Trojaner-Board - Windows 7: Webseitenumleitung ihavenet.com

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Windows 7: Webseitenumleitung ihavenet.com (https://www.trojaner-board.de/141354-windows-7-webseitenumleitung-ihavenet-com.html)

Windows 7: Webseitenumleitung ihavenet.com

Hallo,
habe hier von einer guten Freundin einen Windows 7 - Rechner (64bit, Servicepack 1), bei dem die Suchergebnisse von google auf unterschiedliche (Werbe-)Seiten umgeleitet werden. Zwischendurch steht in der Adresszeile immer ihavenet.com. Dies passiert im Internet Explorer genauso wie im Firefox. Direkte Eingabe von Internetadressen funktioniert.
Avira Internet Security (Vollversion) findet nichts. Allerdings bekomme ich hier "den Schirm nicht mehr auf".

Vielen Dank vorab für Eure Hilfe!
Felix

Hier die LogFiles:

defogger:

Code:

defogger_disable by jpshortstuff (23.02.10.1)

Log created at 14:44 on 11/09/2013 (Rodenwald)
 

Checking for autostart values...

HKCU\~\Run values retrieved.

HKLM\~\Run values retrieved.
 

Checking for services/drivers...
 
 

-=E.O.F=-

FRST:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-09-2013

Ran by Rodenwald (administrator) on RW-PC on 11-09-2013 14:47:32

Running from C:\Users\Rodenwald\Downloads

Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) =================
 

(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe

(Microsoft Corporation) C:\Windows\system32\WLANExt.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe

(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe

(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe

(Egis Technology Inc.) C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe

(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe

(Intel Corporation) C:\Windows\system32\igfxsrvc.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesApp64.exe

(Acer Group) C:\Program Files\Acer\Acer Updater\UpdaterService.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

() C:\Windows\PLFSetI.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe

(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe

(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe

(Egis Technology Inc.) C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe

(Egis Technology Inc.) C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE

(Intel Corporation) C:\Windows\system32\igfxext.exe

(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe

(Avira Operations GmbH & Co. KG) C:\program files (x86)\avira\antivir desktop\avcenter.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [mwlDaemon] - C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe [349552 2010-02-01] (Egis Technology Inc.)

HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10060832 2010-02-09] (Realtek Semiconductor)

HKLM\...\Run: [PLFSetI] - C:\Windows\PLFSetI.exe [206208 2012-11-01] ()

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1842472 2009-09-18] (Synaptics Incorporated)

HKLM\...\Run: [Acer ePower Management] - C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [860704 2010-03-17] (Acer Incorporated)

HKLM\...\Policies\Explorer: [NoActiveDesktop] 1

HKLM\...\Policies\Explorer: [NoActiveDesktopChanges] 1

HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19876456 2013-06-21] (Skype Technologies S.A.)

HKCU\...\Run: [hpiwsygrv] - rundll32 "C:\Users\Rodenwald\AppData\Roaming\mprddmt.dll",SNUNOQ

MountPoints2: D - D:\PSetup.exe /continue /uionlyifneeded

HKLM-x32\...\Run: [BackupManagerTray] - C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [260608 2010-03-09] (NewTech Infosystems, Inc.)

HKLM-x32\...\Run: [SuiteTray] - C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe [337264 2010-02-01] (Egis Technology Inc.)

HKLM-x32\...\Run: [EgisUpdate] - C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe [201512 2009-12-25] (Egis Technology Inc.)

HKLM-x32\...\Run: [EgisTecPMMUpdate] - C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe [401192 2009-12-25] (Egis Technology Inc.)

HKLM-x32\...\Run: [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe [1300560 2010-03-04] (Dritek System Inc.)

HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-08-20] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] - C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [685048 2012-08-03] (Cisco Systems, Inc.)

HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [154144 2010-01-15] ()

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk

ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.gamesagogo.iplay.com/?o=shp

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_1830t&r=07361112b126l0428z155t4541k41q

SearchScopes: HKCU - {36377DD7-B3EB-42f5-986F-680BAF59BA9D} URL = hxxp://start.gamesagogo.iplay.com/searchresultsredirect.aspx?o=chrome&q={searchTerms}

BHO-x32: GamesBar (W) - {2e94b700-eafb-4c9e-a696-77200aa3f89b} - C:\Program Files (x86)\gamesagogo_w3i\encyclopediabritannicagamesbarX.dll No File

Toolbar: HKLM-x32 - GamesBar (W) - {2e94b700-eafb-4c9e-a696-77200aa3f89b} - C:\Program Files (x86)\gamesagogo_w3i\encyclopediabritannicagamesbarX.dll No File

Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
 

FireFox:

========

FF ProfilePath: C:\Users\Rodenwald\AppData\Roaming\Mozilla\Firefox\Profiles\sh5g0skb.default

FF DefaultSearchEngine: Yahoo!

FF Homepage: hxxp://www.google.de

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\Yahooober1163533.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: GamesBar (W) - C:\Users\Rodenwald\AppData\Roaming\Mozilla\Firefox\Profiles\sh5g0skb.default\Extensions\{2e94b700-eafb-4c9e-a696-77200aa3f89b}

FF Extension: langpack-de - C:\Users\Rodenwald\AppData\Roaming\Mozilla\Firefox\Profiles\sh5g0skb.default\Extensions\langpack-de@firefox.mozilla.org.xpi

FF Extension: No Name - C:\Users\Rodenwald\AppData\Roaming\Mozilla\Firefox\Profiles\sh5g0skb.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi

FF Extension: No Name - C:\Users\Rodenwald\AppData\Roaming\Mozilla\Firefox\Profiles\sh5g0skb.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
 

==================== Services (Whitelisted) =================
 

R2 AntiVirFirewallService; C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe [655928 2013-08-20] (Avira Operations GmbH & Co. KG)

S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [622648 2013-09-03] (Avira Operations GmbH & Co. KG)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-08-20] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-08-20] (Avira Operations GmbH & Co. KG)

R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-08-20] (Avira Operations GmbH & Co. KG)

S3 MWLService; C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [305520 2010-02-01] (Egis Technology Inc.)

R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe [2402080 2013-01-28] (TuneUp Software)
 

==================== Drivers (Whitelisted) ====================
 

R3 avfwim; C:\Windows\System32\DRIVERS\avfwim.sys [114608 2013-02-12] (Avira GmbH)

R1 avfwot; C:\Windows\System32\DRIVERS\avfwot.sys [141376 2013-02-12] (Avira GmbH)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-03] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-08-20] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-03-28] (Avira Operations GmbH & Co. KG)

R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesDriver64.sys [11880 2012-09-19] (TuneUp Software)

S3 ALSysIO; \??\C:\Users\RODENW~1\AppData\Local\Temp\ALSysIO64.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-09-11 14:45 - 2013-09-11 14:45 - 01949408 _____ (Farbar) C:\Users\Rodenwald\Downloads\FRST64.exe

2013-09-11 14:44 - 2013-09-11 14:44 - 00000480 _____ C:\Users\Rodenwald\Downloads\defogger_disable.log

2013-09-11 14:44 - 2013-09-11 14:44 - 00000000 _____ C:\Users\Rodenwald\defogger_reenable

2013-09-11 14:43 - 2013-09-11 14:43 - 00050477 _____ C:\Users\Rodenwald\Downloads\Defogger.exe

2013-09-10 22:01 - 2013-07-09 11:14 - 00001820 _____ C:\Users\Rodenwald\Desktop\delfolders.bat

2013-09-10 21:58 - 2013-09-10 22:15 - 00000029 _____ C:\Users\Rodenwald\Desktop\Shutme.bat

2013-09-10 21:53 - 2013-09-10 21:53 - 00240532 _____ C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Trojaner-Board.html

2013-09-10 21:53 - 2013-09-10 21:53 - 00117440 _____ C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Seite 2 - Trojaner-Board.html

2013-09-10 21:53 - 2013-09-10 21:53 - 00091410 _____ C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Seite 3 - Trojaner-Board.html

2013-09-10 21:53 - 2013-09-10 21:53 - 00000000 ____D C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Trojaner-Board_files

2013-09-10 21:53 - 2013-09-10 21:53 - 00000000 ____D C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Seite 3 - Trojaner-Board_files

2013-09-10 21:53 - 2013-09-10 21:53 - 00000000 ____D C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Seite 2 - Trojaner-Board_files

2013-09-10 21:36 - 2013-09-10 21:36 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2013-09-10 21:26 - 2013-09-10 22:03 - 00181064 _____ (Sysinternals) C:\Windows\PSEXESVC.EXE

2013-09-10 21:17 - 2013-09-10 21:17 - 00001117 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-09-10 21:15 - 2013-09-10 21:15 - 03268369 _____ C:\Users\Rodenwald\Downloads\tweaking.com_windows_repair_aio.zip

2013-09-10 21:15 - 2013-09-10 21:15 - 00000000 ____D C:\Users\Rodenwald\Downloads\tweaking.com_windows_repair_aio

2013-09-10 21:09 - 2013-09-10 21:09 - 00686017 _____ C:\Users\Rodenwald\Desktop\SysInspector-RW-PC-130910-2103.zip

2013-09-10 21:03 - 2013-09-10 21:03 - 04919312 _____ C:\Users\Rodenwald\Downloads\SysInspector_1.2.42.zip

2013-09-10 21:03 - 2013-09-10 21:03 - 00000000 ____D C:\Users\Rodenwald\Downloads\SysInspector_1.2.42

2013-09-10 20:54 - 2013-09-10 20:54 - 00000000 ____D C:\Windows\ERUNT

2013-09-10 20:34 - 2013-09-10 21:17 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-09-10 20:34 - 2013-09-10 20:34 - 00000000 ____D C:\Users\Rodenwald\AppData\Roaming\Malwarebytes

2013-09-10 20:34 - 2013-09-10 20:34 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-09-10 20:34 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2013-09-10 19:58 - 2013-09-10 19:58 - 00119925 _____ C:\Users\Rodenwald\Desktop\bookmarks.html

2013-09-09 20:14 - 2013-09-10 20:25 - 00000000 ____D C:\AdwCleaner

2013-09-09 20:13 - 2013-09-09 20:13 - 01037278 _____ C:\Users\Rodenwald\Downloads\AdwCleaner.exe

2013-09-05 20:32 - 2013-09-05 20:32 - 00000000 ____D C:\Intel

2013-09-03 13:29 - 2013-09-03 13:29 - 00208896 __RSH C:\Users\Rodenwald\AppData\Roaming\mprddmt.dll

2013-08-17 16:32 - 2013-09-10 21:36 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2013-08-16 16:26 - 2013-08-16 16:26 - 00000815 _____ C:\Users\Public\Desktop\PowerTeacher.lnk

2013-08-16 16:26 - 2013-08-16 16:26 - 00000000 ____D C:\ProgramData\PowerTeacher

2013-08-15 11:38 - 2013-08-15 11:38 - 00344832 _____ C:\Users\Rodenwald\Downloads\documents-export-2013-08-15.zip

2013-08-15 00:10 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2013-08-15 00:10 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2013-08-15 00:10 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2013-08-15 00:10 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2013-08-15 00:10 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2013-08-15 00:10 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2013-08-15 00:10 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2013-08-15 00:10 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2013-08-15 00:10 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2013-08-15 00:10 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2013-08-15 00:10 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll

2013-08-15 00:10 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2013-08-15 00:10 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2013-08-15 00:10 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2013-08-15 00:10 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2013-08-15 00:10 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2013-08-15 00:10 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2013-08-15 00:10 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2013-08-15 00:10 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2013-08-15 00:10 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2013-08-15 00:10 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2013-08-15 00:10 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2013-08-15 00:10 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2013-08-15 00:10 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll

2013-08-15 00:10 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2013-08-15 00:10 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2013-08-15 00:10 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2013-08-15 00:10 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2013-08-15 00:10 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2013-08-15 00:10 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe

2013-08-15 00:10 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe

2013-08-14 22:28 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL

2013-08-14 22:28 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL

2013-08-14 22:28 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll

2013-08-14 22:28 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll

2013-08-14 22:28 - 2013-07-09 08:03 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2013-08-14 22:28 - 2013-07-09 07:54 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll

2013-08-14 22:28 - 2013-07-09 07:53 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll

2013-08-14 22:28 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll

2013-08-14 22:28 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll

2013-08-14 22:28 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll

2013-08-14 22:28 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll

2013-08-14 22:28 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll

2013-08-14 22:28 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe

2013-08-14 22:28 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe

2013-08-14 22:28 - 2013-07-09 06:53 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll

2013-08-14 22:28 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll

2013-08-14 22:28 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll

2013-08-14 22:28 - 2013-07-09 06:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll

2013-08-14 22:28 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll

2013-08-14 22:28 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll

2013-08-14 22:28 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll

2013-08-14 22:28 - 2013-07-09 04:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe

2013-08-14 22:28 - 2013-07-09 04:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll

2013-08-14 22:28 - 2013-07-09 04:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe

2013-08-14 22:28 - 2013-07-09 04:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe

2013-08-14 22:28 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2013-08-14 22:28 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
 

==================== One Month Modified Files and Folders =======
 

2013-09-11 14:47 - 2013-09-11 14:47 - 00000000 ____D C:\FRST

2013-09-11 14:45 - 2013-09-11 14:45 - 01949408 _____ (Farbar) C:\Users\Rodenwald\Downloads\FRST64.exe

2013-09-11 14:44 - 2013-09-11 14:44 - 00000480 _____ C:\Users\Rodenwald\Downloads\defogger_disable.log

2013-09-11 14:44 - 2013-09-11 14:44 - 00000000 _____ C:\Users\Rodenwald\defogger_reenable

2013-09-11 14:44 - 2012-11-01 13:36 - 00000000 ____D C:\Users\Rodenwald

2013-09-11 14:44 - 2012-11-01 13:31 - 01847896 _____ C:\Windows\WindowsUpdate.log

2013-09-11 14:43 - 2013-09-11 14:43 - 00050477 _____ C:\Users\Rodenwald\Downloads\Defogger.exe

2013-09-11 14:42 - 2012-11-04 23:30 - 00000000 ____D C:\Users\Rodenwald\AppData\Roaming\Skype

2013-09-11 14:30 - 2012-11-08 13:45 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-09-11 13:56 - 2012-11-01 22:21 - 00654400 _____ C:\Windows\system32\perfh007.dat

2013-09-11 13:56 - 2012-11-01 22:21 - 00130240 _____ C:\Windows\system32\perfc007.dat

2013-09-11 13:56 - 2009-07-14 07:13 - 01498742 _____ C:\Windows\system32\PerfStringBackup.INI

2013-09-11 13:56 - 2009-07-14 06:45 - 00017376 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-09-11 13:56 - 2009-07-14 06:45 - 00017376 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-09-11 13:51 - 2013-07-21 23:29 - 00008034 _____ C:\Windows\setupact.log

2013-09-11 13:51 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-09-10 22:15 - 2013-09-10 21:58 - 00000029 _____ C:\Users\Rodenwald\Desktop\Shutme.bat

2013-09-10 22:06 - 2013-07-21 23:29 - 00427160 _____ C:\Windows\system32\FNTCACHE.DAT

2013-09-10 22:05 - 2013-07-21 23:28 - 00006428 _____ C:\Windows\PFRO.log

2013-09-10 22:03 - 2013-09-10 21:26 - 00181064 _____ (Sysinternals) C:\Windows\PSEXESVC.EXE

2013-09-10 21:59 - 2009-07-14 04:34 - 00000514 _____ C:\Windows\win.ini

2013-09-10 21:53 - 2013-09-10 21:53 - 00240532 _____ C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Trojaner-Board.html

2013-09-10 21:53 - 2013-09-10 21:53 - 00117440 _____ C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Seite 2 - Trojaner-Board.html

2013-09-10 21:53 - 2013-09-10 21:53 - 00091410 _____ C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Seite 3 - Trojaner-Board.html

2013-09-10 21:53 - 2013-09-10 21:53 - 00000000 ____D C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Trojaner-Board_files

2013-09-10 21:53 - 2013-09-10 21:53 - 00000000 ____D C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Seite 3 - Trojaner-Board_files

2013-09-10 21:53 - 2013-09-10 21:53 - 00000000 ____D C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Seite 2 - Trojaner-Board_files

2013-09-10 21:52 - 2013-07-21 14:11 - 00111288 _____ C:\Users\RODENW~1\AppData\Local\GDIPFONTCACHEV1.DAT

2013-09-10 21:36 - 2013-09-10 21:36 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2013-09-10 21:36 - 2013-08-17 16:32 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2013-09-10 21:17 - 2013-09-10 21:17 - 00001117 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-09-10 21:17 - 2013-09-10 20:34 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-09-10 21:15 - 2013-09-10 21:15 - 03268369 _____ C:\Users\Rodenwald\Downloads\tweaking.com_windows_repair_aio.zip

2013-09-10 21:15 - 2013-09-10 21:15 - 00000000 ____D C:\Users\Rodenwald\Downloads\tweaking.com_windows_repair_aio

2013-09-10 21:09 - 2013-09-10 21:09 - 00686017 _____ C:\Users\Rodenwald\Desktop\SysInspector-RW-PC-130910-2103.zip

2013-09-10 21:03 - 2013-09-10 21:03 - 04919312 _____ C:\Users\Rodenwald\Downloads\SysInspector_1.2.42.zip

2013-09-10 21:03 - 2013-09-10 21:03 - 00000000 ____D C:\Users\Rodenwald\Downloads\SysInspector_1.2.42

2013-09-10 20:54 - 2013-09-10 20:54 - 00000000 ____D C:\Windows\ERUNT

2013-09-10 20:34 - 2013-09-10 20:34 - 00000000 ____D C:\Users\Rodenwald\AppData\Roaming\Malwarebytes

2013-09-10 20:34 - 2013-09-10 20:34 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-09-10 20:25 - 2013-09-09 20:14 - 00000000 ____D C:\AdwCleaner

2013-09-10 19:58 - 2013-09-10 19:58 - 00119925 _____ C:\Users\Rodenwald\Desktop\bookmarks.html

2013-09-09 20:13 - 2013-09-09 20:13 - 01037278 _____ C:\Users\Rodenwald\Downloads\AdwCleaner.exe

2013-09-05 20:32 - 2013-09-05 20:32 - 00000000 ____D C:\Intel

2013-09-03 13:29 - 2013-09-03 13:29 - 00208896 __RSH C:\Users\Rodenwald\AppData\Roaming\mprddmt.dll

2013-09-03 11:25 - 2013-03-28 21:51 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

2013-09-03 10:59 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT

2013-08-30 09:48 - 2013-02-05 13:22 - 00000000 ___RD C:\Program Files (x86)\Skype

2013-08-30 09:48 - 2012-11-04 23:30 - 00000000 ____D C:\ProgramData\Skype

2013-08-29 14:40 - 2013-07-18 00:23 - 00000000 ____D C:\Windows\system32\MRT

2013-08-29 14:38 - 2012-11-10 23:39 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2013-08-20 12:37 - 2013-05-02 11:27 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys

2013-08-20 12:37 - 2013-03-28 21:51 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys

2013-08-16 16:26 - 2013-08-16 16:26 - 00000815 _____ C:\Users\Public\Desktop\PowerTeacher.lnk

2013-08-16 16:26 - 2013-08-16 16:26 - 00000000 ____D C:\ProgramData\PowerTeacher

2013-08-15 11:38 - 2013-08-15 11:38 - 00344832 _____ C:\Users\Rodenwald\Downloads\documents-export-2013-08-15.zip

2013-08-15 10:54 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache

2013-08-15 07:12 - 2009-07-27 22:41 - 00000000 ____D C:\Windows\Panther

2013-08-15 00:09 - 2010-04-13 04:55 - 00000000 ____D C:\ProgramData\Microsoft Help
 

Files to move or delete:

====================

C:\Users\RODENW~1\AppData\Local\Temp\mbam-setup.exe

C:\Users\RODENW~1\AppData\Local\Temp\Quarantine.exe
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-09-01 21:05
 

==================== End Of Log ============================

Additions:

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-09-2013

Ran by Rodenwald at 2013-09-11 14:48:54

Running from C:\Users\Rodenwald\Downloads

Boot Mode: Normal

==========================================================
 
 

==================== Installed Programs =======================
 

 Update for Microsoft Office 2007 (KB2508958) (x32)

64 Bit HP CIO Components Installer (Version: 8.2.4)

7-Zip 9.20 (x32)

Acer Backup Manager (x32 Version: 2.0.0.60)

Acer Crystal Eye webcam Ver:1.1.158.203 (x32 Version: 1.1.158.203)

Acer ePower Management (x32 Version: 5.00.3003)

Acer eRecovery Management (x32 Version: 4.05.3011)

Acer Registration (x32 Version: 1.03.3002)

Acer ScreenSaver (x32 Version: 1.1.0211.2010)

Acer Updater (x32 Version: 1.02.3001)

Acrobat.com (x32 Version: 1.6.65)

Adobe AIR (x32 Version: 1.5.0.7220)

Adobe Flash Player 10 ActiveX (x32 Version: 10.0.45.2)

Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.94)

Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03)

Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (x32 Version: 1.0.0.20)

Avira Internet Security (x32 Version: 13.0.0.4052)

Backup Manager Basic (x32 Version: 2.0.0.60)

Cisco AnyConnect Secure Mobility Client  (x32 Version: 3.1.00495)

Cisco AnyConnect Secure Mobility Client (x32 Version: 3.1.00495)

Compatibility Pack für 2007 Office System (x32 Version: 12.0.6612.1000)

CyberLink PowerDVD 9 (x32 Version: 9.0.2529.50)

eSobi v2 (x32 Version: 2.0.4.000274)

Free WMA to MP3 Converter 1.16 (x32)

Free YouTube Download version 3.2.5.628 (x32 Version: 3.2.5.628)

Free YouTube to MP3 Converter version 3.12.5.628 (x32 Version: 3.12.5.628)

GamesBar (W) (x32 Version: 3.2.0.36)

GIMP 2.8.4 (Version: 2.8.4)

Identity Card (x32 Version: 1.00.3003)

ImageJ 1.47t

Intel(R) Graphics Media Accelerator Driver (x32 Version: 8.15.10.2057)

Intel(R) Management Engine Components (x32 Version: 6.0.0.1179)

Intel(R) Rapid Storage Technology (x32 Version: 9.5.6.1001)

Junk Mail filter update (x32 Version: 14.0.8089.726)

Langenscheidt Vokabeltrainer 6.0 Englisch (x32 Version: 6.0.9)

Launch Manager (x32 Version: 4.0.7)

Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)

Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)

Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)

Microsoft Application Error Reporting (Version: 12.0.6015.5000)

Microsoft Choice Guard (x32 Version: 2.0.48.0)

Microsoft Office 2007 Service Pack 3 (SP3) (x32)

Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003)

Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Language Pack 2007 - German/Deutsch (x32 Version: 12.0.6612.1000)

Microsoft Office Live Add-in 1.5 (x32 Version: 2.0.4024.1)

Microsoft Office O MUI (German) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000)

Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014)

Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32)

Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000)

Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office SharePoint Designer 2007 Service Pack 3 (SP3) (x32)

Microsoft Office SharePoint Designer MUI (German) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Visio 2007 Service Pack 3 (SP3) (x32)

Microsoft Office Visio MUI (German) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Visio Professional 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office X MUI (German) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Silverlight (Version: 5.1.20513.0)

Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)

Microsoft Works (x32 Version: 9.7.0621)

Mozilla Firefox 23.0.1 (x86 de) (x32 Version: 23.0.1)

Mozilla Maintenance Service (x32 Version: 23.0.1)

MSVCRT (x32 Version: 14.0.1468.721)

MyWinLocker (x32 Version: 3.1.206.0)

MyWinLocker Suite (x32 Version: 3.1.206.0)

PowerTeacher Version 23.04.026.P41 (x32 Version: 23.04.026.P41)

R for Windows 3.0.1 (Version: 3.0.1)

Realtek High Definition Audio Driver (x32 Version: 6.0.1.6043)

Realtek USB 2.0 Card Reader (x32 Version: 6.1.7600.30113)

RStudio (x32 Version: 0.97.551)

Shredder (Version: 2.0.5.0)

Shredder (x32 Version: 2.0.5.0)

Skype™ 6.6 (x32 Version: 6.6.106)

Snagit 11 (x32 Version: 11.1.0)

Synaptics Pointing Device Driver (Version: 14.0.6.0)

TuneUp Utilities 2013 (x32 Version: 13.0.3020.2)

TuneUp Utilities Language Pack (de-DE) (x32 Version: 13.0.3020.2)

Uninstall Helper (x32 Version: 2.0.1.0)

Update for 2007 Microsoft Office System (KB967642) (x32)

Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32)

Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition (x32)

Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition (x32)

Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (x32)

Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (x32)

Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32)

Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (x32)

Update for Microsoft Office Outlook 2007 (KB2768023) 32-Bit Edition (x32)

Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2817642) 32-Bit Edition (x32)

Update für Microsoft Office Excel 2007 Help (KB963678) (x32)

Update für Microsoft Office Outlook 2007 Help (KB963677) (x32)

Update für Microsoft Office Powerpoint 2007 Help (KB963669) (x32)

Update für Microsoft Office Word 2007 Help (KB963665) (x32)

Welcome Center (x32 Version: 1.01.3002)

WIDCOMM Bluetooth Software (Version: 6.3.0.4300)

Windows Live Call (x32 Version: 14.0.8064.0206)

Windows Live Communications Platform (x32 Version: 14.0.8064.206)

Windows Live Essentials (x32 Version: 14.0.8089.0726)

Windows Live Essentials (x32 Version: 14.0.8089.726)

Windows Live Fotogalerie (x32 Version: 14.0.8081.709)

