Trojaner-Board - Trojan.VBS.Autorun beim Einstecken eines USB-Sticks

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Trojan.VBS.Autorun beim Einstecken eines USB-Sticks (https://www.trojaner-board.de/139075-trojan-vbs-autorun-beim-einstecken-usb-sticks.html)

Trojan.VBS.Autorun beim Einstecken eines USB-Sticks

Hallo und guten Abend,

ich hoffe, Ihr könnt mir helfen.

Meine Schwester hat sich bei einem Visitenkartenladen auf ihrem USB-Stick den o.g. Trojaner eingefangen. Als sie ihn wieder in Ihren Laptop steckte, schrie ZoneAlarm gleich auf und versuchte zu löschen. Acht von zehn Meldungen wurden gelöscht und die restlichen zwei - wurden nie wieder gesehen. Wir haben uns einen Wolf gesucht und die angehängte ZA-Log gefunden.
Weitere Scans (im abgesicherten Modus) von AntiVir, Spybot, MalwareByte und von ZA haben keine neuen Funde ergeben.
Somit wäre wohl "nur" noch der Stick infiziert - um den kümmere ich mich dann irgendwann!

Meine Schwester hat dann noch HiJackThis durchlaufen lassen. Ich hatte die Log online checken lassen. Aber da die Seite nicht mehr gewartet wird, möchte ich auf Nummer sicher gehen und Euch bitten, mal über das Log drüber zu schauen.

Es wäre echt super lieb von Euch, denn ich bin mir echt nicht sicher, ob jetzt wirklich alles in Ordnung ist. Meine Schwester braucht ihren Laptop dienstlich und ist ohne ihn echt aufgeschmissen.

Vielen Dank für Eure Unterstützung
Claudia

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

http://www.trojaner-board.de/picture...&pictureid=307

Hallo Schrauber,

leider kann ich erst jetzt die Scanergebnisse posten. Ich hoffe nur, es ist alles in Ordnung.

Vielen Dank für Deine Hilfe
Liebe Grüße
Claudia

Logs bitte wie oben beschrieben in Codetags in den Thread posten.

Hallo Schrauber,
bin wohl zu blind gewesen. Hier also der richtige Datenpost

- FRST.txt

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 30-07-2013 03

Ran by ... (administrator) on 01-08-2013 17:46:29

Running from C:\Users\...\Desktop

Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) =================
 

(AMD) C:\Windows\system32\atiesrxx.exe

(AMD) C:\Windows\system32\atieclxx.exe

(SANDBOXIE L.T.D) C:\Program Files\Sandboxie\SbieSvc.exe

(Check Point Software Technologies LTD) C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe

(Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(TOSHIBA Corporation) C:\Windows\system32\TODDSrv.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TecoService.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\ForceField.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe

(Dropbox, Inc.) C:\Users\...\AppData\Roaming\Dropbox\bin\Dropbox.exe

() C:\Program Files (x86)\InternetEverywhere\WTGService.exe

(Safer Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe

(Check Point Software Technologies LTD) C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe

(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe

(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFProcSRVC.exe

(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [TosSENotify] - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [709976 2009-08-03] (TOSHIBA Corporation)

HKLM\...\Run: [TosWaitSrv] - C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [711000 2009-08-04] (TOSHIBA Corporation)

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7982112 2009-07-28] (Realtek Semiconductor)

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1815848 2009-07-20] (Synaptics Incorporated)

HKLM\...\Run: [ISW] - C:\Program Files\CheckPoint\ZAForceField\ForceField.exe [1127592 2012-11-22] (Check Point Software Technologies)

HKLM\...\InprocServer32: [Default-cscui]  <==== ATTENTION!

HKCU\...\Run: [SpybotSD TeaTimer] - C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2260480 2009-03-05] (Safer-Networking Ltd.)

MountPoints2: F - F:\.\Setup.exe AUTORUN=1

MountPoints2: {323e3194-4ddd-11e2-8c2c-00235afc196c} - G:\.\Setup.exe AUTORUN=1

MountPoints2: {323e31a4-4ddd-11e2-8c2c-00235afc196c} - F:\.\Setup.exe AUTORUN=1

MountPoints2: {472ab179-4872-11e2-9c74-00235afc196c} - G:\.\Setup.exe AUTORUN=1

MountPoints2: {472ab185-4872-11e2-9c74-00235afc196c} - F:\.\Setup.exe AUTORUN=1

MountPoints2: {472ab197-4872-11e2-9c74-00235afc196c} - F:\.\Setup.exe AUTORUN=1

MountPoints2: {77248199-4696-11e2-97fb-00235afc196c} - F:\.\Setup.exe AUTORUN=1

MountPoints2: {772481b0-4696-11e2-97fb-00235afc196c} - F:\.\Setup.exe AUTORUN=1

MountPoints2: {98b8ebb1-b185-11e1-a0b8-806e6f6e6963} - D:\install_7.exe

MountPoints2: {b44727e1-4ddf-11e2-b1ee-00235afc196c} - F:\.\Setup.exe AUTORUN=1

MountPoints2: {b44727f0-4ddf-11e2-b1ee-00235afc196c} - F:\.\Setup.exe AUTORUN=1

MountPoints2: {b44727fc-4ddf-11e2-b1ee-00235afc196c} - F:\.\Setup.exe AUTORUN=1

MountPoints2: {b4472809-4ddf-11e2-b1ee-00235afc196c} - F:\.\Setup.exe AUTORUN=1

MountPoints2: {b4472817-4ddf-11e2-b1ee-00235afc196c} - F:\.\Setup.exe AUTORUN=1

MountPoints2: {be9b6376-4698-11e2-8b8e-00235afc196c} - F:\.\Setup.exe AUTORUN=1

HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-07-29] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [ZoneAlarm] - C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe [73832 2013-03-27] (Check Point Software Technologies LTD)

HKLM-x32\...\Run: [KeNotify] - C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe [34088 2009-01-13] (TOSHIBA CORPORATION)

HKLM-x32\...\Run: [HWSetup] - C:\Program Files\TOSHIBA\Utilities\HWSetup.exe [423936 2009-06-02] (TOSHIBA Electronics, Inc.)

HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [345144 2013-06-27] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)

Startup: C:\Users\...\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Users\...\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://safesearchr.lavasoft.com/?source=3336ca5f&tbp=homepage&toolbarid=adawaretb&v=2_2&u=BB9CCE2F3C2A4F81A0BCA1507DB50408

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

SearchScopes: HKCU - DefaultScope {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxp://isearch.avg.com/search?cid={CA5D92D3-F190-4120-AB20-A0DE4401FBF4}&mid=f1f1225ee9d147d0a01bd16a1c18f09f-6f542a97238478dd8c9e91d3fb1cc4b5b3e35281&lang=de&ds=st011&pr=sa&d=2012-06-16 18:45:16&v=9.0.0.23&sap=dsp&q={searchTerms}

SearchScopes: HKCU - {3BD44F0E-0596-4008-AEE0-45D47E3A8F0E} URL = hxxp://safesearchr.lavasoft.com/?source=3336ca5f&tbp=rbox&toolbarid=adawaretb&u=BB9CCE2F3C2A4F81A0BCA150843F334C&q={searchTerms}

SearchScopes: HKCU - {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxp://isearch.avg.com/search?cid={CA5D92D3-F190-4120-AB20-A0DE4401FBF4}&mid=f1f1225ee9d147d0a01bd16a1c18f09f-6f542a97238478dd8c9e91d3fb1cc4b5b3e35281&lang=de&ds=st011&pr=sa&d=2012-06-16 18:45:16&v=9.0.0.23&sap=dsp&q={searchTerms}

BHO: ZoneAlarm Security Engine Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)

BHO-x32: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll (Safer Networking Limited)

BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)

BHO-x32: ZoneAlarm Security Engine Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)

Toolbar: HKLM-x32 - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)

Toolbar: HKCU - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
 

FireFox:

========

FF ProfilePath: C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default

FF user.js: detected! => C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\user.js

FF Homepage: hxxp://search.zonealarm.com/?src=hp&tbid=base2013&Lan=de&gu=866e590beaf945308949e22b5ec8d8a1&tu=10GX0007y1B0008&sku=&tstsId=&ver=&

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()

FF Plugin: @microsoft.com/GENUINE - disabled No File

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()

FF Plugin-x32: @checkpoint.com/FFApi - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\npFFApi.dll ()

FF Plugin-x32: @java.com/DTPlugin,version=10.4.1 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.4.1 - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/GENUINE - disabled No File

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @videolan.org/vlc,version=2.0.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF SearchPlugin: C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\searchplugins\11-suche.xml

FF SearchPlugin: C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\searchplugins\ecosia.xml

FF SearchPlugin: C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\searchplugins\englische-ergebnisse.xml

FF SearchPlugin: C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\searchplugins\gmx-suche.xml

FF SearchPlugin: C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\searchplugins\lastminute.xml

FF SearchPlugin: C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\searchplugins\webde-suche.xml

FF SearchPlugin: C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\searchplugins\zonealarm.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\adawaretb.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\avg-secure-search.xml

FF Extension: No Name - C:\Users\...\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}

FF Extension: Deutsches Wörterbuch - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\de-DE@dictionaries.addons.mozilla.org

FF Extension: British English Dictionary - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\en-GB@dictionaries.addons.mozilla.org

FF Extension: zonealarm.com - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\ffxtlbr@zonealarm.com

FF Extension: Lavasoft Search Plugin - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\jid1-yZwVFzbsyfMrqQ@jetpack

FF Extension: No Name - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\nostmp

FF Extension: No Name - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\sfStatistics.xml

FF Extension: tabutils - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\tabutils@ithinc.cn.xpi

FF Extension: toolbar - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\toolbar@gmx.net.xpi

FF Extension: No Name - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\{1280606b-2510-4fe0-97ef-9b5a22eafe30}.xpi

FF Extension: No Name - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi

FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF HKLM\...\Firefox\Extensions: [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}] C:\Program Files\CheckPoint\ZAForceField\TrustChecker

FF Extension: No Name - C:\Program Files\CheckPoint\ZAForceField\TrustChecker

FF HKLM-x32\...\Firefox\Extensions: [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}] C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker

FF Extension: ZoneAlarm Security Engine - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker
 

==================== Services (Whitelisted) =================
 

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-06-27] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-06-27] (Avira Operations GmbH & Co. KG)

R2 IswSvc; C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe [828072 2012-11-22] (Check Point Software Technologies)

R2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [123664 2012-12-16] (SANDBOXIE L.T.D)

R2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)

S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [112080 2011-02-10] (Toshiba Europe GmbH)

R2 vsmon; C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe [2447888 2013-03-27] (Check Point Software Technologies LTD)

R2 WTGService; C:\Program Files (x86)\InternetEverywhere\WTGService.exe [312784 2010-05-21] ()
 

==================== Drivers (Whitelisted) ====================
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-04-02] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130016 2013-04-02] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-04-02] (Avira Operations GmbH & Co. KG)

R0 gfibto; C:\Windows\System32\drivers\gfibto.sys [14456 2013-01-02] (GFI Software)

R1 HWiNFO32; C:\Program Files\HWiNFO64\HWiNFO64A.SYS [30592 2012-05-10] (REALiX(tm))

R2 ISWKL; C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys [33712 2012-11-22] (Check Point Software Technologies)

R0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [460888 2012-01-09] (Kaspersky Lab ZAO)

R1 kl2; C:\Windows\System32\DRIVERS\kl2.sys [11864 2012-01-09] (Kaspersky Lab ZAO)

R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [485680 2012-01-09] (Kaspersky Lab)

R3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [202632 2012-12-16] (SANDBOXIE L.T.D)

R1 Vsdatant; C:\Windows\System32\DRIVERS\vsdatant.sys [450136 2012-12-13] (Check Point Software Technologies LTD)

S3 RSUSBSTOR; System32\Drivers\RtsUStor.sys [x]

S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [x]

S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-08-01 17:46 - 2013-08-01 17:45 - 01781589 _____ (Farbar) C:\Users\...\Desktop\FRST64.exe

2013-08-01 17:45 - 2013-08-01 17:45 - 01781589 _____ (Farbar) C:\Users\...\Downloads\FRST64.exe

2013-07-31 19:31 - 2013-07-31 19:31 - 00000352 _____ C:\Windows\Tasks\{3F02381E-7340-4323-8428-84FCDE0B6051}.job

2013-07-31 10:17 - 2013-07-31 10:21 - 00000000 ____D C:\Windows\system32\MRT

2013-07-30 19:26 - 2013-07-30 19:26 - 00010376 _____ C:\Users\...\Desktop\hijackthis.log

2013-07-30 18:18 - 2013-07-30 18:18 - 00010379 _____ C:\Users\...\Downloads\hijackthis.log

2013-07-30 17:01 - 2013-07-30 18:15 - 00000645 _____ C:\Users\...\Downloads\Stinger_30072013_170103.html

2013-07-30 16:07 - 2013-07-30 16:07 - 00388608 _____ (Trend Micro Inc.) C:\Users\...\Downloads\HijackThis.exe

2013-07-29 18:16 - 2013-07-30 18:17 - 00000116 ___RH C:\Users\...\Downloads\Stinger.opt

2013-07-29 15:56 - 2013-07-30 16:35 - 00000000 ____D C:\Stinger_Quarantine

2013-07-29 15:56 - 2013-07-29 18:13 - 00000635 _____ C:\Users\...\Downloads\Stinger_29072013_155650.html

2013-07-29 08:47 - 2013-07-30 18:17 - 00000000 ____D C:\Program Files\stinger

2013-07-29 08:47 - 2013-07-29 08:47 - 00490268 _____ C:\Users\...\Downloads\runtime.dat

2013-07-29 08:46 - 2013-07-29 08:47 - 12511264 _____ (McAfee Inc) C:\Users\...\Downloads\stinger64.exe

