Trojaner-Board - a variant of Win32/Spy.Banker.YIL trojan mit ESET online scan endeckt

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - a variant of Win32/Spy.Banker.YIL trojan mit ESET online scan endeckt (https://www.trojaner-board.de/138850-a-variant-of-win32-spy-banker-yil-trojan-eset-online-scan-endeckt.html)

a variant of Win32/Spy.Banker.YIL trojan mit ESET online scan endeckt

Hi habe heute ESET scanner durchlaufen lassen!!
dabei hat er folgenden Eintrag Gefunden:
variant of Win32/Spy.Banker.YIL trojan

Wie Kann ich mein System am geschicktesten von dem Übel befreien ??

Code:

C:\Users\***\AppData\Roaming\5052\components\AcroFF0527.dll a variant of Win32/Spy.Banker.YIL trojan

Anhang 58298

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Zitat:

Zitat von schrauber (Beitrag 1119352)

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Hi,
danke für die schnelle Antwort :daumenhoc

First:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 27-07-2013

Ran by Sarah (administrator) on 27-07-2013 12:44:59

Running from C:\Users\Sarah\Downloads

Microsoft® Windows Vista™ Ultimate  Service Pack 1 (X86) OS Language: German Standard

Internet Explorer Version 7

Boot Mode: Normal
 

==================== Processes (Whitelisted) ===================
 

(ATI Technologies Inc.) C:\Windows\system32\Ati2evxx.exe

(Microsoft Corporation) C:\Windows\system32\SLsvc.exe

(ATI Technologies Inc.) C:\Windows\system32\Ati2evxx.exe

(Abbott Diabetes Care) C:\Program Files\Abbott Diabetes Care\FreeStyle Auto-Assist\adcmald.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe

(Nalpeiron Ltd.) C:\Windows\system32\nlssrv32.exe

(TeamViewer GmbH) C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe

(Sony Corporation) C:\Program Files\Sony\VAIO Event Service\VESMgr.exe

(Sony Corporation) C:\Program Files\Sony\VAIO Event Service\VESMgrSub.exe

(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMgr.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe

(Microsoft Corporation) C:\Windows\WindowsMobile\wmdSync.exe

(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe

() C:\Program Files\Abbott Diabetes Care\FreeStyle Auto-Assist\adclaunchd.exe

(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe

() C:\Program Files\VoIPdial\VoIPdial.exe

(Sony Corporation) C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe

(Google) C:\Program Files\Google\Drive\googledrivesync.exe

(Samsung) C:\Program Files\Samsung\Kies\Kies.exe

(Dropbox, Inc.) C:\Users\Sarah\AppData\Roaming\Dropbox\bin\Dropbox.exe

(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe

(Microsoft Corporation) C:\Windows\system32\wbem\unsecapp.exe

(Google) C:\Program Files\Google\Drive\googledrivesync.exe

(Sony Corporation) C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe

(Sony Corporation) C:\Program Files\Sony\VAIO Update\VUAgent.exe

(Microsoft Corporation) C:\Windows\System32\mobsync.exe

(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe

(Microsoft Corporation) C:\Windows\system32\conime.exe

(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\swriter.exe

(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.exe

(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.bin

(Microsoft Corporation) C:\Windows\System32\calc.exe

(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe

(Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe

(Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe

(Microsoft Corporation) C:\Windows\system32\FirewallControlPanel.exe

(ESET) C:\Program Files\ESET\ESET Online Scanner\OnlineScannerApp.exe

(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe

(Google) C:\Users\Sarah\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [avast] - C:\Program Files\AVAST Software\Avast\avastUI.exe [4858968 2013-05-09] (AVAST Software)

HKLM\...\Run: [Windows Mobile-based device management] - C:\Windows\WindowsMobile\wmdSync.exe [215552 2008-01-21] (Microsoft Corporation)

HKLM\...\Run: [KiesTrayAgent] - C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [310640 2013-03-28] (Samsung Electronics Co., Ltd.)

HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)

HKLM\...\Run: [FreeStyle AutoLaunch] - C:\Program Files\Abbott Diabetes Care\FreeStyle Auto-Assist\adclaunchd.exe [196960 2013-02-09] ()

HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)

HKLM\...\Runonce: [Malwarebytes Anti-Malware (cleanup)] - rundll32.exe "C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll",ProcessCleanupScript [x]

HKLM\...\Winlogon: [Userinit] c:\windows\system32\userinit.exe,userinit.exe,

Winlogon\Notify\!SASWinLogon: I:\System\Apps\7E5842E4-EF51-421A-8FB3-19F3ECB18E3C\Data\SASWINLO.DLL [X]

Winlogon\Notify\VESWinlogon: VESWinlogon.dll (Sony Corporation)

HKCU\...\Run: [VoIPdial] - C:\Program Files\VoIPdial\VoIPdial.exe [274039 2009-09-30] ()

HKCU\...\Run: [Facebook Update] - C:\Users\Sarah\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-07-12] (Facebook Inc.)

HKCU\...\Run: [GoogleDriveSync] - C:\Program Files\Google\Drive\googledrivesync.exe [19676256 2013-06-06] (Google)

HKCU\...\Run: [Google Update] - C:\Users\Sarah\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-02-22] (Google Inc.)

HKCU\...\Run: [KiesPreload] - C:\Program Files\Samsung\Kies\Kies.exe [1511792 2013-03-28] (Samsung)

HKCU\...\Run: [] - C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [1106288 2013-03-28] (Samsung)

HKCU\...\Run: [WMPNSCFG] - C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-21] (Microsoft Corporation)

MountPoints2: G - G:\LaunchU3.exe -a

MountPoints2: {1836f5ee-e5bf-11e0-94d8-001e3d3bc32e} - G:\LaunchU3.exe -a

MountPoints2: {7472dfd3-2f15-11e2-9f95-001e3d3bc32e} - G:\Windows\StartFreeStyle.exe

MountPoints2: {a48a3f4d-1205-11e2-b1fd-001e3d3bc32e} - RunClubSanDisk.exe

MountPoints2: {c2486bab-fca5-11e0-ad5c-001e3d3bc32e} - G:\LaunchU3.exe -a

HKU\Administrator\...\Run: [Sidebar] - C:\Program Files\Windows Sidebar\sidebar.exe [ 2008-01-21] (Microsoft Corporation)

HKU\Administrator\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2008-01-21] (Microsoft Corporation)

HKU\Default\...\Run: [Sidebar] - C:\Program Files\Windows Sidebar\Sidebar.exe [ 2008-01-21] (Microsoft Corporation)

HKU\Default\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2008-01-21] (Microsoft Corporation)

HKU\Default User\...\Run: [Sidebar] - C:\Program Files\Windows Sidebar\Sidebar.exe [ 2008-01-21] (Microsoft Corporation)

HKU\Default User\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2008-01-21] (Microsoft Corporation)

HKU\Sepp\...\Run: [Sidebar] - C:\Program Files\Windows Sidebar\sidebar.exe [ 2008-01-21] (Microsoft Corporation)

HKU\Sepp\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2008-01-21] (Microsoft Corporation)

HKU\Sepp\...\Run: [GoogleDriveSync] - C:\Program Files\Google\Drive\googledrivesync.exe [ 2013-06-06] (Google)

HKU\Sepp\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\system32\Macromed\Flash\FlashUtil32_11_7_700_224_Plugin.exe -update plugin [x]

Startup: C:\Users\Sarah\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Users\Sarah\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

Startup: C:\Users\Sarah\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk

ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()

Startup: C:\Users\Sepp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk

ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()

BootExecute: autocheck autochk /p \??\H:autocheck autochk * 
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

SearchScopes: HKLM - DefaultScope value is missing.

SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}

SearchScopes: HKCU - {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL = 

BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_07-windows-i586.cab

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

ShellExecuteHooks: SABShellExecuteHook Class - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} -  No File [ ]

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
 

FireFox:

========

FF ProfilePath: C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Path=Profiles\iy8dzkv7.Sebastian

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll ()

FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin: @google.com/npPicasa3,version=3.0.0 - C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)

FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Sarah\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)

FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin - C:\Users\Sarah\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)

FF Plugin HKCU: @talk.google.com/O1DPlugin - C:\Users\Sarah\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)

FF Plugin HKCU: @talk.google.com/O3DPlugin - C:\Users\Sarah\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()

FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Sarah\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Sarah\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Extension: Default - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF HKLM\...\Firefox\Extensions: [{184AA5E6-741D-464a-820E-94B3ABC2F3B4}] C:\Users\Sarah\AppData\Roaming\5064

FF Extension: Java String Helper - C:\Users\Sarah\AppData\Roaming\5064

FF HKLM\...\Firefox\Extensions: [wrc@avast.com] C:\Program Files\AVAST Software\Avast\WebRep\FF

FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF

FF HKCU\...\Firefox\Extensions: [{184AA5E6-741D-464a-820E-94B3ABC2F3B4}] C:\Users\Sarah\AppData\Roaming\5064

FF Extension: Java String Helper - C:\Users\Sarah\AppData\Roaming\5064
 

Chrome: 

=======

CHR HomePage: hxxp://www.google.com
 

========================== Services (Whitelisted) =================
 

R2 adcmald; C:\Program Files\Abbott Diabetes Care\FreeStyle Auto-Assist\adcmald.exe [535896 2013-02-09] (Abbott Diabetes Care)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-05-09] (AVAST Software)

S4 SBSDWSCService; C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)

R3 VUAgent; C:\Program Files\Sony\VAIO Update\VUAgent.exe [1013808 2013-03-26] (Sony Corporation)

S2 AntiVirSchedulerService; "C:\Program Files\Avira\AntiVir Desktop\sched.exe" [x]

S2 AntiVirService; "C:\Program Files\Avira\AntiVir Desktop\avguard.exe" [x]

S3 rpcapd; "%ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini" [x]
 

==================== Drivers (Whitelisted) ====================
 

R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [29816 2013-05-09] (AVAST Software)

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [66336 2013-05-09] (AVAST Software)

R1 aswRdr; C:\Windows\System32\Drivers\aswRdr.sys [49760 2013-05-09] (AVAST Software)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [49376 2013-05-09] ()

R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [770344 2013-06-28] (AVAST Software)

R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [369584 2013-06-28] (AVAST Software)

R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [56080 2013-05-09] (AVAST Software)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [175176 2013-06-28] ()

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [66616 2011-08-06] (Avira GmbH)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [138192 2011-08-06] (Avira GmbH)

S3 bdacap; C:\Windows\System32\drivers\bdacap.sys [217728 2006-02-14] (Genesys Logic, Inc.)

S3 cpudrv; C:\Program Files\SystemRequirementsLab\cpudrv.sys [11336 2011-06-02] ()

S3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2010-06-14] ()

S3 GLHIDKBFILTER; C:\Windows\System32\DRIVERS\GLKbFilter.sys [11264 2006-01-06] (Genesys Logic)

R3 MBAMSwissArmy; C:\Windows\system32\drivers\mbamswissarmy.sys [40776 2013-07-27] (Malwarebytes Corporation)

R2 NPF; C:\Windows\System32\drivers\npf.sys [36600 2013-03-01] (Riverbed Technology, Inc.)

S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [15576 2013-01-11] ()

S3 pwdspio; C:\Windows\system32\pwdspio.sys [10200 2013-01-11] ()

R3 R5U870FLx86; C:\Windows\System32\Drivers\R5U870FLx86.sys [73472 2008-01-30] (Ricoh)

R3 R5U870FUx86; C:\Windows\System32\Drivers\R5U870FUx86.sys [43904 2008-01-30] (Ricoh)

R1 StarOpen; C:\Windows\System32\Drivers\StarOpen.sys [5632 2006-07-24] ()

S3 tap0901; C:\Windows\System32\DRIVERS\tap0901.sys [26624 2011-12-15] (The OpenVPN Project)

R3 ti21sony; C:\Windows\System32\drivers\ti21sony.sys [818688 2007-11-16] (Texas Instruments)

S3 UIUSys; C:\Windows\System32\DRIVERS\UIUSYS.SYS [6909 2008-01-30] (Conexant Systems, Inc)

U0 wpif; C:\Windows\System32\drivers\jxlyr.sys [54016 2013-07-27] ()

S3 IpInIp; system32\DRIVERS\ipinip.sys [x]

S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]

S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]

S1 SASDIFSV; \??\I:\System\Apps\7E5842E4-EF51-421A-8FB3-19F3ECB18E3C\Data\SASDIFSV.SYS [x]

S1 SASKUTIL; \??\I:\System\Apps\7E5842E4-EF51-421A-8FB3-19F3ECB18E3C\Data\SASKUTIL.SYS [x]

S3 USBAAPL; System32\Drivers\usbaapl.sys [x]

S3 WinRing0_1_2_0; \??\C:\Program Files\BatteryCare\WinRing0.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-07-27 12:44 - 2013-07-27 12:44 - 01220544 _____ (Farbar) C:\Users\Sarah\Downloads\FRST.exe

2013-07-27 12:44 - 2013-07-27 12:44 - 00000000 ____D C:\FRST

2013-07-27 12:33 - 2013-07-27 12:33 - 00054016 _____ C:\Windows\system32\Drivers\jxlyr.sys

2013-07-27 12:12 - 2013-07-27 12:14 - 00040776 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamswissarmy.sys

2013-07-27 10:41 - 2013-07-27 10:41 - 00000000 ____D C:\Program Files\ESET

2013-07-27 10:40 - 2013-07-27 10:40 - 02347384 _____ (ESET) C:\Users\Sarah\Downloads\esetsmartinstaller_enu.exe

2013-07-25 12:50 - 2013-07-25 12:50 - 00074445 _____ C:\Users\Sarah\Downloads\nummernkreise_flexiblenummernautomatik3.zip

2013-07-25 11:39 - 2013-07-25 11:39 - 00001868 _____ C:\Users\Sarah\Downloads\sg_backup_2013-07-25-1139.spg

2013-07-25 11:39 - 2013-07-25 11:39 - 00001868 _____ C:\Users\Sarah\Downloads\FirstBackup.spg

2013-07-25 11:36 - 2013-07-25 11:36 - 00659456 _____ (Speed Guide Inc.) C:\Users\Sarah\Downloads\TCP308Optimizer.exe

2013-07-24 19:21 - 2013-07-24 19:21 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\Wireshark

2013-07-24 19:20 - 2013-07-24 20:02 - 02775040 _____ C:\Users\Sarah\session.sqlite

2013-07-24 19:19 - 2013-07-24 19:19 - 00000000 ____D C:\Program Files\Wireshark

2013-07-24 19:17 - 2013-07-24 19:18 - 22238848 _____ (Wireshark development team) C:\Users\Sarah\Downloads\Wireshark-win32-1.10.0.exe

2013-07-24 19:15 - 2013-07-24 19:16 - 37099197 _____ C:\Users\Sarah\Downloads\CookieCadger-1.06.jar

2013-07-23 17:28 - 2013-07-23 17:29 - 37099197 _____ C:\Users\Sarah\Desktop\CookieCadger-1.06.jar

2013-07-23 17:18 - 2013-07-23 17:18 - 00678144 _____ C:\Users\Sarah\Downloads\FaceNiff-2.4.apk

2013-07-23 17:02 - 2013-07-23 17:03 - 00000000 ____D C:\Program Files\Safari

2013-07-23 17:00 - 2013-07-23 17:00 - 00000000 ____D C:\Program Files\Apple Software Update

2013-07-23 16:58 - 2013-07-23 16:58 - 38494576 _____ (Apple Inc.) C:\Users\Sarah\Downloads\SafariSetup-5.1.7.exe

2013-07-23 16:45 - 2013-07-23 16:45 - 00000000 ____D C:\Program Files\WinPcap

2013-07-23 16:44 - 2013-07-23 16:44 - 00915128 _____ (Riverbed Technology, Inc.) C:\Users\Sarah\Downloads\WinPcap_4_1_3.exe

2013-07-23 15:45 - 2013-07-23 15:50 - 00000077 _____ C:\wepkeys.txt

2013-07-23 15:44 - 2013-07-23 15:44 - 00000000 ____D C:\Aircrack

2013-07-23 15:40 - 2013-07-23 15:41 - 08287320 _____ C:\Users\Sarah\Downloads\aircrack-ng-1.2-beta1-win.zip

2013-07-23 14:59 - 2013-07-23 14:59 - 00000000 ____D C:\Users\Sarah\Documents\EasyBox Key Decrypter Logfile

2013-07-23 14:57 - 2013-07-23 14:57 - 00001106 _____ C:\Users\Sarah\Desktop\EasyBox Key Decrypter.lnk

2013-07-23 14:57 - 2013-07-23 14:57 - 00000000 ____D C:\Program Files\EasyBox Key Decrypter

2013-07-23 14:56 - 2013-07-23 14:56 - 01797880 _____ C:\Users\Sarah\Downloads\EasyBox_Key_Decrypter_v1.4_Setup.exe

2013-07-23 13:24 - 2013-07-23 13:24 - 00028833 _____ C:\Users\Sarah\Downloads\formular_aktuelle_modue.zip

2013-07-23 12:36 - 2013-07-23 12:37 - 77021736 _____ C:\Users\Sarah\Downloads\Cro_Sunny.zip

2013-07-19 18:35 - 2013-07-19 18:35 - 00630802 _____ C:\Users\Sarah\Downloads\Wave_Backgrounds_with_Grass_Elements.zip

2013-07-19 17:45 - 2013-07-19 17:45 - 00719586 _____ C:\Users\Sarah\Downloads\Stunning_Retro_Backgrounds.zip

2013-07-19 17:02 - 2013-07-19 17:02 - 01385419 _____ C:\Users\Sarah\Downloads\FreeVectorFlowerBackground.zip

2013-07-19 16:08 - 2013-07-19 16:08 - 01053864 _____ C:\Users\Sarah\Downloads\FloralDesignHeaders2-by-gfxcool.zip

2013-07-19 15:42 - 2013-07-19 15:42 - 04943043 _____ C:\Users\Sarah\Downloads\free_vector_fancy_headers.zip

2013-07-19 15:31 - 2013-07-19 15:31 - 00080868 _____ C:\Users\Sarah\Downloads\Newsletter_Main_Feature.zip

2013-07-19 13:19 - 2013-07-19 13:20 - 29584723 _____ C:\Users\Sarah\Downloads\sendblaster2.0.138.zip

2013-07-17 13:26 - 2013-07-17 13:27 - 00000000 ____D C:\Users\Sarah\www.apowersoft.com

2013-07-13 13:30 - 2013-07-13 13:30 - 00303308 _____ C:\Users\Sarah\Downloads\De Bauer.mp4