Windows Live Mail (x32 Version: 14.0.8089.0726)

Windows Live Movie Maker (x32 Version: 14.0.8091.0730)

Windows Live Sync (x32 Version: 14.0.8089.726)

Windows Live Writer (x32 Version: 14.0.8089.0726)

Windows Live-Uploadtool (x32 Version: 14.0.8014.1029)
 

==================== Restore Points  =========================
 

11-08-2013 10:16:57 Geplanter Prüfpunkt

14-08-2013 22:01:18 Windows Update

21-08-2013 22:06:55 Geplanter Prüfpunkt

29-08-2013 12:37:16 Windows Update

07-09-2013 07:18:35 Geplanter Prüfpunkt

10-09-2013 19:18:34 Tweaking.com - Windows Repair
 

==================== Hosts content: ==========================
 

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {044A6734-E90E-4F8F-B357-B2DC8AB3B5EC} - System32\Tasks\Microsoft\Windows\Time Synchronization\SynchronizeTime => Sc.exe start w32time task_started

Task: {10C927F0-3F2C-4CF6-AF39-2DBAA99E695B} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-07-16] (Adobe Systems Incorporated)

Task: {1B6ACB28-78DB-47DB-A68B-FF82A6392AEE} - System32\Tasks\{2B971B3F-5DD2-4F3C-9CB6-D1621AC35D08} => Firefox.exe hxxp://ui.skype.com/ui/0/4.1.0.179.367/de/abandoninstall?source=lightinstaller&amp;page=tsMain&amp;installinfo=google-toolbar:notoffered;notincluded,google-chrome:notoffered;notincluded

Task: {2BB21F6E-E892-4FEB-A246-34A1009FAD29} - System32\Tasks\Microsoft\Windows\TabletPC\InputPersonalization => C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe [2009-07-14] (Microsoft Corporation)

Task: {8F15E77E-2E6C-41AC-B91B-4AE23BAD143F} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-04-04] (Adobe Systems Incorporated)

Task: {AFD810A6-CCF3-4AB9-9B4E-5129B0810969} - System32\Tasks\Microsoft\Windows\WindowsBackup\Windows Backup Monitor => C:\Windows\system32\sdclt.exe [2010-11-20] (Microsoft Corporation)

Task: {B35646A8-D26E-4FEB-ACF1-BA92E768C136} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => C:\Windows\System32\sdengin2.dll [2010-11-20] (Microsoft Corporation)

Task: {C077D271-2425-40F6-9D5F-631291551814} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 => C:\Program Files (x86)\TuneUp Utilities 2013\OneClick.exe [2013-01-28] (TuneUp Software)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
 

==================== Loaded Modules (whitelisted) =============
 

2012-11-01 13:49 - 2010-03-17 11:56 - 00271904 _____ (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\SysHook.dll

2012-11-01 22:07 - 2010-01-26 03:04 - 00286208 _____ (Intel Corporation) C:\Windows\system32\igfxrDEU.lrc

2010-03-26 12:46 - 2010-03-26 12:46 - 00173856 _____ () C:\Program Files\WIDCOMM\Bluetooth Software\btkeyind.dll

2013-01-28 15:19 - 2013-01-28 15:19 - 00028960 _____ (TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\SDShelEx-x64.dll

2012-11-01 22:08 - 2009-09-18 06:09 - 00396072 _____ (Synaptics Incorporated) C:\Windows\system32\SynCOM.dll

2012-11-01 22:08 - 2009-09-18 06:09 - 00205608 _____ (Synaptics Incorporated) C:\Windows\system32\SynTPAPI.dll

2012-11-01 13:49 - 2010-03-17 11:56 - 00219168 _____ (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\BrightnessControl.dll

2012-11-01 13:49 - 2010-03-17 11:56 - 00218144 _____ (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\PowerSettingControl.dll

2012-11-01 13:49 - 2010-03-17 11:56 - 00218144 _____ (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\NetAdapterControl.dll

2012-11-01 13:49 - 2010-03-17 11:56 - 00217120 _____ (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\CommonControl.dll

2009-07-14 02:09 - 2009-07-14 03:38 - 00425984 _____ (Microsoft Corporation) C:\Windows\system32\irprops.cpl

2012-11-01 22:08 - 2010-03-09 05:07 - 00457296 _____ (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDUtl.dll

2012-11-10 15:23 - 2010-11-20 15:27 - 01435648 _____ (Microsoft Corporation) C:\Windows\System32\Speech\Common\sapi.dll

2008-11-12 03:16 - 2008-11-12 03:16 - 00268848 _____ (EgisTec Inc.) C:\Program Files (x86)\EgisTec MyWinLocker\x86\keyManager.dll

2010-02-01 20:03 - 2010-02-01 20:03 - 00529776 _____ (EgisTec Inc.) C:\Program Files (x86)\EgisTec MyWinLocker\x86\CryptoAPI.dll

2013-06-21 10:57 - 2013-06-21 10:57 - 00088680 ____R (Skype Technologies) C:\Program Files (x86)\Skype\Updater\Updater.dll

2012-11-10 15:29 - 2010-11-20 14:16 - 00193536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ksproxy.ax

2009-07-14 01:51 - 2009-07-14 03:14 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vidcap.ax

2012-11-10 15:29 - 2010-11-20 14:16 - 00107008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kswdmcap.ax

2012-11-10 15:29 - 2010-11-20 14:16 - 00320000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WINSPOOL.DRV

2010-03-09 02:18 - 2010-03-09 02:18 - 00465576 _____ () C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\sqlite3.dll

2010-03-09 02:14 - 2010-03-09 02:14 - 00018688 _____ (NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\MUI\0407\lang.dll

2012-11-01 22:08 - 2009-07-21 01:12 - 00137736 _____ (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\ComFnUtl.dll

2012-11-01 22:08 - 2009-07-15 00:53 - 00128008 _____ (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\CDRomUtl.dll

2012-11-01 22:08 - 2009-07-27 22:42 - 00062472 _____ (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MixerUtl.dll

2012-11-01 22:08 - 2009-07-27 22:47 - 00068104 _____ (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\Wnd2File.dll

2012-11-01 22:08 - 2009-07-28 04:43 - 00068104 _____ (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\PowerUtl.dll

2012-11-01 22:08 - 2009-12-31 03:13 - 00326736 _____ (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\OSDUtl2.dll

2012-11-01 22:08 - 2009-07-27 22:38 - 00088584 _____ (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\SzUPFUtl.dll

2012-11-01 22:08 - 2010-03-02 02:43 - 00351312 _____ (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\RadioWndUtl.dll

2012-11-01 22:08 - 2009-07-04 02:29 - 00147464 _____ (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\VistaVol.DLL

2012-11-01 22:08 - 2009-05-21 00:02 - 00072200 _____ () C:\Program Files (x86)\Launch Manager\CdDirIo.dll

2012-11-01 22:08 - 2010-02-10 19:49 - 00082000 _____ (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LmSmbKel.dll

2012-11-01 22:08 - 2010-03-04 07:21 - 00280656 _____ (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\aipflib.dll

2009-07-14 01:30 - 2009-07-14 03:16 - 00029184 _____ (Microsoft Corporation) C:\Windows\sysWOW64\wbem\wbemprox.dll

2009-07-14 01:30 - 2009-07-14 03:16 - 00047616 _____ (Microsoft Corporation) C:\Windows\sysWOW64\wbem\wbemsvc.dll

2012-11-10 15:29 - 2010-11-20 14:19 - 00606208 _____ (Microsoft Corporation) C:\Windows\sysWOW64\wbem\fastprox.dll

2012-08-03 14:53 - 2012-08-03 14:53 - 00062968 _____ () C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\zlib1.dll

2012-11-01 22:08 - 2010-02-03 22:31 - 00071248 _____ (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\NTKCUtl.dll

2013-09-10 21:36 - 2013-08-14 19:55 - 03551640 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

2009-07-14 01:31 - 2009-07-14 03:16 - 00187392 _____ (Microsoft Corporation) C:\Windows\sysWOW64\wbem\wbemdisp.dll

2009-07-14 01:30 - 2009-07-14 03:16 - 00085504 _____ (Microsoft Corporation) C:\Windows\sysWOW64\wbem\wmiutils.dll
 

==================== Alternate Data Streams (whitelisted) ==========
 
 
 

==================== Faulty Device Manager Devices =============
 

Name: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64

Description: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64

Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}

Manufacturer: Cisco Systems

Service: vpnva

Problem: : This device is disabled. (Code 22)

Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (09/11/2013 01:53:21 PM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: avmailc.exe, Version: 13.6.20.2202, Zeitstempel: 0x521f4012

Name des fehlerhaften Moduls: MSVCR100.dll, Version: 10.0.40219.325, Zeitstempel: 0x4df2be1e

Ausnahmecode: 0x40000015

Fehleroffset: 0x0008d6fd

ID des fehlerhaften Prozesses: 0x1380

Startzeit der fehlerhaften Anwendung: 0xavmailc.exe0

Pfad der fehlerhaften Anwendung: avmailc.exe1

Pfad des fehlerhaften Moduls: avmailc.exe2

Berichtskennung: avmailc.exe3
 

Error: (09/11/2013 01:53:20 PM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: avmailc.exe, Version: 13.6.20.2202, Zeitstempel: 0x521f4012

Name des fehlerhaften Moduls: MSVCR100.dll, Version: 10.0.40219.325, Zeitstempel: 0x4df2be1e

Ausnahmecode: 0x40000015

Fehleroffset: 0x0008d6fd

ID des fehlerhaften Prozesses: 0x10ac

Startzeit der fehlerhaften Anwendung: 0xavmailc.exe0

Pfad der fehlerhaften Anwendung: avmailc.exe1

Pfad des fehlerhaften Moduls: avmailc.exe2

Berichtskennung: avmailc.exe3
 

Error: (09/11/2013 01:53:13 PM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: avmailc.exe, Version: 13.6.20.2202, Zeitstempel: 0x521f4012

Name des fehlerhaften Moduls: MSVCR100.dll, Version: 10.0.40219.325, Zeitstempel: 0x4df2be1e

Ausnahmecode: 0x40000015

Fehleroffset: 0x0008d6fd

ID des fehlerhaften Prozesses: 0xa9c

Startzeit der fehlerhaften Anwendung: 0xavmailc.exe0

Pfad der fehlerhaften Anwendung: avmailc.exe1

Pfad des fehlerhaften Moduls: avmailc.exe2

Berichtskennung: avmailc.exe3
 

Error: (09/11/2013 11:52:53 AM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: avmailc.exe, Version: 13.6.20.2202, Zeitstempel: 0x521f4012

Name des fehlerhaften Moduls: MSVCR100.dll, Version: 10.0.40219.325, Zeitstempel: 0x4df2be1e

Ausnahmecode: 0x40000015

Fehleroffset: 0x0008d6fd

ID des fehlerhaften Prozesses: 0x1608

Startzeit der fehlerhaften Anwendung: 0xavmailc.exe0

Pfad der fehlerhaften Anwendung: avmailc.exe1

Pfad des fehlerhaften Moduls: avmailc.exe2

Berichtskennung: avmailc.exe3
 

Error: (09/11/2013 11:52:06 AM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: avmailc.exe, Version: 13.6.20.2202, Zeitstempel: 0x521f4012

Name des fehlerhaften Moduls: MSVCR100.dll, Version: 10.0.40219.325, Zeitstempel: 0x4df2be1e

Ausnahmecode: 0x40000015

Fehleroffset: 0x0008d6fd

ID des fehlerhaften Prozesses: 0x15dc

Startzeit der fehlerhaften Anwendung: 0xavmailc.exe0

Pfad der fehlerhaften Anwendung: avmailc.exe1

Pfad des fehlerhaften Moduls: avmailc.exe2

Berichtskennung: avmailc.exe3
 

Error: (09/11/2013 11:37:02 AM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: avmailc.exe, Version: 13.6.20.2202, Zeitstempel: 0x521f4012

Name des fehlerhaften Moduls: MSVCR100.dll, Version: 10.0.40219.325, Zeitstempel: 0x4df2be1e

Ausnahmecode: 0x40000015

Fehleroffset: 0x0008d6fd

ID des fehlerhaften Prozesses: 0x15bc

Startzeit der fehlerhaften Anwendung: 0xavmailc.exe0

Pfad der fehlerhaften Anwendung: avmailc.exe1

Pfad des fehlerhaften Moduls: avmailc.exe2

Berichtskennung: avmailc.exe3
 

Error: (09/11/2013 11:36:41 AM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: avmailc.exe, Version: 13.6.20.2202, Zeitstempel: 0x521f4012

Name des fehlerhaften Moduls: MSVCR100.dll, Version: 10.0.40219.325, Zeitstempel: 0x4df2be1e

Ausnahmecode: 0x40000015

Fehleroffset: 0x0008d6fd

ID des fehlerhaften Prozesses: 0x11c0

Startzeit der fehlerhaften Anwendung: 0xavmailc.exe0

Pfad der fehlerhaften Anwendung: avmailc.exe1

Pfad des fehlerhaften Moduls: avmailc.exe2

Berichtskennung: avmailc.exe3
 

Error: (09/11/2013 11:35:59 AM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: avmailc.exe, Version: 13.6.20.2202, Zeitstempel: 0x521f4012

