17FA0444-A025-43B9-862C-81AE6307C2F2}) (Version: 3.10.0050 - Seiko Epson Corporation)
Epson E-Web Print (HKLM-x32\...\{6BF9F374-EC67-4808-A90C-F127DE6D989D}) (Version: 1.23.0000 - SEIKO EPSON CORPORATION)
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version: - Seiko Epson Corporation)
EPSON XP-215 217 Series Printer Uninstall (HKLM\...\EPSON XP-215 217 Series) (Version: - SEIKO EPSON Corporation)
EpsonNet Print (HKLM-x32\...\{3E31400D-274E-4647-916C-2CACC3741799}) (Version: 2.6.0 - SEIKO EPSON CORPORATION)
Fax (x32 Version: 140.0.307.000 - Hewlett-Packard) Hidden
File Type Advisor 1.6 (HKLM-x32\...\File Type Advisor_is1) (Version: - )
Free M4a to MP3 Converter 8.3 (HKLM-x32\...\Free M4a to MP3 Converter_is1) (Version: - ManiacTools.com)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 45.0.2454.101 - Google Inc.)
Google Update Helper (x32 Version: 1.3.21.169 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.28.15 - Google Inc.) Hidden
GPBaseService2 (x32 Version: 140.0.297.000 - Hewlett-Packard) Hidden
HP Customer Participation Program 14.0 (HKLM\...\HPExtendedCapabilities) (Version: 14.0 - HP)
HP Imaging Device Functions 14.0 (HKLM\...\HP Imaging Device Functions) (Version: 14.0 - HP)
HP OfficeJet J4600 All-In-One Series (HKLM\...\{6122CE5C-9DD3-402D-8413-57B681739FA7}) (Version: 14.0 - HP)
HP Solution Center 14.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 14.0 - HP)
HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
HPDiagnosticAlert (x32 Version: 1.00.0001 - Microsoft) Hidden
HPProductAssistant (x32 Version: 140.0.298.000 - Hewlett-Packard) Hidden
HPSSupply (x32 Version: 140.0.297.000 - Hewlett-Packard) Hidden
iCloud (HKLM\...\{709A2D23-C25E-47B5-9268-CB6FEE648504}) (Version: 4.1.1.53 - Apple Inc.)
iTunes (HKLM\...\{BFEAB774-C7DC-4032-B05A-DA5F7CB7B365}) (Version: 12.2.2.25 - Apple Inc.)
J4680 (x32 Version: 140.0.001.000 - Hewlett-Packard) Hidden
K-Lite Codec Pack 9.9.9 (64-bit) (HKLM\...\KLiteCodecPack64_is1) (Version: 9.9.9 - )
Lexware buchhalter 2013 (HKLM-x32\...\{6AB4E5CD-0062-48E8-96A3-E5B4486DFCB3}) (Version: 18.04.00.0021 - Haufe-Lexware GmbH Co.KG)
Lexware Datenbank plus 2014 (x32 Version: 14.25.00.0056 - Haufe-Lexware GmbH & Co.KG) Hidden
Lexware Elster (HKLM-x32\...\{9F6BFB0F-6B1F-4D1A-A9DA-42F6794C9188}) (Version: 13.00.00.0027 - Haufe-Lexware GmbH & Co.KG)
Lexware Info Service (x32 Version: 4.01.00.0077 - Haufe-Lexware GmbH & Co.KG) Hidden
Lexware Installations Dienst (x32 Version: 3.01.00.0011 - Haufe-Lexware GmbH & Co.KG) Hidden
Lexware online banking (x32 Version: 20.00.00.0059 - Haufe-Lexware GmbH Co.KG) Hidden
Lexware reisekosten plus 2014 (x32 Version: 14.50.00.0190 - Haufe-Lexware GmbH & Co.KG) Hidden
Lexware reisekosten plus 2014 Client (HKLM-x32\...\{14f5fd58-b258-45e3-add4-ffba9a503225}) (Version: 14.50.0.190 - Haufe-Lexware GmbH & Co.KG)
Lexware reisekosten plus Gratisversion 2014 (HKLM-x32\...\{d9f64277-f45d-4950-b05f-ae2c0179374d}) (Version: 14.50.0.190 - Haufe-Lexware GmbH & Co.KG)
Lexware Server Plus 2014 (x32 Version: 14.1.0.1 - Haufe-Lexware GmbH & Co.KG) Hidden
Lexware Services (x32 Version: 2.00.00.0024 - Haufe-Lexware GmbH & Co.KG) Hidden
Malwarebytes Anti-Malware Version 2.1.8.1057 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)
MarketResearch (x32 Version: 140.0.212.000 - Hewlett-Packard) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40728.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{402ED4A1-8F5B-387A-8688-997ABF58B8F2}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 41.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 41.0.1 (x86 de)) (Version: 41.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 41.0.1.5750 - Mozilla)
MyEpson Portal (HKLM-x32\...\MyEpson Portal) (Version: - SEIKO EPSON Corporation)
MyEpson Portal (x32 Version: 1.1.1.0 - SEIKO EPSON CORPORATION) Hidden
MyPhoneExplorer (HKLM-x32\...\MPE) (Version: 1.8.5 - F.J. Wechselberger)
Network64 (Version: 140.0.306.000 - Hewlett-Packard) Hidden
OCR Software by I.R.I.S. 14.0 (HKLM\...\HPOCR) (Version: 14.0 - HP)
OpenOffice 4.1.1 (HKLM-x32\...\{ACD0FFF9-6B35-43C1-82DB-9FF6990E8602}) (Version: 4.11.9775 - Apache Software Foundation)
ProductContext (x32 Version: 140.0.001.000 - Hewlett-Packard) Hidden
ProgDVB x64 (HKLM\...\ProgDVB) (Version: 7.x - Prog)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.6.2.14014_7 - Samsung Electronics Co., Ltd.)