2013-07-13 13:04 - 2013-07-13 13:04 - 00446040 _____ C:\Users\Sarah\Downloads\JW.Player.v6.1.2972.Pro.incl.Keygen.FLASH.NULL-DGT.zip

2013-07-13 13:00 - 2013-07-13 13:00 - 00507325 _____ C:\Users\Sarah\Downloads\mediaplayer.zip

2013-07-13 11:40 - 2013-07-26 17:48 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\Skype

2013-07-13 11:39 - 2013-07-13 11:52 - 00002379 _____ C:\Users\Public\Desktop\Skype.lnk

2013-07-13 11:39 - 2013-07-13 11:40 - 00000000 ____D C:\ProgramData\Skype

2013-07-13 11:39 - 2013-07-13 11:39 - 00000000 ___RD C:\Program Files\Skype

2013-07-13 11:39 - 2013-07-13 11:39 - 00000000 ____D C:\Program Files\Common Files\Skype

2013-07-13 11:37 - 2013-07-13 11:37 - 01492584 _____ (Skype Technologies S.A.) C:\Users\Sarah\Downloads\SkypeSetup.exe

2013-07-12 19:46 - 2013-07-12 19:46 - 00969301 _____ C:\Users\Sarah\Downloads\wptouch.1.9.7.zip

2013-07-12 19:39 - 2013-07-12 19:39 - 00861291 _____ C:\Users\Sarah\Downloads\nextgen-gallery.zip

2013-07-12 19:36 - 2013-07-12 19:37 - 03786542 _____ C:\Users\Sarah\Downloads\jw-player-plugin-for-wordpress.2.1.1.zip

2013-07-12 19:35 - 2013-07-12 19:35 - 00521811 _____ C:\Users\Sarah\Downloads\contact-form-plugin.3.47.zip

2013-07-12 19:31 - 2013-07-12 19:31 - 00219355 _____ C:\Users\Sarah\Downloads\antispam-bee.zip

2013-07-12 18:33 - 2013-07-12 18:34 - 04815135 _____ (FileZilla Project) C:\Users\Sarah\Downloads\FileZilla_3.7.1_win32-setup.exe

2013-07-12 18:30 - 2013-07-12 19:14 - 04353459 _____ C:\Users\Sarah\Downloads\wordpress-3.5.2-de_DE.zip

2013-07-12 12:42 - 2013-07-12 12:42 - 00060912 _____ C:\Users\Sepp\AppData\Local\GDIPFONTCACHEV1.DAT

2013-07-12 12:30 - 2013-07-12 12:30 - 01940642 _____ C:\Users\Sepp\Downloads\vorlagen3de_opendoc.zip

2013-07-12 12:30 - 2013-07-12 12:30 - 00000000 ____D C:\Users\Sepp\AppData\Roaming\WinRAR

2013-07-12 12:25 - 2013-07-12 12:21 - 00000543 _____ C:\Users\Sepp\Documents\indexfile.txt

2013-07-12 12:02 - 2013-07-12 12:26 - 00000000 ___SD C:\Users\Sepp\Google Drive

2013-07-12 12:02 - 2013-07-12 12:02 - 00001547 _____ C:\Users\Sepp\Desktop\Google Drive.lnk

2013-07-12 11:42 - 2013-07-12 11:42 - 00000000 ____D C:\Users\Sepp\AppData\Roaming\OpenOffice.org

2013-07-09 16:00 - 2013-07-09 16:00 - 00179832 _____ C:\Users\Sarah\Desktop\Passwörter.txt

2013-07-09 15:51 - 2013-07-09 15:51 - 00024345 _____ C:\Users\Sarah\Desktop\password-export-2013-07-09.csv

2013-07-09 15:49 - 2013-07-09 15:49 - 00041249 _____ C:\Users\Sarah\Desktop\password-export-2013-07-09.xml

2013-07-04 08:41 - 2013-07-04 08:41 - 05706781 _____ C:\Users\Sarah\Desktop\Rising Sun - Epic Orchestra Film Instrumental Music.mp4

2013-07-02 13:16 - 2013-07-02 13:16 - 00698764 _____ C:\Users\Sarah\Downloads\Uhr.exe

2013-07-01 22:21 - 2013-07-01 22:16 - 07126244 _____ C:\Users\Sarah\Desktop\tobi-song-movie.wmv

2013-07-01 21:10 - 2013-07-13 12:18 - 00000955 _____ C:\Users\Public\Desktop\TeamViewer 8.lnk

2013-06-30 14:20 - 2013-06-30 14:20 - 00000000 ____D C:\Users\Sepp\AppData\Local\Macromedia

2013-06-30 14:11 - 2013-06-30 14:19 - 00000000 ____D C:\Users\Sepp\AppData\Roaming\Mozilla

2013-06-30 14:11 - 2013-06-30 14:11 - 00000000 ____D C:\Users\Sepp\AppData\Local\Mozilla

2013-06-28 11:32 - 2013-06-28 11:32 - 00000468 _____ C:\Users\Sarah\Desktop\hunday mobile.txt

2013-06-28 10:22 - 2013-06-28 10:22 - 00000175 _____ C:\Windows\system32\Drivers\aswVmm.sys.sum

2013-06-27 09:52 - 2013-06-28 10:22 - 00000175 _____ C:\Windows\system32\Drivers\aswSP.sys.sum

2013-06-27 09:52 - 2013-06-28 10:22 - 00000175 _____ C:\Windows\system32\Drivers\aswSnx.sys.sum
 

==================== One Month Modified Files and Folders =======
 

2013-07-27 12:44 - 2013-07-27 12:44 - 01220544 _____ (Farbar) C:\Users\Sarah\Downloads\FRST.exe

2013-07-27 12:44 - 2013-07-27 12:44 - 00000000 ____D C:\FRST

2013-07-27 12:33 - 2013-07-27 12:33 - 00054016 _____ C:\Windows\system32\Drivers\jxlyr.sys

2013-07-27 12:33 - 2012-04-02 16:31 - 00000000 ____D C:\Windows\pss

2013-07-27 12:32 - 2013-02-22 16:11 - 00001120 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2257783777-1101859096-687163147-1000UA.job

2013-07-27 12:32 - 2013-02-06 10:32 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-07-27 12:32 - 2011-10-19 15:22 - 00001138 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2257783777-1101859096-687163147-1000UA.job

2013-07-27 12:32 - 2011-10-19 15:22 - 00001116 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2257783777-1101859096-687163147-1000Core.job

2013-07-27 12:18 - 2006-11-02 14:46 - 00003760 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

2013-07-27 12:18 - 2006-11-02 14:46 - 00003760 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

2013-07-27 12:14 - 2013-07-27 12:12 - 00040776 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamswissarmy.sys

2013-07-27 11:59 - 2012-03-30 14:21 - 00001096 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-07-27 11:59 - 2012-03-30 14:21 - 00001092 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-07-27 11:32 - 2013-02-22 16:11 - 00001068 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2257783777-1101859096-687163147-1000Core.job

2013-07-27 11:30 - 2012-07-14 11:42 - 00000000 ___SD C:\Users\Sarah\Google Drive

2013-07-27 11:10 - 2011-08-05 20:14 - 00000418 ____H C:\Windows\Tasks\User_Feed_Synchronization-{A9097228-7BF7-4646-B1F5-D5A7D9C4D20A}.job

2013-07-27 10:41 - 2013-07-27 10:41 - 00000000 ____D C:\Program Files\ESET

2013-07-27 10:40 - 2013-07-27 10:40 - 02347384 _____ (ESET) C:\Users\Sarah\Downloads\esetsmartinstaller_enu.exe

2013-07-26 20:27 - 2006-11-02 14:35 - 00000000 ____D C:\Windows\system32\FxsTmp

2013-07-26 17:48 - 2013-07-13 11:40 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\Skype

2013-07-25 23:01 - 2013-03-09 12:33 - 00476012 _____ C:\Windows\WindowsUpdate.log

2013-07-25 22:55 - 2013-04-22 22:16 - 00000000 ___RD C:\Users\Sarah\Dropbox

2013-07-25 22:55 - 2013-04-22 22:11 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\Dropbox

2013-07-25 22:32 - 2006-11-02 15:00 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-07-25 16:03 - 2011-08-05 12:41 - 00059904 _____ C:\Users\Sarah\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2013-07-25 15:44 - 2013-04-20 14:27 - 00001892 _____ C:\Users\Public\Desktop\Adobe Reader X.lnk

2013-07-25 15:43 - 2011-08-08 11:01 - 00000000 ____D C:\ProgramData\Adobe

2013-07-25 15:36 - 2011-08-08 11:09 - 00000000 ____D C:\Users\Sarah\AppData\Local\Adobe

2013-07-25 12:50 - 2013-07-25 12:50 - 00074445 _____ C:\Users\Sarah\Downloads\nummernkreise_flexiblenummernautomatik3.zip

2013-07-25 12:09 - 2011-08-05 12:50 - 00001660 _____ C:\Windows\bthservsdp.dat

2013-07-25 12:09 - 2006-11-02 15:00 - 00032626 _____ C:\Windows\Tasks\SCHEDLGU.TXT

2013-07-25 11:42 - 2012-10-10 20:14 - 00000000 ____D C:\Program Files\Microsoft Silverlight

2013-07-25 11:39 - 2013-07-25 11:39 - 00001868 _____ C:\Users\Sarah\Downloads\sg_backup_2013-07-25-1139.spg

2013-07-25 11:39 - 2013-07-25 11:39 - 00001868 _____ C:\Users\Sarah\Downloads\FirstBackup.spg

2013-07-25 11:36 - 2013-07-25 11:36 - 00659456 _____ (Speed Guide Inc.) C:\Users\Sarah\Downloads\TCP308Optimizer.exe

2013-07-24 20:02 - 2013-07-24 19:20 - 02775040 _____ C:\Users\Sarah\session.sqlite

2013-07-24 20:02 - 2011-08-05 12:35 - 00000000 ____D C:\Users\Sarah

2013-07-24 19:21 - 2013-07-24 19:21 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\Wireshark

2013-07-24 19:19 - 2013-07-24 19:19 - 00000000 ____D C:\Program Files\Wireshark

2013-07-24 19:18 - 2013-07-24 19:17 - 22238848 _____ (Wireshark development team) C:\Users\Sarah\Downloads\Wireshark-win32-1.10.0.exe

2013-07-24 19:16 - 2013-07-24 19:15 - 37099197 _____ C:\Users\Sarah\Downloads\CookieCadger-1.06.jar

2013-07-23 17:29 - 2013-07-23 17:28 - 37099197 _____ C:\Users\Sarah\Desktop\CookieCadger-1.06.jar

2013-07-23 17:18 - 2013-07-23 17:18 - 00678144 _____ C:\Users\Sarah\Downloads\FaceNiff-2.4.apk

2013-07-23 17:03 - 2013-07-23 17:02 - 00000000 ____D C:\Program Files\Safari

2013-07-23 17:03 - 2011-12-03 15:15 - 00000000 ____D C:\Users\Sarah\AppData\Local\Apple Computer

2013-07-23 17:03 - 2011-11-22 17:43 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\Apple Computer

2013-07-23 17:02 - 2012-03-09 21:06 - 00000000 ____D C:\ProgramData\Apple Computer

2013-07-23 17:00 - 2013-07-23 17:00 - 00000000 ____D C:\Program Files\Apple Software Update

2013-07-23 17:00 - 2011-11-10 12:44 - 00000000 ____D C:\ProgramData\Apple

2013-07-23 16:58 - 2013-07-23 16:58 - 38494576 _____ (Apple Inc.) C:\Users\Sarah\Downloads\SafariSetup-5.1.7.exe

2013-07-23 16:45 - 2013-07-23 16:45 - 00000000 ____D C:\Program Files\WinPcap

2013-07-23 16:44 - 2013-07-23 16:44 - 00915128 _____ (Riverbed Technology, Inc.) C:\Users\Sarah\Downloads\WinPcap_4_1_3.exe

2013-07-23 15:50 - 2013-07-23 15:45 - 00000077 _____ C:\wepkeys.txt

2013-07-23 15:44 - 2013-07-23 15:44 - 00000000 ____D C:\Aircrack

2013-07-23 15:41 - 2013-07-23 15:40 - 08287320 _____ C:\Users\Sarah\Downloads\aircrack-ng-1.2-beta1-win.zip

2013-07-23 14:59 - 2013-07-23 14:59 - 00000000 ____D C:\Users\Sarah\Documents\EasyBox Key Decrypter Logfile

2013-07-23 14:57 - 2013-07-23 14:57 - 00001106 _____ C:\Users\Sarah\Desktop\EasyBox Key Decrypter.lnk

2013-07-23 14:57 - 2013-07-23 14:57 - 00000000 ____D C:\Program Files\EasyBox Key Decrypter

2013-07-23 14:56 - 2013-07-23 14:56 - 01797880 _____ C:\Users\Sarah\Downloads\EasyBox_Key_Decrypter_v1.4_Setup.exe

2013-07-23 13:24 - 2013-07-23 13:24 - 00028833 _____ C:\Users\Sarah\Downloads\formular_aktuelle_modue.zip

2013-07-23 12:37 - 2013-07-23 12:36 - 77021736 _____ C:\Users\Sarah\Downloads\Cro_Sunny.zip

2013-07-19 19:10 - 2012-01-20 14:01 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\FileZilla

2013-07-19 18:35 - 2013-07-19 18:35 - 00630802 _____ C:\Users\Sarah\Downloads\Wave_Backgrounds_with_Grass_Elements.zip

2013-07-19 17:45 - 2013-07-19 17:45 - 00719586 _____ C:\Users\Sarah\Downloads\Stunning_Retro_Backgrounds.zip

2013-07-19 17:02 - 2013-07-19 17:02 - 01385419 _____ C:\Users\Sarah\Downloads\FreeVectorFlowerBackground.zip

2013-07-19 16:08 - 2013-07-19 16:08 - 01053864 _____ C:\Users\Sarah\Downloads\FloralDesignHeaders2-by-gfxcool.zip

2013-07-19 15:42 - 2013-07-19 15:42 - 04943043 _____ C:\Users\Sarah\Downloads\free_vector_fancy_headers.zip

2013-07-19 15:31 - 2013-07-19 15:31 - 00080868 _____ C:\Users\Sarah\Downloads\Newsletter_Main_Feature.zip

2013-07-19 13:20 - 2013-07-19 13:19 - 29584723 _____ C:\Users\Sarah\Downloads\sendblaster2.0.138.zip

2013-07-17 13:27 - 2013-07-17 13:26 - 00000000 ____D C:\Users\Sarah\www.apowersoft.com

2013-07-17 13:26 - 2012-04-06 19:06 - 00000000 ____D C:\Program Files\JDownloader

2013-07-15 22:43 - 2012-01-20 14:00 - 00000000 ____D C:\Program Files\FileZilla FTP Client

2013-07-14 11:52 - 2012-04-20 15:46 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe

2013-07-14 11:52 - 2011-08-05 15:20 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl

2013-07-13 13:30 - 2013-07-13 13:30 - 00303308 _____ C:\Users\Sarah\Downloads\De Bauer.mp4

2013-07-13 13:04 - 2013-07-13 13:04 - 00446040 _____ C:\Users\Sarah\Downloads\JW.Player.v6.1.2972.Pro.incl.Keygen.FLASH.NULL-DGT.zip

2013-07-13 13:00 - 2013-07-13 13:00 - 00507325 _____ C:\Users\Sarah\Downloads\mediaplayer.zip

2013-07-13 12:18 - 2013-07-01 21:10 - 00000955 _____ C:\Users\Public\Desktop\TeamViewer 8.lnk

2013-07-13 11:52 - 2013-07-13 11:39 - 00002379 _____ C:\Users\Public\Desktop\Skype.lnk

2013-07-13 11:40 - 2013-07-13 11:39 - 00000000 ____D C:\ProgramData\Skype

2013-07-13 11:39 - 2013-07-13 11:39 - 00000000 ___RD C:\Program Files\Skype

2013-07-13 11:39 - 2013-07-13 11:39 - 00000000 ____D C:\Program Files\Common Files\Skype

2013-07-13 11:37 - 2013-07-13 11:37 - 01492584 _____ (Skype Technologies S.A.) C:\Users\Sarah\Downloads\SkypeSetup.exe

2013-07-13 11:31 - 2006-11-02 14:46 - 03626288 _____ C:\Windows\system32\FNTCACHE.DAT

2013-07-13 11:28 - 2013-05-19 21:15 - 00000000 ____D C:\Program Files\Mozilla Firefox

2013-07-13 11:28 - 2013-05-18 10:26 - 00003428 _____ C:\Windows\PFRO.log

2013-07-13 11:28 - 2012-05-03 16:56 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service

2013-07-12 19:46 - 2013-07-12 19:46 - 00969301 _____ C:\Users\Sarah\Downloads\wptouch.1.9.7.zip

2013-07-12 19:39 - 2013-07-12 19:39 - 00861291 _____ C:\Users\Sarah\Downloads\nextgen-gallery.zip

2013-07-12 19:37 - 2013-07-12 19:36 - 03786542 _____ C:\Users\Sarah\Downloads\jw-player-plugin-for-wordpress.2.1.1.zip

2013-07-12 19:35 - 2013-07-12 19:35 - 00521811 _____ C:\Users\Sarah\Downloads\contact-form-plugin.3.47.zip

2013-07-12 19:31 - 2013-07-12 19:31 - 00219355 _____ C:\Users\Sarah\Downloads\antispam-bee.zip

2013-07-12 19:14 - 2013-07-12 18:30 - 04353459 _____ C:\Users\Sarah\Downloads\wordpress-3.5.2-de_DE.zip

2013-07-12 18:42 - 2013-02-07 11:36 - 00000000 ____D C:\Users\Sarah\Documents\Blockbackup

2013-07-12 18:34 - 2013-07-12 18:33 - 04815135 _____ (FileZilla Project) C:\Users\Sarah\Downloads\FileZilla_3.7.1_win32-setup.exe

2013-07-12 12:42 - 2013-07-12 12:42 - 00060912 _____ C:\Users\Sepp\AppData\Local\GDIPFONTCACHEV1.DAT

2013-07-12 12:30 - 2013-07-12 12:30 - 01940642 _____ C:\Users\Sepp\Downloads\vorlagen3de_opendoc.zip

2013-07-12 12:30 - 2013-07-12 12:30 - 00000000 ____D C:\Users\Sepp\AppData\Roaming\WinRAR

2013-07-12 12:26 - 2013-07-12 12:02 - 00000000 ___SD C:\Users\Sepp\Google Drive

2013-07-12 12:21 - 2013-07-12 12:25 - 00000543 _____ C:\Users\Sepp\Documents\indexfile.txt