Name des fehlerhaften Moduls: MSVCR100.dll, Version: 10.0.40219.325, Zeitstempel: 0x4df2be1e

Ausnahmecode: 0x40000015

Fehleroffset: 0x0008d6fd

ID des fehlerhaften Prozesses: 0xf40

Startzeit der fehlerhaften Anwendung: 0xavmailc.exe0

Pfad der fehlerhaften Anwendung: avmailc.exe1

Pfad des fehlerhaften Moduls: avmailc.exe2

Berichtskennung: avmailc.exe3
 

Error: (09/10/2013 10:08:17 PM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: avmailc.exe, Version: 13.6.20.2202, Zeitstempel: 0x521f4012

Name des fehlerhaften Moduls: MSVCR100.dll, Version: 10.0.40219.325, Zeitstempel: 0x4df2be1e

Ausnahmecode: 0x40000015

Fehleroffset: 0x0008d6fd

ID des fehlerhaften Prozesses: 0xe04

Startzeit der fehlerhaften Anwendung: 0xavmailc.exe0

Pfad der fehlerhaften Anwendung: avmailc.exe1

Pfad des fehlerhaften Moduls: avmailc.exe2

Berichtskennung: avmailc.exe3
 

Error: (09/10/2013 10:08:15 PM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: avmailc.exe, Version: 13.6.20.2202, Zeitstempel: 0x521f4012

Name des fehlerhaften Moduls: MSVCR100.dll, Version: 10.0.40219.325, Zeitstempel: 0x4df2be1e

Ausnahmecode: 0x40000015

Fehleroffset: 0x0008d6fd

ID des fehlerhaften Prozesses: 0xc40

Startzeit der fehlerhaften Anwendung: 0xavmailc.exe0

Pfad der fehlerhaften Anwendung: avmailc.exe1

Pfad des fehlerhaften Moduls: avmailc.exe2

Berichtskennung: avmailc.exe3
 
 

System errors:

=============

Error: (09/11/2013 02:42:07 PM) (Source: DCOM) (User: NT-AUTORITÄT)

Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
 

Error: (09/11/2013 02:32:07 PM) (Source: DCOM) (User: NT-AUTORITÄT)

Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
 

Error: (09/11/2013 02:22:07 PM) (Source: DCOM) (User: NT-AUTORITÄT)

Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
 

Error: (09/11/2013 02:12:07 PM) (Source: DCOM) (User: NT-AUTORITÄT)

Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
 

Error: (09/11/2013 02:02:07 PM) (Source: DCOM) (User: NT-AUTORITÄT)

Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
 

Error: (09/11/2013 01:53:21 PM) (Source: Service Control Manager) (User: )

Description: Dienst "Avira Email Schutz" wurde unerwartet beendet. Dies ist bereits 3 Mal passiert.
 

Error: (09/11/2013 01:53:21 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Avira Email Schutz" wurde unerwartet beendet. Dies ist bereits 2 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden durchgeführt: Neustart des Diensts.
 

Error: (09/11/2013 01:53:18 PM) (Source: WMPNetworkSvc) (User: )

Description: Dienst "WMPNetworkSvc" konnte nicht ordnungsgemäß gestartet werden, da ein Fehler "0x80004005" in "CoCreateInstance(CLSID_UPnPDeviceFinder)" aufgetreten ist. Überprüfen Sie, ob der Dienst "UPnPHost" ausgeführt wird und ob die Windows-Komponente "UPnPHost" richtig installiert ist.
 

Error: (09/11/2013 01:53:16 PM) (Source: Service Control Manager) (User: )

Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 

cdrom
 

Error: (09/11/2013 01:53:16 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Avira Email Schutz" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden durchgeführt: Neustart des Diensts.
 
 

Microsoft Office Sessions:

=========================
 

CodeIntegrity Errors:

===================================

  Date: 2013-09-11 13:53:57.566

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2013-09-11 11:38:00.319

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2013-09-10 22:15:34.240

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2013-09-10 20:03:20.153

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2013-09-10 20:02:55.356

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2013-09-10 19:56:56.834

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2013-09-10 08:32:52.234

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2013-09-09 12:28:04.222

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2013-09-09 12:13:42.552

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2013-09-09 09:31:06.547

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 52%

Total physical RAM: 3765.86 MB

Available physical RAM: 1778.75 MB

Total Pagefile: 7529.9 MB

Available Pagefile: 5118.47 MB

Total Virtual: 8192 MB

Available Virtual: 8191.81 MB
 

==================== Drives ================================
 

Drive c: (ACER) (Fixed) (Total:285.3 GB) (Free:159.82 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 298 GB) (Disk ID: C51EC51E)

Partition 1: (Not Active) - (Size=13 GB) - (Type=27)

Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=285 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

Vor dem Gmer-Scan ist es mir nicht gelungen, AVIRA zu beenden.
Unten folgt noch ein Gmer-Scan aus dem abgesicherten Modus.
Gmer:

Code:

GMER 2.1.19163 - hxxp://www.gmer.net

Rootkit scan 2013-09-11 15:10:33

Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 Hitachi_ rev.PB3O 298,09GB

Running: rygoqjug.exe; Driver: C:\Users\RODENW~1\AppData\Local\Temp\pgtdrpoc.sys
 
 

---- Kernel code sections - GMER 2.1 ----
 

INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 544                                                                                   fffff80003000000 45 bytes [00, 00, 00, 00, 00, 00, 00, ...]

INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 591                                                                                   fffff8000300002f 16 bytes [00, 00, 00, 00, 00, 00, 00, ...]
 

---- User code sections - GMER 2.1 ----
 

.text     C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe[1736] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                               0000000075ab1465 2 bytes [AB, 75]

.text     C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe[1736] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                              0000000075ab14bb 2 bytes [AB, 75]

.text     ...                                                                                                                                                  * 2

.text     C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2064] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69                  0000000075ab1465 2 bytes [AB, 75]

.text     C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2064] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155                 0000000075ab14bb 2 bytes [AB, 75]

.text     ...                                                                                                                                                  * 2

.text     C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2164] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69        0000000075ab1465 2 bytes [AB, 75]

.text     C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2164] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155       0000000075ab14bb 2 bytes [AB, 75]

.text     ...                                                                                                                                                  * 2

.text     C:\Windows\PLFSetI.exe[2828] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                 0000000075ab1465 2 bytes [AB, 75]

.text     C:\Windows\PLFSetI.exe[2828] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                0000000075ab14bb 2 bytes [AB, 75]

.text     ...                                                                                                                                                  * 2

.text     C:\Windows\SysWOW64\RunDll32.exe[3060] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                       0000000075ab1465 2 bytes [AB, 75]

.text     C:\Windows\SysWOW64\RunDll32.exe[3060] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                      0000000075ab14bb 2 bytes [AB, 75]

.text     ...                                                                                                                                                  * 2

.text     C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe[3308] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69   0000000075ab1465 2 bytes [AB, 75]

.text     C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe[3308] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155  0000000075ab14bb 2 bytes [AB, 75]

.text     ...                                                                                                                                                  * 2

.text     C:\Program Files (x86)\Launch Manager\LManager.exe[3440] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                     0000000075ab1465 2 bytes [AB, 75]

.text     C:\Program Files (x86)\Launch Manager\LManager.exe[3440] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                    0000000075ab14bb 2 bytes [AB, 75]

.text     ...                                                                                                                                                  * 2

.text     C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[3512] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69         0000000075ab1465 2 bytes [AB, 75]

.text     C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[3512] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155        0000000075ab14bb 2 bytes [AB, 75]

.text     ...                                                                                                                                                  * 2
 

---- Threads - GMER 2.1 ----
 

Thread    C:\Windows\SysWOW64\rundll32.exe [2952:2968]                                                                                                         00000000002115e0

Thread    C:\Windows\SysWOW64\rundll32.exe [2952:2972]                                                                                                         0000000000193a80

Thread    C:\Windows\SysWOW64\rundll32.exe [2952:2992]                                                                                                         0000000000193a10

Thread    C:\Windows\SysWOW64\rundll32.exe [2952:3360]                                                                                                         0000000000a4832b

Thread    C:\Windows\SysWOW64\rundll32.exe [2952:1672]                                                                                                         0000000000a45514

Thread    C:\Windows\SysWOW64\rundll32.exe [2952:3776]                                                                                                         0000000000a45a5e

Thread    C:\Windows\SysWOW64\rundll32.exe [2952:2044]                                                                                                         00000000023438ea
 

---- Registry - GMER 2.1 ----
 

Reg       HKLM\SYSTEM\CurrentControlSet@5                                                                                                                      3337
 

---- EOF - GMER 2.1 ----

Hier Gmer aus dem abgesicherten Modus:

Code:

GMER 2.1.19163 - hxxp://www.gmer.net

Rootkit scan 2013-09-11 15:21:57

Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 Hitachi_ rev.PB3O 298,09GB

Running: rygoqjug.exe; Driver: C:\Users\RODENW~1\AppData\Local\Temp\pgtdrpoc.sys
 
 

---- Registry - GMER 2.1 ----
 

Reg  HKLM\SYSTEM\CurrentControlSet\services\WmiApRpl\Performance@Last Counter  11786

Reg  HKLM\SYSTEM\CurrentControlSet\services\WmiApRpl\Performance@Last Help     11787

Reg  HKLM\SYSTEM\CurrentControlSet\services\WmiApRpl\Performance@Object List   11608 11614 11626 11636 11646 11666 11710 11720 11758 11764 11780
 

---- EOF - GMER 2.1 ----

hi,

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Hallo Schrauber,
vielen Dank für Deine Hilfe.
Hier die Logs:

Code:

Malwarebytes Anti-Malware 1.75.0.1300

www.malwarebytes.org
 

Datenbank Version: v2013.09.11.05
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 10.0.9200.16660

Rodenwald :: RW-PC [Administrator]
 

11.09.2013 16:43:25

mbam-log-2013-09-11 (16-43-25).txt
 

Art des Suchlaufs: Quick-Scan

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 218327

Laufzeit: 6 Minute(n), 32 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

Code:

# AdwCleaner v3.003 - Bericht erstellt am 11/09/2013 um 16:59:21

# Updated 07/09/2013 von Xplode

# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)

# Benutzername : Rodenwald - RW-PC

# Gestartet von : C:\Users\Rodenwald\Desktop\adwcleaner(1).exe

# Option : Löschen
 

***** [ Dienste ] *****
 
 

***** [ Dateien / Ordner ] *****
 
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 
 

***** [ Browser ] *****
 

-\\ Internet Explorer v10.0.9200.16660
 
 

-\\ Mozilla Firefox v23.0.1 (de)
 

[ Datei : C:\Users\Rodenwald\AppData\Roaming\Mozilla\Firefox\Profiles\sh5g0skb.default\prefs.js ]
 
 

*************************
 

AdwCleaner[R0].txt - [4901 octets] - [09/09/2013 20:15:10]

AdwCleaner[R1].txt - [4950 octets] - [10/09/2013 20:15:13]

AdwCleaner[R2].txt - [980 octets] - [10/09/2013 20:24:01]

AdwCleaner[R3].txt - [1112 octets] - [11/09/2013 16:57:57]

AdwCleaner[S0].txt - [4920 octets] - [10/09/2013 20:18:43]

AdwCleaner[S1].txt - [1040 octets] - [10/09/2013 20:25:06]

AdwCleaner[S2].txt - [1034 octets] - [11/09/2013 16:59:21]
 

########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [1094 octets] ##########

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 5.5.9 (09.07.2013:1)

OS: Windows 7 Home Premium x64

Ran by Rodenwald on 11.09.2013 at 17:12:21,26

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 

~~~ Services
 
 
 

~~~ Registry Values
 
 
 

~~~ Registry Keys
 

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{36377DD7-B3EB-42f5-986F-680BAF59BA9D}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2E94B700-EAFB-4C9E-A696-77200AA3F89B}
 
 
 

~~~ Files
 
 
 

~~~ Folders
 
 
 

~~~ FireFox
 

Emptied folder: C:\Users\Rodenwald\AppData\Roaming\mozilla\firefox\profiles\sh5g0skb.default\minidumps [209 files]
 