2013-07-28 12:30 - 2013-07-28 12:30 - 00449062 ____R C:\Windows\system32\Drivers\etc\hosts.20130728-123030.backup

2013-07-28 12:30 - 2013-04-29 07:42 - 00446463 _____ C:\Windows\system32\Drivers\etc\hosts.20130728-123008.backup

2013-07-28 12:01 - 2013-07-28 12:02 - 11394080 _____ (McAfee Inc) C:\Users\...\Downloads\stinger32.exe

2013-07-28 11:37 - 2013-07-28 11:37 - 00000666 _____ C:\Windows\PFRO.log

2013-07-28 08:55 - 2013-07-28 08:55 - 01067456 _____ (Solid State Networks) C:\Users\...\Downloads\install_flashplayer11x32au_mssd_aaa_aih(1).exe

2013-07-27 12:49 - 2013-07-27 12:49 - 01067456 _____ (Solid State Networks) C:\Users\...\Downloads\install_flashplayer11x32au_mssd_aaa_aih.exe

2013-07-12 21:15 - 2013-07-12 21:15 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore1ce7f3c9633a105.job

2013-07-12 18:28 - 2013-07-12 18:28 - 00000000 ____D C:\Users\...\Desktop\Audio CD_2

2013-07-12 18:26 - 2013-07-12 18:28 - 00000000 ____D C:\Users\...\Desktop\Audio CD_1

2013-07-12 11:45 - 2013-06-12 00:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2013-07-12 11:45 - 2013-06-12 00:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2013-07-12 11:45 - 2013-06-12 00:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2013-07-12 11:45 - 2013-06-12 00:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2013-07-12 11:45 - 2013-06-12 00:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2013-07-12 11:45 - 2013-06-12 00:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2013-07-12 11:45 - 2013-06-12 00:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2013-07-12 11:45 - 2013-06-12 00:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2013-07-12 11:45 - 2013-06-12 00:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2013-07-12 11:45 - 2013-06-12 00:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2013-07-12 11:45 - 2013-06-12 00:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll

2013-07-12 11:45 - 2013-06-12 00:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2013-07-12 11:45 - 2013-06-12 00:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2013-07-12 11:45 - 2013-06-12 00:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2013-07-12 11:45 - 2013-06-12 00:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2013-07-12 11:45 - 2013-06-12 00:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2013-07-12 11:45 - 2013-06-12 00:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2013-07-12 11:45 - 2013-06-12 00:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2013-07-12 11:45 - 2013-06-12 00:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2013-07-12 11:45 - 2013-06-12 00:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2013-07-12 11:45 - 2013-06-12 00:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2013-07-12 11:45 - 2013-06-12 00:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2013-07-12 11:45 - 2013-06-12 00:25 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2013-07-12 11:45 - 2013-06-12 00:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll

2013-07-12 11:45 - 2013-06-12 00:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2013-07-12 11:45 - 2013-06-12 00:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2013-07-12 11:45 - 2013-06-12 00:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2013-07-12 11:45 - 2013-06-11 23:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe

2013-07-12 11:45 - 2013-06-11 23:50 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe

2013-07-12 11:45 - 2013-06-07 04:22 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2013-07-12 11:45 - 2013-06-07 03:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2013-07-11 18:52 - 2013-07-11 18:53 - 00000000 ____D C:\Users\...\Downloads\Akouda

2013-07-11 16:07 - 2013-05-13 06:51 - 01464320 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll

2013-07-11 16:07 - 2013-05-13 06:51 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll

2013-07-11 16:07 - 2013-05-13 06:51 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll

2013-07-11 16:07 - 2013-05-13 06:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\certenc.dll

2013-07-11 16:07 - 2013-05-13 05:45 - 01160192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll

2013-07-11 16:07 - 2013-05-13 05:45 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll

2013-07-11 16:07 - 2013-05-13 05:45 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll

2013-07-11 16:07 - 2013-05-13 04:43 - 01192448 _____ (Microsoft Corporation) C:\Windows\system32\certutil.exe

2013-07-11 16:07 - 2013-05-13 04:08 - 00903168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe

2013-07-11 16:07 - 2013-05-13 04:08 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll

2013-07-10 18:22 - 2013-07-10 18:22 - 00095853 _____ C:\Users\...\Downloads\Musterbusinessplan_Doenertempel-data.pdf;jsessionid=19E86AB2431B59D42E8BD6207DA1D238.repl23

2013-07-10 17:31 - 2013-06-05 04:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2013-07-10 17:31 - 2013-06-04 07:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll

2013-07-10 17:31 - 2013-06-04 05:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll

2013-07-10 17:31 - 2013-05-06 07:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL

2013-07-10 17:31 - 2013-05-06 05:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL

2013-07-10 17:31 - 2013-04-10 00:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll

2013-07-10 17:31 - 2013-04-02 23:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll

2013-07-03 18:56 - 2013-07-03 18:56 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2013-07-03 09:10 - 2013-07-03 09:10 - 06018531 _____ C:\Users\...\Downloads\URS dokumentacija.zip

2013-07-03 09:07 - 2013-07-03 09:07 - 08646812 _____ C:\Users\...\Downloads\URC dokumentacija.zip

2013-07-02 17:11 - 2013-07-08 15:23 - 00000000 ____D C:\Users\...\Downloads\PREDD

103
 

==================== One Month Modified Files and Folders =======
 

2013-08-01 17:46 - 2013-08-01 17:46 - 00000000 ____D C:\FRST

2013-08-01 17:45 - 2013-08-01 17:46 - 01781589 _____ (Farbar) C:\Users\...\Desktop\FRST64.exe

2013-08-01 17:45 - 2013-08-01 17:45 - 01781589 _____ (Farbar) C:\Users\...\Downloads\FRST64.exe

2013-08-01 17:43 - 2012-07-26 12:18 - 00000000 ____D C:\Users\...\AppData\Roaming\Dropbox

2013-08-01 17:29 - 2009-07-14 05:45 - 00014784 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-08-01 17:29 - 2009-07-14 05:45 - 00014784 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-08-01 17:20 - 2013-06-29 07:58 - 00002576 _____ C:\Windows\setupact.log

2013-07-31 19:32 - 2012-06-08 17:21 - 02027801 _____ C:\Windows\WindowsUpdate.log

2013-07-31 19:31 - 2013-07-31 19:31 - 00000352 _____ C:\Windows\Tasks\{3F02381E-7340-4323-8428-84FCDE0B6051}.job

2013-07-31 19:31 - 2012-06-09 16:16 - 00000000 ____D C:\Users\...\AppData\Roaming\Skype

2013-07-31 10:21 - 2013-07-31 10:17 - 00000000 ____D C:\Windows\system32\MRT

2013-07-31 10:15 - 2009-07-14 18:58 - 00657910 _____ C:\Windows\system32\perfh007.dat

2013-07-31 10:15 - 2009-07-14 18:58 - 00131250 _____ C:\Windows\system32\perfc007.dat

2013-07-31 10:15 - 2009-07-14 06:13 - 01529334 _____ C:\Windows\system32\PerfStringBackup.INI

2013-07-30 19:26 - 2013-07-30 19:26 - 00010376 _____ C:\Users\...\Desktop\hijackthis.log

2013-07-30 18:18 - 2013-07-30 18:18 - 00010379 _____ C:\Users\...\Downloads\hijackthis.log

2013-07-30 18:17 - 2013-07-29 18:16 - 00000116 ___RH C:\Users\...\Downloads\Stinger.opt

2013-07-30 18:17 - 2013-07-29 08:47 - 00000000 ____D C:\Program Files\stinger

2013-07-30 18:15 - 2013-07-30 17:01 - 00000645 _____ C:\Users\...\Downloads\Stinger_30072013_170103.html

2013-07-30 16:35 - 2013-07-29 15:56 - 00000000 ____D C:\Stinger_Quarantine

2013-07-30 16:10 - 2012-06-09 10:49 - 00000000 ____D C:\Users\...\Desktop\Sicherheit

2013-07-30 16:07 - 2013-07-30 16:07 - 00388608 _____ (Trend Micro Inc.) C:\Users\...\Downloads\HijackThis.exe

2013-07-29 21:34 - 2013-04-03 13:12 - 00000000 ____D C:\Users\...\Downloads\Software

2013-07-29 18:13 - 2013-07-29 15:56 - 00000635 _____ C:\Users\...\Downloads\Stinger_29072013_155650.html

2013-07-29 08:47 - 2013-07-29 08:47 - 00490268 _____ C:\Users\...\Downloads\runtime.dat

2013-07-29 08:47 - 2013-07-29 08:46 - 12511264 _____ (McAfee Inc) C:\Users\...\Downloads\stinger64.exe

2013-07-28 14:24 - 2012-12-24 19:19 - 00000000 ____D C:\Program Files (x86)\stinger

2013-07-28 12:30 - 2013-07-28 12:30 - 00449062 ____R C:\Windows\system32\Drivers\etc\hosts.20130728-123030.backup

2013-07-28 12:02 - 2013-07-28 12:01 - 11394080 _____ (McAfee Inc) C:\Users\...\Downloads\stinger32.exe

2013-07-28 11:37 - 2013-07-28 11:37 - 00000666 _____ C:\Windows\PFRO.log

2013-07-28 08:57 - 2012-07-16 07:53 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-07-28 08:57 - 2012-06-09 20:52 - 00000000 ____D C:\Users\...\AppData\Local\Adobe

2013-07-28 08:57 - 2012-06-09 15:53 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2013-07-28 08:57 - 2012-06-09 15:53 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2013-07-28 08:55 - 2013-07-28 08:55 - 01067456 _____ (Solid State Networks) C:\Users\...\Downloads\install_flashplayer11x32au_mssd_aaa_aih(1).exe

2013-07-27 12:49 - 2013-07-27 12:49 - 01067456 _____ (Solid State Networks) C:\Users\...\Downloads\install_flashplayer11x32au_mssd_aaa_aih.exe

2013-07-18 10:49 - 2013-06-11 19:25 - 00000000 ____D C:\Users\...\Downloads\Forum Citoyen pour l'Environnement_FORCE 2013

2013-07-12 21:15 - 2013-07-12 21:15 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore1ce7f3c9633a105.job

2013-07-12 18:28 - 2013-07-12 18:28 - 00000000 ____D C:\Users\...\Desktop\Audio CD_2

2013-07-12 18:28 - 2013-07-12 18:26 - 00000000 ____D C:\Users\...\Desktop\Audio CD_1

2013-07-12 18:27 - 2012-06-09 16:49 - 00000000 ____D C:\Users\...\AppData\Roaming\vlc

2013-07-12 18:23 - 2012-06-09 13:26 - 00000000 ____D C:\ProgramData\Microsoft Help

2013-07-12 11:58 - 2012-06-08 18:18 - 00000000 ____D C:\Windows\Panther

2013-07-11 18:53 - 2013-07-11 18:52 - 00000000 ____D C:\Users\...\Downloads\Akouda

2013-07-11 14:50 - 2012-06-09 21:02 - 00000000 ____D C:\Program Files (x86)\Opera

2013-07-10 18:22 - 2013-07-10 18:22 - 00095853 _____ C:\Users\...\Downloads\Musterbusinessplan_Doenertempel-data.pdf;jsessionid=19E86AB2431B59D42E8BD6207DA1D238.repl23

2013-07-10 17:41 - 2009-07-14 05:45 - 00413624 _____ C:\Windows\system32\FNTCACHE.DAT

2013-07-10 17:37 - 2009-07-14 19:18 - 00000000 ____D C:\Program Files\Windows Journal

2013-07-10 17:37 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Defender

2013-07-10 17:37 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender

2013-07-08 15:23 - 2013-07-02 17:11 - 00000000 ____D C:\Users\...\Downloads\PREDD

2013-07-04 11:39 - 2012-06-15 22:30 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2013-07-03 18:56 - 2013-07-03 18:56 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2013-07-03 09:10 - 2013-07-03 09:10 - 06018531 _____ C:\Users\...\Downloads\URS dokumentacija.zip

2013-07-03 09:07 - 2013-07-03 09:07 - 08646812 _____ C:\Users\...\Downloads\URC dokumentacija.zip
 

Files to move or delete:

====================

C:\Windows\Tasks\{020F7741-8C06-41AE-A2C6-3464E3DB4769}.job

C:\Windows\Tasks\{3F02381E-7340-4323-8428-84FCDE0B6051}.job

C:\Windows\Tasks\{98188F27-98C8-4287-84B3-46DCCEC3B929}.job

C:\Windows\Tasks\{9B8AEFA2-134D-4E43-88E6-552AEBB6355A}.job

C:\Windows\Tasks\{EC7C70CF-E283-4A3D-8B00-DCE5C6C75C32}.job

C:\Windows\Tasks\{F3FF7234-8D03-47B2-96AE-410EF37C0422}.job
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2012-06-08 18:10
 

==================== End Of Log ============================

--- --- ---

--- --- ---

- Addition.txt

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 30-07-2013 03

Ran by Sabine at 2013-08-01 17:47:50

Running from C:\Users\...\Desktop

Boot Mode: Normal

==========================================================
 
 

==================== Installed Programs =======================
 

   

 Update for Microsoft Office 2007 (KB2508958) (x32)

7-Zip 9.20 (x32)

7-Zip 9.20 (x64 edition) (Version: 9.20.00.0)

Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.94)

Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03)

Ashampoo Burning Studio 2012 v.10.0.15 (x32 Version: 10.0.15)

ATI Catalyst Install Manager (Version: 3.0.732.0)

Avira Free Antivirus (x32 Version: 13.0.0.3884)

Catalyst Control Center - Branding (x32 Version: 1.00.0000)

Catalyst Control Center Core Implementation (x32 Version: 2009.0729.2238.38827)