2013-07-12 12:02 - 2013-07-12 12:02 - 00001547 _____ C:\Users\Sepp\Desktop\Google Drive.lnk

2013-07-12 12:02 - 2013-05-17 18:03 - 00000000 ____D C:\Users\Sepp

2013-07-12 11:42 - 2013-07-12 11:42 - 00000000 ____D C:\Users\Sepp\AppData\Roaming\OpenOffice.org

2013-07-11 17:26 - 2011-08-05 12:56 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\Mozilla

2013-07-09 16:00 - 2013-07-09 16:00 - 00179832 _____ C:\Users\Sarah\Desktop\Passwörter.txt

2013-07-09 15:51 - 2013-07-09 15:51 - 00024345 _____ C:\Users\Sarah\Desktop\password-export-2013-07-09.csv

2013-07-09 15:49 - 2013-07-09 15:49 - 00041249 _____ C:\Users\Sarah\Desktop\password-export-2013-07-09.xml

2013-07-08 15:15 - 2012-04-03 18:24 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\TeamViewer

2013-07-04 14:40 - 2011-08-05 12:36 - 00060912 _____ C:\Users\Sarah\AppData\Local\GDIPFONTCACHEV1.DAT

2013-07-04 08:41 - 2013-07-04 08:41 - 05706781 _____ C:\Users\Sarah\Desktop\Rising Sun - Epic Orchestra Film Instrumental Music.mp4

2013-07-04 08:33 - 2011-08-05 12:35 - 00000680 _____ C:\Users\Sarah\AppData\Local\d3d9caps.dat

2013-07-02 13:16 - 2013-07-02 13:16 - 00698764 _____ C:\Users\Sarah\Downloads\Uhr.exe

2013-07-01 22:16 - 2013-07-01 22:21 - 07126244 _____ C:\Users\Sarah\Desktop\tobi-song-movie.wmv

2013-07-01 21:10 - 2012-04-24 09:50 - 00000000 ____D C:\Program Files\TeamViewer

2013-06-30 14:20 - 2013-06-30 14:20 - 00000000 ____D C:\Users\Sepp\AppData\Local\Macromedia

2013-06-30 14:19 - 2013-06-30 14:11 - 00000000 ____D C:\Users\Sepp\AppData\Roaming\Mozilla

2013-06-30 14:11 - 2013-06-30 14:11 - 00000000 ____D C:\Users\Sepp\AppData\Local\Mozilla

2013-06-28 11:32 - 2013-06-28 11:32 - 00000468 _____ C:\Users\Sarah\Desktop\hunday mobile.txt

2013-06-28 10:22 - 2013-06-28 10:22 - 00000175 _____ C:\Windows\system32\Drivers\aswVmm.sys.sum

2013-06-28 10:22 - 2013-06-27 09:52 - 00000175 _____ C:\Windows\system32\Drivers\aswSP.sys.sum

2013-06-28 10:22 - 2013-06-27 09:52 - 00000175 _____ C:\Windows\system32\Drivers\aswSnx.sys.sum

2013-06-28 10:22 - 2013-03-21 11:42 - 00175176 _____ C:\Windows\system32\Drivers\aswVmm.sys

2013-06-28 10:22 - 2012-01-02 14:26 - 00770344 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys

2013-06-28 10:22 - 2012-01-02 14:26 - 00369584 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
 

==================== Bamital & volsnap Check =================
 

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-07-27 10:56
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Addition:

Code:

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 27-07-2013

Ran by Sarah at 2013-07-27 12:46:03

Running from C:\Users\Sarah\Downloads

Boot Mode: Normal

==========================================================
 
 

==================== Installed Programs =======================
 

Adobe AIR (Version: 3.7.0.2090)

Adobe Flash Player 11 ActiveX (Version: 11.8.800.94)

Adobe Flash Player 11 Plugin (Version: 11.8.800.94)

Adobe Reader X (10.1.7) - Deutsch (Version: 10.1.7)

Apple Software Update (Version: 2.1.3.127)

avast! Free Antivirus (Version: 8.0.1489.0)

CCleaner (Version: 4.01)

Dropbox (HKCU Version: 2.0.22)

EasyBox Key Decrypter (Version: 1.4)

ESET Online Scanner v3

FileZilla Client 3.7.1 (Version: 3.7.1)

FOTOParadies (Version: 3.5.0.3)

Google Drive (Version: 1.10.4769.632)

Google Talk Plugin (Version: 4.2.1.14031)

Google Update Helper (Version: 1.3.21.153)

Java 7 Update 25 (Version: 7.0.250)

Java Auto Updater

Malwarebytes Anti-Malware Version 1.75.0.1300 (Version: 1.75.0.1300)

Microsoft Silverlight (Version: 5.1.20513.0)

Mozilla Firefox 22.0 (x86 de) (Version: 22.0)

Mozilla Maintenance Service (Version: 22.0)

Safari (Version: 5.34.57.2)

Skype™ 6.6 (Version: 6.6.106)

TeamViewer 8 (Version: 8.0.19617)

VAIO Update (Version: 6.2.1.03260)

WinPcap 4.1.3 (Version: 4.1.0.2980)

Wireshark 1.10.0 (32-bit) (Version: 1.10.0)

 
 

==================== Restore Points  =========================
 

17-07-2013 09:29:03 Geplanter Prüfpunkt

19-07-2013 17:45:21 Geplanter Prüfpunkt

21-07-2013 09:50:35 Geplanter Prüfpunkt

21-07-2013 22:00:04 Geplanter Prüfpunkt

22-07-2013 22:00:03 Geplanter Prüfpunkt

23-07-2013 15:00:35 Installed Safari

24-07-2013 19:47:37 Windows Update

25-07-2013 16:27:49 Geplanter Prüfpunkt

26-07-2013 22:00:05 Geplanter Prüfpunkt
 

==================== Hosts content: ==========================
 

2006-11-02 12:23 - 2012-04-18 21:53 - 00438758 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1       localhost

127.0.0.1        www.007guard.com

127.0.0.1        007guard.com

127.0.0.1        008i.com

127.0.0.1        www.008k.com

127.0.0.1        008k.com

127.0.0.1        www.00hq.com

127.0.0.1        00hq.com

127.0.0.1        010402.com

127.0.0.1        www.032439.com

127.0.0.1        032439.com

127.0.0.1        www.0scan.com

127.0.0.1        0scan.com

127.0.0.1        1000gratisproben.com

127.0.0.1        www.1000gratisproben.com

127.0.0.1        1001namen.com

127.0.0.1        www.1001namen.com

127.0.0.1        100888290cs.com

127.0.0.1        www.100888290cs.com

127.0.0.1        www.100sexlinks.com

127.0.0.1        100sexlinks.com

127.0.0.1        10sek.com

127.0.0.1        www.10sek.com

127.0.0.1        www.1-2005-search.com

127.0.0.1        1-2005-search.com

127.0.0.1        123fporn.info

127.0.0.1        www.123fporn.info

127.0.0.1        123haustiereundmehr.com

127.0.0.1        www.123haustiereundmehr.com
 

There are 1000 more lines.
 
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {00272DB7-FCA0-4E94-8A30-6338DDED2971} - System32\Tasks\Microsoft\Windows\Defrag\ManualDefrag => C:\Windows\system32\defrag.exe [2008-01-21] (Microsoft Corp.)

Task: {075F7B0C-8858-426A-81EA-5161F4D13E82} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages

Task: {154E98C1-C983-454D-BE7C-5FC880595600} - System32\Tasks\Sony Corporation\VAIO Update\VAIO Update => C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe [2013-03-26] (Sony Corporation)

Task: {18D486E1-F3D2-4F43-8F58-C05D739BEA65} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2257783777-1101859096-687163147-1000Core => C:\Users\Sarah\AppData\Local\Google\Update\GoogleUpdate.exe [2013-02-22] (Google Inc.)

Task: {255B5E03-25D0-4EEF-9991-E179DDA28A94} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2013-05-09] (AVAST Software)

Task: {2EF1A2C3-210D-4AFD-BEB7-E51E7FD69C0C} - System32\Tasks\Microsoft\Windows\MobilePC\TMM

Task: {3A950610-5351-4CF3-89BD-526A7E64AA8B} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-21] ()

Task: {3C6DAF9D-24D6-4482-B7AE-753359DBB0B9} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2257783777-1101859096-687163147-1000UA => C:\Users\Sarah\AppData\Local\Google\Update\GoogleUpdate.exe [2013-02-22] (Google Inc.)

Task: {3ED41489-88D0-49CD-80B4-158FD317F193} - System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\OptinNotification => C:\Windows\System32\wsqmcons.exe [2008-01-21] (Microsoft Corporation)

Task: {44712EC5-B1EA-4281-A25E-FEA4E5C73C6E} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2257783777-1101859096-687163147-1000Core => C:\Users\Sarah\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-12] (Facebook Inc.)

Task: {58FC740B-0751-4F3B-A7B4-DF75B7D2D4DF} - System32\Tasks\SONY\WSSU\WSSU => C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe [2007-06-15] (Sony Corporation)

Task: {5A6D9831-D95C-4713-B4E9-F03D1644498F} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-21] (Microsoft Corporation)

Task: {6EECDFF2-88F8-46BA-AB01-401FF7BD3940} - System32\Tasks\Sony Corporation\VAIO Update\VAIO Update Self Repair => C:\Program Files\Sony\VAIO Update\VUSR.exe [2013-03-26] (Sony Corporation)

Task: {73243767-E976-4E3D-AA02-7B55243D2603} - System32\Tasks\BrowserProtect => C:\Windows\system32\sc.exe [2006-11-02] (Microsoft Corporation)

Task: {7D32B7AF-7F5C-4F29-A7EB-21B15D345113} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-04-23] (Piriform Ltd)

Task: {81A01513-DD65-4B04-9EB2-4EEED91CA405} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2008-01-21] (Microsoft Corporation)

Task: {9A36A669-7D50-4BEE-B948-7B00E58116CC} - System32\Tasks\User_Feed_Synchronization-{A9097228-7BF7-4646-B1F5-D5A7D9C4D20A} => C:\Windows\system32\msfeedssync.exe [2008-01-21] (Microsoft Corporation)

Task: {B25D4244-6254-4542-9A54-D5A933EC915A} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI

Task: {BE8B5C1B-6716-4696-AD54-FD0942651A60} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-03-30] (Google Inc.)

Task: {BECFC2AB-F871-4B5F-9513-CD1273AEFD10} - System32\Tasks\Auslogics\Disk Defrag\Sheduled Defragmentation => C:\Program Files\Auslogics\Auslogics Disk Defrag\DiskDefrag.exe [2012-03-29] (Auslogics)

Task: {D3E97CFD-3982-4476-8100-C5DE0993FC4B} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-03-30] (Google Inc.)

Task: {D7159F95-121B-4CE4-AB4E-7D3C1A2F4FC3} - System32\Tasks\Microsoft\Windows\PLA\System\ConvertLogEntries => C:\Windows\system32\rundll32.exe [2006-11-02] (Microsoft Corporation)

Task: {DB75D7C8-1519-40F1-9724-97DCFC4D39EE} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-07-14] (Adobe Systems Incorporated)

Task: {FA2ED70C-D6F9-4766-8953-E74EDCF94495} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2257783777-1101859096-687163147-1000UA => C:\Users\Sarah\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-12] (Facebook Inc.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2257783777-1101859096-687163147-1000Core.job => C:\Users\Sarah\AppData\Local\Facebook\Update\FacebookUpdate.exe

Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2257783777-1101859096-687163147-1000UA.job => C:\Users\Sarah\AppData\Local\Facebook\Update\FacebookUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2257783777-1101859096-687163147-1000Core.job => C:\Users\Sarah\AppData\Local\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2257783777-1101859096-687163147-1000UA.job => C:\Users\Sarah\AppData\Local\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\User_Feed_Synchronization-{A9097228-7BF7-4646-B1F5-D5A7D9C4D20A}.job => C:\Windows\system32\msfeedssync.exe
 

==================== Faulty Device Manager Devices =============
 

Name: 

Description: 

Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}

Manufacturer: 

Service: 

Problem: : This device is disabled. (Code 22)

Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (07/25/2013 10:33:57 PM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (07/25/2013 05:58:22 PM) (Source: Application Error) (User: )

Description: Fehlerhafte Anwendung Explorer.EXE, Version 6.0.6001.18164, Zeitstempel 0x4907e242, fehlerhaftes Modul contextmenu32.dll, Version 1.0.0.1, Zeitstempel 0x5139308e, Ausnahmecode 0xc0000005, Fehleroffset 0x0000572b,

Prozess-ID 0x8bc, Anwendungsstartzeit Explorer.EXE0.
 

Error: (07/25/2013 05:22:44 PM) (Source: Windows Search Service) (User: )

Description: Eintrag <C:\CONFIG.MSI\BC92C0.RBS> in der Hash-Zuordnung kann nicht aktualisiert werden.
 

Kontext:  Anwendung, SystemIndex Katalog
 
 

Details:

        Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)
 

Error: (07/25/2013 05:21:09 PM) (Source: Microsoft Fax) (User: )

Description: Fehler beim Senden des Faxes. Der Anschluss ist besetzt. Dieses Fax wird nicht gesendet, da die maximale Anzahl der Wiederholungsversuche erreicht wurde. Absender: Sebastian Fritz. Rechnungscode: . Firma des Absenders: . Abteilung des Absenders: . Gerätename: HDAUDIO SoftV92 Data Fax Modem with SmartCP. Auftrags-ID: 0x0201ce8949cba2b8. Benutzername: Sarah-PC\Sarah.

 Weitere Informationen erhalten Sie im Aktivitätsprotokoll.
 

Error: (07/25/2013 04:48:48 PM) (Source: Application Error) (User: )

Description: Fehlerhafte Anwendung WFS.exe, Version 6.0.6001.18000, Zeitstempel 0x47919551, fehlerhaftes Modul WFS.exe, Version 6.0.6001.18000, Zeitstempel 0x47919551, Ausnahmecode 0xc0000094, Fehleroffset 0x00052998,

Prozess-ID 0x684, Anwendungsstartzeit WFS.exe0.
 

Error: (07/25/2013 04:46:37 PM) (Source: Microsoft Fax) (User: )

Description: Die Datei mit der Erweiterung ".jpg" kann nicht per Fax gesendet werden, da die Datei dafür als TIF-Datei gerendert werden muss. Diese Datei kann nicht gerendert werden, weil die zugehörige Anwendung auf diesem Computer nicht vorhanden ist.
 

Error: (07/25/2013 04:46:29 PM) (Source: Microsoft Fax) (User: )

Description: Die Datei mit der Erweiterung ".jpg" kann nicht per Fax gesendet werden, da die Datei dafür als TIF-Datei gerendert werden muss. Diese Datei kann nicht gerendert werden, weil die zugehörige Anwendung auf diesem Computer nicht vorhanden ist.
 

Error: (07/25/2013 04:40:38 PM) (Source: Microsoft Fax) (User: )

Description: Die Datei mit der Erweiterung ".jpg" kann nicht per Fax gesendet werden, da die Datei dafür als TIF-Datei gerendert werden muss. Diese Datei kann nicht gerendert werden, weil die zugehörige Anwendung auf diesem Computer nicht vorhanden ist.
 

Error: (07/25/2013 04:40:38 PM) (Source: Microsoft Fax) (User: )

Description: Die Datei mit der Erweiterung ".jpg" kann nicht per Fax gesendet werden, da die Datei dafür als TIF-Datei gerendert werden muss. Diese Datei kann nicht gerendert werden, weil die zugehörige Anwendung auf diesem Computer nicht vorhanden ist.
 

Error: (07/25/2013 04:40:37 PM) (Source: Microsoft Fax) (User: )

Description: Die Datei mit der Erweiterung ".jpg" kann nicht per Fax gesendet werden, da die Datei dafür als TIF-Datei gerendert werden muss. Diese Datei kann nicht gerendert werden, weil die zugehörige Anwendung auf diesem Computer nicht vorhanden ist.
 
 

System errors:

=============
 

Microsoft Office Sessions:

=========================

Error: (07/25/2013 10:33:57 PM) (Source: WinMgmt)(User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (07/25/2013 05:58:22 PM) (Source: Application Error)(User: )

Description: Explorer.EXE6.0.6001.181644907e242contextmenu32.dll1.0.0.15139308ec00000050000572b8bc01ce891fa8161aa6
 

Error: (07/25/2013 05:22:44 PM) (Source: Windows Search Service)(User: )

Description: Kontext:  Anwendung, SystemIndex Katalog
 
 

Details:

        Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

C:\CONFIG.MSI\BC92C0.RBS
 

Error: (07/25/2013 05:21:09 PM) (Source: Microsoft Fax)(User: )

Description: Sebastian FritzHDAUDIO SoftV92 Data Fax Modem with SmartCP0x0201ce8949cba2b8Sarah-PC\Sarah
 

Error: (07/25/2013 04:48:48 PM) (Source: Application Error)(User: )

Description: WFS.exe6.0.6001.1800047919551WFS.exe6.0.6001.1800047919551c00000940005299868401ce8945b5dad000
 

Error: (07/25/2013 04:46:37 PM) (Source: Microsoft Fax)(User: )

Description: .jpg
 

Error: (07/25/2013 04:46:29 PM) (Source: Microsoft Fax)(User: )

Description: .jpg
 

Error: (07/25/2013 04:40:38 PM) (Source: Microsoft Fax)(User: )

Description: .jpg
 

Error: (07/25/2013 04:40:38 PM) (Source: Microsoft Fax)(User: )

Description: .jpg
 

Error: (07/25/2013 04:40:37 PM) (Source: Microsoft Fax)(User: )

Description: .jpg
 
 

CodeIntegrity Errors:

===================================

  Date: 2013-07-27 12:45:17.656

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2013-07-27 12:45:17.563

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2013-07-27 12:45:17.469

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2013-07-27 12:45:17.377

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2013-07-27 12:45:17.272

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2013-07-27 12:45:17.180

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2013-07-27 12:45:17.083

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2013-07-27 12:45:16.989

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2013-07-27 12:26:49.082

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2013-07-27 12:26:49.034

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 68%

Total physical RAM: 2045.69 MB

Available physical RAM: 635.38 MB

Total Pagefile: 4330.38 MB

Available Pagefile: 2343.45 MB

Total Virtual: 2047.88 MB

Available Virtual: 1905.36 MB
 

==================== Drives ================================
 

Drive c: () (Fixed) (Total:149.04 GB) (Free:60.33 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 149 GB) (Disk ID: 2A817B72)

Partition 1: (Active) - (Size=149 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Ok habe ich gemacht hier sind die log´s:

Code:

# AdwCleaner v2.306 - Datei am 27/07/2013 um 13:45:47 erstellt

# Aktualisiert am 19/07/2013 von Xplode

# Betriebssystem : Windows Vista (TM) Ultimate Service Pack 1 (32 bits)

# Benutzer : Sarah - SARAH-PC

# Bootmodus : Normal

# Ausgeführt unter : C:\Users\Sarah\Desktop\Trojaner hilfe\adwcleaner.exe

# Option [Löschen]
 
 

**** [Dienste] ****
 
 

***** [Dateien / Ordner] *****
 

Datei Gelöscht : C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\iy8dzkv7.Sebastian\foxydeal.sqlite

Datei Gelöscht : C:\Users\Sepp\AppData\Roaming\Mozilla\Firefox\Profiles\f8r0muvv.default\foxydeal.sqlite

Ordner Gelöscht : C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\iy8dzkv7.Sebastian\jetpack
 

***** [Registrierungsdatenbank] *****
 

Schlüssel Gelöscht : HKCU\Software\BabSolution
 

***** [Internet Browser] *****
 

-\\ Internet Explorer v7.0.6001.18000
 

[OK] Die Registrierungsdatenbank ist sauber.
 