 
 

~~~ Event Viewer Logs were cleared
 
 
 
 
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 11.09.2013 at 17:24:55,65

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-09-2013

Ran by Rodenwald (administrator) on RW-PC on 11-09-2013 17:29:14

Running from C:\Users\Rodenwald\Downloads

Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) =================
 

(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe

(Microsoft Corporation) C:\Windows\system32\WLANExt.exe

(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe

(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe

(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe

(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe

(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe

(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesApp64.exe

(Egis Technology Inc.) C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

() C:\Windows\PLFSetI.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Intel Corporation) C:\Windows\system32\igfxsrvc.exe

(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe

(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe

(Egis Technology Inc.) C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe

(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Intel Corporation) C:\Windows\system32\igfxext.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe

(Egis Technology Inc.) C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe

(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [mwlDaemon] - C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe [349552 2010-02-01] (Egis Technology Inc.)

HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10060832 2010-02-09] (Realtek Semiconductor)

HKLM\...\Run: [PLFSetI] - C:\Windows\PLFSetI.exe [206208 2012-11-01] ()

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1842472 2009-09-18] (Synaptics Incorporated)

HKLM\...\Run: [Acer ePower Management] - C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [860704 2010-03-17] (Acer Incorporated)

HKLM\...\Policies\Explorer: [NoActiveDesktop] 1

HKLM\...\Policies\Explorer: [NoActiveDesktopChanges] 1

HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19876456 2013-06-21] (Skype Technologies S.A.)

HKCU\...\Run: [hpiwsygrv] - rundll32 "C:\Users\Rodenwald\AppData\Roaming\mprddmt.dll",SNUNOQ

MountPoints2: D - D:\PSetup.exe /continue /uionlyifneeded

HKLM-x32\...\Run: [BackupManagerTray] - C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [260608 2010-03-09] (NewTech Infosystems, Inc.)

HKLM-x32\...\Run: [SuiteTray] - C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe [337264 2010-02-01] (Egis Technology Inc.)

HKLM-x32\...\Run: [EgisUpdate] - C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe [201512 2009-12-25] (Egis Technology Inc.)

HKLM-x32\...\Run: [EgisTecPMMUpdate] - C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe [401192 2009-12-25] (Egis Technology Inc.)

HKLM-x32\...\Run: [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe [1300560 2010-03-04] (Dritek System Inc.)

HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] - C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [685048 2012-08-03] (Cisco Systems, Inc.)

HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [154144 2010-01-15] ()

HKU\Default User\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [154144 2010-01-15] ()

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk

ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.gamesagogo.iplay.com/?o=shp

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_1830t&r=07361112b126l0428z155t4541k41q

Toolbar: HKLM-x32 - GamesBar (W) - {2e94b700-eafb-4c9e-a696-77200aa3f89b} - C:\Program Files (x86)\gamesagogo_w3i\encyclopediabritannicagamesbarX.dll No File

Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
 

FireFox:

========

FF ProfilePath: C:\Users\Rodenwald\AppData\Roaming\Mozilla\Firefox\Profiles\sh5g0skb.default

FF DefaultSearchEngine: Yahoo!

FF Homepage: hxxp://www.google.de

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\Yahooober1163533.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: GamesBar (W) - C:\Users\Rodenwald\AppData\Roaming\Mozilla\Firefox\Profiles\sh5g0skb.default\Extensions\{2e94b700-eafb-4c9e-a696-77200aa3f89b}

FF Extension: langpack-de - C:\Users\Rodenwald\AppData\Roaming\Mozilla\Firefox\Profiles\sh5g0skb.default\Extensions\langpack-de@firefox.mozilla.org.xpi

FF Extension: No Name - C:\Users\Rodenwald\AppData\Roaming\Mozilla\Firefox\Profiles\sh5g0skb.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi

FF Extension: No Name - C:\Users\Rodenwald\AppData\Roaming\Mozilla\Firefox\Profiles\sh5g0skb.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
 

==================== Services (Whitelisted) =================
 

S3 MWLService; C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [305520 2010-02-01] (Egis Technology Inc.)

R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe [2402080 2013-01-28] (TuneUp Software)
 

==================== Drivers (Whitelisted) ====================
 

R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesDriver64.sys [11880 2012-09-19] (TuneUp Software)

S3 ALSysIO; \??\C:\Users\RODENW~1\AppData\Local\Temp\ALSysIO64.sys [x]

S3 avfwim; system32\DRIVERS\avfwim.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-09-11 17:20 - 2013-08-07 04:22 - 00278800 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

2013-09-11 17:07 - 2013-09-11 17:07 - 01029490 _____ (Thisisu) C:\Users\Rodenwald\Desktop\JRT.exe

2013-09-11 17:05 - 2013-09-11 17:05 - 00001174 _____ C:\Users\Rodenwald\Downloads\AdwCleaner[S2].txt

2013-09-11 16:56 - 2013-09-11 16:56 - 01037278 _____ C:\Users\Rodenwald\Desktop\adwcleaner(1).exe

2013-09-11 16:35 - 2013-09-11 16:35 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Rodenwald\Downloads\mbam-setup-1.75.0.1300.exe

2013-09-11 15:21 - 2013-09-11 15:21 - 00000657 _____ C:\Users\Rodenwald\Downloads\Gmer_AbgesicherterModus.log

2013-09-11 15:10 - 2013-09-11 15:10 - 00006725 _____ C:\Users\Rodenwald\Downloads\Gmer.txt

2013-09-11 14:50 - 2013-09-11 14:50 - 00377856 _____ C:\Users\Rodenwald\Downloads\rygoqjug.exe

2013-09-11 14:48 - 2013-09-11 14:49 - 00027254 _____ C:\Users\Rodenwald\Downloads\Addition.txt

2013-09-11 14:47 - 2013-09-11 14:47 - 00000000 ____D C:\FRST

2013-09-11 14:45 - 2013-09-11 14:45 - 01949408 _____ (Farbar) C:\Users\Rodenwald\Downloads\FRST64.exe

2013-09-11 14:44 - 2013-09-11 14:44 - 00000480 _____ C:\Users\Rodenwald\Downloads\defogger_disable.log

2013-09-11 14:44 - 2013-09-11 14:44 - 00000000 _____ C:\Users\Rodenwald\defogger_reenable

2013-09-11 14:43 - 2013-09-11 14:43 - 00050477 _____ C:\Users\Rodenwald\Downloads\Defogger.exe

2013-09-10 22:01 - 2013-07-09 11:14 - 00001820 _____ C:\Users\Rodenwald\Desktop\delfolders.bat

2013-09-10 21:58 - 2013-09-10 22:15 - 00000029 _____ C:\Users\Rodenwald\Desktop\Shutme.bat

2013-09-10 21:53 - 2013-09-10 21:53 - 00240532 _____ C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Trojaner-Board.html

2013-09-10 21:53 - 2013-09-10 21:53 - 00117440 _____ C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Seite 2 - Trojaner-Board.html

2013-09-10 21:53 - 2013-09-10 21:53 - 00091410 _____ C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Seite 3 - Trojaner-Board.html

2013-09-10 21:53 - 2013-09-10 21:53 - 00000000 ____D C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Trojaner-Board_files

2013-09-10 21:53 - 2013-09-10 21:53 - 00000000 ____D C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Seite 3 - Trojaner-Board_files

2013-09-10 21:53 - 2013-09-10 21:53 - 00000000 ____D C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Seite 2 - Trojaner-Board_files

2013-09-10 21:36 - 2013-09-10 21:36 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2013-09-10 21:26 - 2013-09-10 22:03 - 00181064 _____ (Sysinternals) C:\Windows\PSEXESVC.EXE

2013-09-10 21:17 - 2013-09-11 16:36 - 00001117 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-09-10 21:15 - 2013-09-10 21:15 - 03268369 _____ C:\Users\Rodenwald\Downloads\tweaking.com_windows_repair_aio.zip

2013-09-10 21:15 - 2013-09-10 21:15 - 00000000 ____D C:\Users\Rodenwald\Downloads\tweaking.com_windows_repair_aio

2013-09-10 21:09 - 2013-09-10 21:09 - 00686017 _____ C:\Users\Rodenwald\Desktop\SysInspector-RW-PC-130910-2103.zip

2013-09-10 21:03 - 2013-09-10 21:03 - 04919312 _____ C:\Users\Rodenwald\Downloads\SysInspector_1.2.42.zip

2013-09-10 21:03 - 2013-09-10 21:03 - 00000000 ____D C:\Users\Rodenwald\Downloads\SysInspector_1.2.42

2013-09-10 20:54 - 2013-09-10 20:54 - 00000000 ____D C:\Windows\ERUNT

2013-09-10 20:34 - 2013-09-11 16:36 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-09-10 20:34 - 2013-09-10 20:34 - 00000000 ____D C:\Users\Rodenwald\AppData\Roaming\Malwarebytes

2013-09-10 20:34 - 2013-09-10 20:34 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-09-10 20:34 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2013-09-10 19:58 - 2013-09-10 19:58 - 00119925 _____ C:\Users\Rodenwald\Desktop\bookmarks.html

2013-09-09 20:14 - 2013-09-11 16:59 - 00000000 ____D C:\AdwCleaner

2013-09-09 20:13 - 2013-09-09 20:13 - 01037278 _____ C:\Users\Rodenwald\Downloads\AdwCleaner.exe

2013-09-05 20:32 - 2013-09-05 20:32 - 00000000 ____D C:\Intel

2013-09-03 13:29 - 2013-09-03 13:29 - 00208896 __RSH C:\Users\Rodenwald\AppData\Roaming\mprddmt.dll

2013-08-17 16:32 - 2013-09-10 21:36 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2013-08-16 16:26 - 2013-08-16 16:26 - 00000815 _____ C:\Users\Public\Desktop\PowerTeacher.lnk

2013-08-16 16:26 - 2013-08-16 16:26 - 00000000 ____D C:\ProgramData\PowerTeacher

2013-08-15 11:38 - 2013-08-15 11:38 - 00344832 _____ C:\Users\Rodenwald\Downloads\documents-export-2013-08-15.zip

2013-08-15 00:10 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2013-08-15 00:10 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2013-08-15 00:10 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2013-08-15 00:10 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2013-08-15 00:10 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2013-08-15 00:10 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2013-08-15 00:10 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2013-08-15 00:10 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2013-08-15 00:10 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2013-08-15 00:10 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2013-08-15 00:10 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll

2013-08-15 00:10 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2013-08-15 00:10 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2013-08-15 00:10 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2013-08-15 00:10 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2013-08-15 00:10 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2013-08-15 00:10 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2013-08-15 00:10 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2013-08-15 00:10 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2013-08-15 00:10 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2013-08-15 00:10 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2013-08-15 00:10 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2013-08-15 00:10 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2013-08-15 00:10 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll

2013-08-15 00:10 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2013-08-15 00:10 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2013-08-15 00:10 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2013-08-15 00:10 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2013-08-15 00:10 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2013-08-15 00:10 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe

2013-08-15 00:10 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe

2013-08-14 22:28 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL

2013-08-14 22:28 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL

2013-08-14 22:28 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll

2013-08-14 22:28 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll

2013-08-14 22:28 - 2013-07-09 08:03 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2013-08-14 22:28 - 2013-07-09 07:54 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll

2013-08-14 22:28 - 2013-07-09 07:53 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll

2013-08-14 22:28 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll

2013-08-14 22:28 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll

2013-08-14 22:28 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll

2013-08-14 22:28 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll

2013-08-14 22:28 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll

2013-08-14 22:28 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe

2013-08-14 22:28 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe

2013-08-14 22:28 - 2013-07-09 06:53 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll

2013-08-14 22:28 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll

2013-08-14 22:28 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll

2013-08-14 22:28 - 2013-07-09 06:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll

2013-08-14 22:28 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll

2013-08-14 22:28 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll

2013-08-14 22:28 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll

2013-08-14 22:28 - 2013-07-09 04:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe

2013-08-14 22:28 - 2013-07-09 04:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll

2013-08-14 22:28 - 2013-07-09 04:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe

2013-08-14 22:28 - 2013-07-09 04:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe

2013-08-14 22:28 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2013-08-14 22:28 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
 

==================== One Month Modified Files and Folders =======
 

2013-09-11 17:24 - 2013-09-11 17:24 - 00001083 _____ C:\Users\Rodenwald\Desktop\JRT.txt

2013-09-11 17:20 - 2012-11-01 13:31 - 01917729 _____ C:\Windows\WindowsUpdate.log

2013-09-11 17:10 - 2012-11-04 23:30 - 00000000 ____D C:\Users\Rodenwald\AppData\Roaming\Skype

2013-09-11 17:07 - 2013-09-11 17:07 - 01029490 _____ (Thisisu) C:\Users\Rodenwald\Desktop\JRT.exe

2013-09-11 17:06 - 2012-11-01 22:21 - 00654400 _____ C:\Windows\system32\perfh007.dat

2013-09-11 17:06 - 2012-11-01 22:21 - 00130240 _____ C:\Windows\system32\perfc007.dat

2013-09-11 17:06 - 2009-07-14 07:13 - 01498742 _____ C:\Windows\system32\PerfStringBackup.INI

2013-09-11 17:06 - 2009-07-14 06:45 - 00017376 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-09-11 17:06 - 2009-07-14 06:45 - 00017376 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-09-11 17:05 - 2013-09-11 17:05 - 00001174 _____ C:\Users\Rodenwald\Downloads\AdwCleaner[S2].txt

2013-09-11 17:01 - 2013-07-21 23:29 - 00008146 _____ C:\Windows\setupact.log

2013-09-11 17:01 - 2013-07-21 23:28 - 00006762 _____ C:\Windows\PFRO.log

2013-09-11 17:01 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-09-11 16:59 - 2013-09-09 20:14 - 00000000 ____D C:\AdwCleaner

2013-09-11 16:56 - 2013-09-11 16:56 - 01037278 _____ C:\Users\Rodenwald\Desktop\adwcleaner(1).exe

2013-09-11 16:48 - 2012-11-01 21:47 - 00000000 ____D C:\ProgramData\Avira

2013-09-11 16:36 - 2013-09-10 21:17 - 00001117 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-09-11 16:36 - 2013-09-10 20:34 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-09-11 16:35 - 2013-09-11 16:35 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Rodenwald\Downloads\mbam-setup-1.75.0.1300.exe

2013-09-11 16:30 - 2012-11-08 13:45 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-09-11 15:30 - 2012-11-08 13:45 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2013-09-11 15:30 - 2012-11-08 13:45 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2013-09-11 15:30 - 2012-11-08 13:45 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

2013-09-11 15:21 - 2013-09-11 15:21 - 00000657 _____ C:\Users\Rodenwald\Downloads\Gmer_AbgesicherterModus.log

2013-09-11 15:10 - 2013-09-11 15:10 - 00006725 _____ C:\Users\Rodenwald\Downloads\Gmer.txt

2013-09-11 14:50 - 2013-09-11 14:50 - 00377856 _____ C:\Users\Rodenwald\Downloads\rygoqjug.exe

2013-09-11 14:49 - 2013-09-11 14:48 - 00027254 _____ C:\Users\Rodenwald\Downloads\Addition.txt

2013-09-11 14:47 - 2013-09-11 14:47 - 00000000 ____D C:\FRST

2013-09-11 14:45 - 2013-09-11 14:45 - 01949408 _____ (Farbar) C:\Users\Rodenwald\Downloads\FRST64.exe

2013-09-11 14:44 - 2013-09-11 14:44 - 00000480 _____ C:\Users\Rodenwald\Downloads\defogger_disable.log

2013-09-11 14:44 - 2013-09-11 14:44 - 00000000 _____ C:\Users\Rodenwald\defogger_reenable

2013-09-11 14:44 - 2012-11-01 13:36 - 00000000 ____D C:\Users\Rodenwald

2013-09-11 14:43 - 2013-09-11 14:43 - 00050477 _____ C:\Users\Rodenwald\Downloads\Defogger.exe

2013-09-10 22:15 - 2013-09-10 21:58 - 00000029 _____ C:\Users\Rodenwald\Desktop\Shutme.bat

2013-09-10 22:06 - 2013-07-21 23:29 - 00427160 _____ C:\Windows\system32\FNTCACHE.DAT

2013-09-10 22:03 - 2013-09-10 21:26 - 00181064 _____ (Sysinternals) C:\Windows\PSEXESVC.EXE

2013-09-10 21:59 - 2009-07-14 04:34 - 00000514 _____ C:\Windows\win.ini

2013-09-10 21:53 - 2013-09-10 21:53 - 00240532 _____ C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Trojaner-Board.html

2013-09-10 21:53 - 2013-09-10 21:53 - 00117440 _____ C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Seite 2 - Trojaner-Board.html

2013-09-10 21:53 - 2013-09-10 21:53 - 00091410 _____ C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Seite 3 - Trojaner-Board.html

2013-09-10 21:53 - 2013-09-10 21:53 - 00000000 ____D C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Trojaner-Board_files

2013-09-10 21:53 - 2013-09-10 21:53 - 00000000 ____D C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Seite 3 - Trojaner-Board_files

2013-09-10 21:53 - 2013-09-10 21:53 - 00000000 ____D C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Seite 2 - Trojaner-Board_files

2013-09-10 21:52 - 2013-07-21 14:11 - 00111288 _____ C:\Users\RODENW~1\AppData\Local\GDIPFONTCACHEV1.DAT

2013-09-10 21:36 - 2013-09-10 21:36 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2013-09-10 21:36 - 2013-08-17 16:32 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2013-09-10 21:15 - 2013-09-10 21:15 - 03268369 _____ C:\Users\Rodenwald\Downloads\tweaking.com_windows_repair_aio.zip

2013-09-10 21:15 - 2013-09-10 21:15 - 00000000 ____D C:\Users\Rodenwald\Downloads\tweaking.com_windows_repair_aio

2013-09-10 21:09 - 2013-09-10 21:09 - 00686017 _____ C:\Users\Rodenwald\Desktop\SysInspector-RW-PC-130910-2103.zip

2013-09-10 21:03 - 2013-09-10 21:03 - 04919312 _____ C:\Users\Rodenwald\Downloads\SysInspector_1.2.42.zip

2013-09-10 21:03 - 2013-09-10 21:03 - 00000000 ____D C:\Users\Rodenwald\Downloads\SysInspector_1.2.42

2013-09-10 20:54 - 2013-09-10 20:54 - 00000000 ____D C:\Windows\ERUNT

2013-09-10 20:34 - 2013-09-10 20:34 - 00000000 ____D C:\Users\Rodenwald\AppData\Roaming\Malwarebytes

2013-09-10 20:34 - 2013-09-10 20:34 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-09-10 19:58 - 2013-09-10 19:58 - 00119925 _____ C:\Users\Rodenwald\Desktop\bookmarks.html

2013-09-09 20:13 - 2013-09-09 20:13 - 01037278 _____ C:\Users\Rodenwald\Downloads\AdwCleaner.exe

2013-09-05 20:32 - 2013-09-05 20:32 - 00000000 ____D C:\Intel

2013-09-03 13:29 - 2013-09-03 13:29 - 00208896 __RSH C:\Users\Rodenwald\AppData\Roaming\mprddmt.dll

2013-09-03 10:59 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT

2013-08-30 09:48 - 2013-02-05 13:22 - 00000000 ___RD C:\Program Files (x86)\Skype

2013-08-30 09:48 - 2012-11-04 23:30 - 00000000 ____D C:\ProgramData\Skype

2013-08-29 14:40 - 2013-07-18 00:23 - 00000000 ____D C:\Windows\system32\MRT

2013-08-29 14:38 - 2012-11-10 23:39 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2013-08-16 16:26 - 2013-08-16 16:26 - 00000815 _____ C:\Users\Public\Desktop\PowerTeacher.lnk

2013-08-16 16:26 - 2013-08-16 16:26 - 00000000 ____D C:\ProgramData\PowerTeacher

2013-08-15 11:38 - 2013-08-15 11:38 - 00344832 _____ C:\Users\Rodenwald\Downloads\documents-export-2013-08-15.zip

2013-08-15 10:54 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache

2013-08-15 07:12 - 2009-07-27 22:41 - 00000000 ____D C:\Windows\Panther

2013-08-15 00:09 - 2010-04-13 04:55 - 00000000 ____D C:\ProgramData\Microsoft Help
 

Files to move or delete:

====================

C:\Users\RODENW~1\AppData\Local\Temp\mbam-setup.exe

C:\Users\RODENW~1\AppData\Local\Temp\Quarantine.exe
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-09-01 21:05
 

==================== End Of Log ============================

--- --- ---

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

Guten Morgen,
hier die Logs:

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6920

# api_version=3.0.2

# EOSSerial=4e683b4a66cf004ca07b892d12c690ab

# engine=15094

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=false

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2013-09-11 10:21:01

# local_time=2013-09-12 12:21:01 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=1799 16775165 100 94 21659 22068 14251 0

# compatibility_mode=5893 16776574 100 94 24554 130567911 0 0

# scanned=193754

# found=1

# cleaned=0

# scan_time=7543

sh=0000000000000000000000000000000000000000 ft=- fh=0000000000000000 vn="probably a variant of Win32/Ponmocup.AA trojan" ac=I fn="${Memory}"

Code:

 Results of screen317's Security Check version 0.99.73  

 Windows 7 Service Pack 1 x64 (UAC is enabled)  

 Internet Explorer 10  
 ``````````````Antivirus/Firewall Check:`````````````` 