Catalyst Control Center Graphics Full Existing (x32 Version: 2009.0729.2238.38827)

Catalyst Control Center Graphics Full New (x32 Version: 2009.0729.2238.38827)

Catalyst Control Center Graphics Light (x32 Version: 2009.0729.2238.38827)

Catalyst Control Center Graphics Previews Vista (x32 Version: 2009.0729.2238.38827)

Catalyst Control Center InstallProxy (x32 Version: 2009.0729.2238.38827)

Catalyst Control Center Localization All (x32 Version: 2009.0729.2238.38827)

CCC Help Chinese Standard (x32 Version: 2009.0729.2237.38827)

CCC Help Chinese Traditional (x32 Version: 2009.0729.2237.38827)

CCC Help Czech (x32 Version: 2009.0729.2237.38827)

CCC Help Danish (x32 Version: 2009.0729.2237.38827)

CCC Help Dutch (x32 Version: 2009.0729.2237.38827)

CCC Help English (x32 Version: 2009.0729.2237.38827)

CCC Help Finnish (x32 Version: 2009.0729.2237.38827)

CCC Help French (x32 Version: 2009.0729.2237.38827)

CCC Help German (x32 Version: 2009.0729.2237.38827)

CCC Help Greek (x32 Version: 2009.0729.2237.38827)

CCC Help Hungarian (x32 Version: 2009.0729.2237.38827)

CCC Help Italian (x32 Version: 2009.0729.2237.38827)

CCC Help Japanese (x32 Version: 2009.0729.2237.38827)

CCC Help Korean (x32 Version: 2009.0729.2237.38827)

CCC Help Norwegian (x32 Version: 2009.0729.2237.38827)

CCC Help Polish (x32 Version: 2009.0729.2237.38827)

CCC Help Portuguese (x32 Version: 2009.0729.2237.38827)

CCC Help Russian (x32 Version: 2009.0729.2237.38827)

CCC Help Spanish (x32 Version: 2009.0729.2237.38827)

CCC Help Swedish (x32 Version: 2009.0729.2237.38827)

CCC Help Thai (x32 Version: 2009.0729.2237.38827)

CCC Help Turkish (x32 Version: 2009.0729.2237.38827)

ccc-core-static (x32 Version: 2009.0729.2238.38827)

ccc-utility64 (Version: 2009.0729.2238.38827)

Dropbox (HKCU Version: 2.0.22)

eaner (Version: 4.01)

EVEREST Home Edition v2.20 (x32 Version: 2.20)

Google Update Helper (x32 Version: 1.3.21.153)

HP Deskjet 3000 J310 series - Grundlegende Software für das Gerät (Version: 28.0.1315.0)

HWiNFO64 Version 3.96 (Version: 3.96)

Intel® Matrix Storage Manager

Internet Everywhere (x32 Version: )

IrfanView (remove only) (x32 Version: 4.32)

Java Auto Updater (x32 Version: 2.1.6.0)

Java(TM) 7 Update 4 (x32 Version: 7.0.40)

JavaFX 2.1.0 (x32 Version: 2.1.0)

Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)

Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)

Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)

Microsoft Office 2007 Service Pack 3 (SP3) (x32)

Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000)

Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014)

Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32)

Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000)

Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)

Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336)

Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)

Mozilla Firefox 22.0 (x86 de) (x32 Version: 22.0)

Mozilla Maintenance Service (x32 Version: 22.0)

MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)

MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)

NetCologne-Installationsdateien entfernen (x32)

Opera 12.16 (x32 Version: 12.16.1860)

PDFCreator (x32 Version: 1.3.2)

PlayReady PC Runtime amd64 (Version: 1.3.0)

Realtek Ethernet Controller Driver For Windows Vista and Later (x32 Version: 1.00.0011)

Realtek High Definition Audio Driver (x32 Version: 6.0.1.5904)

Realtek USB 2.0 Card Reader (x32 Version: 6.1.7600.30101)

SAGEM F@st 1704 (x32 Version: 1.00.000)

Sandboxie 3.76 (64-bit) (Version: 3.76)

Skype™ 6.5 (x32 Version: 6.5.158)

SpeedFan (remove only) (x32)

Spybot - Search & Destroy (x32 Version: 1.6.2)

Synaptics Pointing Device Driver (Version: 13.2.6.1)

TOSHIBA Assist (x32 Version: 2.01.11)

TOSHIBA Bulletin Board (Version: 1.0.04.64)

TOSHIBA Bulletin Board (x32 Version: 1.0.04.64)

TOSHIBA ConfigFree (x32 Version: 8.0.23)

TOSHIBA Disc Creator (Version: 2.1.0.1 for x64)

TOSHIBA DVD PLAYER (x32 Version: 3.01.0.11-A)

TOSHIBA eco Utility (Version: 1.1.11.64)

TOSHIBA eco Utility (x32 Version: 1.1.11.64)

TOSHIBA Extended Tiles for Windows Mobility Center (Version: 1.01.00)

TOSHIBA Extended Tiles for Windows Mobility Center (x32 Version: )

TOSHIBA Face Recognition (Version: 3.1.1.64)

TOSHIBA Face Recognition (x32 Version: 3.1.1.64)

TOSHIBA Flash Cards Support Utility (x32 Version: 1.63.0.4C)

TOSHIBA Hardware Setup (x32 Version: 1.63.0.11C)

TOSHIBA HDD/SSD Alert (Version: 3.1.64.0)

TOSHIBA HDD/SSD Alert (x32 Version: 3.1.64.0)

TOSHIBA PC Health Monitor (Version: 1.4.1.64)

TOSHIBA ReelTime (Version: 1.0.04.64)

TOSHIBA ReelTime (x32 Version: 1.0.04.64)

TOSHIBA SD Memory Utilities (Version: 1.9.1.12)

TOSHIBA Service Station (x32 Version: 2.1.33)

TOSHIBA Supervisor Password (x32 Version: 1.63.0.7C)

TOSHIBA Supervisorkennwort (x32 Version: 1.63.0.7C)

TOSHIBA TEMPRO (x32 Version: 3.35)

TOSHIBA Value Added Package (Version: 1.2.34.64)

TOSHIBA Value Added Package (x32 Version: 1.2.34.64)

TOSHIBA Web Camera Application (x32 Version: 1.1.1.4)

Update for 2007 Microsoft Office System (KB967642) (x32)

Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)

Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32)

Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition (x32)

Update for Microsoft Office 2007 suites (KB2596802) 32-Bit Edition (x32)

Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition (x32)

Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (x32)

Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32)

Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (x32)

Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2817563) 32-Bit Edition (x32)

Update für Microsoft Office Excel 2007 Help (KB963678) (x32)

Update für Microsoft Office Outlook 2007 Help (KB963677) (x32)

Update für Microsoft Office Powerpoint 2007 Help (KB963669) (x32)

Update für Microsoft Office Word 2007 Help (KB963665) (x32)

Utility Common Driver (x32 Version: 1.0.50.27C)

VC 9.0 Runtime (x32 Version: 1.0.0)

VLC media player 2.0.2 (x32 Version: 2.0.2)

WinRAR archiver (x32)

xp-AntiSpy 3.98-2 (x32)

ZoneAlarm Antivirus (x32 Version: 10.2.078.000)

ZoneAlarm Firewall (x32 Version: 11.0.000.504)

ZoneAlarm Free Firewall (x32 Version: 11.0.000.504)

ZoneAlarm LTD Toolbar

ZoneAlarm Security (x32 Version: 11.0.000.504)

ZoneAlarm Security Toolbar  (x32 Version: 1.8.11.11)
 

==================== Restore Points  =========================
 

31-07-2013 09:12:14 Windows Update
 

==================== Hosts content: ==========================
 

2013-04-07 10:21 - 2013-07-28 12:30 - 00449062 ____N C:\Windows\system32\Drivers\etc\hosts

127.0.0.1        www.007guard.com

127.0.0.1        007guard.com

127.0.0.1        008i.com

127.0.0.1        www.008k.com

127.0.0.1        008k.com

127.0.0.1        www.00hq.com

127.0.0.1        00hq.com

127.0.0.1        010402.com

127.0.0.1        www.032439.com

127.0.0.1        032439.com

127.0.0.1        www.0scan.com

127.0.0.1        0scan.com

127.0.0.1        www.1000gratisproben.com

127.0.0.1        1000gratisproben.com

127.0.0.1        1001namen.com

127.0.0.1        www.1001namen.com

127.0.0.1        100888290cs.com

127.0.0.1        www.100888290cs.com

127.0.0.1        www.100sexlinks.com

127.0.0.1        100sexlinks.com

127.0.0.1        www.10sek.com

127.0.0.1        10sek.com

127.0.0.1        www.1-2005-search.com

127.0.0.1        1-2005-search.com

127.0.0.1        www.123fporn.info

127.0.0.1        123fporn.info

127.0.0.1        123haustiereundmehr.com

127.0.0.1        www.123haustiereundmehr.com

127.0.0.1        123moviedownload.com
 

There are 1000 more lines.
 
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {06344D3C-C3F4-435E-A413-1B6A9E7F8EE9} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => C:\Windows\system32\rundll32.exe [2009-07-14] (Microsoft Corporation)

Task: {09A1E7A4-A072-4241-8177-05C6EA488BDA} - System32\Tasks\Ad-Aware Antivirus Scheduled Scan => C:\PROGRA~2\AD-AWA~1\AdAwareLauncher.exe No File

Task: {43009BA6-18B0-4644-A5F4-E85D2EB979FC} - System32\Tasks\Microsoft\Windows\WindowsBackup\Windows Backup Monitor => C:\Windows\system32\sdclt.exe [2010-11-20] (Microsoft Corporation)

Task: {C90BF6F2-B51B-409F-AA26-A0D3A3A96486} - System32\Tasks\ConfigFree Startup Programs => C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe [2009-09-03] (TOSHIBA CORPORATION)

Task: {D9792FE2-6593-43B3-8A59-47733010C68A} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2009-07-14] (Microsoft Corporation)

Task: C:\Windows\Tasks\Ad-Aware Antivirus Scheduled Scan.job => C:\PROGRA~2\AD-AWA~1\AdAwareLauncher.exe

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\ConfigFree Startup Programs.job => C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1ce7f3c9633a105.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\HP Deskjet 3000 J310 series.exe_{3D3BC974-AF55-4E5A-9E50-038BDE7B2237}.job => C:\Program Files\HP\HP Deskjet 3000 J310 series\Bin\HP Deskjet 3000 J310 series.exe

Task: C:\Windows\Tasks\Toolbox.exe_{55AE83F5-9CC3-466D-9C61-0246AB5F891A}.job => C:\Program Files\HP\HP Deskjet 3000 J310 series\Bin\Toolbox.exe

Task: C:\Windows\Tasks\{020F7741-8C06-41AE-A2C6-3464E3DB4769}.job => c:\program files (x86)\mozilla firefox\firefox.exe

Task: C:\Windows\Tasks\{3F02381E-7340-4323-8428-84FCDE0B6051}.job => c:\program files (x86)\mozilla firefox\firefox.exe

Task: C:\Windows\Tasks\{98188F27-98C8-4287-84B3-46DCCEC3B929}.job => c:\program files (x86)\mozilla firefox\firefox.exe

Task: C:\Windows\Tasks\{9B8AEFA2-134D-4E43-88E6-552AEBB6355A}.job => c:\program files (x86)\mozilla firefox\firefox.exe

Task: C:\Windows\Tasks\{EC7C70CF-E283-4A3D-8B00-DCE5C6C75C32}.job => c:\program files (x86)\mozilla firefox\firefox.exe

Task: C:\Windows\Tasks\{F3FF7234-8D03-47B2-96AE-410EF37C0422}.job => c:\program files (x86)\mozilla firefox\firefox.exe
 

==================== Faulty Device Manager Devices =============
 

Name: USB2.0 UVC WebCam

Description: USB-Videogerät

Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}

Manufacturer: Microsoft

Service: usbvideo

Problem: : This device is disabled. (Code 22)

Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
 

Name: Intel(R) WiFi Link 5100 AGN

Description: Intel(R) WiFi Link 5100 AGN

Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}

Manufacturer: Intel Corporation

Service: NETw5s64

Problem: : This device is disabled. (Code 22)

Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (07/29/2013 02:59:50 PM) (Source: Avira Antivirus) (User: NT-AUTORITÄT)

Description: AUSNAHMEFEHLER beim Aufruf der Funktion AVEPROC_TestFile() für die Datei

D:\Eigene Dateien\Eigene Dateien\Eigene Bilder\Kuba\3\PICT0400.JPG.

 [ACCESS_VIOLATION Exception!! EIP = 0x70248c32]

 Bitte Avira informieren und die obige Datei übersenden!
 

Error: (07/28/2013 03:05:46 PM) (Source: Microsoft-Windows-CAPI2) (User: )

Description: Vom Kryptografiedienst konnte das VSS-Sicherungsobjekt "System Writer" nicht initialisiert werden.
 
 

Details:

Could not query the status of the EventSystem service.
 

System Error:

Der Computer wird heruntergefahren.

.
 

Error: (06/22/2013 08:40:43 AM) (Source: Windows Search Service) (User: )

Description: Der Index kann nicht initialisiert werden.
 
 

Details:

        Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)
 

Error: (06/22/2013 08:40:43 AM) (Source: Windows Search Service) (User: )

Description: Die Anwendung kann nicht initialisiert werden.
 

Kontext: Windows Anwendung
 
 

Details:

        Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)
 

Error: (06/22/2013 08:40:43 AM) (Source: Windows Search Service) (User: )

Description: Das Gatherer-Objekt kann nicht initialisiert werden.
 

Kontext: Windows Anwendung, SystemIndex Katalog
 
 

Details:

        Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)
 

Error: (06/22/2013 08:40:43 AM) (Source: Windows Search Service) (User: )

Description: Plug-In in <Search.TripoliIndexer> kann nicht initialisiert werden.
 