-\\ Mozilla Firefox v22.0 (de)
 

Datei : C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\iy8dzkv7.Sebastian\prefs.js
 

Gelöscht : user_pref("extensions.ffxtlbr@delta.com.install-event-fired", true);
 

Datei : C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\wjv2k0u7.default\prefs.js
 

[OK] Die Datei ist sauber.
 

Datei : C:\Users\Sepp\AppData\Roaming\Mozilla\Firefox\Profiles\f8r0muvv.default\prefs.js
 

[OK] Die Datei ist sauber.
 

Datei : C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\wjrh6fgf.default\prefs.js
 

[OK] Die Datei ist sauber.
 

-\\ Google Chrome v [Version kann nicht ermittelt werden]
 

Datei : C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default\Preferences
 

[OK] Die Datei ist sauber.
 

*************************
 

AdwCleaner[S2].txt - [1714 octets] - [27/07/2013 13:45:47]
 

########## EOF - C:\AdwCleaner[S2].txt - [1774 octets] ##########

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 5.2.5 (07.26.2013:2)

OS: Windows Vista (TM) Ultimate x86

Ran by Sarah on 27.07.2013 at 13:55:38,51

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 

~~~ Services
 
 
 

~~~ Registry Values
 

Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs

Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\DisplayName

Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\URL
 
 
 

~~~ Registry Keys
 

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\interface\{6f43fa77-c18f-4d0c-9c7e-958876fe2061}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\interface\{df948646-8bf4-450e-a059-cf8a4e0fe2be}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\interface\{e96b49b0-e11f-48fc-984a-eec29a4f57e1}

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\anchorfree
 
 
 

~~~ Files
 

Successfully deleted: [File] C:\eula.1049.txt

Successfully deleted: [File] C:\install.res.1049.dll
 
 
 

~~~ Folders
 
 
 

~~~ FireFox
 

Successfully deleted: [File] C:\Users\Sarah\AppData\Roaming\mozilla\firefox\profiles\wjv2k0u7.default\invalidprefs.js

Successfully deleted: [Registry Value] HKEY_CURRENT_USER\Software\Mozilla\Firefox\Extensions\\{184aa5e6-741d-464a-820e-94b3abc2f3b4}

Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions\\{184aa5e6-741d-464a-820e-94b3abc2f3b4}

Successfully deleted the following from C:\Users\Sarah\AppData\Roaming\mozilla\firefox\profiles\wjv2k0u7.default\prefs.js
 

user_pref("browser.search.searchEnginesURL", "hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=. ");

user_pref("extensions.facetweak.addit.remoteInstallItems", "{ \"software\": {\"78\": {\"id\": \"78\",\"title\": \"Ciuvo\",\"type\": \"XPI\",\"url\": \"hxxps://addons.mozilla.o

user_pref("extensions.jid1-QpHD8URtZWJC2A@jetpack.status_cproxy", false);

user_pref("extensions.webbooster@iminent.com.install-event-fired", true);

user_pref("id_imbooster4web_v6.bubble_src", "hxxp%3A//toolbar.iminent.com/SocialNetworking/%3FvToolbar%3DIminent");

user_pref("iminent.webbooster.scripts.minibar.registerToolbarEvent109", "1313234032849");

user_pref("iminent.webbooster.scripts.minibar.registerToolbarEvent111", "1313234032834");

user_pref("iminent.webbooster.scripts.minibar.registerToolbarEvent112", "1313234032943");

Emptied folder: C:\Users\Sarah\AppData\Roaming\mozilla\firefox\profiles\wjv2k0u7.default\minidumps [44 files]

Emptied folder: C:\Users\Sarah\AppData\Roaming\mozilla\firefox\profiles\iy8dzkv7.Sebastian\minidumps [120 files]
 