Avira Desktop   

 Antivirus up to date!  (On Access scanning disabled!) 
 `````````Anti-malware/Other Utilities Check:````````` 

 Malwarebytes Anti-Malware Version 1.75.0.1300  

 TuneUp Utilities 2013   

 TuneUp Utilities Language Pack (de-DE) 

 Adobe Flash Player 10 Flash Player out of Date! 

 Adobe Flash Player 11.8.800.168  

 Adobe Reader XI  

 Mozilla Firefox (23.0.1) 
 ````````Process Check: objlist.exe by Laurent````````  

 Avira Antivir avgnt.exe 

 Avira Antivir avguard.exe 
 `````````````````System Health check````````````````` 

 Total Fragmentation on Drive C:  
 ````````````````````End of Log``````````````````````

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-09-2013 02

Ran by Rodenwald (administrator) on RW-PC on 12-09-2013 06:51:26

Running from C:\Users\Rodenwald\Downloads

Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) =================
 

(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe

(Microsoft Corporation) C:\Windows\system32\WLANExt.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe

(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe

(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe

(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe

(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe

(Acer Group) C:\Program Files\Acer\Acer Updater\UpdaterService.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesApp64.exe

(Egis Technology Inc.) C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Intel Corporation) C:\Windows\system32\igfxsrvc.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

() C:\Windows\PLFSetI.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe

(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe

(Egis Technology Inc.) C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe

(Egis Technology Inc.) C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe

(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe

(Intel Corporation) C:\Windows\system32\igfxext.exe

(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

() C:\Users\Rodenwald\Downloads\SecurityCheck.exe

(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe

(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [mwlDaemon] - C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe [349552 2010-02-01] (Egis Technology Inc.)

HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10060832 2010-02-09] (Realtek Semiconductor)

HKLM\...\Run: [PLFSetI] - C:\Windows\PLFSetI.exe [206208 2012-11-01] ()

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1842472 2009-09-18] (Synaptics Incorporated)

HKLM\...\Run: [Acer ePower Management] - C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [860704 2010-03-17] (Acer Incorporated)

HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19876456 2013-06-21] (Skype Technologies S.A.)

HKCU\...\Run: [hpiwsygrv] - rundll32 "C:\Users\Rodenwald\AppData\Roaming\mprddmt.dll",SNUNOQ

MountPoints2: D - D:\PSetup.exe /continue /uionlyifneeded

HKLM-x32\...\Run: [BackupManagerTray] - C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [260608 2010-03-09] (NewTech Infosystems, Inc.)

HKLM-x32\...\Run: [SuiteTray] - C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe [337264 2010-02-01] (Egis Technology Inc.)

HKLM-x32\...\Run: [EgisUpdate] - C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe [201512 2009-12-25] (Egis Technology Inc.)

HKLM-x32\...\Run: [EgisTecPMMUpdate] - C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe [401192 2009-12-25] (Egis Technology Inc.)

HKLM-x32\...\Run: [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe [1300560 2010-03-04] (Dritek System Inc.)

HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] - C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [685048 2012-08-03] (Cisco Systems, Inc.)

HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-11] (Avira Operations GmbH & Co. KG)

HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [154144 2010-01-15] ()
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.gamesagogo.iplay.com/?o=shp

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_1830t&r=07361112b126l0428z155t4541k41q

Toolbar: HKLM-x32 - GamesBar (W) - {2e94b700-eafb-4c9e-a696-77200aa3f89b} - C:\Program Files (x86)\gamesagogo_w3i\encyclopediabritannicagamesbarX.dll No File

Toolbar: HKCU -  No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
 

FireFox:

========

FF ProfilePath: C:\Users\Rodenwald\AppData\Roaming\Mozilla\Firefox\Profiles\sh5g0skb.default

FF DefaultSearchEngine: Yahoo!

FF Homepage: hxxp://www.google.de

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\Yahooober1163533.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: GamesBar (W) - C:\Users\Rodenwald\AppData\Roaming\Mozilla\Firefox\Profiles\sh5g0skb.default\Extensions\{2e94b700-eafb-4c9e-a696-77200aa3f89b}

FF Extension: langpack-de - C:\Users\Rodenwald\AppData\Roaming\Mozilla\Firefox\Profiles\sh5g0skb.default\Extensions\langpack-de@firefox.mozilla.org.xpi

FF Extension: No Name - C:\Users\Rodenwald\AppData\Roaming\Mozilla\Firefox\Profiles\sh5g0skb.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi

FF Extension: No Name - C:\Users\Rodenwald\AppData\Roaming\Mozilla\Firefox\Profiles\sh5g0skb.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
 

==================== Services (Whitelisted) =================
 

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-11] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-11] (Avira Operations GmbH & Co. KG)

S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-11] (Avira Operations GmbH & Co. KG)

S3 MWLService; C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [305520 2010-02-01] (Egis Technology Inc.)