Kontext: Windows Anwendung, SystemIndex Katalog
 
 

Details:

        Element nicht gefunden.  (HRESULT : 0x80070490) (0x80070490)
 

Error: (06/22/2013 08:40:41 AM) (Source: Windows Search Service) (User: )

Description: Plug-In in <Search.JetPropStore> kann nicht initialisiert werden.
 

Kontext: Windows Anwendung, SystemIndex Katalog
 
 

Details:

        Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)
 

Error: (06/22/2013 08:40:41 AM) (Source: Windows Search Service) (User: )

Description: Die Eigenschaftenspeicherdaten können von Windows Search nicht geladen werden.
 

Kontext: Windows Anwendung, SystemIndex Katalog
 
 

Details:

        Die Inhaltsindexdatenbank ist fehlerhaft.  (HRESULT : 0xc0041800) (0xc0041800)
 

Error: (06/22/2013 08:40:41 AM) (Source: Windows Search Service) (User: )

Description: Windows Search wird aufgrund eines Problems bei der Indizierung The catalog is corrupt beendet.
 
 

Details:

        Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)
 

Error: (06/22/2013 08:40:41 AM) (Source: Windows Search Service) (User: )

Description: Vom Suchdienst wurden beschädigte Datendateien im Index {id=4700} erkannt. Vom Dienst wird versucht, dieses Problem durch Neuerstellung des Indexes automatisch zu beheben.
 
 

Details:

        Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)
 
 

System errors:

=============

Error: (08/01/2013 05:23:51 PM) (Source: DCOM) (User: NT-AUTORITÄT)

Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
 

Error: (08/01/2013 05:20:26 PM) (Source: atikmdag) (User: )

Description: Display is not active
 

Error: (08/01/2013 05:20:26 PM) (Source: atikmdag) (User: )

Description: CPLIB :: General - Invalid Parameter
 

Error: (07/31/2013 06:49:57 PM) (Source: atikmdag) (User: )

Description: Display is not active
 

Error: (07/31/2013 04:38:02 PM) (Source: atikmdag) (User: )

Description: Display is not active
 

Error: (07/31/2013 02:12:51 PM) (Source: atikmdag) (User: )

Description: Display is not active
 

Error: (07/31/2013 09:39:51 AM) (Source: DCOM) (User: NT-AUTORITÄT)

Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
 

Error: (07/31/2013 09:38:17 AM) (Source: atikmdag) (User: )

Description: Display is not active
 

Error: (07/31/2013 09:38:17 AM) (Source: atikmdag) (User: )

Description: CPLIB :: General - Invalid Parameter
 

Error: (07/30/2013 08:33:33 PM) (Source: Service Control Manager) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst TOSHIBA eco Utility Service erreicht.
 
 

Microsoft Office Sessions:

=========================
 

CodeIntegrity Errors:

===================================

  Date: 2013-08-01 17:48:02.178

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2013-07-31 19:31:04.545

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2013-07-31 16:38:18.191

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2013-07-31 14:22:34.101

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2013-07-31 14:13:29.666

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2013-07-31 10:56:35.906

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2013-07-31 10:12:44.231

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2013-07-30 20:32:38.495

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2013-07-30 19:54:17.723

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2013-07-30 16:07:08.250

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 50%

Total physical RAM: 4060.88 MB

Available physical RAM: 1994.95 MB

Total Pagefile: 8119.93 MB

Available Pagefile: 5700.57 MB

Total Virtual: 8192 MB

Available Virtual: 8191.82 MB
 

==================== Drives ================================
 

Drive c: (Boot) (Fixed) (Total:48.73 GB) (Free:14.03 GB) NTFS (Disk=0 Partition=2)

Drive d: (Daten) (Fixed) (Total:117.19 GB) (Free:63.99 GB) NTFS (Disk=0 Partition=3)

Drive e: (Media) (Fixed) (Total:117.19 GB) (Free:114.34 GB) NTFS (Disk=0 Partition=4)

Drive s: (Sicherung) (Fixed) (Total:182.56 GB) (Free:157.43 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: F078D84B)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=49 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=117 GB) - (Type=07 NTFS)

Partition 4: (Not Active) - (Size=300 GB) - (Type=OF Extended)
 

==================== End Of Log ============================

Ich hoffe, jetzt kannst Du alles lesen.

Nochmals vielen Dank und
viele Grüße

Claudia

Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel

Link 1

WICHTIG - Speichere Combofix auf deinem Desktop

Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Hallo Schrauber,

habe meine Schwester erreicht (ist nicht so einfach - sie lebt weiter weg :-( )

Hier die Log-Datei von ComboFix:

Code:

ComboFix 13-08-04.01 - ... 04.08.2013  15:25:39.1.2 - x64 MINIMAL

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.4061.2804 [GMT 1:00]

ausgeführt von:: c:\users\...\Desktop\ComboFix.exe

AV: Avira Desktop *Enabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

AV: ZoneAlarm Free Firewall Antivirus *Enabled/Updated* {DE038A5B-9EDD-18A9-2361-FF7D98D43730}

FW: ZoneAlarm Free Firewall Firewall *Enabled* {E6380B7E-D4B2-19F1-083E-56486607704B}

SP: Avira Desktop *Enabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: ZoneAlarm Free Firewall Anti-Spyware *Enabled/Updated* {65626BBF-B8E7-1727-19D1-C40FE3537D8D}

 * Neuer Wiederherstellungspunkt wurde erstellt

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\program files (x86)\xp-AntiSpy

c:\program files (x86)\xp-AntiSpy\Uninstall.exe

c:\program files (x86)\xp-AntiSpy\xp-AntiSpy.chm

c:\program files (x86)\xp-AntiSpy\xp-AntiSpy.exe

c:\program files (x86)\xp-AntiSpy\xp-AntiSpy.url

c:\windows\SysWow64\rnaph.dll

.

.

(((((((((((((((((((((((   Dateien erstellt von 2013-07-04 bis 2013-08-04  ))))))))))))))))))))))))))))))

.

.

2013-08-04 14:30 . 2013-08-04 14:30        --------        d-----w-        c:\users\Default\AppData\Local\temp

2013-08-01 16:46 . 2013-08-01 16:46        --------        d-----w-        C:\FRST

2013-07-31 09:17 . 2013-07-31 09:21        --------        d-----w-        c:\windows\system32\MRT

2013-07-29 14:56 . 2013-07-30 15:35        --------        d-----w-        C:\Stinger_Quarantine

2013-07-29 07:47 . 2013-07-30 17:17        --------        d-----w-        c:\program files\stinger

2013-07-11 15:07 . 2013-05-13 05:51        184320        ----a-w-        c:\windows\system32\cryptsvc.dll

2013-07-11 15:07 . 2013-05-13 05:51        1464320        ----a-w-        c:\windows\system32\crypt32.dll

2013-07-11 15:07 . 2013-05-13 05:51        139776        ----a-w-        c:\windows\system32\cryptnet.dll

2013-07-11 15:07 . 2013-05-13 05:50        52224        ----a-w-        c:\windows\system32\certenc.dll

2013-07-11 15:07 . 2013-05-13 04:45        140288        ----a-w-        c:\windows\SysWow64\cryptsvc.dll

2013-07-11 15:07 . 2013-05-13 04:45        1160192        ----a-w-        c:\windows\SysWow64\crypt32.dll

2013-07-11 15:07 . 2013-05-13 04:45        103936        ----a-w-        c:\windows\SysWow64\cryptnet.dll

2013-07-11 15:07 . 2013-05-13 03:43        1192448        ----a-w-        c:\windows\system32\certutil.exe

2013-07-11 15:07 . 2013-05-13 03:08        903168        ----a-w-        c:\windows\SysWow64\certutil.exe

2013-07-11 15:07 . 2013-05-13 03:08        43008        ----a-w-        c:\windows\SysWow64\certenc.dll

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-07-28 07:57 . 2012-06-09 14:53        71048        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2013-07-28 07:57 . 2012-06-09 14:53        692104        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2013-06-27 13:06 . 2013-05-17 20:13        83672        ----a-w-        c:\windows\system32\drivers\avnetflt.sys

2013-06-23 23:57 . 2012-06-09 11:17        78277128        ----a-w-        c:\windows\system32\MRT.exe

2013-05-10 05:49 . 2013-06-21 08:10        30720        ----a-w-        c:\windows\system32\cryptdlg.dll

2013-05-10 03:20 . 2013-06-21 08:10        24576        ----a-w-        c:\windows\SysWow64\cryptdlg.dll

2013-05-08 06:39 . 2013-06-21 08:10        1910632        ----a-w-        c:\windows\system32\drivers\tcpip.sys

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-25 00:36        130736        ----a-w-        c:\users\...\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-25 00:36        130736        ----a-w-        c:\users\...\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-25 00:36        130736        ----a-w-        c:\users\...\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-07-29 98304]

"KeNotify"="c:\program files (x86)\TOSHIBA\Utilities\KeNotify.exe" [2009-01-13 34088]

"HWSetup"="c:\program files\TOSHIBA\Utilities\HWSetup.exe" [2009-06-02 423936]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]

"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-06-27 345144]

.

c:\users\...\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dropbox.lnk - c:\users\...\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2013-5-25 27776968]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"NoRecentDocsNetHood"= 1 (0x1)

.

R1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]

R1 HWiNFO32;HWiNFO32/64 Kernel Driver;c:\program files\HWiNFO64\HWiNFO64A.SYS;c:\program files\HWiNFO64\HWiNFO64A.SYS [x]

R1 kl2;kl2;c:\windows\system32\DRIVERS\kl2.sys;c:\windows\SYSNATIVE\DRIVERS\kl2.sys [x]

R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]

R2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]

R2 cfWiMAXService;ConfigFree WiMAX Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe;c:\program files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe [x]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]

R2 ConfigFree Gadget Service;ConfigFree Gadget Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFProcSRVC.exe;c:\program files (x86)\TOSHIBA\ConfigFree\CFProcSRVC.exe [x]

R2 ConfigFree Service;ConfigFree Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe;c:\program files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe [x]

R2 gupdate;Google Update-Dienst (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe;c:\program files (x86)\Google\Update\GoogleUpdate.exe [x]

R2 ISWKL;ZoneAlarm LTD Toolbar ISWKL;c:\program files\CheckPoint\ZAForceField\ISWKL.sys;c:\program files\CheckPoint\ZAForceField\ISWKL.sys [x]

R2 IswSvc;ZoneAlarm LTD Toolbar IswSvc;c:\program files\CheckPoint\ZAForceField\IswSvc.exe;c:\program files\CheckPoint\ZAForceField\IswSvc.exe [x]

R2 sbapifs;sbapifs;c:\windows\system32\DRIVERS\sbapifs.sys;c:\windows\SYSNATIVE\DRIVERS\sbapifs.sys [x]

R2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [x]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]

R2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;c:\program files\TOSHIBA\TECO\TecoService.exe;c:\program files\TOSHIBA\TECO\TecoService.exe [x]

R2 WTGService;WTGService;c:\program files (x86)\InternetEverywhere\WTGService.exe;c:\program files (x86)\InternetEverywhere\WTGService.exe [x]

R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe;c:\program files (x86)\Google\Update\GoogleUpdate.exe [x]

R3 NETw5s64;Intel(R) Wireless WiFi Link Adaptertreiber für Windows 7 64-Bit;c:\windows\system32\DRIVERS\NETw5s64.sys;c:\windows\SYSNATIVE\DRIVERS\NETw5s64.sys [x]

R3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series - Adaptertreiber für Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys;c:\windows\SYSNATIVE\DRIVERS\netw5v64.sys [x]

R3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys;c:\windows\SYSNATIVE\DRIVERS\pgeffect.sys [x]

R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]

R3 RTL8167;Realtek 8167 NT-Treiber;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]

R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys;c:\windows\SYSNATIVE\DRIVERS\Rts516xIR.sys [x]

R3 SBFWIMCL;GFI Software Firewall NDIS IM Filter Service;c:\windows\system32\DRIVERS\sbfwim.sys;c:\windows\SYSNATIVE\DRIVERS\sbfwim.sys [x]

R3 SBFWIMCLMP;GFI Software Firewall NDIS IM Filter Miniport;c:\windows\system32\DRIVERS\SBFWIM.sys;c:\windows\SYSNATIVE\DRIVERS\SBFWIM.sys [x]

R3 sbhips;sbhips;c:\windows\system32\drivers\sbhips.sys;c:\windows\SYSNATIVE\drivers\sbhips.sys [x]

R3 sbwtis;sbwtis;c:\windows\system32\DRIVERS\sbwtis.sys;c:\windows\SYSNATIVE\DRIVERS\sbwtis.sys [x]

R3 TemproMonitoringService;Notebook Performance Tuning Service (TEMPRO);c:\program files (x86)\Toshiba TEMPRO\TemproSvc.exe;c:\program files (x86)\Toshiba TEMPRO\TemproSvc.exe [x]

R3 TMachInfo;TMachInfo;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [x]

R3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [x]

R3 TPCHSrv;TPCH Service;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]

R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]

S0 gfibto;gfibto;c:\windows\system32\drivers\gfibto.sys;c:\windows\SYSNATIVE\drivers\gfibto.sys [x]

S0 tos_sps64;TOSHIBA tos_sps64 Service;c:\windows\system32\DRIVERS\tos_sps64.sys;c:\windows\SYSNATIVE\DRIVERS\tos_sps64.sys [x]

S1 SBRE;SBRE;c:\windows\system32\drivers\SBREdrv.sys;c:\windows\SYSNATIVE\drivers\SBREdrv.sys [x]

S2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\DRIVERS\TVALZFL.sys;c:\windows\SYSNATIVE\DRIVERS\TVALZFL.sys [x]

.

.

Inhalt des "geplante Tasks" Ordners

.

2013-07-28 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-09 07:57]

.