 
 

~~~ Event Viewer Logs were cleared
 
 
 
 
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 27.07.2013 at 13:58:36,22

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 27-07-2013

Ran by Sarah (administrator) on 27-07-2013 14:00:43

Running from C:\Users\Sarah\Desktop\Trojaner hilfe

Microsoft® Windows Vista™ Ultimate  Service Pack 1 (X86) OS Language: German Standard

Internet Explorer Version 7

Boot Mode: Normal
 

==================== Processes (Whitelisted) ===================
 

(ATI Technologies Inc.) C:\Windows\system32\Ati2evxx.exe

(Microsoft Corporation) C:\Windows\system32\SLsvc.exe

(ATI Technologies Inc.) C:\Windows\system32\Ati2evxx.exe

(Abbott Diabetes Care) C:\Program Files\Abbott Diabetes Care\FreeStyle Auto-Assist\adcmald.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe

(Nalpeiron Ltd.) C:\Windows\system32\nlssrv32.exe

(TeamViewer GmbH) C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe

(Sony Corporation) C:\Program Files\Sony\VAIO Event Service\VESMgr.exe

(Sony Corporation) C:\Program Files\Sony\VAIO Event Service\VESMgrSub.exe

(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMgr.exe

(Sony Corporation) C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe

(Microsoft Corporation) C:\Windows\WindowsMobile\wmdSync.exe

(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe

() C:\Program Files\Abbott Diabetes Care\FreeStyle Auto-Assist\adclaunchd.exe

(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe

() C:\Program Files\VoIPdial\VoIPdial.exe

(Google) C:\Program Files\Google\Drive\googledrivesync.exe

(Samsung) C:\Program Files\Samsung\Kies\Kies.exe

(Samsung) C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe

(Dropbox, Inc.) C:\Users\Sarah\AppData\Roaming\Dropbox\bin\Dropbox.exe

(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe

(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.exe

(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.bin

(Microsoft Corporation) C:\Windows\system32\wbem\unsecapp.exe

(Google) C:\Program Files\Google\Drive\googledrivesync.exe

(Sony Corporation) C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe

(Sony Corporation) C:\Program Files\Sony\VAIO Update\VUAgent.exe

(Microsoft Corporation) C:\Windows\system32\prevhost.exe

(Microsoft Corporation) C:\Windows\system32\conime.exe

(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [avast] - C:\Program Files\AVAST Software\Avast\avastUI.exe [4858968 2013-05-09] (AVAST Software)

HKLM\...\Run: [Windows Mobile-based device management] - C:\Windows\WindowsMobile\wmdSync.exe [215552 2008-01-21] (Microsoft Corporation)

HKLM\...\Run: [KiesTrayAgent] - C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [310640 2013-03-28] (Samsung Electronics Co., Ltd.)

HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)

HKLM\...\Run: [FreeStyle AutoLaunch] - C:\Program Files\Abbott Diabetes Care\FreeStyle Auto-Assist\adclaunchd.exe [196960 2013-02-09] ()

HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)

HKLM\...\Winlogon: [Userinit] c:\windows\system32\userinit.exe,userinit.exe,

Winlogon\Notify\!SASWinLogon: I:\System\Apps\7E5842E4-EF51-421A-8FB3-19F3ECB18E3C\Data\SASWINLO.DLL [X]

Winlogon\Notify\VESWinlogon: VESWinlogon.dll (Sony Corporation)

HKCU\...\Run: [VoIPdial] - C:\Program Files\VoIPdial\VoIPdial.exe [274039 2009-09-30] ()

HKCU\...\Run: [Facebook Update] - C:\Users\Sarah\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-07-12] (Facebook Inc.)

HKCU\...\Run: [GoogleDriveSync] - C:\Program Files\Google\Drive\googledrivesync.exe [19676256 2013-06-06] (Google)

HKCU\...\Run: [Google Update] - C:\Users\Sarah\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-02-22] (Google Inc.)

HKCU\...\Run: [KiesPreload] - C:\Program Files\Samsung\Kies\Kies.exe [1511792 2013-03-28] (Samsung)

HKCU\...\Run: [] - C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [1106288 2013-03-28] (Samsung)

HKCU\...\Run: [WMPNSCFG] - C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-21] (Microsoft Corporation)

MountPoints2: G - G:\LaunchU3.exe -a

MountPoints2: {1836f5ee-e5bf-11e0-94d8-001e3d3bc32e} - G:\LaunchU3.exe -a

MountPoints2: {7472dfd3-2f15-11e2-9f95-001e3d3bc32e} - G:\Windows\StartFreeStyle.exe

MountPoints2: {a48a3f4d-1205-11e2-b1fd-001e3d3bc32e} - RunClubSanDisk.exe

MountPoints2: {c2486bab-fca5-11e0-ad5c-001e3d3bc32e} - G:\LaunchU3.exe -a

HKU\Administrator\...\Run: [Sidebar] - C:\Program Files\Windows Sidebar\sidebar.exe [ 2008-01-21] (Microsoft Corporation)

HKU\Administrator\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2008-01-21] (Microsoft Corporation)

HKU\Default\...\Run: [Sidebar] - C:\Program Files\Windows Sidebar\Sidebar.exe [ 2008-01-21] (Microsoft Corporation)

HKU\Default\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2008-01-21] (Microsoft Corporation)

HKU\Default User\...\Run: [Sidebar] - C:\Program Files\Windows Sidebar\Sidebar.exe [ 2008-01-21] (Microsoft Corporation)

HKU\Default User\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2008-01-21] (Microsoft Corporation)

HKU\Sepp\...\Run: [Sidebar] - C:\Program Files\Windows Sidebar\sidebar.exe [ 2008-01-21] (Microsoft Corporation)

HKU\Sepp\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2008-01-21] (Microsoft Corporation)

HKU\Sepp\...\Run: [GoogleDriveSync] - C:\Program Files\Google\Drive\googledrivesync.exe [ 2013-06-06] (Google)

HKU\Sepp\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\system32\Macromed\Flash\FlashUtil32_11_7_700_224_Plugin.exe -update plugin [x]

Startup: C:\Users\Sarah\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Users\Sarah\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

Startup: C:\Users\Sarah\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk

ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()

Startup: C:\Users\Sepp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk

ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()

BootExecute: autocheck autochk /p \??\H:autocheck autochk * 
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

SearchScopes: HKLM - DefaultScope value is missing.

SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search

SearchScopes: HKCU - {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL = 

BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_07-windows-i586.cab

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

ShellExecuteHooks: SABShellExecuteHook Class - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} -  No File [ ]

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
 

FireFox:

========

FF ProfilePath: C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Path=Profiles\iy8dzkv7.Sebastian

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll ()

FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin: @google.com/npPicasa3,version=3.0.0 - C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)

FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Sarah\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)

FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin - C:\Users\Sarah\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)

FF Plugin HKCU: @talk.google.com/O1DPlugin - C:\Users\Sarah\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)

FF Plugin HKCU: @talk.google.com/O3DPlugin - C:\Users\Sarah\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()

FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Sarah\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Sarah\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Extension: Default - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF HKLM\...\Firefox\Extensions: [wrc@avast.com] C:\Program Files\AVAST Software\Avast\WebRep\FF

FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF
 

Chrome: 

=======

CHR HomePage: hxxp://www.google.com
 

========================== Services (Whitelisted) =================
 

R2 adcmald; C:\Program Files\Abbott Diabetes Care\FreeStyle Auto-Assist\adcmald.exe [535896 2013-02-09] (Abbott Diabetes Care)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-05-09] (AVAST Software)

S4 SBSDWSCService; C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)

R3 VUAgent; C:\Program Files\Sony\VAIO Update\VUAgent.exe [1013808 2013-03-26] (Sony Corporation)

S2 AntiVirSchedulerService; "C:\Program Files\Avira\AntiVir Desktop\sched.exe" [x]

S2 AntiVirService; "C:\Program Files\Avira\AntiVir Desktop\avguard.exe" [x]

S3 rpcapd; "%ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini" [x]
 

==================== Drivers (Whitelisted) ====================
 

R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [29816 2013-05-09] (AVAST Software)

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [66336 2013-05-09] (AVAST Software)

R1 aswRdr; C:\Windows\System32\Drivers\aswRdr.sys [49760 2013-05-09] (AVAST Software)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [49376 2013-05-09] ()

R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [770344 2013-06-28] (AVAST Software)

R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [369584 2013-06-28] (AVAST Software)

R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [56080 2013-05-09] (AVAST Software)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [175176 2013-06-28] ()

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [66616 2011-08-06] (Avira GmbH)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [138192 2011-08-06] (Avira GmbH)

S3 bdacap; C:\Windows\System32\drivers\bdacap.sys [217728 2006-02-14] (Genesys Logic, Inc.)

S3 cpudrv; C:\Program Files\SystemRequirementsLab\cpudrv.sys [11336 2011-06-02] ()

S3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2010-06-14] ()

S3 GLHIDKBFILTER; C:\Windows\System32\DRIVERS\GLKbFilter.sys [11264 2006-01-06] (Genesys Logic)

R2 NPF; C:\Windows\System32\drivers\npf.sys [36600 2013-03-01] (Riverbed Technology, Inc.)

S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [15576 2013-01-11] ()

S3 pwdspio; C:\Windows\system32\pwdspio.sys [10200 2013-01-11] ()

R3 R5U870FLx86; C:\Windows\System32\Drivers\R5U870FLx86.sys [73472 2008-01-30] (Ricoh)

R3 R5U870FUx86; C:\Windows\System32\Drivers\R5U870FUx86.sys [43904 2008-01-30] (Ricoh)

R1 StarOpen; C:\Windows\System32\Drivers\StarOpen.sys [5632 2006-07-24] ()

S3 tap0901; C:\Windows\System32\DRIVERS\tap0901.sys [26624 2011-12-15] (The OpenVPN Project)

R3 ti21sony; C:\Windows\System32\drivers\ti21sony.sys [818688 2007-11-16] (Texas Instruments)

S3 UIUSys; C:\Windows\System32\DRIVERS\UIUSYS.SYS [6909 2008-01-30] (Conexant Systems, Inc)

S3 IpInIp; system32\DRIVERS\ipinip.sys [x]

S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]

S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]

S1 SASDIFSV; \??\I:\System\Apps\7E5842E4-EF51-421A-8FB3-19F3ECB18E3C\Data\SASDIFSV.SYS [x]

S1 SASKUTIL; \??\I:\System\Apps\7E5842E4-EF51-421A-8FB3-19F3ECB18E3C\Data\SASKUTIL.SYS [x]

S3 USBAAPL; System32\Drivers\usbaapl.sys [x]

S3 WinRing0_1_2_0; \??\C:\Program Files\BatteryCare\WinRing0.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-07-27 13:55 - 2013-07-27 13:55 - 00000000 ____D C:\Windows\ERUNT

2013-07-27 13:43 - 2013-07-27 14:00 - 00000000 ____D C:\Users\Sarah\Desktop\Trojaner hilfe

2013-07-27 12:46 - 2013-07-27 12:46 - 00036679 _____ C:\Users\Sarah\Downloads\FRST.txt

2013-07-27 12:46 - 2013-07-27 12:46 - 00017049 _____ C:\Users\Sarah\Downloads\Addition.txt

2013-07-27 12:44 - 2013-07-27 12:44 - 00000000 ____D C:\FRST

2013-07-27 10:41 - 2013-07-27 10:41 - 00000000 ____D C:\Program Files\ESET

2013-07-27 10:40 - 2013-07-27 10:40 - 02347384 _____ (ESET) C:\Users\Sarah\Downloads\esetsmartinstaller_enu.exe

2013-07-25 12:50 - 2013-07-25 12:50 - 00074445 _____ C:\Users\Sarah\Downloads\nummernkreise_flexiblenummernautomatik3.zip

2013-07-25 11:39 - 2013-07-25 11:39 - 00001868 _____ C:\Users\Sarah\Downloads\sg_backup_2013-07-25-1139.spg

2013-07-25 11:39 - 2013-07-25 11:39 - 00001868 _____ C:\Users\Sarah\Downloads\FirstBackup.spg

2013-07-25 11:36 - 2013-07-25 11:36 - 00659456 _____ (Speed Guide Inc.) C:\Users\Sarah\Downloads\TCP308Optimizer.exe

2013-07-24 19:21 - 2013-07-24 19:21 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\Wireshark

2013-07-24 19:20 - 2013-07-24 20:02 - 02775040 _____ C:\Users\Sarah\session.sqlite

2013-07-24 19:19 - 2013-07-24 19:19 - 00000000 ____D C:\Program Files\Wireshark

2013-07-24 19:17 - 2013-07-24 19:18 - 22238848 _____ (Wireshark development team) C:\Users\Sarah\Downloads\Wireshark-win32-1.10.0.exe

2013-07-24 19:15 - 2013-07-24 19:16 - 37099197 _____ C:\Users\Sarah\Downloads\CookieCadger-1.06.jar

2013-07-23 17:28 - 2013-07-23 17:29 - 37099197 _____ C:\Users\Sarah\Desktop\CookieCadger-1.06.jar

2013-07-23 17:18 - 2013-07-23 17:18 - 00678144 _____ C:\Users\Sarah\Downloads\FaceNiff-2.4.apk

2013-07-23 17:02 - 2013-07-23 17:03 - 00000000 ____D C:\Program Files\Safari

2013-07-23 17:00 - 2013-07-23 17:00 - 00000000 ____D C:\Program Files\Apple Software Update

2013-07-23 16:58 - 2013-07-23 16:58 - 38494576 _____ (Apple Inc.) C:\Users\Sarah\Downloads\SafariSetup-5.1.7.exe

2013-07-23 16:45 - 2013-07-23 16:45 - 00000000 ____D C:\Program Files\WinPcap

2013-07-23 16:44 - 2013-07-23 16:44 - 00915128 _____ (Riverbed Technology, Inc.) C:\Users\Sarah\Downloads\WinPcap_4_1_3.exe

2013-07-23 15:45 - 2013-07-23 15:50 - 00000077 _____ C:\wepkeys.txt

2013-07-23 15:44 - 2013-07-23 15:44 - 00000000 ____D C:\Aircrack

2013-07-23 15:40 - 2013-07-23 15:41 - 08287320 _____ C:\Users\Sarah\Downloads\aircrack-ng-1.2-beta1-win.zip

2013-07-23 14:59 - 2013-07-23 14:59 - 00000000 ____D C:\Users\Sarah\Documents\EasyBox Key Decrypter Logfile

2013-07-23 14:57 - 2013-07-23 14:57 - 00001106 _____ C:\Users\Sarah\Desktop\EasyBox Key Decrypter.lnk

2013-07-23 14:57 - 2013-07-23 14:57 - 00000000 ____D C:\Program Files\EasyBox Key Decrypter

2013-07-23 14:56 - 2013-07-23 14:56 - 01797880 _____ C:\Users\Sarah\Downloads\EasyBox_Key_Decrypter_v1.4_Setup.exe

2013-07-23 13:24 - 2013-07-23 13:24 - 00028833 _____ C:\Users\Sarah\Downloads\formular_aktuelle_modue.zip

2013-07-23 12:36 - 2013-07-23 12:37 - 77021736 _____ C:\Users\Sarah\Downloads\Cro_Sunny.zip

2013-07-19 18:35 - 2013-07-19 18:35 - 00630802 _____ C:\Users\Sarah\Downloads\Wave_Backgrounds_with_Grass_Elements.zip

2013-07-19 17:45 - 2013-07-19 17:45 - 00719586 _____ C:\Users\Sarah\Downloads\Stunning_Retro_Backgrounds.zip

2013-07-19 17:02 - 2013-07-19 17:02 - 01385419 _____ C:\Users\Sarah\Downloads\FreeVectorFlowerBackground.zip

2013-07-19 16:08 - 2013-07-19 16:08 - 01053864 _____ C:\Users\Sarah\Downloads\FloralDesignHeaders2-by-gfxcool.zip

2013-07-19 15:42 - 2013-07-19 15:42 - 04943043 _____ C:\Users\Sarah\Downloads\free_vector_fancy_headers.zip

2013-07-19 15:31 - 2013-07-19 15:31 - 00080868 _____ C:\Users\Sarah\Downloads\Newsletter_Main_Feature.zip

2013-07-19 13:19 - 2013-07-19 13:20 - 29584723 _____ C:\Users\Sarah\Downloads\sendblaster2.0.138.zip

2013-07-17 13:26 - 2013-07-17 13:27 - 00000000 ____D C:\Users\Sarah\www.apowersoft.com

2013-07-13 13:30 - 2013-07-13 13:30 - 00303308 _____ C:\Users\Sarah\Downloads\De Bauer.mp4

2013-07-13 13:04 - 2013-07-13 13:04 - 00446040 _____ C:\Users\Sarah\Downloads\JW.Player.v6.1.2972.Pro.incl.Keygen.FLASH.NULL-DGT.zip

2013-07-13 13:00 - 2013-07-13 13:00 - 00507325 _____ C:\Users\Sarah\Downloads\mediaplayer.zip

2013-07-13 11:40 - 2013-07-26 17:48 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\Skype

2013-07-13 11:39 - 2013-07-13 11:52 - 00002379 _____ C:\Users\Public\Desktop\Skype.lnk

2013-07-13 11:39 - 2013-07-13 11:40 - 00000000 ____D C:\ProgramData\Skype

2013-07-13 11:39 - 2013-07-13 11:39 - 00000000 ___RD C:\Program Files\Skype

2013-07-13 11:39 - 2013-07-13 11:39 - 00000000 ____D C:\Program Files\Common Files\Skype

2013-07-13 11:37 - 2013-07-13 11:37 - 01492584 _____ (Skype Technologies S.A.) C:\Users\Sarah\Downloads\SkypeSetup.exe

2013-07-12 19:46 - 2013-07-12 19:46 - 00969301 _____ C:\Users\Sarah\Downloads\wptouch.1.9.7.zip

2013-07-12 19:39 - 2013-07-12 19:39 - 00861291 _____ C:\Users\Sarah\Downloads\nextgen-gallery.zip

2013-07-12 19:36 - 2013-07-12 19:37 - 03786542 _____ C:\Users\Sarah\Downloads\jw-player-plugin-for-wordpress.2.1.1.zip

2013-07-12 19:35 - 2013-07-12 19:35 - 00521811 _____ C:\Users\Sarah\Downloads\contact-form-plugin.3.47.zip

2013-07-12 19:31 - 2013-07-12 19:31 - 00219355 _____ C:\Users\Sarah\Downloads\antispam-bee.zip

2013-07-12 18:33 - 2013-07-12 18:34 - 04815135 _____ (FileZilla Project) C:\Users\Sarah\Downloads\FileZilla_3.7.1_win32-setup.exe

2013-07-12 18:30 - 2013-07-12 19:14 - 04353459 _____ C:\Users\Sarah\Downloads\wordpress-3.5.2-de_DE.zip

2013-07-12 12:42 - 2013-07-12 12:42 - 00060912 _____ C:\Users\Sepp\AppData\Local\GDIPFONTCACHEV1.DAT

2013-07-12 12:30 - 2013-07-12 12:30 - 01940642 _____ C:\Users\Sepp\Downloads\vorlagen3de_opendoc.zip

2013-07-12 12:30 - 2013-07-12 12:30 - 00000000 ____D C:\Users\Sepp\AppData\Roaming\WinRAR

2013-07-12 12:25 - 2013-07-12 12:21 - 00000543 _____ C:\Users\Sepp\Documents\indexfile.txt

2013-07-12 12:02 - 2013-07-12 12:26 - 00000000 ___SD C:\Users\Sepp\Google Drive

2013-07-12 12:02 - 2013-07-12 12:02 - 00001547 _____ C:\Users\Sepp\Desktop\Google Drive.lnk

2013-07-12 11:42 - 2013-07-12 11:42 - 00000000 ____D C:\Users\Sepp\AppData\Roaming\OpenOffice.org

2013-07-09 16:00 - 2013-07-09 16:00 - 00179832 _____ C:\Users\Sarah\Desktop\Passwörter.txt

2013-07-09 15:51 - 2013-07-09 15:51 - 00024345 _____ C:\Users\Sarah\Desktop\password-export-2013-07-09.csv

2013-07-09 15:49 - 2013-07-09 15:49 - 00041249 _____ C:\Users\Sarah\Desktop\password-export-2013-07-09.xml

2013-07-04 08:41 - 2013-07-04 08:41 - 05706781 _____ C:\Users\Sarah\Desktop\Rising Sun - Epic Orchestra Film Instrumental Music.mp4

2013-07-02 13:16 - 2013-07-02 13:16 - 00698764 _____ C:\Users\Sarah\Downloads\Uhr.exe

2013-07-01 22:21 - 2013-07-01 22:16 - 07126244 _____ C:\Users\Sarah\Desktop\tobi-song-movie.wmv

2013-07-01 21:10 - 2013-07-13 12:18 - 00000955 _____ C:\Users\Public\Desktop\TeamViewer 8.lnk

2013-06-30 14:20 - 2013-06-30 14:20 - 00000000 ____D C:\Users\Sepp\AppData\Local\Macromedia

2013-06-30 14:11 - 2013-06-30 14:19 - 00000000 ____D C:\Users\Sepp\AppData\Roaming\Mozilla

2013-06-30 14:11 - 2013-06-30 14:11 - 00000000 ____D C:\Users\Sepp\AppData\Local\Mozilla

2013-06-28 11:32 - 2013-06-28 11:32 - 00000468 _____ C:\Users\Sarah\Desktop\hunday mobile.txt

2013-06-28 10:22 - 2013-06-28 10:22 - 00000175 _____ C:\Windows\system32\Drivers\aswVmm.sys.sum

2013-06-27 09:52 - 2013-06-28 10:22 - 00000175 _____ C:\Windows\system32\Drivers\aswSP.sys.sum

2013-06-27 09:52 - 2013-06-28 10:22 - 00000175 _____ C:\Windows\system32\Drivers\aswSnx.sys.sum
 

==================== One Month Modified Files and Folders =======
 

2013-07-27 14:00 - 2013-07-27 13:43 - 00000000 ____D C:\Users\Sarah\Desktop\Trojaner hilfe

2013-07-27 13:59 - 2012-03-30 14:21 - 00001096 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-07-27 13:55 - 2013-07-27 13:55 - 00000000 ____D C:\Windows\ERUNT

2013-07-27 13:53 - 2013-04-22 22:16 - 00000000 ___RD C:\Users\Sarah\Dropbox

2013-07-27 13:53 - 2013-04-22 22:11 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\Dropbox

2013-07-27 13:53 - 2012-07-14 11:42 - 00000000 ___SD C:\Users\Sarah\Google Drive

2013-07-27 13:51 - 2012-03-30 14:21 - 00001092 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-07-27 13:49 - 2006-11-02 14:46 - 00003760 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

2013-07-27 13:49 - 2006-11-02 14:46 - 00003760 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

2013-07-27 13:48 - 2013-05-18 10:26 - 00004002 _____ C:\Windows\PFRO.log

2013-07-27 13:48 - 2012-04-02 16:31 - 00000000 ____D C:\Windows\pss

2013-07-27 13:48 - 2006-11-02 15:00 - 00032564 _____ C:\Windows\Tasks\SCHEDLGU.TXT

2013-07-27 13:48 - 2006-11-02 15:00 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-07-27 13:47 - 2013-03-09 12:33 - 00478741 _____ C:\Windows\WindowsUpdate.log

2013-07-27 13:47 - 2011-08-05 12:50 - 00001660 _____ C:\Windows\bthservsdp.dat

2013-07-27 13:32 - 2013-02-22 16:11 - 00001120 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2257783777-1101859096-687163147-1000UA.job

2013-07-27 13:32 - 2013-02-06 10:32 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-07-27 12:46 - 2013-07-27 12:46 - 00036679 _____ C:\Users\Sarah\Downloads\FRST.txt

2013-07-27 12:46 - 2013-07-27 12:46 - 00017049 _____ C:\Users\Sarah\Downloads\Addition.txt

2013-07-27 12:44 - 2013-07-27 12:44 - 00000000 ____D C:\FRST

2013-07-27 12:32 - 2011-10-19 15:22 - 00001138 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2257783777-1101859096-687163147-1000UA.job

2013-07-27 12:32 - 2011-10-19 15:22 - 00001116 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2257783777-1101859096-687163147-1000Core.job

2013-07-27 11:32 - 2013-02-22 16:11 - 00001068 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2257783777-1101859096-687163147-1000Core.job

2013-07-27 11:10 - 2011-08-05 20:14 - 00000418 ____H C:\Windows\Tasks\User_Feed_Synchronization-{A9097228-7BF7-4646-B1F5-D5A7D9C4D20A}.job

2013-07-27 10:41 - 2013-07-27 10:41 - 00000000 ____D C:\Program Files\ESET

2013-07-27 10:40 - 2013-07-27 10:40 - 02347384 _____ (ESET) C:\Users\Sarah\Downloads\esetsmartinstaller_enu.exe

2013-07-26 20:27 - 2006-11-02 14:35 - 00000000 ____D C:\Windows\system32\FxsTmp

2013-07-26 17:48 - 2013-07-13 11:40 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\Skype

2013-07-25 16:03 - 2011-08-05 12:41 - 00059904 _____ C:\Users\Sarah\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2013-07-25 15:44 - 2013-04-20 14:27 - 00001892 _____ C:\Users\Public\Desktop\Adobe Reader X.lnk

2013-07-25 15:43 - 2011-08-08 11:01 - 00000000 ____D C:\ProgramData\Adobe

2013-07-25 15:36 - 2011-08-08 11:09 - 00000000 ____D C:\Users\Sarah\AppData\Local\Adobe

2013-07-25 12:50 - 2013-07-25 12:50 - 00074445 _____ C:\Users\Sarah\Downloads\nummernkreise_flexiblenummernautomatik3.zip

2013-07-25 11:42 - 2012-10-10 20:14 - 00000000 ____D C:\Program Files\Microsoft Silverlight

2013-07-25 11:39 - 2013-07-25 11:39 - 00001868 _____ C:\Users\Sarah\Downloads\sg_backup_2013-07-25-1139.spg

2013-07-25 11:39 - 2013-07-25 11:39 - 00001868 _____ C:\Users\Sarah\Downloads\FirstBackup.spg

2013-07-25 11:36 - 2013-07-25 11:36 - 00659456 _____ (Speed Guide Inc.) C:\Users\Sarah\Downloads\TCP308Optimizer.exe

2013-07-24 20:02 - 2013-07-24 19:20 - 02775040 _____ C:\Users\Sarah\session.sqlite

2013-07-24 20:02 - 2011-08-05 12:35 - 00000000 ____D C:\Users\Sarah

2013-07-24 19:21 - 2013-07-24 19:21 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\Wireshark

2013-07-24 19:19 - 2013-07-24 19:19 - 00000000 ____D C:\Program Files\Wireshark

2013-07-24 19:18 - 2013-07-24 19:17 - 22238848 _____ (Wireshark development team) C:\Users\Sarah\Downloads\Wireshark-win32-1.10.0.exe

2013-07-24 19:16 - 2013-07-24 19:15 - 37099197 _____ C:\Users\Sarah\Downloads\CookieCadger-1.06.jar

2013-07-23 17:29 - 2013-07-23 17:28 - 37099197 _____ C:\Users\Sarah\Desktop\CookieCadger-1.06.jar

2013-07-23 17:18 - 2013-07-23 17:18 - 00678144 _____ C:\Users\Sarah\Downloads\FaceNiff-2.4.apk

2013-07-23 17:03 - 2013-07-23 17:02 - 00000000 ____D C:\Program Files\Safari

2013-07-23 17:03 - 2011-12-03 15:15 - 00000000 ____D C:\Users\Sarah\AppData\Local\Apple Computer

2013-07-23 17:03 - 2011-11-22 17:43 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\Apple Computer

2013-07-23 17:02 - 2012-03-09 21:06 - 00000000 ____D C:\ProgramData\Apple Computer

2013-07-23 17:00 - 2013-07-23 17:00 - 00000000 ____D C:\Program Files\Apple Software Update

2013-07-23 17:00 - 2011-11-10 12:44 - 00000000 ____D C:\ProgramData\Apple

2013-07-23 16:58 - 2013-07-23 16:58 - 38494576 _____ (Apple Inc.) C:\Users\Sarah\Downloads\SafariSetup-5.1.7.exe

2013-07-23 16:45 - 2013-07-23 16:45 - 00000000 ____D C:\Program Files\WinPcap

2013-07-23 16:44 - 2013-07-23 16:44 - 00915128 _____ (Riverbed Technology, Inc.) C:\Users\Sarah\Downloads\WinPcap_4_1_3.exe

2013-07-23 15:50 - 2013-07-23 15:45 - 00000077 _____ C:\wepkeys.txt

2013-07-23 15:44 - 2013-07-23 15:44 - 00000000 ____D C:\Aircrack

2013-07-23 15:41 - 2013-07-23 15:40 - 08287320 _____ C:\Users\Sarah\Downloads\aircrack-ng-1.2-beta1-win.zip

2013-07-23 14:59 - 2013-07-23 14:59 - 00000000 ____D C:\Users\Sarah\Documents\EasyBox Key Decrypter Logfile

2013-07-23 14:57 - 2013-07-23 14:57 - 00001106 _____ C:\Users\Sarah\Desktop\EasyBox Key Decrypter.lnk

2013-07-23 14:57 - 2013-07-23 14:57 - 00000000 ____D C:\Program Files\EasyBox Key Decrypter

2013-07-23 14:56 - 2013-07-23 14:56 - 01797880 _____ C:\Users\Sarah\Downloads\EasyBox_Key_Decrypter_v1.4_Setup.exe

2013-07-23 13:24 - 2013-07-23 13:24 - 00028833 _____ C:\Users\Sarah\Downloads\formular_aktuelle_modue.zip

2013-07-23 12:37 - 2013-07-23 12:36 - 77021736 _____ C:\Users\Sarah\Downloads\Cro_Sunny.zip

2013-07-19 19:10 - 2012-01-20 14:01 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\FileZilla

2013-07-19 18:35 - 2013-07-19 18:35 - 00630802 _____ C:\Users\Sarah\Downloads\Wave_Backgrounds_with_Grass_Elements.zip

2013-07-19 17:45 - 2013-07-19 17:45 - 00719586 _____ C:\Users\Sarah\Downloads\Stunning_Retro_Backgrounds.zip

2013-07-19 17:02 - 2013-07-19 17:02 - 01385419 _____ C:\Users\Sarah\Downloads\FreeVectorFlowerBackground.zip

2013-07-19 16:08 - 2013-07-19 16:08 - 01053864 _____ C:\Users\Sarah\Downloads\FloralDesignHeaders2-by-gfxcool.zip

2013-07-19 15:42 - 2013-07-19 15:42 - 04943043 _____ C:\Users\Sarah\Downloads\free_vector_fancy_headers.zip

2013-07-19 15:31 - 2013-07-19 15:31 - 00080868 _____ C:\Users\Sarah\Downloads\Newsletter_Main_Feature.zip

2013-07-19 13:20 - 2013-07-19 13:19 - 29584723 _____ C:\Users\Sarah\Downloads\sendblaster2.0.138.zip

2013-07-17 13:27 - 2013-07-17 13:26 - 00000000 ____D C:\Users\Sarah\www.apowersoft.com

2013-07-17 13:26 - 2012-04-06 19:06 - 00000000 ____D C:\Program Files\JDownloader

2013-07-15 22:43 - 2012-01-20 14:00 - 00000000 ____D C:\Program Files\FileZilla FTP Client

2013-07-14 11:52 - 2012-04-20 15:46 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe

2013-07-14 11:52 - 2011-08-05 15:20 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl

2013-07-13 13:30 - 2013-07-13 13:30 - 00303308 _____ C:\Users\Sarah\Downloads\De Bauer.mp4

2013-07-13 13:04 - 2013-07-13 13:04 - 00446040 _____ C:\Users\Sarah\Downloads\JW.Player.v6.1.2972.Pro.incl.Keygen.FLASH.NULL-DGT.zip

2013-07-13 13:00 - 2013-07-13 13:00 - 00507325 _____ C:\Users\Sarah\Downloads\mediaplayer.zip

2013-07-13 12:18 - 2013-07-01 21:10 - 00000955 _____ C:\Users\Public\Desktop\TeamViewer 8.lnk

2013-07-13 11:52 - 2013-07-13 11:39 - 00002379 _____ C:\Users\Public\Desktop\Skype.lnk

2013-07-13 11:40 - 2013-07-13 11:39 - 00000000 ____D C:\ProgramData\Skype

2013-07-13 11:39 - 2013-07-13 11:39 - 00000000 ___RD C:\Program Files\Skype

2013-07-13 11:39 - 2013-07-13 11:39 - 00000000 ____D C:\Program Files\Common Files\Skype

2013-07-13 11:37 - 2013-07-13 11:37 - 01492584 _____ (Skype Technologies S.A.) C:\Users\Sarah\Downloads\SkypeSetup.exe

2013-07-13 11:31 - 2006-11-02 14:46 - 03626288 _____ C:\Windows\system32\FNTCACHE.DAT

2013-07-13 11:28 - 2013-05-19 21:15 - 00000000 ____D C:\Program Files\Mozilla Firefox

2013-07-13 11:28 - 2012-05-03 16:56 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service

2013-07-12 19:46 - 2013-07-12 19:46 - 00969301 _____ C:\Users\Sarah\Downloads\wptouch.1.9.7.zip

2013-07-12 19:39 - 2013-07-12 19:39 - 00861291 _____ C:\Users\Sarah\Downloads\nextgen-gallery.zip

2013-07-12 19:37 - 2013-07-12 19:36 - 03786542 _____ C:\Users\Sarah\Downloads\jw-player-plugin-for-wordpress.2.1.1.zip

2013-07-12 19:35 - 2013-07-12 19:35 - 00521811 _____ C:\Users\Sarah\Downloads\contact-form-plugin.3.47.zip

2013-07-12 19:31 - 2013-07-12 19:31 - 00219355 _____ C:\Users\Sarah\Downloads\antispam-bee.zip

2013-07-12 19:14 - 2013-07-12 18:30 - 04353459 _____ C:\Users\Sarah\Downloads\wordpress-3.5.2-de_DE.zip

2013-07-12 18:42 - 2013-02-07 11:36 - 00000000 ____D C:\Users\Sarah\Documents\Blockbackup

2013-07-12 18:34 - 2013-07-12 18:33 - 04815135 _____ (FileZilla Project) C:\Users\Sarah\Downloads\FileZilla_3.7.1_win32-setup.exe

2013-07-12 12:42 - 2013-07-12 12:42 - 00060912 _____ C:\Users\Sepp\AppData\Local\GDIPFONTCACHEV1.DAT

2013-07-12 12:30 - 2013-07-12 12:30 - 01940642 _____ C:\Users\Sepp\Downloads\vorlagen3de_opendoc.zip

2013-07-12 12:30 - 2013-07-12 12:30 - 00000000 ____D C:\Users\Sepp\AppData\Roaming\WinRAR

2013-07-12 12:26 - 2013-07-12 12:02 - 00000000 ___SD C:\Users\Sepp\Google Drive

2013-07-12 12:21 - 2013-07-12 12:25 - 00000543 _____ C:\Users\Sepp\Documents\indexfile.txt

2013-07-12 12:02 - 2013-07-12 12:02 - 00001547 _____ C:\Users\Sepp\Desktop\Google Drive.lnk

2013-07-12 12:02 - 2013-05-17 18:03 - 00000000 ____D C:\Users\Sepp

2013-07-12 11:42 - 2013-07-12 11:42 - 00000000 ____D C:\Users\Sepp\AppData\Roaming\OpenOffice.org

2013-07-11 17:26 - 2011-08-05 12:56 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\Mozilla

2013-07-09 16:00 - 2013-07-09 16:00 - 00179832 _____ C:\Users\Sarah\Desktop\Passwörter.txt

2013-07-09 15:51 - 2013-07-09 15:51 - 00024345 _____ C:\Users\Sarah\Desktop\password-export-2013-07-09.csv

2013-07-09 15:49 - 2013-07-09 15:49 - 00041249 _____ C:\Users\Sarah\Desktop\password-export-2013-07-09.xml

2013-07-08 15:15 - 2012-04-03 18:24 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\TeamViewer

2013-07-04 14:40 - 2011-08-05 12:36 - 00060912 _____ C:\Users\Sarah\AppData\Local\GDIPFONTCACHEV1.DAT

2013-07-04 08:41 - 2013-07-04 08:41 - 05706781 _____ C:\Users\Sarah\Desktop\Rising Sun - Epic Orchestra Film Instrumental Music.mp4

2013-07-04 08:33 - 2011-08-05 12:35 - 00000680 _____ C:\Users\Sarah\AppData\Local\d3d9caps.dat

2013-07-02 13:16 - 2013-07-02 13:16 - 00698764 _____ C:\Users\Sarah\Downloads\Uhr.exe

2013-07-01 22:16 - 2013-07-01 22:21 - 07126244 _____ C:\Users\Sarah\Desktop\tobi-song-movie.wmv

2013-07-01 21:10 - 2012-04-24 09:50 - 00000000 ____D C:\Program Files\TeamViewer

2013-06-30 14:20 - 2013-06-30 14:20 - 00000000 ____D C:\Users\Sepp\AppData\Local\Macromedia

2013-06-30 14:19 - 2013-06-30 14:11 - 00000000 ____D C:\Users\Sepp\AppData\Roaming\Mozilla

2013-06-30 14:11 - 2013-06-30 14:11 - 00000000 ____D C:\Users\Sepp\AppData\Local\Mozilla

2013-06-28 11:32 - 2013-06-28 11:32 - 00000468 _____ C:\Users\Sarah\Desktop\hunday mobile.txt

2013-06-28 10:22 - 2013-06-28 10:22 - 00000175 _____ C:\Windows\system32\Drivers\aswVmm.sys.sum

2013-06-28 10:22 - 2013-06-27 09:52 - 00000175 _____ C:\Windows\system32\Drivers\aswSP.sys.sum

2013-06-28 10:22 - 2013-06-27 09:52 - 00000175 _____ C:\Windows\system32\Drivers\aswSnx.sys.sum

2013-06-28 10:22 - 2013-03-21 11:42 - 00175176 _____ C:\Windows\system32\Drivers\aswVmm.sys

2013-06-28 10:22 - 2012-01-02 14:26 - 00770344 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys

2013-06-28 10:22 - 2012-01-02 14:26 - 00369584 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
 

==================== Bamital & volsnap Check =================
 

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-07-27 13:56
 

==================== End Of Log ============================

--- --- ---

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

Hey,
schon mal vielen vielen dank im voraus echt super wie du mir hilfst :dankeschoen: iss ja doch schon recht viel Arbeit für dich :daumenhoc !!!

hat der Trojaner irgendetwas mit online banking zu tun?? oder woher der Name Spy.banker

Hier sind die neuen Log´s

ESET-

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6920

# api_version=3.0.2

# EOSSerial=b1f653d01e59a7409799b6a48171d179

# engine=14545

# end=finished

# remove_checked=false

# archives_checked=false

# unwanted_checked=false

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2013-07-27 10:00:36

# local_time=2013-07-27 12:00:36 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.0.6001 NT Service Pack 1

# compatibility_mode=774 16777213 85 94 1945255 151625508 0 0

# compatibility_mode=5892 16776573 100 95 174036417 212452091 0 0

# scanned=177804

# found=1

# cleaned=0

# scan_time=4616

sh=1903427E210D38475454E4F9CEDFC9C2B3DDCD33 ft=1 fh=c7ebdbe6db765fe8 vn="a variant of Win32/Spy.Banker.YIL trojan" ac=I fn="C:\Users\Sarah\AppData\Roaming\5052\components\AcroFF0527.dll"

ESETSmartInstaller@High as downloader log:

all ok

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6920

# api_version=3.0.2

# EOSSerial=b1f653d01e59a7409799b6a48171d179

# engine=14551

# end=finished

# remove_checked=false

# archives_checked=false

# unwanted_checked=false

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2013-07-27 04:28:11

# local_time=2013-07-27 06:28:11 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.0.6001 NT Service Pack 1

# compatibility_mode=774 16777213 85 94 1968510 151648763 0 0

# compatibility_mode=5892 16776573 100 95 174059672 212475346 0 0

# scanned=177310

# found=1

# cleaned=0

# scan_time=4783

sh=1903427E210D38475454E4F9CEDFC9C2B3DDCD33 ft=1 fh=c7ebdbe6db765fe8 vn="a variant of Win32/Spy.Banker.YIL trojan" ac=I fn="C:\Users\Sarah\AppData\Roaming\5052\components\AcroFF0527.dll"

ESETSmartInstaller@High as downloader log:

all ok

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6920

# api_version=3.0.2

# EOSSerial=b1f653d01e59a7409799b6a48171d179

# engine=14554

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=false

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2013-07-27 08:30:23

# local_time=2013-07-27 10:30:23 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.0.6001 NT Service Pack 1

# compatibility_mode=774 16777213 85 94 1983042 151663295 0 0

# compatibility_mode=5892 16776573 100 95 174074204 212489878 0 0

# scanned=177443

# found=3

# cleaned=0

# scan_time=7920

sh=1903427E210D38475454E4F9CEDFC9C2B3DDCD33 ft=1 fh=c7ebdbe6db765fe8 vn="a variant of Win32/Spy.Banker.YIL trojan" ac=I fn="C:\Users\Sarah\AppData\Roaming\5052\components\AcroFF0527.dll"

sh=8A14F8BF5B8689FFA9DF13C93DD732F0FBED0142 ft=0 fh=0000000000000000 vn="a variant of Android/Adware.Youmi.B application" ac=I fn="C:\Users\Sarah\Documents\Galaxy ace\SD Alt\TitaniumBackup\com.outfit7.talkingpierrefree-ee67057286cd2b9d54fe79e3c937010b.apk.gz"

sh=1A58C9B7B436CAA05DA3BFB4F954DB59547D4786 ft=0 fh=0000000000000000 vn="probably a variant of Android/Adware.Youmi.B application" ac=I fn="C:\Users\Sarah\Documents\Galaxy ace\SD Alt\TitaniumBackup\com.outfit7.talkingtom-6323b39201e377151c75b0e122aa16f7.apk.gz"

Security Check

Code:

 Results of screen317's Security Check version 0.99.70  

 Windows Vista Service Pack 1 x86 (UAC is disabled!)  

 Out of date service pack!! 

 Internet Explorer 7 Out of date! 
 ``````````````Antivirus/Firewall Check:`````````````` 