R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe [2402080 2013-01-28] (TuneUp Software)
 

==================== Drivers (Whitelisted) ====================
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-11] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-09-11] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-09-11] (Avira Operations GmbH & Co. KG)

S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)

R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesDriver64.sys [11880 2012-09-19] (TuneUp Software)

S3 ALSysIO; \??\C:\Users\RODENW~1\AppData\Local\Temp\ALSysIO64.sys [x]

S3 avfwim; system32\DRIVERS\avfwim.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-09-12 06:22 - 2013-09-12 06:22 - 97238077 _____ C:\Windows\SysWOW64\碽攝£

2013-09-12 03:08 - 2013-08-10 07:22 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2013-09-12 03:08 - 2013-08-10 07:22 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2013-09-12 03:08 - 2013-08-10 07:22 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2013-09-12 03:08 - 2013-08-10 07:21 - 19246592 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2013-09-12 03:08 - 2013-08-10 07:21 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2013-09-12 03:08 - 2013-08-10 07:21 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2013-09-12 03:08 - 2013-08-10 07:20 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2013-09-12 03:08 - 2013-08-10 07:20 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2013-09-12 03:08 - 2013-08-10 07:20 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2013-09-12 03:08 - 2013-08-10 07:20 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2013-09-12 03:08 - 2013-08-10 07:20 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2013-09-12 03:08 - 2013-08-10 07:20 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll

2013-09-12 03:08 - 2013-08-10 07:20 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2013-09-12 03:08 - 2013-08-10 07:20 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2013-09-12 03:08 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2013-09-12 03:08 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2013-09-12 03:08 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2013-09-12 03:08 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2013-09-12 03:08 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2013-09-12 03:08 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2013-09-12 03:08 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2013-09-12 03:08 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2013-09-12 03:08 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2013-09-12 03:08 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll

2013-09-12 03:08 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2013-09-12 03:08 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2013-09-12 03:08 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2013-09-12 03:08 - 2013-08-10 05:17 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2013-09-12 03:08 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2013-09-12 03:08 - 2013-08-10 04:27 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe

2013-09-12 03:08 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe

2013-09-12 00:22 - 2013-09-12 00:21 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys

2013-09-11 22:20 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2013-09-11 22:20 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys

2013-09-11 22:20 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2013-09-11 22:20 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll

2013-09-11 22:20 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll

2013-09-11 22:20 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll

2013-09-11 22:20 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll

2013-09-11 22:20 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll

2013-09-11 22:20 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll

2013-09-11 22:20 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll

2013-09-11 22:20 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe

2013-09-11 22:20 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe

2013-09-11 22:20 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll

2013-09-11 22:20 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll

2013-09-11 22:20 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll

2013-09-11 22:20 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll

2013-09-11 22:20 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll

2013-09-11 22:20 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe

2013-09-11 22:20 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe

2013-09-11 22:20 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe

2013-09-11 22:20 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll

2013-09-11 22:20 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe

2013-09-11 22:20 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe

2013-09-11 22:20 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll

2013-09-11 22:20 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll

2013-09-11 22:20 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll

2013-09-11 22:20 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2013-09-11 22:20 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll

2013-09-11 22:10 - 2013-09-11 22:10 - 00000000 ____D C:\Users\Rodenwald\AppData\Roaming\Avira

2013-09-11 22:08 - 2013-09-11 22:08 - 00891144 _____ C:\Users\Rodenwald\Downloads\SecurityCheck.exe

2013-09-11 22:07 - 2013-09-11 22:07 - 02347384 _____ (ESET) C:\Users\Rodenwald\Downloads\esetsmartinstaller_enu.exe

2013-09-11 18:19 - 2013-09-11 18:19 - 00000000 ____D C:\Program Files (x86)\Avira

2013-09-11 18:19 - 2013-09-11 18:18 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys

2013-09-11 18:19 - 2013-09-11 18:18 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

2013-09-11 18:19 - 2013-09-11 18:18 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys

2013-09-11 18:01 - 2013-09-11 18:01 - 02092792 _____ C:\Users\Rodenwald\Downloads\avira_free_antivirus.exe

2013-09-11 17:24 - 2013-09-11 17:24 - 00001083 _____ C:\Users\Rodenwald\Desktop\JRT.txt

2013-09-11 17:20 - 2013-08-07 04:22 - 00278800 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

2013-09-11 17:07 - 2013-09-11 17:07 - 01029490 _____ (Thisisu) C:\Users\Rodenwald\Desktop\JRT.exe

2013-09-11 17:05 - 2013-09-11 17:05 - 00001174 _____ C:\Users\Rodenwald\Downloads\AdwCleaner[S2].txt

2013-09-11 16:56 - 2013-09-11 16:56 - 01037278 _____ C:\Users\Rodenwald\Desktop\adwcleaner(1).exe

2013-09-11 16:35 - 2013-09-11 16:35 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Rodenwald\Downloads\mbam-setup-1.75.0.1300.exe

2013-09-11 15:21 - 2013-09-11 15:21 - 00000657 _____ C:\Users\Rodenwald\Downloads\Gmer_AbgesicherterModus.log

2013-09-11 15:10 - 2013-09-11 15:10 - 00006725 _____ C:\Users\Rodenwald\Downloads\Gmer.txt

2013-09-11 14:50 - 2013-09-11 14:50 - 00377856 _____ C:\Users\Rodenwald\Downloads\rygoqjug.exe

2013-09-11 14:48 - 2013-09-11 14:49 - 00027254 _____ C:\Users\Rodenwald\Downloads\Addition.txt

2013-09-11 14:47 - 2013-09-11 14:47 - 00000000 ____D C:\FRST

2013-09-11 14:44 - 2013-09-11 14:44 - 00000480 _____ C:\Users\Rodenwald\Downloads\defogger_disable.log

2013-09-11 14:44 - 2013-09-11 14:44 - 00000000 _____ C:\Users\Rodenwald\defogger_reenable

2013-09-11 14:43 - 2013-09-11 14:43 - 00050477 _____ C:\Users\Rodenwald\Downloads\Defogger.exe

2013-09-10 22:01 - 2013-07-09 11:14 - 00001820 _____ C:\Users\Rodenwald\Desktop\delfolders.bat

2013-09-10 21:58 - 2013-09-10 22:15 - 00000029 _____ C:\Users\Rodenwald\Desktop\Shutme.bat

2013-09-10 21:53 - 2013-09-10 21:53 - 00240532 _____ C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Trojaner-Board.html

2013-09-10 21:53 - 2013-09-10 21:53 - 00117440 _____ C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Seite 2 - Trojaner-Board.html

2013-09-10 21:53 - 2013-09-10 21:53 - 00091410 _____ C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Seite 3 - Trojaner-Board.html

2013-09-10 21:53 - 2013-09-10 21:53 - 00000000 ____D C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Trojaner-Board_files

2013-09-10 21:53 - 2013-09-10 21:53 - 00000000 ____D C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Seite 3 - Trojaner-Board_files

2013-09-10 21:53 - 2013-09-10 21:53 - 00000000 ____D C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Seite 2 - Trojaner-Board_files

2013-09-10 21:36 - 2013-09-10 21:36 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2013-09-10 21:26 - 2013-09-10 22:03 - 00181064 _____ (Sysinternals) C:\Windows\PSEXESVC.EXE

2013-09-10 21:17 - 2013-09-11 16:36 - 00001117 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-09-10 21:15 - 2013-09-10 21:15 - 03268369 _____ C:\Users\Rodenwald\Downloads\tweaking.com_windows_repair_aio.zip

2013-09-10 21:15 - 2013-09-10 21:15 - 00000000 ____D C:\Users\Rodenwald\Downloads\tweaking.com_windows_repair_aio

2013-09-10 21:09 - 2013-09-10 21:09 - 00686017 _____ C:\Users\Rodenwald\Desktop\SysInspector-RW-PC-130910-2103.zip

2013-09-10 21:03 - 2013-09-10 21:03 - 04919312 _____ C:\Users\Rodenwald\Downloads\SysInspector_1.2.42.zip

2013-09-10 21:03 - 2013-09-10 21:03 - 00000000 ____D C:\Users\Rodenwald\Downloads\SysInspector_1.2.42

2013-09-10 20:54 - 2013-09-10 20:54 - 00000000 ____D C:\Windows\ERUNT

2013-09-10 20:34 - 2013-09-11 16:36 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-09-10 20:34 - 2013-09-10 20:34 - 00000000 ____D C:\Users\Rodenwald\AppData\Roaming\Malwarebytes

2013-09-10 20:34 - 2013-09-10 20:34 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-09-10 20:34 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2013-09-10 19:58 - 2013-09-10 19:58 - 00119925 _____ C:\Users\Rodenwald\Desktop\bookmarks.html

2013-09-09 20:14 - 2013-09-11 16:59 - 00000000 ____D C:\AdwCleaner

2013-09-09 20:13 - 2013-09-09 20:13 - 01037278 _____ C:\Users\Rodenwald\Downloads\AdwCleaner.exe

2013-09-05 20:32 - 2013-09-05 20:32 - 00000000 ____D C:\Intel

2013-09-03 13:29 - 2013-09-03 13:29 - 00208896 __RSH C:\Users\Rodenwald\AppData\Roaming\mprddmt.dll

2013-08-17 16:32 - 2013-09-10 21:36 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2013-08-16 16:26 - 2013-08-16 16:26 - 00000815 _____ C:\Users\Public\Desktop\PowerTeacher.lnk

2013-08-16 16:26 - 2013-08-16 16:26 - 00000000 ____D C:\ProgramData\PowerTeacher

2013-08-15 11:38 - 2013-08-15 11:38 - 00344832 _____ C:\Users\Rodenwald\Downloads\documents-export-2013-08-15.zip

2013-08-14 22:28 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL

2013-08-14 22:28 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL

2013-08-14 22:28 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll

2013-08-14 22:28 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll

2013-08-14 22:28 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll

2013-08-14 22:28 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll

2013-08-14 22:28 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll

2013-08-14 22:28 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll

2013-08-14 22:28 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll

2013-08-14 22:28 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll

2013-08-14 22:28 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll

2013-08-14 22:28 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll

2013-08-14 22:28 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll

2013-08-14 22:28 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll

2013-08-14 22:28 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2013-08-14 22:28 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
 

==================== One Month Modified Files and Folders =======
 

2013-09-12 06:51 - 2013-09-12 06:51 - 01949642 _____ (Farbar) C:\Users\Rodenwald\Downloads\FRST64.exe

2013-09-12 06:38 - 2012-11-04 23:30 - 00000000 ____D C:\Users\Rodenwald\AppData\Roaming\Skype

2013-09-12 06:30 - 2012-11-08 13:45 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-09-12 06:29 - 2012-11-01 13:31 - 01191547 _____ C:\Windows\WindowsUpdate.log

2013-09-12 06:22 - 2013-09-12 06:22 - 97238077 _____ C:\Windows\SysWOW64\碽攝£

2013-09-12 04:41 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache

2013-09-12 03:33 - 2009-07-14 06:45 - 00017376 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-09-12 03:33 - 2009-07-14 06:45 - 00017376 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-09-12 03:29 - 2012-11-01 13:39 - 00000000 ___RD C:\Users\Rodenwald\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

2013-09-12 03:29 - 2012-11-01 13:39 - 00000000 ___RD C:\Users\Rodenwald\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools

2013-09-12 03:28 - 2013-07-21 23:29 - 00427160 _____ C:\Windows\system32\FNTCACHE.DAT

2013-09-12 03:28 - 2013-07-21 23:29 - 00008258 _____ C:\Windows\setupact.log

2013-09-12 03:28 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-09-12 03:08 - 2010-04-13 04:55 - 00000000 ____D C:\ProgramData\Microsoft Help

2013-09-12 00:21 - 2013-09-12 00:22 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys

2013-09-11 22:10 - 2013-09-11 22:10 - 00000000 ____D C:\Users\Rodenwald\AppData\Roaming\Avira

2013-09-11 22:08 - 2013-09-11 22:08 - 00891144 _____ C:\Users\Rodenwald\Downloads\SecurityCheck.exe

2013-09-11 22:08 - 2012-11-01 22:21 - 00654400 _____ C:\Windows\system32\perfh007.dat

2013-09-11 22:08 - 2012-11-01 22:21 - 00130240 _____ C:\Windows\system32\perfc007.dat

2013-09-11 22:08 - 2009-07-14 07:13 - 01498742 _____ C:\Windows\system32\PerfStringBackup.INI

2013-09-11 22:07 - 2013-09-11 22:07 - 02347384 _____ (ESET) C:\Users\Rodenwald\Downloads\esetsmartinstaller_enu.exe

2013-09-11 22:03 - 2013-07-21 23:28 - 00109000 _____ C:\Windows\PFRO.log

2013-09-11 18:19 - 2013-09-11 18:19 - 00000000 ____D C:\Program Files (x86)\Avira

2013-09-11 18:19 - 2012-11-01 21:47 - 00000000 ____D C:\ProgramData\Avira

2013-09-11 18:18 - 2013-09-11 18:19 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys

2013-09-11 18:18 - 2013-09-11 18:19 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