Samsung Kies (x32 Version: 2.6.2.14014_7 - Samsung Electronics Co., Ltd.) Hidden
Samsung Kies3 (HKLM-x32\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.15024.8 - Samsung Electronics Co., Ltd.)
Samsung Kies3 (x32 Version: 3.2.15024.8 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.49.0 - SAMSUNG Electronics Co., Ltd.)
Scan (x32 Version: 140.0.253.000 - Hewlett-Packard) Hidden
Secunia PSI (3.0.0.9016) (HKLM-x32\...\Secunia PSI) (Version: 3.0.0.9016 - Secunia)
Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 14.0 - HP)
Software Updater (HKLM-x32\...\{E1BAD1BA-C0E8-4018-9281-E7D2C6B07474}) (Version: 4.3.6 - SEIKO EPSON CORPORATION)
SolutionCenter (x32 Version: 140.0.299.000 - Hewlett-Packard) Hidden
Spotify (HKU\S-1-5-21-40867682-1087133493-2937002368-1001\...\Spotify) (Version: 0.9.8.296.g91f68827 - Spotify AB)
SpywareBlaster 5.0 (HKLM-x32\...\SpywareBlaster_is1) (Version: 5.0.0 - BrightFort LLC)
Status (x32 Version: 140.0.342.000 - Hewlett-Packard) Hidden
Sybase12ConversionPlus (HKLM-x32\...\{8506411D-495E-4D5F-947D-FD6DA761FE6C}) (Version: 14.25.00.0056 - Haufe Lexware GmbH Co.KG)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.10.19 - Synaptics Incorporated)
TAXMAN 2013 (HKLM-x32\...\{F289D934-2224-473B-B57E-0040D2693F83}) (Version: 19.07.00.0004 - Haufe-Lexware GmbH & Co.KG)
TAXMAN 2014 (HKLM-x32\...\{4A1C559D-38F6-49CF-BDA5-CF354FFE04E4}) (Version: 20.04.00.0003 - Haufe-Lexware GmbH & Co.KG)
TAXMAN 2015 (HKLM-x32\...\{5613CAD3-71ED-4207-95A0-1BA0BF465E38}) (Version: 20.31.151 - Haufe-Lexware GmbH & Co.KG)
Toolbox (x32 Version: 140.0.596.000 - Hewlett-Packard) Hidden
TrayApp (x32 Version: 140.0.297.000 - Hewlett-Packard) Hidden
USB Disk Storage Format Tool 5.1 (HKLM\...\USB Disk Storage Format Tool_is1) (Version: - Authorsoft Corporation)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.1 - VideoLAN)
WebReg (x32 Version: 140.0.297.017 - Hewlett-Packard) Hidden
Websuche (HKLM-x32\...\Websuche) (Version: - Websuche)
WinRAR 5.10 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.10.0 - win.rar GmbH)
==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Wiederherstellungspunkte =========================
Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 19:46 on 05/10/2015 (XXXXX)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-10-05 20:45:36
Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\0000002a TOSHIBA_MK5059GSXP rev.GN003J 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\XXXXX\AppData\Local\Temp\fgldypod.sys
---- Kernel code sections - GMER 2.1 ----
.text C:\WINDOWS\System32\win32k.sys!W32pServiceTable fffff96000129300 15 bytes [00, 0B, F2, 01, 00, 06, 6C, ...]
.text C:\WINDOWS\System32\win32k.sys!W32pServiceTable + 16 fffff96000129310 8 bytes [00, D7, FB, FF, 00, D3, CD, ...]