 Windows Security Center service is not running! This report may not be accurate! 

 WMI entry may not exist for antivirus; attempting automatic update. 
 `````````Anti-malware/Other Utilities Check:````````` 

 MVPS Hosts File  

 Malwarebytes Anti-Malware Version 1.75.0.1300  

 CCleaner     

 Java 7 Update 25  

 Adobe Flash Player         11.8.800.94  

 Adobe Reader 10.1.7 Adobe Reader out of Date!  

 Mozilla Firefox (22.0) 
 ````````Process Check: objlist.exe by Laurent````````  

 ESET ESET Online Scanner OnlineScannerApp.exe  

 Abbott Diabetes Care FreeStyle Auto-Assist adcmald.exe  

 AVAST Software Avast AvastSvc.exe  

 AVAST Software Avast AvastUI.exe  
 `````````````````System Health check````````````````` 

 Total Fragmentation on Drive C:  % 
 ````````````````````End of Log``````````````````````

FRST

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 27-07-2013

Ran by Sarah (administrator) on 28-07-2013 16:29:14

Running from C:\Users\Sarah\Desktop\Trojaner hilfe

Microsoft® Windows Vista™ Ultimate  Service Pack 1 (X86) OS Language: German Standard

Internet Explorer Version 7

Boot Mode: Normal
 

==================== Processes (Whitelisted) ===================
 

(ATI Technologies Inc.) C:\Windows\system32\Ati2evxx.exe

(Microsoft Corporation) C:\Windows\system32\SLsvc.exe

(ATI Technologies Inc.) C:\Windows\system32\Ati2evxx.exe

(Abbott Diabetes Care) C:\Program Files\Abbott Diabetes Care\FreeStyle Auto-Assist\adcmald.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe

(Nalpeiron Ltd.) C:\Windows\system32\nlssrv32.exe

(TeamViewer GmbH) C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe

(Sony Corporation) C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe

(Microsoft Corporation) C:\Windows\WindowsMobile\wmdSync.exe

(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe

() C:\Program Files\Abbott Diabetes Care\FreeStyle Auto-Assist\adclaunchd.exe

(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe

() C:\Program Files\VoIPdial\VoIPdial.exe

(Google) C:\Program Files\Google\Drive\googledrivesync.exe

(Samsung) C:\Program Files\Samsung\Kies\Kies.exe

(Samsung) C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe

(Dropbox, Inc.) C:\Users\Sarah\AppData\Roaming\Dropbox\bin\Dropbox.exe

(Microsoft Corporation) C:\Windows\system32\wbem\unsecapp.exe

(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe

(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.exe

(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.bin

(Sony Corporation) C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe

(Google) C:\Program Files\Google\Drive\googledrivesync.exe

(Sony Corporation) C:\Program Files\Sony\VAIO Event Service\VESMgr.exe

(Sony Corporation) C:\Program Files\Sony\VAIO Event Service\VESMgrSub.exe

(Sony Corporation) C:\Program Files\Sony\VAIO Update\VUAgent.exe

(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMgr.exe

(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe

(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe

(Google) C:\Users\Sarah\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe

(Microsoft Corporation) C:\Windows\system32\conime.exe

(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe

(Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe

(Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe

() C:\Users\Sarah\Downloads\SecurityCheck.exe

(Microsoft Corporation) C:\Windows\system32\cmd.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [avast] - C:\Program Files\AVAST Software\Avast\avastUI.exe [4858968 2013-05-09] (AVAST Software)

HKLM\...\Run: [Windows Mobile-based device management] - C:\Windows\WindowsMobile\wmdSync.exe [215552 2008-01-21] (Microsoft Corporation)

HKLM\...\Run: [KiesTrayAgent] - C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [310640 2013-03-28] (Samsung Electronics Co., Ltd.)

HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)

HKLM\...\Run: [FreeStyle AutoLaunch] - C:\Program Files\Abbott Diabetes Care\FreeStyle Auto-Assist\adclaunchd.exe [196960 2013-02-09] ()

HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)

HKLM\...\Winlogon: [Userinit] c:\windows\system32\userinit.exe,userinit.exe,

Winlogon\Notify\!SASWinLogon: I:\System\Apps\7E5842E4-EF51-421A-8FB3-19F3ECB18E3C\Data\SASWINLO.DLL [X]

Winlogon\Notify\VESWinlogon: VESWinlogon.dll (Sony Corporation)

HKCU\...\Run: [VoIPdial] - C:\Program Files\VoIPdial\VoIPdial.exe [274039 2009-09-30] ()

HKCU\...\Run: [Facebook Update] - C:\Users\Sarah\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-07-12] (Facebook Inc.)

HKCU\...\Run: [GoogleDriveSync] - C:\Program Files\Google\Drive\googledrivesync.exe [19676256 2013-06-06] (Google)

HKCU\...\Run: [Google Update] - C:\Users\Sarah\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-02-22] (Google Inc.)

HKCU\...\Run: [KiesPreload] - C:\Program Files\Samsung\Kies\Kies.exe [1511792 2013-03-28] (Samsung)

HKCU\...\Run: [] - C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [1106288 2013-03-28] (Samsung)

HKCU\...\Run: [WMPNSCFG] - C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-21] (Microsoft Corporation)

MountPoints2: G - G:\LaunchU3.exe -a

MountPoints2: {1836f5ee-e5bf-11e0-94d8-001e3d3bc32e} - G:\LaunchU3.exe -a

MountPoints2: {7472dfd3-2f15-11e2-9f95-001e3d3bc32e} - G:\Windows\StartFreeStyle.exe

MountPoints2: {a48a3f4d-1205-11e2-b1fd-001e3d3bc32e} - RunClubSanDisk.exe

MountPoints2: {c2486bab-fca5-11e0-ad5c-001e3d3bc32e} - G:\LaunchU3.exe -a

HKU\Administrator\...\Run: [Sidebar] - C:\Program Files\Windows Sidebar\sidebar.exe [ 2008-01-21] (Microsoft Corporation)

HKU\Administrator\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2008-01-21] (Microsoft Corporation)

HKU\Default\...\Run: [Sidebar] - C:\Program Files\Windows Sidebar\Sidebar.exe [ 2008-01-21] (Microsoft Corporation)

HKU\Default\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2008-01-21] (Microsoft Corporation)

HKU\Default User\...\Run: [Sidebar] - C:\Program Files\Windows Sidebar\Sidebar.exe [ 2008-01-21] (Microsoft Corporation)

HKU\Default User\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2008-01-21] (Microsoft Corporation)

HKU\Sepp\...\Run: [Sidebar] - C:\Program Files\Windows Sidebar\sidebar.exe [ 2008-01-21] (Microsoft Corporation)

HKU\Sepp\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2008-01-21] (Microsoft Corporation)

HKU\Sepp\...\Run: [GoogleDriveSync] - C:\Program Files\Google\Drive\googledrivesync.exe [ 2013-06-06] (Google)

HKU\Sepp\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\system32\Macromed\Flash\FlashUtil32_11_7_700_224_Plugin.exe -update plugin [x]

Startup: C:\Users\Sarah\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Users\Sarah\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

Startup: C:\Users\Sarah\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk

ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()

Startup: C:\Users\Sepp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk

ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()

BootExecute: autocheck autochk /p \??\H:autocheck autochk * 
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

SearchScopes: HKLM - DefaultScope value is missing.

SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search

SearchScopes: HKCU - {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL = 

BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_07-windows-i586.cab

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

ShellExecuteHooks: SABShellExecuteHook Class - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} -  No File [ ]

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
 

FireFox:

========

FF ProfilePath: C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Path=Profiles\iy8dzkv7.Sebastian

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll ()

FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin: @google.com/npPicasa3,version=3.0.0 - C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)

FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Sarah\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)

FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin - C:\Users\Sarah\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)

FF Plugin HKCU: @talk.google.com/O1DPlugin - C:\Users\Sarah\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)

FF Plugin HKCU: @talk.google.com/O3DPlugin - C:\Users\Sarah\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()

FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Sarah\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Sarah\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Extension: Default - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF HKLM\...\Firefox\Extensions: [wrc@avast.com] C:\Program Files\AVAST Software\Avast\WebRep\FF

FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF
 

Chrome: 

=======

CHR HomePage: hxxp://www.google.com
 

========================== Services (Whitelisted) =================
 

R2 adcmald; C:\Program Files\Abbott Diabetes Care\FreeStyle Auto-Assist\adcmald.exe [535896 2013-02-09] (Abbott Diabetes Care)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-05-09] (AVAST Software)

S4 SBSDWSCService; C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)

R3 VUAgent; C:\Program Files\Sony\VAIO Update\VUAgent.exe [1013808 2013-03-26] (Sony Corporation)

S2 AntiVirSchedulerService; "C:\Program Files\Avira\AntiVir Desktop\sched.exe" [x]

S2 AntiVirService; "C:\Program Files\Avira\AntiVir Desktop\avguard.exe" [x]

S3 rpcapd; "%ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini" [x]
 

==================== Drivers (Whitelisted) ====================
 

R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [29816 2013-05-09] (AVAST Software)

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [66336 2013-05-09] (AVAST Software)

R1 aswRdr; C:\Windows\System32\Drivers\aswRdr.sys [49760 2013-05-09] (AVAST Software)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [49376 2013-05-09] ()

R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [770344 2013-06-28] (AVAST Software)

R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [369584 2013-06-28] (AVAST Software)

R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [56080 2013-05-09] (AVAST Software)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [175176 2013-06-28] ()

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [66616 2011-08-06] (Avira GmbH)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [138192 2011-08-06] (Avira GmbH)

S3 bdacap; C:\Windows\System32\drivers\bdacap.sys [217728 2006-02-14] (Genesys Logic, Inc.)