2012-06-09 c:\windows\Tasks\ConfigFree Startup Programs.job

- c:\program files (x86)\TOSHIBA\ConfigFree\NDSTray.exe [2009-09-03 13:06]

.

2013-07-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore1ce7f3c9633a105.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-11-17 22:49]

.

2012-12-31 c:\windows\Tasks\HP Deskjet 3000 J310 series.exe_{3D3BC974-AF55-4E5A-9E50-038BDE7B2237}.job

- c:\program files\HP\HP Deskjet 3000 J310 series\Bin\HP Deskjet 3000 J310 series.exe [2012-10-17 03:40]

.

2012-12-31 c:\windows\Tasks\Toolbox.exe_{55AE83F5-9CC3-466D-9C61-0246AB5F891A}.job

- c:\program files\HP\HP Deskjet 3000 J310 series\Bin\Toolbox.exe [2012-10-17 03:34]

.

2013-01-24 c:\windows\Tasks\{020F7741-8C06-41AE-A2C6-3464E3DB4769}.job

- c:\program files (x86)\mozilla firefox\firefox.exe [2013-07-03 17:56]

.

2013-07-31 c:\windows\Tasks\{3F02381E-7340-4323-8428-84FCDE0B6051}.job

- c:\program files (x86)\mozilla firefox\firefox.exe [2013-07-03 17:56]

.

2013-01-24 c:\windows\Tasks\{98188F27-98C8-4287-84B3-46DCCEC3B929}.job

- c:\program files (x86)\mozilla firefox\firefox.exe [2013-07-03 17:56]

.

2013-01-24 c:\windows\Tasks\{9B8AEFA2-134D-4E43-88E6-552AEBB6355A}.job

- c:\program files (x86)\mozilla firefox\firefox.exe [2013-07-03 17:56]

.

2013-01-24 c:\windows\Tasks\{EC7C70CF-E283-4A3D-8B00-DCE5C6C75C32}.job

- c:\program files (x86)\mozilla firefox\firefox.exe [2013-07-03 17:56]

.

2013-01-24 c:\windows\Tasks\{F3FF7234-8D03-47B2-96AE-410EF37C0422}.job

- c:\program files (x86)\mozilla firefox\firefox.exe [2013-07-03 17:56]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-25 00:36        164016        ----a-w-        c:\users\...\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-25 00:36        164016        ----a-w-        c:\users\...\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-25 00:36        164016        ----a-w-        c:\users\...\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]

@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-25 00:36        164016        ----a-w-        c:\users\...\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"TosSENotify"="c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [2009-08-03 709976]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-07-28 7982112]

"ISW"="c:\program files\CheckPoint\ZAForceField\ForceField.exe" [2012-11-22 1127592]

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://safesearchr.lavasoft.com/?source=3336ca5f&tbp=homepage&toolbarid=adawaretb&v=2_2&u=BB9CCE2F3C2A4F81A0BCA1507DB50408

mLocal Page = c:\windows\SysWOW64\blank.htm

IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000

TCP: DhcpNameServer = 192.168.1.1

TCP: Interfaces\{89AAF7E2-24D0-4EC6-A604-F2331129BC1B}: DhcpNameServer = 192.168.1.1

TCP: Interfaces\{89AAF7E2-24D0-4EC6-A604-F2331129BC1B}\6494E4B4: DhcpNameServer = 192.168.1.1

FF - ProfilePath - c:\users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\

FF - prefs.js: browser.startup.homepage - hxxp://search.zonealarm.com/?src=hp&tbid=base2013&Lan=de&gu=866e590beaf945308949e22b5ec8d8a1&tu=10GX0007y1B0008&sku=&tstsId=&ver=&

FF - user.js: extensions.zonealarm.hpOld0 - www.benefind.de

FF - user.js: extensions.zonealarm.tlbrSrchUrl - hxxp://search.zonealarm.com/search?src=tb&tbid=base2013&Lan={dfltLng}&gu=866e590beaf945308949e22b5ec8d8a1&tu=10GX0007y1B0008&sku=&tstsId=&ver=&&q=

FF - user.js: extensions.zonealarm.id - 88eb38b2000000000000000000000000

FF - user.js: extensions.zonealarm.appId - {C56C48A0-DA4E-46F6-9859-1553DC865F84}

FF - user.js: extensions.zonealarm.instlDay - 15834

FF - user.js: extensions.zonealarm.vrsn - 1.8.11.11

FF - user.js: extensions.zonealarm.vrsni - 1.8.11.11

FF - user.js: extensions.zonealarm.vrsnTs - 1.8.11.1117:33

FF - user.js: extensions.zonealarm.prtnrId - checkpoint

FF - user.js: extensions.zonealarm.prdct - zonealarm

FF - user.js: extensions.zonealarm.aflt - 1025

FF - user.js: extensions.zonealarm.smplGrp - none

FF - user.js: extensions.zonealarm.tlbrId - base2013

FF - user.js: extensions.zonealarm.instlRef - ZLN27462529832131-1001

FF - user.js: extensions.zonealarm.dfltLng - de

FF - user.js: extensions.zonealarm.excTlbr - false

FF - user.js: extensions.zonealarm.ffxUnstlRst - false

FF - user.js: extensions.zonealarm.admin - false

FF - user.js: extensions.zonealarm.autoRvrt - false

FF - user.js: extensions.zonealarm.rvrt - true

FF - user.js: extensions.zonealarm.hmpg - true

FF - user.js: extensions.zonealarm.hmpgUrl - hxxp://search.zonealarm.com/?src=hp&tbid=base2013&Lan=de&gu=866e590beaf945308949e22b5ec8d8a1&tu=10GX0007y1B0008&sku=&tstsId=&ver=&

FF - user.js: extensions.zonealarm.newTab - true

FF - user.js: extensions.zonealarm.newTabUrl - hxxp://search.zonealarm.com/?src=nt&tbid=base2013&Lan=de&gu=866e590beaf945308949e22b5ec8d8a1&tu=10GX0007y1B0008&sku=&tstsId=&ver=&

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start

HKLM-Run-TosWaitSrv - c:\program files (x86)\TOSHIBA\TPHM\TosWaitSrv.exe

HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe

AddRemove-xp-AntiSpy - c:\program files (x86)\xp-AntiSpy\Uninstall.exe

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2013-08-04  15:33:26

ComboFix-quarantined-files.txt  2013-08-04 14:33

.

Vor Suchlauf: 10 Verzeichnis(se), 15.844.839.424 Bytes frei

Nach Suchlauf: 15 Verzeichnis(se), 15.669.121.024 Bytes frei

.

- - End Of File - - A1A127F0A209DC1891A8C107097F4F57

A36C5E4F47E84449FF07ED3517B43A31

Ich hoffe, Sie ist aussagekräftig!

Nochmals vielen lieben Dank für Deine Unterstützung
Liebe Grüße
Claudia

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

und ein frisches FRST log bitte :)

Hallo Schrauber,

leider konnten wir erst heute die gewünschten Scans durchführen.

AdwCleaner[S2].txt:

Code:

# AdwCleaner v2.306 - Datei am 06/08/2013 um 10:34:12 erstellt

# Aktualisiert am 19/07/2013 von Xplode

# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)

# Benutzer : ... - ...-PC

# Bootmodus : Abgesicherter Modus

# Ausgeführt unter : C:\Users\...\Desktop\adwcleaner.exe

# Option [Löschen]
 
 

**** [Dienste] ****
 
 

***** [Dateien / Ordner] *****
 
 

***** [Registrierungsdatenbank] *****
 
 

***** [Internet Browser] *****
 

-\\ Internet Explorer v10.0.9200.16635
 

[OK] Die Registrierungsdatenbank ist sauber.
 

-\\ Mozilla Firefox v22.0 (de)
 

Datei : C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\prefs.js
 

[OK] Die Datei ist sauber.
 

-\\ Opera v12.16.1860.0
 

Datei : C:\Users\...\AppData\Roaming\Opera\Opera\operaprefs.ini
 

[OK] Die Datei ist sauber.
 

*************************
 

AdwCleaner[S1].txt - [4546 octets] - [06/08/2013 10:27:24]

AdwCleaner[S2].txt - [928 octets] - [06/08/2013 10:34:12]
 

########## EOF - C:\AdwCleaner[S2].txt - [987 octets] ##########

mbam-log-2013-08-06 (11-24-42).txt:

Code:

Malwarebytes Anti-Malware 1.75.0.1300

www.malwarebytes.org
 

Datenbank Version: v2013.08.06.01
 

Windows 7 Service Pack 1 x64 NTFS (Abgesichertenmodus)

Internet Explorer 10.0.9200.16635

... :: ...-PC [Administrator]
 

06.08.2013 11:24:42

mbam-log-2013-08-06 (11-24-42).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|S:\|)

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM | P2P

Deaktivierte Suchlaufeinstellungen: 

Durchsuchte Objekte: 368050

Laufzeit: 43 Minute(n), 47 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

FRSTneu.txt:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 30-07-2013 03 (ATTENTION: ====> FRST version is 7 days old and could be outdated)

Ran by ... (administrator) on 06-08-2013 12:16:04

Running from C:\Users\...\Desktop

Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Safe Mode (minimal)
 

==================== Processes (Whitelisted) =================
 

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [TosSENotify] - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [709976 2009-08-03] (TOSHIBA Corporation)

HKLM\...\Run: [TosWaitSrv] - C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [711000 2009-08-04] (TOSHIBA Corporation)

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7982112 2009-07-28] (Realtek Semiconductor)

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1815848 2009-07-20] (Synaptics Incorporated)

HKLM\...\Run: [ISW] - C:\Program Files\CheckPoint\ZAForceField\ForceField.exe [1127592 2012-11-22] (Check Point Software Technologies)

HKLM-x32\...\RunOnce: [Malwarebytes Anti-Malware] - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation)

HKLM\...\InprocServer32: [Default-cscui]  <==== ATTENTION!

HKCU\...\Run: [SpybotSD TeaTimer] - C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2260480 2009-03-05] (Safer-Networking Ltd.)

HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-07-29] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [KeNotify] - C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe [34088 2009-01-13] (TOSHIBA CORPORATION)

HKLM-x32\...\Run: [HWSetup] - C:\Program Files\TOSHIBA\Utilities\HWSetup.exe [423936 2009-06-02] (TOSHIBA Electronics, Inc.)

HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [345144 2013-06-27] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [ZoneAlarm] - C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe [73832 2013-03-27] (Check Point Software Technologies LTD)

Startup: C:\Users\...\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Users\...\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://safesearchr.lavasoft.com/?source=3336ca5f&tbp=homepage&toolbarid=adawaretb&v=2_2&u=BB9CCE2F3C2A4F81A0BCA1507DB50408

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKLM - DefaultScope value is missing.

BHO: ZoneAlarm Security Engine Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)

BHO-x32: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll (Safer Networking Limited)

BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)

BHO-x32: ZoneAlarm Security Engine Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)

Toolbar: HKLM-x32 - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)

Toolbar: HKCU - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
 

FireFox:

========

FF ProfilePath: C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default

FF Homepage: hxxp://search.zonealarm.com/?src=hp&tbid=base2013&Lan=de&gu=866e590beaf945308949e22b5ec8d8a1&tu=10GX0007y1B0008&sku=&tstsId=&ver=&

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()

FF Plugin: @microsoft.com/GENUINE - disabled No File

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()

FF Plugin-x32: @java.com/DTPlugin,version=10.4.1 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.4.1 - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/GENUINE - disabled No File

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @videolan.org/vlc,version=2.0.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF SearchPlugin: C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\searchplugins\ecosia.xml

FF SearchPlugin: C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\searchplugins\englische-ergebnisse.xml

FF SearchPlugin: C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\searchplugins\gmx-suche.xml

FF SearchPlugin: C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\searchplugins\lastminute.xml

FF SearchPlugin: C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\searchplugins\webde-suche.xml

FF Extension: No Name - C:\Users\...\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}

FF Extension: Deutsches Wörterbuch - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\de-DE@dictionaries.addons.mozilla.org

FF Extension: British English Dictionary - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\en-GB@dictionaries.addons.mozilla.org

FF Extension: zonealarm.com - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\ffxtlbr@zonealarm.com

FF Extension: Lavasoft Search Plugin - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\jid1-yZwVFzbsyfMrqQ@jetpack

FF Extension: No Name - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\nostmp

FF Extension: No Name - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\sfStatistics.xml

FF Extension: tabutils - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\tabutils@ithinc.cn.xpi

FF Extension: toolbar - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\toolbar@gmx.net.xpi

FF Extension: No Name - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\{1280606b-2510-4fe0-97ef-9b5a22eafe30}.xpi

FF Extension: No Name - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi

FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF HKLM\...\Firefox\Extensions: [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}] C:\Program Files\CheckPoint\ZAForceField\TrustChecker

FF Extension: No Name - C:\Program Files\CheckPoint\ZAForceField\TrustChecker

FF HKLM-x32\...\Firefox\Extensions: [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}] C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker

FF Extension: ZoneAlarm Security Engine - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker
 

==================== Services (Whitelisted) =================
 

S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-06-27] (Avira Operations GmbH & Co. KG)

S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-06-27] (Avira Operations GmbH & Co. KG)

S2 IswSvc; C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe [828072 2012-11-22] (Check Point Software Technologies)

S2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [123664 2012-12-16] (SANDBOXIE L.T.D)

S2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)

S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [112080 2011-02-10] (Toshiba Europe GmbH)

S2 vsmon; C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe [2447888 2013-03-27] (Check Point Software Technologies LTD)

S2 WTGService; C:\Program Files (x86)\InternetEverywhere\WTGService.exe [312784 2010-05-21] ()
 

==================== Drivers (Whitelisted) ====================
 

S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-04-02] (Avira Operations GmbH & Co. KG)

S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130016 2013-04-02] (Avira Operations GmbH & Co. KG)