---- Threads - GMER 2.1 ----
Thread C:\WINDOWS\system32\csrss.exe [9000:8668] fffff96000345890
Thread C:\WINDOWS\system32\csrss.exe [2452:14796] fffff9600090c2d0
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager@PendingFileRenameOperations ???#?????????????=???????M???&??? ??????????????????????????????????????8A???????????8??????? ??????????????????????????????????????-4???????????&??????? ???????????????????????????? ?????????Tc???????????i??E ???????&??????? ??????????????????????????????????????94???????????e??????? ??????????????????????????????????????80???????????&??????? ??????????????????????????????????????BE???????????F??????? ??????????????????????????????????&???????????????????????? ???????????????????????????????????????????????????????????????&??? ??????????????????????????????????&????????????????????6??? ??????????????????????????????????????_N???????????????????????&???&???&??? ??????????????????????????????????????7E???????????N??????? ??????????????????????????????j???????62????j??????&??SWD\PRINTENUM\{35E433D7-DF5B-4EBB-B8F0-7D6AAFEBFE39}?\??????? ??????????????????????????????????&????????????????????2??? ??????????????????????????????>???????-B????>??????i??Amyuni Document Converter 2.50?A31???????????'???(??? ?????????
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel\RNG@RNGAuxiliarySeed 2017479801
Reg HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch@Epoch 11545
Reg HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch2@Epoch 2933
Reg HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\0@Rw 0x64 0x62 0x03 0x00 ...
Reg HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\0@RwMask 0x64 0x62 0x03 0x00 ...
Reg HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\1@Rw 0x64 0x62 0x03 0x00 ...
Reg HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\1@RwMask 0x64 0x62 0x03 0x00 ...
Reg HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows@UserSelectedDefault 1
---- EOF - GMER 2.1 ----
Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlaufdatum: 05.10.2015 Suchlaufzeit: 18:21 Protokolldatei: Malware.txt Administrator: Ja Version: 2.1.8.1057 Malware-Datenbank: v2015.10.05.05 Rootkit-Datenbank: v2015.10.02.01 Lizenz: Kostenlose Version Malware-Schutz: Deaktiviert Schutz vor bösartigen Websites: Deaktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 8.1 CPU: x64 Dateisystem: NTFS Benutzer: XXXXX Suchlauftyp: Bedrohungssuchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 407102 Abgelaufene Zeit: 1 Std., 1 Min., 20 Sek. Speicher: Aktiviert Start: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 1 PUP.Optional.WProtectManager, C:\ProgramData\tWdsManProt\WdsManPro.exe, 2740, , [71e8aca7fa91c76fdf65aa14d43145bb] Module: 0 (keine bösartigen Elemente erkannt) Registrierungsschlüssel: 10 PUP.Optional.WProtectManager, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\WdsManPro, , [71e8aca7fa91c76fdf65aa14d43145bb], PUP.Optional.CrossRider, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{CC5890FF-5FAD-41D6-B00E-51E548CE027A}, , [abae4c07cfbc85b1f1e2970c54b0ff01], PUP.Optional.Trovi, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\LAYERS\SPVC32LDR, , [85d4b49fa0ebc96dc38e7e54ba4aa65a], PUP.Optional.WdsManPro, HKLM\SOFTWARE\WOW6432NODE\WdsManPro, , [d8813a198a013bfbc70cf9e629db1fe1], PUP.Optional.CrossRider, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{CC5890FF-5FAD-41D6-B00E-51E548CE027A}, , [5108e073b0db06303f94cad9828234cc], PUP.Optional.Coppingo, HKU\S-1-5-21-40867682-1087133493-2937002368-1001\SOFTWARE\coppingo, , [5306054ec9c258deaff7d3cc43c134cc], PUP.Optional.CrossRider, HKU\S-1-5-21-40867682-1087133493-2937002368-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{2C7B50AD-E2DA-4A70-A50D-2D8A180B815B}, , [8bce490a2764e6509b187f24d92ba759], PUP.Optional.CrossRider, HKU\S-1-5-21-40867682-1087133493-2937002368-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{939A7EE7-B473-40A5-93D2-924170844DC9}, , [4b0e5bf8533850e68d263e650ef608f8], PUP.Optional.CrossRider, HKU\S-1-5-21-40867682-1087133493-2937002368-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{9918CB0D-BAEA-4629-BDC4-7A7FF81D9F7E}, , [c099aba88efdf640575bf5aef2127f81], PUP.Optional.CrossRider, HKU\S-1-5-21-40867682-1087133493-2937002368-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{CC5890FF-5FAD-41D6-B00E-51E548CE027A}, , [b7a2aba83259db5b5859247fff050df3], Registrierungswerte: 