S3 cpudrv; C:\Program Files\SystemRequirementsLab\cpudrv.sys [11336 2011-06-02] ()

S3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2010-06-14] ()

S3 GLHIDKBFILTER; C:\Windows\System32\DRIVERS\GLKbFilter.sys [11264 2006-01-06] (Genesys Logic)

R2 NPF; C:\Windows\System32\drivers\npf.sys [36600 2013-03-01] (Riverbed Technology, Inc.)

S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [15576 2013-01-11] ()

S3 pwdspio; C:\Windows\system32\pwdspio.sys [10200 2013-01-11] ()

R3 R5U870FLx86; C:\Windows\System32\Drivers\R5U870FLx86.sys [73472 2008-01-30] (Ricoh)

R3 R5U870FUx86; C:\Windows\System32\Drivers\R5U870FUx86.sys [43904 2008-01-30] (Ricoh)

R1 StarOpen; C:\Windows\System32\Drivers\StarOpen.sys [5632 2006-07-24] ()

S3 tap0901; C:\Windows\System32\DRIVERS\tap0901.sys [26624 2011-12-15] (The OpenVPN Project)

R3 ti21sony; C:\Windows\System32\drivers\ti21sony.sys [818688 2007-11-16] (Texas Instruments)

S3 UIUSys; C:\Windows\System32\DRIVERS\UIUSYS.SYS [6909 2008-01-30] (Conexant Systems, Inc)

S3 IpInIp; system32\DRIVERS\ipinip.sys [x]

S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]

S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]

S1 SASDIFSV; \??\I:\System\Apps\7E5842E4-EF51-421A-8FB3-19F3ECB18E3C\Data\SASDIFSV.SYS [x]

S1 SASKUTIL; \??\I:\System\Apps\7E5842E4-EF51-421A-8FB3-19F3ECB18E3C\Data\SASKUTIL.SYS [x]

S3 USBAAPL; System32\Drivers\usbaapl.sys [x]

S3 WinRing0_1_2_0; \??\C:\Program Files\BatteryCare\WinRing0.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-07-27 20:16 - 2013-07-27 20:16 - 00891062 _____ C:\Users\Sarah\Downloads\SecurityCheck.exe

2013-07-27 20:06 - 2013-07-27 20:06 - 02347384 _____ (ESET) C:\Users\Sarah\Downloads\esetsmartinstaller_enu(1).exe

2013-07-27 13:55 - 2013-07-27 13:55 - 00000000 ____D C:\Windows\ERUNT

2013-07-27 13:43 - 2013-07-27 14:13 - 00000000 ____D C:\Users\Sarah\Desktop\Trojaner hilfe

2013-07-27 12:46 - 2013-07-27 12:46 - 00036679 _____ C:\Users\Sarah\Downloads\FRST.txt

2013-07-27 12:46 - 2013-07-27 12:46 - 00017049 _____ C:\Users\Sarah\Downloads\Addition.txt

2013-07-27 12:44 - 2013-07-27 12:44 - 00000000 ____D C:\FRST

2013-07-27 10:41 - 2013-07-27 10:41 - 00000000 ____D C:\Program Files\ESET

2013-07-27 10:40 - 2013-07-27 10:40 - 02347384 _____ (ESET) C:\Users\Sarah\Downloads\esetsmartinstaller_enu.exe

2013-07-25 12:50 - 2013-07-25 12:50 - 00074445 _____ C:\Users\Sarah\Downloads\nummernkreise_flexiblenummernautomatik3.zip

2013-07-25 11:39 - 2013-07-25 11:39 - 00001868 _____ C:\Users\Sarah\Downloads\sg_backup_2013-07-25-1139.spg

2013-07-25 11:39 - 2013-07-25 11:39 - 00001868 _____ C:\Users\Sarah\Downloads\FirstBackup.spg

2013-07-25 11:36 - 2013-07-25 11:36 - 00659456 _____ (Speed Guide Inc.) C:\Users\Sarah\Downloads\TCP308Optimizer.exe

2013-07-24 19:21 - 2013-07-24 19:21 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\Wireshark

2013-07-24 19:20 - 2013-07-24 20:02 - 02775040 _____ C:\Users\Sarah\session.sqlite

2013-07-24 19:19 - 2013-07-24 19:19 - 00000000 ____D C:\Program Files\Wireshark

2013-07-24 19:17 - 2013-07-24 19:18 - 22238848 _____ (Wireshark development team) C:\Users\Sarah\Downloads\Wireshark-win32-1.10.0.exe

2013-07-24 19:15 - 2013-07-24 19:16 - 37099197 _____ C:\Users\Sarah\Downloads\CookieCadger-1.06.jar

2013-07-23 17:28 - 2013-07-23 17:29 - 37099197 _____ C:\Users\Sarah\Desktop\CookieCadger-1.06.jar

2013-07-23 17:18 - 2013-07-23 17:18 - 00678144 _____ C:\Users\Sarah\Downloads\FaceNiff-2.4.apk

2013-07-23 17:02 - 2013-07-23 17:03 - 00000000 ____D C:\Program Files\Safari

2013-07-23 17:00 - 2013-07-23 17:00 - 00000000 ____D C:\Program Files\Apple Software Update

2013-07-23 16:58 - 2013-07-23 16:58 - 38494576 _____ (Apple Inc.) C:\Users\Sarah\Downloads\SafariSetup-5.1.7.exe

2013-07-23 16:45 - 2013-07-23 16:45 - 00000000 ____D C:\Program Files\WinPcap

2013-07-23 16:44 - 2013-07-23 16:44 - 00915128 _____ (Riverbed Technology, Inc.) C:\Users\Sarah\Downloads\WinPcap_4_1_3.exe

2013-07-23 15:45 - 2013-07-23 15:50 - 00000077 _____ C:\wepkeys.txt

2013-07-23 15:44 - 2013-07-23 15:44 - 00000000 ____D C:\Aircrack

2013-07-23 15:40 - 2013-07-23 15:41 - 08287320 _____ C:\Users\Sarah\Downloads\aircrack-ng-1.2-beta1-win.zip

2013-07-23 14:59 - 2013-07-23 14:59 - 00000000 ____D C:\Users\Sarah\Documents\EasyBox Key Decrypter Logfile

2013-07-23 14:57 - 2013-07-23 14:57 - 00001106 _____ C:\Users\Sarah\Desktop\EasyBox Key Decrypter.lnk

2013-07-23 14:57 - 2013-07-23 14:57 - 00000000 ____D C:\Program Files\EasyBox Key Decrypter

2013-07-23 14:56 - 2013-07-23 14:56 - 01797880 _____ C:\Users\Sarah\Downloads\EasyBox_Key_Decrypter_v1.4_Setup.exe

2013-07-23 13:24 - 2013-07-23 13:24 - 00028833 _____ C:\Users\Sarah\Downloads\formular_aktuelle_modue.zip

2013-07-23 12:36 - 2013-07-23 12:37 - 77021736 _____ C:\Users\Sarah\Downloads\Cro_Sunny.zip

2013-07-19 18:35 - 2013-07-19 18:35 - 00630802 _____ C:\Users\Sarah\Downloads\Wave_Backgrounds_with_Grass_Elements.zip

2013-07-19 17:45 - 2013-07-19 17:45 - 00719586 _____ C:\Users\Sarah\Downloads\Stunning_Retro_Backgrounds.zip

2013-07-19 17:02 - 2013-07-19 17:02 - 01385419 _____ C:\Users\Sarah\Downloads\FreeVectorFlowerBackground.zip

2013-07-19 16:08 - 2013-07-19 16:08 - 01053864 _____ C:\Users\Sarah\Downloads\FloralDesignHeaders2-by-gfxcool.zip

2013-07-19 15:42 - 2013-07-19 15:42 - 04943043 _____ C:\Users\Sarah\Downloads\free_vector_fancy_headers.zip

2013-07-19 15:31 - 2013-07-19 15:31 - 00080868 _____ C:\Users\Sarah\Downloads\Newsletter_Main_Feature.zip

2013-07-19 13:19 - 2013-07-19 13:20 - 29584723 _____ C:\Users\Sarah\Downloads\sendblaster2.0.138.zip

2013-07-17 13:26 - 2013-07-17 13:27 - 00000000 ____D C:\Users\Sarah\www.apowersoft.com

2013-07-13 13:30 - 2013-07-13 13:30 - 00303308 _____ C:\Users\Sarah\Downloads\De Bauer.mp4

2013-07-13 13:04 - 2013-07-13 13:04 - 00446040 _____ C:\Users\Sarah\Downloads\JW.Player.v6.1.2972.Pro.incl.Keygen.FLASH.NULL-DGT.zip

2013-07-13 13:00 - 2013-07-13 13:00 - 00507325 _____ C:\Users\Sarah\Downloads\mediaplayer.zip

2013-07-13 11:40 - 2013-07-26 17:48 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\Skype

2013-07-13 11:39 - 2013-07-13 11:52 - 00002379 _____ C:\Users\Public\Desktop\Skype.lnk

2013-07-13 11:39 - 2013-07-13 11:40 - 00000000 ____D C:\ProgramData\Skype

2013-07-13 11:39 - 2013-07-13 11:39 - 00000000 ___RD C:\Program Files\Skype

2013-07-13 11:39 - 2013-07-13 11:39 - 00000000 ____D C:\Program Files\Common Files\Skype

2013-07-13 11:37 - 2013-07-13 11:37 - 01492584 _____ (Skype Technologies S.A.) C:\Users\Sarah\Downloads\SkypeSetup.exe

2013-07-12 19:46 - 2013-07-12 19:46 - 00969301 _____ C:\Users\Sarah\Downloads\wptouch.1.9.7.zip

2013-07-12 19:39 - 2013-07-12 19:39 - 00861291 _____ C:\Users\Sarah\Downloads\nextgen-gallery.zip

2013-07-12 19:36 - 2013-07-12 19:37 - 03786542 _____ C:\Users\Sarah\Downloads\jw-player-plugin-for-wordpress.2.1.1.zip

2013-07-12 19:35 - 2013-07-12 19:35 - 00521811 _____ C:\Users\Sarah\Downloads\contact-form-plugin.3.47.zip

2013-07-12 19:31 - 2013-07-12 19:31 - 00219355 _____ C:\Users\Sarah\Downloads\antispam-bee.zip

2013-07-12 18:33 - 2013-07-12 18:34 - 04815135 _____ (FileZilla Project) C:\Users\Sarah\Downloads\FileZilla_3.7.1_win32-setup.exe

2013-07-12 18:30 - 2013-07-12 19:14 - 04353459 _____ C:\Users\Sarah\Downloads\wordpress-3.5.2-de_DE.zip

2013-07-12 12:42 - 2013-07-12 12:42 - 00060912 _____ C:\Users\Sepp\AppData\Local\GDIPFONTCACHEV1.DAT

2013-07-12 12:30 - 2013-07-12 12:30 - 01940642 _____ C:\Users\Sepp\Downloads\vorlagen3de_opendoc.zip

2013-07-12 12:30 - 2013-07-12 12:30 - 00000000 ____D C:\Users\Sepp\AppData\Roaming\WinRAR

2013-07-12 12:25 - 2013-07-12 12:21 - 00000543 _____ C:\Users\Sepp\Documents\indexfile.txt

2013-07-12 12:02 - 2013-07-12 12:26 - 00000000 ___SD C:\Users\Sepp\Google Drive

2013-07-12 12:02 - 2013-07-12 12:02 - 00001547 _____ C:\Users\Sepp\Desktop\Google Drive.lnk

2013-07-12 11:42 - 2013-07-12 11:42 - 00000000 ____D C:\Users\Sepp\AppData\Roaming\OpenOffice.org

2013-07-09 16:00 - 2013-07-09 16:00 - 00179832 _____ C:\Users\Sarah\Desktop\Passwörter.txt

2013-07-09 15:51 - 2013-07-09 15:51 - 00024345 _____ C:\Users\Sarah\Desktop\password-export-2013-07-09.csv

2013-07-09 15:49 - 2013-07-09 15:49 - 00041249 _____ C:\Users\Sarah\Desktop\password-export-2013-07-09.xml

2013-07-04 08:41 - 2013-07-04 08:41 - 05706781 _____ C:\Users\Sarah\Desktop\Rising Sun - Epic Orchestra Film Instrumental Music.mp4

2013-07-02 13:16 - 2013-07-02 13:16 - 00698764 _____ C:\Users\Sarah\Downloads\Uhr.exe

2013-07-01 22:21 - 2013-07-01 22:16 - 07126244 _____ C:\Users\Sarah\Desktop\tobi-song-movie.wmv

2013-07-01 21:10 - 2013-07-13 12:18 - 00000955 _____ C:\Users\Public\Desktop\TeamViewer 8.lnk

2013-06-30 14:20 - 2013-06-30 14:20 - 00000000 ____D C:\Users\Sepp\AppData\Local\Macromedia

2013-06-30 14:11 - 2013-06-30 14:19 - 00000000 ____D C:\Users\Sepp\AppData\Roaming\Mozilla

2013-06-30 14:11 - 2013-06-30 14:11 - 00000000 ____D C:\Users\Sepp\AppData\Local\Mozilla

2013-06-28 11:32 - 2013-06-28 11:32 - 00000468 _____ C:\Users\Sarah\Desktop\hunday mobile.txt

2013-06-28 10:22 - 2013-06-28 10:22 - 00000175 _____ C:\Windows\system32\Drivers\aswVmm.sys.sum
 

==================== One Month Modified Files and Folders =======
 

2013-07-28 15:59 - 2012-03-30 14:21 - 00001096 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-07-28 15:32 - 2013-02-22 16:11 - 00001120 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2257783777-1101859096-687163147-1000UA.job

2013-07-28 15:32 - 2013-02-06 10:32 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-07-28 15:32 - 2011-10-19 15:22 - 00001138 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2257783777-1101859096-687163147-1000UA.job

2013-07-28 15:31 - 2011-08-05 20:14 - 00000418 ____H C:\Windows\Tasks\User_Feed_Synchronization-{A9097228-7BF7-4646-B1F5-D5A7D9C4D20A}.job

2013-07-28 15:30 - 2006-11-02 14:46 - 00003760 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

2013-07-28 15:30 - 2006-11-02 14:46 - 00003760 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

2013-07-28 12:32 - 2011-10-19 15:22 - 00001116 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2257783777-1101859096-687163147-1000Core.job

2013-07-28 12:02 - 2011-08-06 21:01 - 00000000 ____D C:\Program Files\Google

2013-07-28 11:59 - 2012-03-30 14:21 - 00001092 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-07-28 11:49 - 2013-04-22 22:11 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\Dropbox

2013-07-28 11:32 - 2013-02-22 16:11 - 00001068 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2257783777-1101859096-687163147-1000Core.job

2013-07-27 20:16 - 2013-07-27 20:16 - 00891062 _____ C:\Users\Sarah\Downloads\SecurityCheck.exe

2013-07-27 20:06 - 2013-07-27 20:06 - 02347384 _____ (ESET) C:\Users\Sarah\Downloads\esetsmartinstaller_enu(1).exe

2013-07-27 16:52 - 2013-03-09 12:33 - 00481448 _____ C:\Windows\WindowsUpdate.log

2013-07-27 16:47 - 2012-07-14 11:42 - 00000000 ___SD C:\Users\Sarah\Google Drive

2013-07-27 16:46 - 2013-04-22 22:16 - 00000000 ___RD C:\Users\Sarah\Dropbox

2013-07-27 16:44 - 2006-11-02 15:00 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-07-27 16:42 - 2011-08-05 12:50 - 00001660 _____ C:\Windows\bthservsdp.dat

2013-07-27 16:42 - 2006-11-02 15:00 - 00032564 _____ C:\Windows\Tasks\SCHEDLGU.TXT

2013-07-27 14:13 - 2013-07-27 13:43 - 00000000 ____D C:\Users\Sarah\Desktop\Trojaner hilfe

2013-07-27 13:55 - 2013-07-27 13:55 - 00000000 ____D C:\Windows\ERUNT

2013-07-27 13:48 - 2013-05-18 10:26 - 00004002 _____ C:\Windows\PFRO.log

2013-07-27 13:48 - 2012-04-02 16:31 - 00000000 ____D C:\Windows\pss

2013-07-27 12:46 - 2013-07-27 12:46 - 00036679 _____ C:\Users\Sarah\Downloads\FRST.txt

2013-07-27 12:46 - 2013-07-27 12:46 - 00017049 _____ C:\Users\Sarah\Downloads\Addition.txt

2013-07-27 12:44 - 2013-07-27 12:44 - 00000000 ____D C:\FRST

2013-07-27 10:41 - 2013-07-27 10:41 - 00000000 ____D C:\Program Files\ESET

2013-07-27 10:40 - 2013-07-27 10:40 - 02347384 _____ (ESET) C:\Users\Sarah\Downloads\esetsmartinstaller_enu.exe

2013-07-26 20:27 - 2006-11-02 14:35 - 00000000 ____D C:\Windows\system32\FxsTmp

2013-07-26 17:48 - 2013-07-13 11:40 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\Skype

2013-07-25 16:03 - 2011-08-05 12:41 - 00059904 _____ C:\Users\Sarah\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2013-07-25 15:44 - 2013-04-20 14:27 - 00001892 _____ C:\Users\Public\Desktop\Adobe Reader X.lnk

2013-07-25 15:43 - 2011-08-08 11:01 - 00000000 ____D C:\ProgramData\Adobe

2013-07-25 15:36 - 2011-08-08 11:09 - 00000000 ____D C:\Users\Sarah\AppData\Local\Adobe