S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-04-02] (Avira Operations GmbH & Co. KG)

R0 gfibto; C:\Windows\System32\drivers\gfibto.sys [14456 2013-01-02] (GFI Software)

S1 HWiNFO32; C:\Program Files\HWiNFO64\HWiNFO64A.SYS [30592 2012-05-10] (REALiX(tm))

S2 ISWKL; C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys [33712 2012-11-22] (Check Point Software Technologies)

R0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [460888 2012-01-09] (Kaspersky Lab ZAO)

S1 kl2; C:\Windows\System32\DRIVERS\kl2.sys [11864 2012-01-09] (Kaspersky Lab ZAO)

S1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [485680 2012-01-09] (Kaspersky Lab)

S3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [202632 2012-12-16] (SANDBOXIE L.T.D)

S1 Vsdatant; C:\Windows\System32\DRIVERS\vsdatant.sys [450136 2012-12-13] (Check Point Software Technologies LTD)

S3 catchme; \??\C:\ComboFix\catchme.sys [x]

S3 RSUSBSTOR; System32\Drivers\RtsUStor.sys [x]

S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [x]

S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-08-06 10:45 - 2013-08-06 11:18 - 00001117 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-08-06 10:38 - 2013-08-06 10:38 - 00001055 _____ C:\Users\...\Downloads\AdwCleaner[S2].txt

2013-08-06 10:38 - 2013-08-06 10:38 - 00001055 _____ C:\Users\...\Desktop\AdwCleaner[S2].txt

2013-08-06 10:34 - 2013-08-06 10:34 - 00001055 _____ C:\AdwCleaner[S2].txt

2013-08-06 10:27 - 2013-08-06 10:27 - 00004546 _____ C:\AdwCleaner[S1].txt

2013-08-06 10:12 - 2013-08-06 10:11 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\...\Desktop\mbam-setup-1.75.0.1300.exe

2013-08-06 10:10 - 2013-08-06 10:11 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\...\Downloads\mbam-setup-1.75.0.1300.exe

2013-08-05 17:52 - 2013-08-05 17:52 - 00666633 _____ C:\Users\...\Downloads\adwcleaner.exe

2013-08-05 17:52 - 2013-08-05 17:52 - 00666633 _____ C:\Users\...\Desktop\adwcleaner.exe

2013-08-05 08:42 - 2013-08-06 11:14 - 00000336 _____ C:\Windows\setupact.log

2013-08-05 08:42 - 2013-08-05 08:42 - 00000000 _____ C:\Windows\setuperr.log

2013-08-04 15:33 - 2013-08-04 15:33 - 00017760 _____ C:\ComboFix.txt

2013-08-04 15:23 - 2013-08-04 15:33 - 00000000 ____D C:\Qoobox

2013-08-04 15:23 - 2013-08-04 15:31 - 00000000 ____D C:\Windows\erdnt

2013-08-04 15:23 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe

2013-08-04 15:23 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe

2013-08-04 15:23 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2013-08-04 15:23 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2013-08-04 15:23 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2013-08-04 15:23 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe

2013-08-04 15:23 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe

2013-08-04 15:23 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe

2013-08-04 15:22 - 2013-08-04 14:31 - 05099708 ____R (Swearware) C:\Users\...\Desktop\ComboFix.exe

2013-08-04 14:31 - 2013-08-04 14:31 - 05099708 _____ (Swearware) C:\Users\...\Downloads\ComboFix.exe

2013-08-01 17:46 - 2013-08-01 17:46 - 00000000 ____D C:\FRST

2013-08-01 17:46 - 2013-08-01 17:45 - 01781589 _____ (Farbar) C:\Users\...\Desktop\FRST64.exe

2013-07-31 19:31 - 2013-07-31 19:31 - 00000352 _____ C:\Windows\Tasks\{3F02381E-7340-4323-8428-84FCDE0B6051}.job

2013-07-31 10:17 - 2013-07-31 10:21 - 00000000 ____D C:\Windows\system32\MRT

2013-07-29 15:56 - 2013-07-30 16:35 - 00000000 ____D C:\Stinger_Quarantine

2013-07-29 08:47 - 2013-07-30 18:17 - 00000000 ____D C:\Program Files\stinger

2013-07-28 12:30 - 2013-07-28 12:30 - 00449062 ____R C:\Windows\system32\Drivers\etc\hosts.20130728-123030.backup

2013-07-28 12:30 - 2013-04-29 07:42 - 00446463 _____ C:\Windows\system32\Drivers\etc\hosts.20130728-123008.backup

2013-07-12 21:15 - 2013-07-12 21:15 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore1ce7f3c9633a105.job

2013-07-12 18:28 - 2013-07-12 18:28 - 00000000 ____D C:\Users\...\Desktop\Audio CD_2

2013-07-12 18:26 - 2013-07-12 18:28 - 00000000 ____D C:\Users\...\Desktop\Audio CD_1

2013-07-12 11:45 - 2013-06-12 00:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2013-07-12 11:45 - 2013-06-12 00:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2013-07-12 11:45 - 2013-06-12 00:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2013-07-12 11:45 - 2013-06-12 00:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2013-07-12 11:45 - 2013-06-12 00:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2013-07-12 11:45 - 2013-06-12 00:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2013-07-12 11:45 - 2013-06-12 00:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2013-07-12 11:45 - 2013-06-12 00:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2013-07-12 11:45 - 2013-06-12 00:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2013-07-12 11:45 - 2013-06-12 00:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2013-07-12 11:45 - 2013-06-12 00:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll

2013-07-12 11:45 - 2013-06-12 00:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2013-07-12 11:45 - 2013-06-12 00:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2013-07-12 11:45 - 2013-06-12 00:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2013-07-12 11:45 - 2013-06-12 00:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2013-07-12 11:45 - 2013-06-12 00:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2013-07-12 11:45 - 2013-06-12 00:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2013-07-12 11:45 - 2013-06-12 00:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2013-07-12 11:45 - 2013-06-12 00:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2013-07-12 11:45 - 2013-06-12 00:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2013-07-12 11:45 - 2013-06-12 00:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2013-07-12 11:45 - 2013-06-12 00:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2013-07-12 11:45 - 2013-06-12 00:25 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2013-07-12 11:45 - 2013-06-12 00:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll

2013-07-12 11:45 - 2013-06-12 00:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2013-07-12 11:45 - 2013-06-12 00:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2013-07-12 11:45 - 2013-06-12 00:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2013-07-12 11:45 - 2013-06-11 23:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe

2013-07-12 11:45 - 2013-06-11 23:50 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe

2013-07-12 11:45 - 2013-06-07 04:22 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2013-07-12 11:45 - 2013-06-07 03:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2013-07-11 18:52 - 2013-07-11 18:53 - 00000000 ____D C:\Users\...\Downloads\Akouda

2013-07-11 16:07 - 2013-05-13 06:51 - 01464320 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll

2013-07-11 16:07 - 2013-05-13 06:51 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll

2013-07-11 16:07 - 2013-05-13 06:51 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll

2013-07-11 16:07 - 2013-05-13 06:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\certenc.dll

2013-07-11 16:07 - 2013-05-13 05:45 - 01160192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll

2013-07-11 16:07 - 2013-05-13 05:45 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll

2013-07-11 16:07 - 2013-05-13 05:45 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll

2013-07-11 16:07 - 2013-05-13 04:43 - 01192448 _____ (Microsoft Corporation) C:\Windows\system32\certutil.exe

2013-07-11 16:07 - 2013-05-13 04:08 - 00903168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe

2013-07-11 16:07 - 2013-05-13 04:08 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll

2013-07-10 18:22 - 2013-07-10 18:22 - 00095853 _____ C:\Users\...\Downloads\Musterbusinessplan_Doenertempel-data.pdf;jsessionid=19E86AB2431B59D42E8BD6207DA1D238.repl23

2013-07-10 17:31 - 2013-06-05 04:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2013-07-10 17:31 - 2013-06-04 07:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll

2013-07-10 17:31 - 2013-06-04 05:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll

2013-07-10 17:31 - 2013-05-06 07:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL

2013-07-10 17:31 - 2013-05-06 05:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL

2013-07-10 17:31 - 2013-04-10 00:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll

2013-07-10 17:31 - 2013-04-02 23:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll

107
 

==================== One Month Modified Files and Folders =======
 

2013-08-06 11:19 - 2012-06-08 17:21 - 01110199 _____ C:\Windows\WindowsUpdate.log

2013-08-06 11:19 - 2009-07-14 05:45 - 00014784 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-08-06 11:19 - 2009-07-14 05:45 - 00014784 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-08-06 11:18 - 2013-08-06 10:45 - 00001117 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-08-06 11:18 - 2012-06-09 16:14 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-08-06 11:16 - 2012-07-26 12:18 - 00000000 ____D C:\Users\...\AppData\Roaming\Dropbox

2013-08-06 11:14 - 2013-08-05 08:42 - 00000336 _____ C:\Windows\setupact.log

2013-08-06 10:38 - 2013-08-06 10:38 - 00001055 _____ C:\Users\...\Downloads\AdwCleaner[S2].txt

2013-08-06 10:38 - 2013-08-06 10:38 - 00001055 _____ C:\Users\...\Desktop\AdwCleaner[S2].txt

2013-08-06 10:37 - 2012-06-09 09:22 - 00000000 ____D C:\Users\...\AppData\Roaming\CheckPoint

2013-08-06 10:34 - 2013-08-06 10:34 - 00001055 _____ C:\AdwCleaner[S2].txt

2013-08-06 10:27 - 2013-08-06 10:27 - 00004546 _____ C:\AdwCleaner[S1].txt

2013-08-06 10:11 - 2013-08-06 10:12 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\...\Desktop\mbam-setup-1.75.0.1300.exe

2013-08-06 10:11 - 2013-08-06 10:10 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\...\Downloads\mbam-setup-1.75.0.1300.exe

2013-08-05 17:55 - 2012-06-09 10:49 - 00000000 ____D C:\Users\...\Desktop\Sicherheit

2013-08-05 17:52 - 2013-08-05 17:52 - 00666633 _____ C:\Users\...\Downloads\adwcleaner.exe

2013-08-05 17:52 - 2013-08-05 17:52 - 00666633 _____ C:\Users\...\Desktop\adwcleaner.exe

2013-08-05 08:42 - 2013-08-05 08:42 - 00000000 _____ C:\Windows\setuperr.log

2013-08-04 17:25 - 2012-06-09 09:37 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy

2013-08-04 17:25 - 2012-06-08 18:18 - 00000000 ____D C:\Windows\Panther

2013-08-04 15:33 - 2013-08-04 15:33 - 00017760 _____ C:\ComboFix.txt

2013-08-04 15:33 - 2013-08-04 15:23 - 00000000 ____D C:\Qoobox

2013-08-04 15:31 - 2013-08-04 15:23 - 00000000 ____D C:\Windows\erdnt

2013-08-04 15:30 - 2009-07-14 03:34 - 00000215 _____ C:\Windows\system.ini

2013-08-04 14:31 - 2013-08-04 15:22 - 05099708 ____R (Swearware) C:\Users\...\Desktop\ComboFix.exe

2013-08-04 14:31 - 2013-08-04 14:31 - 05099708 _____ (Swearware) C:\Users\...\Downloads\ComboFix.exe

2013-08-01 22:39 - 2013-04-03 13:12 - 00000000 ____D C:\Users\...\Downloads\Software

2013-08-01 22:35 - 2009-07-14 18:58 - 00657910 _____ C:\Windows\system32\perfh007.dat

2013-08-01 22:35 - 2009-07-14 18:58 - 00131250 _____ C:\Windows\system32\perfc007.dat

2013-08-01 22:35 - 2009-07-14 06:13 - 01529334 _____ C:\Windows\system32\PerfStringBackup.INI

2013-08-01 17:46 - 2013-08-01 17:46 - 00000000 ____D C:\FRST

2013-08-01 17:45 - 2013-08-01 17:46 - 01781589 _____ (Farbar) C:\Users\...\Desktop\FRST64.exe

2013-07-31 19:31 - 2013-07-31 19:31 - 00000352 _____ C:\Windows\Tasks\{3F02381E-7340-4323-8428-84FCDE0B6051}.job

2013-07-31 19:31 - 2012-06-09 16:16 - 00000000 ____D C:\Users\...\AppData\Roaming\Skype

2013-07-31 10:21 - 2013-07-31 10:17 - 00000000 ____D C:\Windows\system32\MRT

2013-07-30 18:17 - 2013-07-29 08:47 - 00000000 ____D C:\Program Files\stinger

2013-07-30 16:35 - 2013-07-29 15:56 - 00000000 ____D C:\Stinger_Quarantine

2013-07-28 14:24 - 2012-12-24 19:19 - 00000000 ____D C:\Program Files (x86)\stinger

2013-07-28 12:30 - 2013-07-28 12:30 - 00449062 ____R C:\Windows\system32\Drivers\etc\hosts.20130728-123030.backup

2013-07-28 08:57 - 2012-07-16 07:53 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-07-28 08:57 - 2012-06-09 20:52 - 00000000 ____D C:\Users\...\AppData\Local\Adobe

2013-07-28 08:57 - 2012-06-09 15:53 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2013-07-28 08:57 - 2012-06-09 15:53 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2013-07-18 10:49 - 2013-06-11 19:25 - 00000000 ____D C:\Users\...\Downloads\Forum Citoyen pour l'Environnement_FORCE 2013

2013-07-12 21:15 - 2013-07-12 21:15 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore1ce7f3c9633a105.job

2013-07-12 18:28 - 2013-07-12 18:28 - 00000000 ____D C:\Users\...\Desktop\Audio CD_2

2013-07-12 18:28 - 2013-07-12 18:26 - 00000000 ____D C:\Users\...\Desktop\Audio CD_1

2013-07-12 18:27 - 2012-06-09 16:49 - 00000000 ____D C:\Users\...\AppData\Roaming\vlc

2013-07-12 18:23 - 2012-06-09 13:26 - 00000000 ____D C:\ProgramData\Microsoft Help

2013-07-11 18:53 - 2013-07-11 18:52 - 00000000 ____D C:\Users\...\Downloads\Akouda

2013-07-11 14:50 - 2012-06-09 21:02 - 00000000 ____D C:\Program Files (x86)\Opera

2013-07-10 18:22 - 2013-07-10 18:22 - 00095853 _____ C:\Users\...\Downloads\Musterbusinessplan_Doenertempel-data.pdf;jsessionid=19E86AB2431B59D42E8BD6207DA1D238.repl23

2013-07-10 17:41 - 2009-07-14 05:45 - 00413624 _____ C:\Windows\system32\FNTCACHE.DAT

2013-07-10 17:37 - 2009-07-14 19:18 - 00000000 ____D C:\Program Files\Windows Journal

2013-07-10 17:37 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Defender

2013-07-10 17:37 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender

2013-07-08 15:23 - 2013-07-02 17:11 - 00000000 ____D C:\Users\...\Downloads\PREDD
 

Files to move or delete:

====================

C:\Windows\Tasks\{020F7741-8C06-41AE-A2C6-3464E3DB4769}.job

C:\Windows\Tasks\{3F02381E-7340-4323-8428-84FCDE0B6051}.job

C:\Windows\Tasks\{98188F27-98C8-4287-84B3-46DCCEC3B929}.job

C:\Windows\Tasks\{9B8AEFA2-134D-4E43-88E6-552AEBB6355A}.job

C:\Windows\Tasks\{EC7C70CF-E283-4A3D-8B00-DCE5C6C75C32}.job

C:\Windows\Tasks\{F3FF7234-8D03-47B2-96AE-410EF37C0422}.job
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2012-06-08 18:10
 

==================== End Of Log ============================

--- --- ---

Meine Schwester erzählte mir, daß diesmal keine Addition.txt entstanden ist.