12 PUP.Optional.CrossRider, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{cc5890ff-5fad-41d6-b00e-51e548ce027a}|AppName, Browsers App-bg.exe, , [abae4c07cfbc85b1f1e2970c54b0ff01] PUP.Optional.Trovi, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\chrome.exe|{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, 130509493757066287, , [72e743104d3e63d3e26ea52d669e7e82] PUP.Optional.Trovi, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\explorer.exe|{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, 130509493757066287, , [05547fd44e3d1125ee620fc3b84ce11f] PUP.Optional.Trovi, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\firefox.exe|{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, 130509493757066287, , [352499ba5338b6806fe1448ec34153ad] PUP.Optional.Trovi, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\iexplore.exe|{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, 130509493757066287, , [73e6ada67c0f96a0c18fb81abe46768a] PUP.Optional.Trovi, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\LAYERS\SPVC32Ldr|{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, 130509493757066287, , [85d4b49fa0ebc96dc38e7e54ba4aa65a] PUP.Optional.CrossRider, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{cc5890ff-5fad-41d6-b00e-51e548ce027a}|AppName, Browsers App-bg.exe, , [5108e073b0db06303f94cad9828234cc] PUP.Optional.ProtectWindowsManager, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\WdsManPro|ImagePath, C:\ProgramData\tWdsManProt\WdsManPro.exe -service, , [c792332008837bbb9368cf71649f51af] PUP.Optional.CrossRider, HKU\S-1-5-21-40867682-1087133493-2937002368-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{2c7b50ad-e2da-4a70-a50d-2d8a180b815b}|AppName, Browsers App-codedownloader.exe, , [8bce490a2764e6509b187f24d92ba759] PUP.Optional.CrossRider, HKU\S-1-5-21-40867682-1087133493-2937002368-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{939A7EE7-B473-40A5-93D2-924170844DC9}|AppName, ae1183ab-4660-4db2-80a9-d69f7830a324-2.exe-codedownloader.exe, , [4b0e5bf8533850e68d263e650ef608f8] PUP.Optional.CrossRider, HKU\S-1-5-21-40867682-1087133493-2937002368-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{9918CB0D-BAEA-4629-BDC4-7A7FF81D9F7E}|AppName, ae1183ab-4660-4db2-80a9-d69f7830a324-2.exe-buttonutil.exe, , [c099aba88efdf640575bf5aef2127f81] PUP.Optional.CrossRider, HKU\S-1-5-21-40867682-1087133493-2937002368-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{cc5890ff-5fad-41d6-b00e-51e548ce027a}|AppName, Browsers App-bg.exe, , [b7a2aba83259db5b5859247fff050df3] Registrierungsdaten: 0 (keine bösartigen Elemente erkannt) Ordner: 3 PUP.Optional.EnterDigital, C:\ProgramData\7bb6df21-8ca8-4eec-965d-8cd2261544c7, , [025775dedead1224e3ec28fb49ba1de3], PUP.Optional.ProtectWindowsManager, C:\ProgramData\tWdsManProt, , [332657fc1378d95d88ad44f9cf3404fc], PUP.Optional.ProtectWindowsManager, C:\ProgramData\tWdsManProt\update, , [332657fc1378d95d88ad44f9cf3404fc], Dateien: 8 PUP.Optional.WProtectManager, C:\ProgramData\tWdsManProt\WdsManPro.exe, , [71e8aca7fa91c76fdf65aa14d43145bb], Adware.Hijack.SFK, C:\Program Files (x86)\SFK\SFKEX.dll, , [3920a4af1a710e285f26825b758c14ec], Trojan.Downloader, C:\Program Files (x86)\SFK\SFKEX.exe, , [a8b167ece3a82c0aa7783c8ac73a3dc3], Trojan.Downloader, C:\Program Files (x86)\SFK\SFKEX64.dll, , [0a4f57fc3a51d264150c86404bb66c94], Trojan.Downloader, C:\Program Files (x86)\SFK\SFKEX64.exe, , [a0b98fc43b507abc040508be04fda759], PUP.Optional.InstallCore, C:\Users\XXXXX\Downloads\microsoft_excel(1).exe, , [3e1be271593245f11aed856727da41bf], PUP.Optional.InstallCore, C:\Users\XXXXX\Downloads\microsoft_excel.exe, , [d683dc77dab1a591030431bbd8297e82], PUP.Optional.ProtectWindowsManager, C:\ProgramData\tWdsManProt\updateconf, , [332657fc1378d95d88ad44f9cf3404fc], Physische Sektoren: 0 (keine bösartigen Elemente erkannt) (end) Geändert von NicerDicer (05.10.2015 um 20:45 Uhr) Grund: Malwarebytes Scan hinzufügen |
| Themen zu Windows 8 - 34 Funde mit Malwarebytes, u.a. SFKEX (Trojan.downloader) |
| .dll, adobe flash player, antivirus, avast, bonjour, ccsetup, computer, converter, defender, desktop, device driver, dnsapi.dll, explorer, firefox, flash player, homepage, iexplore.exe, mozilla, mp3, officejet, programme, prozesse, registry, security, software, system, usb, windows, winlogon.exe |
Baum-Darstellung