2013-07-25 12:50 - 2013-07-25 12:50 - 00074445 _____ C:\Users\Sarah\Downloads\nummernkreise_flexiblenummernautomatik3.zip

2013-07-25 11:42 - 2012-10-10 20:14 - 00000000 ____D C:\Program Files\Microsoft Silverlight

2013-07-25 11:39 - 2013-07-25 11:39 - 00001868 _____ C:\Users\Sarah\Downloads\sg_backup_2013-07-25-1139.spg

2013-07-25 11:39 - 2013-07-25 11:39 - 00001868 _____ C:\Users\Sarah\Downloads\FirstBackup.spg

2013-07-25 11:36 - 2013-07-25 11:36 - 00659456 _____ (Speed Guide Inc.) C:\Users\Sarah\Downloads\TCP308Optimizer.exe

2013-07-24 20:02 - 2013-07-24 19:20 - 02775040 _____ C:\Users\Sarah\session.sqlite

2013-07-24 20:02 - 2011-08-05 12:35 - 00000000 ____D C:\Users\Sarah

2013-07-24 19:21 - 2013-07-24 19:21 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\Wireshark

2013-07-24 19:19 - 2013-07-24 19:19 - 00000000 ____D C:\Program Files\Wireshark

2013-07-24 19:18 - 2013-07-24 19:17 - 22238848 _____ (Wireshark development team) C:\Users\Sarah\Downloads\Wireshark-win32-1.10.0.exe

2013-07-24 19:16 - 2013-07-24 19:15 - 37099197 _____ C:\Users\Sarah\Downloads\CookieCadger-1.06.jar

2013-07-23 17:29 - 2013-07-23 17:28 - 37099197 _____ C:\Users\Sarah\Desktop\CookieCadger-1.06.jar

2013-07-23 17:18 - 2013-07-23 17:18 - 00678144 _____ C:\Users\Sarah\Downloads\FaceNiff-2.4.apk

2013-07-23 17:03 - 2013-07-23 17:02 - 00000000 ____D C:\Program Files\Safari

2013-07-23 17:03 - 2011-12-03 15:15 - 00000000 ____D C:\Users\Sarah\AppData\Local\Apple Computer

2013-07-23 17:03 - 2011-11-22 17:43 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\Apple Computer

2013-07-23 17:02 - 2012-03-09 21:06 - 00000000 ____D C:\ProgramData\Apple Computer

2013-07-23 17:00 - 2013-07-23 17:00 - 00000000 ____D C:\Program Files\Apple Software Update

2013-07-23 17:00 - 2011-11-10 12:44 - 00000000 ____D C:\ProgramData\Apple

2013-07-23 16:58 - 2013-07-23 16:58 - 38494576 _____ (Apple Inc.) C:\Users\Sarah\Downloads\SafariSetup-5.1.7.exe

2013-07-23 16:45 - 2013-07-23 16:45 - 00000000 ____D C:\Program Files\WinPcap

2013-07-23 16:44 - 2013-07-23 16:44 - 00915128 _____ (Riverbed Technology, Inc.) C:\Users\Sarah\Downloads\WinPcap_4_1_3.exe

2013-07-23 15:50 - 2013-07-23 15:45 - 00000077 _____ C:\wepkeys.txt

2013-07-23 15:44 - 2013-07-23 15:44 - 00000000 ____D C:\Aircrack

2013-07-23 15:41 - 2013-07-23 15:40 - 08287320 _____ C:\Users\Sarah\Downloads\aircrack-ng-1.2-beta1-win.zip

2013-07-23 14:59 - 2013-07-23 14:59 - 00000000 ____D C:\Users\Sarah\Documents\EasyBox Key Decrypter Logfile

2013-07-23 14:57 - 2013-07-23 14:57 - 00001106 _____ C:\Users\Sarah\Desktop\EasyBox Key Decrypter.lnk

2013-07-23 14:57 - 2013-07-23 14:57 - 00000000 ____D C:\Program Files\EasyBox Key Decrypter

2013-07-23 14:56 - 2013-07-23 14:56 - 01797880 _____ C:\Users\Sarah\Downloads\EasyBox_Key_Decrypter_v1.4_Setup.exe

2013-07-23 13:24 - 2013-07-23 13:24 - 00028833 _____ C:\Users\Sarah\Downloads\formular_aktuelle_modue.zip

2013-07-23 12:37 - 2013-07-23 12:36 - 77021736 _____ C:\Users\Sarah\Downloads\Cro_Sunny.zip

2013-07-19 19:10 - 2012-01-20 14:01 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\FileZilla

2013-07-19 18:35 - 2013-07-19 18:35 - 00630802 _____ C:\Users\Sarah\Downloads\Wave_Backgrounds_with_Grass_Elements.zip

2013-07-19 17:45 - 2013-07-19 17:45 - 00719586 _____ C:\Users\Sarah\Downloads\Stunning_Retro_Backgrounds.zip

2013-07-19 17:02 - 2013-07-19 17:02 - 01385419 _____ C:\Users\Sarah\Downloads\FreeVectorFlowerBackground.zip

2013-07-19 16:08 - 2013-07-19 16:08 - 01053864 _____ C:\Users\Sarah\Downloads\FloralDesignHeaders2-by-gfxcool.zip

2013-07-19 15:42 - 2013-07-19 15:42 - 04943043 _____ C:\Users\Sarah\Downloads\free_vector_fancy_headers.zip

2013-07-19 15:31 - 2013-07-19 15:31 - 00080868 _____ C:\Users\Sarah\Downloads\Newsletter_Main_Feature.zip

2013-07-19 13:20 - 2013-07-19 13:19 - 29584723 _____ C:\Users\Sarah\Downloads\sendblaster2.0.138.zip

2013-07-17 13:27 - 2013-07-17 13:26 - 00000000 ____D C:\Users\Sarah\www.apowersoft.com

2013-07-17 13:26 - 2012-04-06 19:06 - 00000000 ____D C:\Program Files\JDownloader

2013-07-15 22:43 - 2012-01-20 14:00 - 00000000 ____D C:\Program Files\FileZilla FTP Client

2013-07-14 11:52 - 2012-04-20 15:46 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe

2013-07-14 11:52 - 2011-08-05 15:20 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl

2013-07-13 13:30 - 2013-07-13 13:30 - 00303308 _____ C:\Users\Sarah\Downloads\De Bauer.mp4

2013-07-13 13:04 - 2013-07-13 13:04 - 00446040 _____ C:\Users\Sarah\Downloads\JW.Player.v6.1.2972.Pro.incl.Keygen.FLASH.NULL-DGT.zip

2013-07-13 13:00 - 2013-07-13 13:00 - 00507325 _____ C:\Users\Sarah\Downloads\mediaplayer.zip

2013-07-13 12:18 - 2013-07-01 21:10 - 00000955 _____ C:\Users\Public\Desktop\TeamViewer 8.lnk

2013-07-13 11:52 - 2013-07-13 11:39 - 00002379 _____ C:\Users\Public\Desktop\Skype.lnk

2013-07-13 11:40 - 2013-07-13 11:39 - 00000000 ____D C:\ProgramData\Skype

2013-07-13 11:39 - 2013-07-13 11:39 - 00000000 ___RD C:\Program Files\Skype

2013-07-13 11:39 - 2013-07-13 11:39 - 00000000 ____D C:\Program Files\Common Files\Skype

2013-07-13 11:37 - 2013-07-13 11:37 - 01492584 _____ (Skype Technologies S.A.) C:\Users\Sarah\Downloads\SkypeSetup.exe

2013-07-13 11:31 - 2006-11-02 14:46 - 03626288 _____ C:\Windows\system32\FNTCACHE.DAT

2013-07-13 11:28 - 2013-05-19 21:15 - 00000000 ____D C:\Program Files\Mozilla Firefox

2013-07-13 11:28 - 2012-05-03 16:56 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service

2013-07-12 19:46 - 2013-07-12 19:46 - 00969301 _____ C:\Users\Sarah\Downloads\wptouch.1.9.7.zip

2013-07-12 19:39 - 2013-07-12 19:39 - 00861291 _____ C:\Users\Sarah\Downloads\nextgen-gallery.zip

2013-07-12 19:37 - 2013-07-12 19:36 - 03786542 _____ C:\Users\Sarah\Downloads\jw-player-plugin-for-wordpress.2.1.1.zip

2013-07-12 19:35 - 2013-07-12 19:35 - 00521811 _____ C:\Users\Sarah\Downloads\contact-form-plugin.3.47.zip

2013-07-12 19:31 - 2013-07-12 19:31 - 00219355 _____ C:\Users\Sarah\Downloads\antispam-bee.zip

2013-07-12 19:14 - 2013-07-12 18:30 - 04353459 _____ C:\Users\Sarah\Downloads\wordpress-3.5.2-de_DE.zip

2013-07-12 18:42 - 2013-02-07 11:36 - 00000000 ____D C:\Users\Sarah\Documents\Blockbackup

2013-07-12 18:34 - 2013-07-12 18:33 - 04815135 _____ (FileZilla Project) C:\Users\Sarah\Downloads\FileZilla_3.7.1_win32-setup.exe

2013-07-12 12:42 - 2013-07-12 12:42 - 00060912 _____ C:\Users\Sepp\AppData\Local\GDIPFONTCACHEV1.DAT

2013-07-12 12:30 - 2013-07-12 12:30 - 01940642 _____ C:\Users\Sepp\Downloads\vorlagen3de_opendoc.zip

2013-07-12 12:30 - 2013-07-12 12:30 - 00000000 ____D C:\Users\Sepp\AppData\Roaming\WinRAR

2013-07-12 12:26 - 2013-07-12 12:02 - 00000000 ___SD C:\Users\Sepp\Google Drive

2013-07-12 12:21 - 2013-07-12 12:25 - 00000543 _____ C:\Users\Sepp\Documents\indexfile.txt

2013-07-12 12:02 - 2013-07-12 12:02 - 00001547 _____ C:\Users\Sepp\Desktop\Google Drive.lnk

2013-07-12 12:02 - 2013-05-17 18:03 - 00000000 ____D C:\Users\Sepp

2013-07-12 11:42 - 2013-07-12 11:42 - 00000000 ____D C:\Users\Sepp\AppData\Roaming\OpenOffice.org

2013-07-11 17:26 - 2011-08-05 12:56 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\Mozilla

2013-07-09 16:00 - 2013-07-09 16:00 - 00179832 _____ C:\Users\Sarah\Desktop\Passwörter.txt

2013-07-09 15:51 - 2013-07-09 15:51 - 00024345 _____ C:\Users\Sarah\Desktop\password-export-2013-07-09.csv

2013-07-09 15:49 - 2013-07-09 15:49 - 00041249 _____ C:\Users\Sarah\Desktop\password-export-2013-07-09.xml

2013-07-08 15:15 - 2012-04-03 18:24 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\TeamViewer

2013-07-04 14:40 - 2011-08-05 12:36 - 00060912 _____ C:\Users\Sarah\AppData\Local\GDIPFONTCACHEV1.DAT

2013-07-04 08:41 - 2013-07-04 08:41 - 05706781 _____ C:\Users\Sarah\Desktop\Rising Sun - Epic Orchestra Film Instrumental Music.mp4

2013-07-04 08:33 - 2011-08-05 12:35 - 00000680 _____ C:\Users\Sarah\AppData\Local\d3d9caps.dat

2013-07-02 13:16 - 2013-07-02 13:16 - 00698764 _____ C:\Users\Sarah\Downloads\Uhr.exe

2013-07-01 22:16 - 2013-07-01 22:21 - 07126244 _____ C:\Users\Sarah\Desktop\tobi-song-movie.wmv

2013-07-01 21:10 - 2012-04-24 09:50 - 00000000 ____D C:\Program Files\TeamViewer

2013-06-30 14:20 - 2013-06-30 14:20 - 00000000 ____D C:\Users\Sepp\AppData\Local\Macromedia

2013-06-30 14:19 - 2013-06-30 14:11 - 00000000 ____D C:\Users\Sepp\AppData\Roaming\Mozilla

2013-06-30 14:11 - 2013-06-30 14:11 - 00000000 ____D C:\Users\Sepp\AppData\Local\Mozilla

2013-06-28 11:32 - 2013-06-28 11:32 - 00000468 _____ C:\Users\Sarah\Desktop\hunday mobile.txt

2013-06-28 10:22 - 2013-06-28 10:22 - 00000175 _____ C:\Windows\system32\Drivers\aswVmm.sys.sum

2013-06-28 10:22 - 2013-06-27 09:52 - 00000175 _____ C:\Windows\system32\Drivers\aswSP.sys.sum

2013-06-28 10:22 - 2013-06-27 09:52 - 00000175 _____ C:\Windows\system32\Drivers\aswSnx.sys.sum

2013-06-28 10:22 - 2013-03-21 11:42 - 00175176 _____ C:\Windows\system32\Drivers\aswVmm.sys

2013-06-28 10:22 - 2012-01-02 14:26 - 00770344 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys

2013-06-28 10:22 - 2012-01-02 14:26 - 00369584 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
 

==================== Bamital & volsnap Check =================
 

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-07-27 16:50
 

==================== End Of Log ============================

--- --- ---

Windows und Adobe updaten.

Ja, Bankdaten für Onlinebanking sowie Passwörter ändern ist Pflicht.

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

C:\Users\Sarah\AppData\Roaming\5052

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Downloade dir bitte

Farbar Service Scanner

Starte das Tool mit Doppelklick auf die FSS.exe
Gehe sicher, dass folgende Optionen angehakt sind.
- Internet Services
- Windows Firewall
- System Restore
- Security Center/Action Center
- Windows Update
- Windows Defender
- Other Services
Klicke auf Scan.
Wenn das Tool fertig ist, wird es eine FSS.txt in dem Verzeichnis erstellen, wo das Tool gelaufen ist.

Poste bitte den Inhalt hier.

Die neuen Logs

Code:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 27-07-2013

Ran by Sarah at 2013-07-28 20:02:01 Run:1

Running from C:\Users\Sarah\Desktop\Trojaner hilfe

Boot Mode: Normal
 

==============================================
 

C:\Users\Sarah\AppData\Roaming\5052 => Moved successfully.
 

==== End of Fixlog ====

Code:

Farbar Service Scanner Version: 26-07-2013

Ran by Sarah (administrator) on 28-07-2013 at 20:07:31

Running from "C:\Users\Sarah\Desktop\Trojaner hilfe"

Microsoft® Windows Vista™ Ultimate  Service Pack 1 (X86)

Boot Mode: Normal

****************************************************************
 

Internet Services:

============
 

Connection Status:

==============

Localhost is accessible.

LAN connected.

Google IP is accessible.

Google.com is accessible.

Yahoo.com is accessible.
 
 

Windows Firewall:

=============
 

Firewall Disabled Policy: 

==================

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall"=DWORD:0
 
 

System Restore:

============
 

System Restore Disabled Policy: 

========================
 
 

Security Center:

============
 

wscsvc Service is not running. Checking service configuration:

The start type of wscsvc service is set to Disabled. The default start type is Auto.

The ImagePath of wscsvc service is OK.

The ServiceDll of wscsvc service is OK.

Checking LEGACY_wscsvc: ATTENTION!=====> Unable to open LEGACY_wscsvc\0000 registry key. The key does not exist.
 
 

Windows Update:

============
 

Windows Autoupdate Disabled Policy: 

============================
 
 

Windows Defender:

==============
 

Other Services:

==============
 
 

File Check:

========

C:\Windows\system32\nsisvc.dll => MD5 is legit

C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit

C:\Windows\system32\dhcpcsvc.dll => MD5 is legit

C:\Windows\system32\Drivers\afd.sys => MD5 is legit

C:\Windows\system32\Drivers\tdx.sys => MD5 is legit

C:\Windows\system32\Drivers\tcpip.sys

[2008-07-09 21:56] - [2008-07-09 21:56] - 0891448 ____A (Microsoft Corporation) 82E266BEE5F0167E41C6ECFDD2A79C02
 

C:\Windows\system32\dnsrslvr.dll => MD5 is legit

C:\Windows\system32\mpssvc.dll

[2008-01-21 04:22] - [2008-01-21 04:22] - 0393216 ____A (Microsoft Corporation) D1639BA315B0D79DEC49A4B0E1FB929B
 

C:\Windows\system32\bfe.dll

[2008-01-21 04:22] - [2008-01-21 04:22] - 0328704 ____A (Microsoft Corporation) 8582E233C346AEFE759833E8A30DD697
 

C:\Windows\system32\Drivers\mpsdrv.sys => MD5 is legit

C:\Windows\system32\SDRSVC.dll => MD5 is legit

C:\Windows\system32\vssvc.exe

[2008-01-21 04:21] - [2008-01-21 04:21] - 1054720 ____A (Microsoft Corporation) D5FB73D19C46ADE183F968E13F186B23
 

C:\Windows\system32\wscsvc.dll

[2008-01-21 04:21] - [2008-01-21 04:21] - 0061440 ____A (Microsoft Corporation) 683DD16B590372F2C9661D277F35E49C
 

C:\Windows\system32\wbem\WMIsvc.dll

[2008-01-21 04:23] - [2008-01-21 04:23] - 0161792 ____A (Microsoft Corporation) 00B79A7C984678F24CF052E5BEB3A2F5
 

C:\Windows\system32\wuaueng.dll

[2008-01-21 04:23] - [2008-01-21 04:23] - 1695232 ____A (Microsoft Corporation) D79538B67FA641E986855DEF651E78FE
 

C:\Windows\system32\qmgr.dll

[2008-01-21 04:23] - [2008-01-21 04:23] - 0758272 ____A (Microsoft Corporation) 02ED7B4DBC2A3232A389106DA7515C3D
 

C:\Windows\system32\es.dll

[2008-08-13 16:26] - [2008-08-13 16:26] - 0269312 ____A (Microsoft Corporation) 3CB3343D720168B575133A0A20DC2465
 

C:\Windows\system32\cryptsvc.dll

[2008-01-21 04:22] - [2008-01-21 04:22] - 0128000 ____A (Microsoft Corporation) 6DE363F9F99334514C46AEC02D3E3678
 

C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit

C:\Windows\system32\ipnathlp.dll => MD5 is legit

C:\Windows\system32\iphlpsvc.dll => MD5 is legit

C:\Windows\system32\svchost.exe => MD5 is legit

C:\Windows\system32\rpcss.dll => MD5 is legit
 
 

**** End of log ****

Gruß Sepp

http://download.bleepingcomputer.com...sta/wscsvc.reg

laden uns ausführen, erlauben. Reboot und frisches FSS log bitte. Noch Probleme?