Viele Grüße und vielen Dank für Deine Unterstützung!
Claudia

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

Hallo Schrauber,

meine Schwester SecurityCheck und FRST durchgeführt.

SecurityCheck:

Code:

Results of screen317's Security Check version 0.99.71  

 Windows 7 Service Pack 1 x64 (UAC is enabled)  

 Internet Explorer 10  
 ``````````````Antivirus/Firewall Check:`````````````` 

ZoneAlarm Free Firewall Antivirus   

Avira Desktop                       

 Antivirus up to date!   
 `````````Anti-malware/Other Utilities Check:````````` 

 xp-AntiSpy 3.98-2    

 Spybot - Search & Destroy 

 Malwarebytes Anti-Malware Version 1.75.0.1300  

 JavaFX 2.1.0    

 Java(TM) 7 Update 4  

 Java version out of Date! 

 Adobe Flash Player 11.8.800.94  

 Adobe Reader XI  

 Mozilla Firefox (22.0) 
 ````````Process Check: objlist.exe by Laurent````````  

 Avira Antivir avgnt.exe 

 Avira Antivir avguard.exe 

 CheckPoint ZoneAlarm vsmon.exe  

 CheckPoint ZoneAlarm zatray.exe  
 `````````````````System Health check````````````````` 

 Total Fragmentation on Drive C:  
 ````````````````````End of Log``````````````````````

FRST:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 30-07-2013 03 (ATTENTION: ====> FRST version is 8 days old and could be outdated)

Ran by ... (administrator) on 07-08-2013 18:05:06

Running from C:\Users\...\Desktop

Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) =================
 

(AMD) C:\Windows\system32\atiesrxx.exe

(SANDBOXIE L.T.D) C:\Program Files\Sandboxie\SbieSvc.exe

(Check Point Software Technologies LTD) C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe

(AMD) C:\Windows\system32\atieclxx.exe

(Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(TOSHIBA Corporation) C:\Windows\system32\TODDSrv.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TecoService.exe

() C:\Program Files (x86)\InternetEverywhere\WTGService.exe

(Safer Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe

(Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\ForceField.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe

(Dropbox, Inc.) C:\Users\...\AppData\Roaming\Dropbox\bin\Dropbox.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Check Point Software Technologies LTD) C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe

(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE

(Microsoft Corporation) C:\Windows\splwow64.exe

(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe

(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFProcSRVC.exe

(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe

(Opera Software) C:\Program Files (x86)\Opera\opera.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe

(Almico Software (www.almico.com)) C:\Program Files (x86)\SpeedFan\speedfan.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [TosSENotify] - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [709976 2009-08-03] (TOSHIBA Corporation)

HKLM\...\Run: [TosWaitSrv] - C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [711000 2009-08-04] (TOSHIBA Corporation)

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7982112 2009-07-28] (Realtek Semiconductor)

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1815848 2009-07-20] (Synaptics Incorporated)

HKLM\...\Run: [ISW] - C:\Program Files\CheckPoint\ZAForceField\ForceField.exe [1127592 2012-11-22] (Check Point Software Technologies)

HKLM\...\InprocServer32: [Default-cscui]  <==== ATTENTION!

HKCU\...\Run: [SpybotSD TeaTimer] - C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2260480 2009-03-05] (Safer-Networking Ltd.)

HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-07-29] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [KeNotify] - C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe [34088 2009-01-13] (TOSHIBA CORPORATION)

HKLM-x32\...\Run: [HWSetup] - C:\Program Files\TOSHIBA\Utilities\HWSetup.exe [423936 2009-06-02] (TOSHIBA Electronics, Inc.)

HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [345144 2013-06-27] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [ZoneAlarm] - C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe [73832 2013-03-27] (Check Point Software Technologies LTD)

Startup: C:\Users\...\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Users\...\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://safesearchr.lavasoft.com/?source=3336ca5f&tbp=homepage&toolbarid=adawaretb&v=2_2&u=BB9CCE2F3C2A4F81A0BCA1507DB50408

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKLM - DefaultScope value is missing.

BHO: ZoneAlarm Security Engine Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)

BHO-x32: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll (Safer Networking Limited)

BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)

BHO-x32: ZoneAlarm Security Engine Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)

Toolbar: HKLM-x32 - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)

Toolbar: HKCU - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
 

FireFox:

========

FF ProfilePath: C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default

FF Homepage: hxxp://search.zonealarm.com/?src=hp&tbid=base2013&Lan=de&gu=866e590beaf945308949e22b5ec8d8a1&tu=10GX0007y1B0008&sku=&tstsId=&ver=&

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()

FF Plugin: @microsoft.com/GENUINE - disabled No File

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()

FF Plugin-x32: @java.com/DTPlugin,version=10.4.1 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.4.1 - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/GENUINE - disabled No File

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @videolan.org/vlc,version=2.0.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF SearchPlugin: C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\searchplugins\ecosia.xml

FF SearchPlugin: C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\searchplugins\englische-ergebnisse.xml

FF SearchPlugin: C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\searchplugins\gmx-suche.xml

FF SearchPlugin: C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\searchplugins\lastminute.xml

FF SearchPlugin: C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\searchplugins\webde-suche.xml

FF Extension: No Name - C:\Users\...\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}

FF Extension: Deutsches Wörterbuch - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\de-DE@dictionaries.addons.mozilla.org

FF Extension: British English Dictionary - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\en-GB@dictionaries.addons.mozilla.org

FF Extension: zonealarm.com - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\ffxtlbr@zonealarm.com

FF Extension: Lavasoft Search Plugin - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\jid1-yZwVFzbsyfMrqQ@jetpack

FF Extension: No Name - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\nostmp

FF Extension: No Name - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\sfStatistics.xml

FF Extension: tabutils - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\tabutils@ithinc.cn.xpi

FF Extension: toolbar - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\toolbar@gmx.net.xpi

FF Extension: No Name - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\{1280606b-2510-4fe0-97ef-9b5a22eafe30}.xpi

FF Extension: No Name - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi

FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF HKLM\...\Firefox\Extensions: [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}] C:\Program Files\CheckPoint\ZAForceField\TrustChecker

FF Extension: No Name - C:\Program Files\CheckPoint\ZAForceField\TrustChecker

FF HKLM-x32\...\Firefox\Extensions: [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}] C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker

FF Extension: ZoneAlarm Security Engine - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker
 

==================== Services (Whitelisted) =================
 

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-06-27] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-06-27] (Avira Operations GmbH & Co. KG)

R2 IswSvc; C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe [828072 2012-11-22] (Check Point Software Technologies)

R2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [123664 2012-12-16] (SANDBOXIE L.T.D)

R2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)

S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [112080 2011-02-10] (Toshiba Europe GmbH)

R2 vsmon; C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe [2447888 2013-03-27] (Check Point Software Technologies LTD)

R2 WTGService; C:\Program Files (x86)\InternetEverywhere\WTGService.exe [312784 2010-05-21] ()
 

==================== Drivers (Whitelisted) ====================
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-04-02] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130016 2013-04-02] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-04-02] (Avira Operations GmbH & Co. KG)

R0 gfibto; C:\Windows\System32\drivers\gfibto.sys [14456 2013-01-02] (GFI Software)

R1 HWiNFO32; C:\Program Files\HWiNFO64\HWiNFO64A.SYS [30592 2012-05-10] (REALiX(tm))

R2 ISWKL; C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys [33712 2012-11-22] (Check Point Software Technologies)

R0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [460888 2012-01-09] (Kaspersky Lab ZAO)

R1 kl2; C:\Windows\System32\DRIVERS\kl2.sys [11864 2012-01-09] (Kaspersky Lab ZAO)

R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [485680 2012-01-09] (Kaspersky Lab)

R3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [202632 2012-12-16] (SANDBOXIE L.T.D)

R1 Vsdatant; C:\Windows\System32\DRIVERS\vsdatant.sys [450136 2012-12-13] (Check Point Software Technologies LTD)

S3 catchme; \??\C:\ComboFix\catchme.sys [x]

S3 RSUSBSTOR; System32\Drivers\RtsUStor.sys [x]

S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [x]

S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-08-07 18:03 - 2013-08-07 18:03 - 00001031 _____ C:\Users\...\Desktop\checkup.txt

2013-08-07 17:54 - 2013-08-07 17:54 - 00891098 _____ C:\Users\...\Downloads\SecurityCheck.exe

2013-08-07 12:53 - 2013-08-07 12:53 - 02347384 _____ (ESET) C:\Users\...\Downloads\esetsmartinstaller_enu.exe

2013-08-06 12:23 - 2013-08-06 12:23 - 00027317 _____ C:\Users\...\Desktop\FRSTneu.txt

2013-08-06 10:45 - 2013-08-06 11:18 - 00001117 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-08-06 10:38 - 2013-08-06 10:38 - 00001055 _____ C:\Users\...\Downloads\AdwCleaner[S2].txt

2013-08-06 10:38 - 2013-08-06 10:38 - 00001055 _____ C:\Users\...\Desktop\AdwCleaner[S2].txt

2013-08-06 10:34 - 2013-08-06 10:34 - 00001055 _____ C:\AdwCleaner[S2].txt

2013-08-06 10:27 - 2013-08-06 10:27 - 00004546 _____ C:\AdwCleaner[S1].txt

2013-08-06 10:12 - 2013-08-06 10:11 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\...\Desktop\mbam-setup-1.75.0.1300.exe

2013-08-06 10:10 - 2013-08-06 10:11 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\...\Downloads\mbam-setup-1.75.0.1300.exe

2013-08-05 17:52 - 2013-08-05 17:52 - 00666633 _____ C:\Users\...\Downloads\adwcleaner.exe

2013-08-05 17:52 - 2013-08-05 17:52 - 00666633 _____ C:\Users\...\Desktop\adwcleaner.exe

2013-08-05 08:42 - 2013-08-06 12:30 - 00000392 _____ C:\Windows\setupact.log

2013-08-05 08:42 - 2013-08-05 08:42 - 00000000 _____ C:\Windows\setuperr.log

2013-08-04 15:33 - 2013-08-04 15:33 - 00017760 _____ C:\ComboFix.txt

2013-08-04 15:23 - 2013-08-04 15:33 - 00000000 ____D C:\Qoobox

2013-08-04 15:23 - 2013-08-04 15:31 - 00000000 ____D C:\Windows\erdnt

2013-08-04 15:23 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe

2013-08-04 15:23 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe

2013-08-04 15:23 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2013-08-04 15:23 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2013-08-04 15:23 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2013-08-04 15:23 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe

2013-08-04 15:23 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe

2013-08-04 15:23 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe

2013-08-04 15:22 - 2013-08-04 14:31 - 05099708 ____R (Swearware) C:\Users\...\Desktop\ComboFix.exe

2013-08-04 14:31 - 2013-08-04 14:31 - 05099708 _____ (Swearware) C:\Users\...\Downloads\ComboFix.exe

2013-08-01 17:46 - 2013-08-01 17:46 - 00000000 ____D C:\FRST

2013-08-01 17:46 - 2013-08-01 17:45 - 01781589 _____ (Farbar) C:\Users\...\Desktop\FRST64.exe

2013-07-31 19:31 - 2013-07-31 19:31 - 00000352 _____ C:\Windows\Tasks\{3F02381E-7340-4323-8428-84FCDE0B6051}.job

2013-07-31 10:17 - 2013-07-31 10:21 - 00000000 ____D C:\Windows\system32\MRT

2013-07-29 15:56 - 2013-07-30 16:35 - 00000000 ____D C:\Stinger_Quarantine

2013-07-29 08:47 - 2013-07-30 18:17 - 00000000 ____D C:\Program Files\stinger

2013-07-28 12:30 - 2013-07-28 12:30 - 00449062 ____R C:\Windows\system32\Drivers\etc\hosts.20130728-123030.backup

2013-07-28 12:30 - 2013-04-29 07:42 - 00446463 _____ C:\Windows\system32\Drivers\etc\hosts.20130728-123008.backup

2013-07-12 21:15 - 2013-07-12 21:15 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore1ce7f3c9633a105.job

2013-07-12 11:45 - 2013-06-12 00:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2013-07-12 11:45 - 2013-06-12 00:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2013-07-12 11:45 - 2013-06-12 00:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2013-07-12 11:45 - 2013-06-12 00:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2013-07-12 11:45 - 2013-06-12 00:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2013-07-12 11:45 - 2013-06-12 00:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2013-07-12 11:45 - 2013-06-12 00:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2013-07-12 11:45 - 2013-06-12 00:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2013-07-12 11:45 - 2013-06-12 00:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2013-07-12 11:45 - 2013-06-12 00:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2013-07-12 11:45 - 2013-06-12 00:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll

2013-07-12 11:45 - 2013-06-12 00:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2013-07-12 11:45 - 2013-06-12 00:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2013-07-12 11:45 - 2013-06-12 00:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2013-07-12 11:45 - 2013-06-12 00:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2013-07-12 11:45 - 2013-06-12 00:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2013-07-12 11:45 - 2013-06-12 00:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2013-07-12 11:45 - 2013-06-12 00:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2013-07-12 11:45 - 2013-06-12 00:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2013-07-12 11:45 - 2013-06-12 00:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2013-07-12 11:45 - 2013-06-12 00:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2013-07-12 11:45 - 2013-06-12 00:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2013-07-12 11:45 - 2013-06-12 00:25 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2013-07-12 11:45 - 2013-06-12 00:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll

2013-07-12 11:45 - 2013-06-12 00:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2013-07-12 11:45 - 2013-06-12 00:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2013-07-12 11:45 - 2013-06-12 00:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2013-07-12 11:45 - 2013-06-11 23:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe

2013-07-12 11:45 - 2013-06-11 23:50 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe

2013-07-12 11:45 - 2013-06-07 04:22 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2013-07-12 11:45 - 2013-06-07 03:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2013-07-11 18:52 - 2013-07-11 18:53 - 00000000 ____D C:\Users\...\Downloads\Akouda

2013-07-11 16:07 - 2013-05-13 06:51 - 01464320 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll

2013-07-11 16:07 - 2013-05-13 06:51 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll

2013-07-11 16:07 - 2013-05-13 06:51 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll

2013-07-11 16:07 - 2013-05-13 06:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\certenc.dll

2013-07-11 16:07 - 2013-05-13 05:45 - 01160192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll

2013-07-11 16:07 - 2013-05-13 05:45 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll

2013-07-11 16:07 - 2013-05-13 05:45 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll

2013-07-11 16:07 - 2013-05-13 04:43 - 01192448 _____ (Microsoft Corporation) C:\Windows\system32\certutil.exe

2013-07-11 16:07 - 2013-05-13 04:08 - 00903168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe

2013-07-11 16:07 - 2013-05-13 04:08 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll

2013-07-10 18:22 - 2013-07-10 18:22 - 00095853 _____ C:\Users\...\Downloads\Musterbusinessplan_Doenertempel-data.pdf;jsessionid=19E86AB2431B59D42E8BD6207DA1D238.repl23

2013-07-10 17:31 - 2013-06-05 04:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2013-07-10 17:31 - 2013-06-04 07:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll

2013-07-10 17:31 - 2013-06-04 05:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll

2013-07-10 17:31 - 2013-05-06 07:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL

2013-07-10 17:31 - 2013-05-06 05:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL

2013-07-10 17:31 - 2013-04-10 00:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll

2013-07-10 17:31 - 2013-04-02 23:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll

109
 

==================== One Month Modified Files and Folders =======
 

2013-08-07 18:03 - 2013-08-07 18:03 - 00001031 _____ C:\Users\...\Desktop\checkup.txt

2013-08-07 17:56 - 2012-06-08 17:21 - 01131749 _____ C:\Windows\WindowsUpdate.log

2013-08-07 17:54 - 2013-08-07 17:54 - 00891098 _____ C:\Users\...\Downloads\SecurityCheck.exe

2013-08-07 17:47 - 2012-06-10 07:53 - 00000000 ____D C:\Program Files (x86)\SpeedFan

2013-08-07 16:46 - 2009-07-14 05:45 - 00014784 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-08-07 16:46 - 2009-07-14 05:45 - 00014784 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-08-07 12:53 - 2013-08-07 12:53 - 02347384 _____ (ESET) C:\Users\...\Downloads\esetsmartinstaller_enu.exe

2013-08-06 12:32 - 2012-07-26 12:18 - 00000000 ____D C:\Users\...\AppData\Roaming\Dropbox

2013-08-06 12:30 - 2013-08-05 08:42 - 00000392 _____ C:\Windows\setupact.log

2013-08-06 12:24 - 2012-06-09 21:10 - 00000000 ___RD C:\Users\...\Desktop\Media

2013-08-06 12:23 - 2013-08-06 12:23 - 00027317 _____ C:\Users\...\Desktop\FRSTneu.txt

2013-08-06 11:18 - 2013-08-06 10:45 - 00001117 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-08-06 11:18 - 2012-06-09 16:14 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-08-06 10:38 - 2013-08-06 10:38 - 00001055 _____ C:\Users\...\Downloads\AdwCleaner[S2].txt

2013-08-06 10:38 - 2013-08-06 10:38 - 00001055 _____ C:\Users\...\Desktop\AdwCleaner[S2].txt

2013-08-06 10:37 - 2012-06-09 09:22 - 00000000 ____D C:\Users\...\AppData\Roaming\CheckPoint

2013-08-06 10:34 - 2013-08-06 10:34 - 00001055 _____ C:\AdwCleaner[S2].txt

2013-08-06 10:27 - 2013-08-06 10:27 - 00004546 _____ C:\AdwCleaner[S1].txt

2013-08-06 10:11 - 2013-08-06 10:12 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\...\Desktop\mbam-setup-1.75.0.1300.exe

2013-08-06 10:11 - 2013-08-06 10:10 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\...\Downloads\mbam-setup-1.75.0.1300.exe

2013-08-05 17:55 - 2012-06-09 10:49 - 00000000 ____D C:\Users\...\Desktop\Sicherheit

2013-08-05 17:52 - 2013-08-05 17:52 - 00666633 _____ C:\Users\...\Downloads\adwcleaner.exe

2013-08-05 17:52 - 2013-08-05 17:52 - 00666633 _____ C:\Users\...\Desktop\adwcleaner.exe

2013-08-05 08:42 - 2013-08-05 08:42 - 00000000 _____ C:\Windows\setuperr.log

2013-08-04 17:25 - 2012-06-09 09:37 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy

2013-08-04 17:25 - 2012-06-08 18:18 - 00000000 ____D C:\Windows\Panther

2013-08-04 15:33 - 2013-08-04 15:33 - 00017760 _____ C:\ComboFix.txt

2013-08-04 15:33 - 2013-08-04 15:23 - 00000000 ____D C:\Qoobox

2013-08-04 15:31 - 2013-08-04 15:23 - 00000000 ____D C:\Windows\erdnt

2013-08-04 15:30 - 2009-07-14 03:34 - 00000215 _____ C:\Windows\system.ini

2013-08-04 14:31 - 2013-08-04 15:22 - 05099708 ____R (Swearware) C:\Users\...\Desktop\ComboFix.exe

2013-08-04 14:31 - 2013-08-04 14:31 - 05099708 _____ (Swearware) C:\Users\...\Downloads\ComboFix.exe

2013-08-01 22:39 - 2013-04-03 13:12 - 00000000 ____D C:\Users\...\Downloads\Software

2013-08-01 22:35 - 2009-07-14 18:58 - 00657910 _____ C:\Windows\system32\perfh007.dat

2013-08-01 22:35 - 2009-07-14 18:58 - 00131250 _____ C:\Windows\system32\perfc007.dat

2013-08-01 22:35 - 2009-07-14 06:13 - 01529334 _____ C:\Windows\system32\PerfStringBackup.INI

2013-08-01 17:46 - 2013-08-01 17:46 - 00000000 ____D C:\FRST

2013-08-01 17:45 - 2013-08-01 17:46 - 01781589 _____ (Farbar) C:\Users\...\Desktop\FRST64.exe

2013-07-31 19:31 - 2013-07-31 19:31 - 00000352 _____ C:\Windows\Tasks\{3F02381E-7340-4323-8428-84FCDE0B6051}.job

2013-07-31 19:31 - 2012-06-09 16:16 - 00000000 ____D C:\Users\...\AppData\Roaming\Skype

2013-07-31 10:21 - 2013-07-31 10:17 - 00000000 ____D C:\Windows\system32\MRT

2013-07-30 18:17 - 2013-07-29 08:47 - 00000000 ____D C:\Program Files\stinger

2013-07-30 16:35 - 2013-07-29 15:56 - 00000000 ____D C:\Stinger_Quarantine

2013-07-28 14:24 - 2012-12-24 19:19 - 00000000 ____D C:\Program Files (x86)\stinger

2013-07-28 12:30 - 2013-07-28 12:30 - 00449062 ____R C:\Windows\system32\Drivers\etc\hosts.20130728-123030.backup

2013-07-28 08:57 - 2012-07-16 07:53 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-07-28 08:57 - 2012-06-09 20:52 - 00000000 ____D C:\Users\...\AppData\Local\Adobe

2013-07-28 08:57 - 2012-06-09 15:53 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2013-07-28 08:57 - 2012-06-09 15:53 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2013-07-18 10:49 - 2013-06-11 19:25 - 00000000 ____D C:\Users\...\Downloads\Forum Citoyen pour l'Environnement_FORCE 2013

2013-07-12 21:15 - 2013-07-12 21:15 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore1ce7f3c9633a105.job

2013-07-12 18:27 - 2012-06-09 16:49 - 00000000 ____D C:\Users\...\AppData\Roaming\vlc

2013-07-12 18:23 - 2012-06-09 13:26 - 00000000 ____D C:\ProgramData\Microsoft Help

2013-07-11 18:53 - 2013-07-11 18:52 - 00000000 ____D C:\Users\...\Downloads\Akouda

2013-07-11 14:50 - 2012-06-09 21:02 - 00000000 ____D C:\Program Files (x86)\Opera

2013-07-10 18:22 - 2013-07-10 18:22 - 00095853 _____ C:\Users\...\Downloads\Musterbusinessplan_Doenertempel-data.pdf;jsessionid=19E86AB2431B59D42E8BD6207DA1D238.repl23

2013-07-10 17:41 - 2009-07-14 05:45 - 00413624 _____ C:\Windows\system32\FNTCACHE.DAT

2013-07-10 17:37 - 2009-07-14 19:18 - 00000000 ____D C:\Program Files\Windows Journal

2013-07-10 17:37 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Defender

2013-07-10 17:37 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender

2013-07-08 15:23 - 2013-07-02 17:11 - 00000000 ____D C:\Users\...\Downloads\PREDD
 

Files to move or delete:

====================

C:\Windows\Tasks\{020F7741-8C06-41AE-A2C6-3464E3DB4769}.job

C:\Windows\Tasks\{3F02381E-7340-4323-8428-84FCDE0B6051}.job

C:\Windows\Tasks\{98188F27-98C8-4287-84B3-46DCCEC3B929}.job

C:\Windows\Tasks\{9B8AEFA2-134D-4E43-88E6-552AEBB6355A}.job

C:\Windows\Tasks\{EC7C70CF-E283-4A3D-8B00-DCE5C6C75C32}.job

C:\Windows\Tasks\{F3FF7234-8D03-47B2-96AE-410EF37C0422}.job
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2012-06-08 18:10
 

==================== End Of Log ============================

--- --- ---

Zu dem OnlineCheck - den trauen wir uns nicht durchzuführen. Ist das denn sicher, wenn wir die Anti-Virus-Programme und die Firewall dabei deaktivieren?

Ich habe noch eine Frage. Mir ist nicht ganz klar, ob Du noch Probleme siehst, da meine Schwester keine Meldungen mehr auf dem Laptop hat. Er funktioniert ohne Probleme. (Ich hatte mich ja aus Unsicherheit, ob wirklich wieder alles in Ordnung ist, an das Board gewandt). Hast Du in unseren Logs noch Hinweise auf irgendwelche Schadsoftware gefunden?

Viele Grüße
Claudia

Nein, nur en paar Reste noch, aber der Onlineacan muss sein zur Absicherung. Lass die Firewall an, nur AV abschalten, mach in der Zeit des Scans nix an dem Rechner, dann passt das schon :)

Hallo Schrauber,

ok, Danke! Dann bin ich ja beruhigt. Meine Schwester wird es am Sonntag oder Montag erledigen. Sie ist momentan unterwegs.

Bis dann am Sonntag oder Montag mit den (hoffentlich) letzten Ergebnissen ;-)

Viele Grüße
Claudia

Hallo Schrauber,

meine Schwester wollte mit großen Widerwillen, da wir dem Frieden (ohne Virenscanner) nicht trauen, den OnlineScan durchführen. Aber es gibt Probleme beim Update - das Tool will einen Proxy haben. Nur, daß meine Schwester gar keinen Proxy nutzt! Es funktioniert also nicht.
Woran kann das hängen? Ich habe das Problem nicht.

Wäre es schlimm, wenn der OnlineScan nicht durchgeführt wird?

Viele Grüße
Claudia

P.S. Meine Schwester und ich verstehen Deine Worte

Zitat:

Nein, nur en paar Reste noch, aber der Onlineacan muss sein zur Absicherung

unterschiedlich. Sie meint, daß Du mit Rest, weitere Scans meinst, ich dagegen Reste vom Trojanerbefall. Was ist nun richtig?