2013-09-11 18:18 - 2013-09-11 18:19 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys

2013-09-11 18:01 - 2013-09-11 18:01 - 02092792 _____ C:\Users\Rodenwald\Downloads\avira_free_antivirus.exe

2013-09-11 17:24 - 2013-09-11 17:24 - 00001083 _____ C:\Users\Rodenwald\Desktop\JRT.txt

2013-09-11 17:07 - 2013-09-11 17:07 - 01029490 _____ (Thisisu) C:\Users\Rodenwald\Desktop\JRT.exe

2013-09-11 17:05 - 2013-09-11 17:05 - 00001174 _____ C:\Users\Rodenwald\Downloads\AdwCleaner[S2].txt

2013-09-11 16:59 - 2013-09-09 20:14 - 00000000 ____D C:\AdwCleaner

2013-09-11 16:56 - 2013-09-11 16:56 - 01037278 _____ C:\Users\Rodenwald\Desktop\adwcleaner(1).exe

2013-09-11 16:36 - 2013-09-10 21:17 - 00001117 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-09-11 16:36 - 2013-09-10 20:34 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-09-11 16:35 - 2013-09-11 16:35 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Rodenwald\Downloads\mbam-setup-1.75.0.1300.exe

2013-09-11 15:30 - 2012-11-08 13:45 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2013-09-11 15:30 - 2012-11-08 13:45 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2013-09-11 15:30 - 2012-11-08 13:45 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

2013-09-11 15:21 - 2013-09-11 15:21 - 00000657 _____ C:\Users\Rodenwald\Downloads\Gmer_AbgesicherterModus.log

2013-09-11 15:10 - 2013-09-11 15:10 - 00006725 _____ C:\Users\Rodenwald\Downloads\Gmer.txt

2013-09-11 14:50 - 2013-09-11 14:50 - 00377856 _____ C:\Users\Rodenwald\Downloads\rygoqjug.exe

2013-09-11 14:49 - 2013-09-11 14:48 - 00027254 _____ C:\Users\Rodenwald\Downloads\Addition.txt

2013-09-11 14:47 - 2013-09-11 14:47 - 00000000 ____D C:\FRST

2013-09-11 14:44 - 2013-09-11 14:44 - 00000480 _____ C:\Users\Rodenwald\Downloads\defogger_disable.log

2013-09-11 14:44 - 2013-09-11 14:44 - 00000000 _____ C:\Users\Rodenwald\defogger_reenable

2013-09-11 14:44 - 2012-11-01 13:36 - 00000000 ____D C:\Users\Rodenwald

2013-09-11 14:43 - 2013-09-11 14:43 - 00050477 _____ C:\Users\Rodenwald\Downloads\Defogger.exe

2013-09-10 22:15 - 2013-09-10 21:58 - 00000029 _____ C:\Users\Rodenwald\Desktop\Shutme.bat

2013-09-10 22:03 - 2013-09-10 21:26 - 00181064 _____ (Sysinternals) C:\Windows\PSEXESVC.EXE

2013-09-10 21:59 - 2009-07-14 04:34 - 00000514 _____ C:\Windows\win.ini

2013-09-10 21:53 - 2013-09-10 21:53 - 00240532 _____ C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Trojaner-Board.html

2013-09-10 21:53 - 2013-09-10 21:53 - 00117440 _____ C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Seite 2 - Trojaner-Board.html

2013-09-10 21:53 - 2013-09-10 21:53 - 00091410 _____ C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Seite 3 - Trojaner-Board.html

2013-09-10 21:53 - 2013-09-10 21:53 - 00000000 ____D C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Trojaner-Board_files

2013-09-10 21:53 - 2013-09-10 21:53 - 00000000 ____D C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Seite 3 - Trojaner-Board_files

2013-09-10 21:53 - 2013-09-10 21:53 - 00000000 ____D C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Seite 2 - Trojaner-Board_files

2013-09-10 21:52 - 2013-07-21 14:11 - 00111288 _____ C:\Users\Rodenwald\AppData\Local\GDIPFONTCACHEV1.DAT

2013-09-10 21:36 - 2013-09-10 21:36 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2013-09-10 21:36 - 2013-08-17 16:32 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2013-09-10 21:15 - 2013-09-10 21:15 - 03268369 _____ C:\Users\Rodenwald\Downloads\tweaking.com_windows_repair_aio.zip

2013-09-10 21:15 - 2013-09-10 21:15 - 00000000 ____D C:\Users\Rodenwald\Downloads\tweaking.com_windows_repair_aio

2013-09-10 21:09 - 2013-09-10 21:09 - 00686017 _____ C:\Users\Rodenwald\Desktop\SysInspector-RW-PC-130910-2103.zip

2013-09-10 21:03 - 2013-09-10 21:03 - 04919312 _____ C:\Users\Rodenwald\Downloads\SysInspector_1.2.42.zip

2013-09-10 21:03 - 2013-09-10 21:03 - 00000000 ____D C:\Users\Rodenwald\Downloads\SysInspector_1.2.42

2013-09-10 20:54 - 2013-09-10 20:54 - 00000000 ____D C:\Windows\ERUNT

2013-09-10 20:34 - 2013-09-10 20:34 - 00000000 ____D C:\Users\Rodenwald\AppData\Roaming\Malwarebytes

2013-09-10 20:34 - 2013-09-10 20:34 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-09-10 19:58 - 2013-09-10 19:58 - 00119925 _____ C:\Users\Rodenwald\Desktop\bookmarks.html

2013-09-09 20:13 - 2013-09-09 20:13 - 01037278 _____ C:\Users\Rodenwald\Downloads\AdwCleaner.exe

2013-09-05 20:32 - 2013-09-05 20:32 - 00000000 ____D C:\Intel

2013-09-03 13:29 - 2013-09-03 13:29 - 00208896 __RSH C:\Users\Rodenwald\AppData\Roaming\mprddmt.dll

2013-09-03 10:59 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT

2013-08-30 09:48 - 2013-02-05 13:22 - 00000000 ___RD C:\Program Files (x86)\Skype

2013-08-30 09:48 - 2012-11-04 23:30 - 00000000 ____D C:\ProgramData\Skype

2013-08-29 14:40 - 2013-07-18 00:23 - 00000000 ____D C:\Windows\system32\MRT

2013-08-29 14:38 - 2012-11-10 23:39 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2013-08-16 16:26 - 2013-08-16 16:26 - 00000815 _____ C:\Users\Public\Desktop\PowerTeacher.lnk

2013-08-16 16:26 - 2013-08-16 16:26 - 00000000 ____D C:\ProgramData\PowerTeacher

2013-08-15 11:38 - 2013-08-15 11:38 - 00344832 _____ C:\Users\Rodenwald\Downloads\documents-export-2013-08-15.zip

2013-08-15 07:12 - 2009-07-27 22:41 - 00000000 ____D C:\Windows\Panther
 

Files to move or delete:

====================

C:\Users\RODENW~1\AppData\Local\Temp\mbam-setup.exe

C:\Users\RODENW~1\AppData\Local\Temp\Quarantine.exe
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-09-12 00:52
 

==================== End Of Log ============================

--- --- ---

Flash Player updaten.

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

HKCU\...\Run: [hpiwsygrv] - rundll32 "C:\Users\Rodenwald\AppData\Roaming\mprddmt.dll",SNUNOQ

C:\Users\Rodenwald\AppData\Roaming\mprddmt.dll

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Noch Probleme?

Hallo,
wiederholt: VIELEN DANK!

(Adobe) FlashPlayer ist aktualisiert.
Hier die Fixlog.txt

Code:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 13-09-2013

Ran by Rodenwald at 2013-09-13 08:24:21 Run:1

Running from C:\Users\Rodenwald\Downloads

Boot Mode: Normal

==============================================
 

Content of fixlist:

*****************

HKCU\...\Run: [hpiwsygrv] - rundll32 "C:\Users\Rodenwald\AppData\Roaming\mprddmt.dll",SNUNOQ

C:\Users\Rodenwald\AppData\Roaming\mprddmt.dll

*****************
 

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\hpiwsygrv => Value deleted successfully.

C:\Users\Rodenwald\AppData\Roaming\mprddmt.dll => Moved successfully.
 

==== End of Fixlog ====

Noch Probleme:
Nach einigen Klicks auf Suchmaschinenergebnisse (google) lande ich leider wieder auf ihavenet.com

mit welchem Browser?

Hallo,
mit Firefox 23.0.1
und auch mit Internet Explorer 10.0.9200

Gruß
Felix

Firefox deinstallieren, keine Daten behalten, neu installieren.

Setze folgendermassen den Internet Explorer zurück:

Öffne den Internet Explorer und gehe zu Extras -> Internetoptionen.
Klicke in der Registerkarte Erweitert unter "Internet Explorer-Einstellungen zurücksetzen" auf Zurücksetzen...
Klicke im Dialogfeld "Internet Explorer-Einstellungen zurücksetzen" zum Bestätigen auf Zurücksetzen.

(Hier findest du die bebilderte Anleitung.)

Frisches FRST log bitte.

Hallo,
ist erledigt.

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-09-2013

Ran by Rodenwald (administrator) on RW-PC on 13-09-2013 10:37:43

Running from C:\Users\Rodenwald\Downloads

Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) =================
 

(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe

(Microsoft Corporation) C:\Windows\system32\WLANExt.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe

(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe

(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe

(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe

(Egis Technology Inc.) C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe

(Intel Corporation) C:\Windows\system32\igfxsrvc.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

() C:\Windows\PLFSetI.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Acer Group) C:\Program Files\Acer\Acer Updater\UpdaterService.exe

(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe

(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe

(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

(Intel Corporation) C:\Windows\system32\igfxext.exe

(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe

(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe

(Egis Technology Inc.) C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe

(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesApp64.exe

(Egis Technology Inc.) C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe

(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [mwlDaemon] - C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe [349552 2010-02-01] (Egis Technology Inc.)

HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10060832 2010-02-09] (Realtek Semiconductor)

HKLM\...\Run: [PLFSetI] - C:\Windows\PLFSetI.exe [206208 2012-11-01] ()

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1842472 2009-09-18] (Synaptics Incorporated)

HKLM\...\Run: [Acer ePower Management] - C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [860704 2010-03-17] (Acer Incorporated)

HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19876456 2013-06-21] (Skype Technologies S.A.)

MountPoints2: D - D:\PSetup.exe /continue /uionlyifneeded

HKLM-x32\...\Run: [BackupManagerTray] - C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [260608 2010-03-09] (NewTech Infosystems, Inc.)

HKLM-x32\...\Run: [SuiteTray] - C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe [337264 2010-02-01] (Egis Technology Inc.)

HKLM-x32\...\Run: [EgisUpdate] - C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe [201512 2009-12-25] (Egis Technology Inc.)

HKLM-x32\...\Run: [EgisTecPMMUpdate] - C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe [401192 2009-12-25] (Egis Technology Inc.)

HKLM-x32\...\Run: [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe [1300560 2010-03-04] (Dritek System Inc.)

HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] - C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [685048 2012-08-03] (Cisco Systems, Inc.)

HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-11] (Avira Operations GmbH & Co. KG)

HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [154144 2010-01-15] ()
 

==================== Internet (Whitelisted) ====================
 

SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

Toolbar: HKLM-x32 -  No Name - {2e94b700-eafb-4c9e-a696-77200aa3f89b} -  No File

Toolbar: HKCU -  No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
 

FireFox:

========

FF ProfilePath: C:\Users\Rodenwald\AppData\Roaming\Mozilla\Firefox\Profiles\oqtvp5hb.default

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\Yahooober1163533.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
 

==================== Services (Whitelisted) =================
 

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-11] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-11] (Avira Operations GmbH & Co. KG)

S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-11] (Avira Operations GmbH & Co. KG)

S3 MWLService; C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [305520 2010-02-01] (Egis Technology Inc.)

R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe [2402080 2013-01-28] (TuneUp Software)
 

==================== Drivers (Whitelisted) ====================
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-11] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-09-11] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-09-11] (Avira Operations GmbH & Co. KG)

S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)

R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesDriver64.sys [11880 2012-09-19] (TuneUp Software)

S3 ALSysIO; \??\C:\Users\RODENW~1\AppData\Local\Temp\ALSysIO64.sys [x]

S3 avfwim; system32\DRIVERS\avfwim.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-09-13 10:35 - 2013-09-13 10:36 - 00000000 ____D C:\Users\Rodenwald\AppData\Roaming\Mozilla

2013-09-13 10:35 - 2013-09-13 10:35 - 00001155 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk

2013-09-13 10:35 - 2013-09-13 10:35 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2013-09-13 10:31 - 2013-09-13 10:31 - 22240760 _____ (Mozilla) C:\Users\Rodenwald\Downloads\Firefox_Setup_23.0.1.exe

2013-09-13 09:40 - 2013-09-13 09:40 - 97443711 _____ C:\Windows\SysWOW64\ﰡ

2013-09-13 08:24 - 2013-09-13 08:24 - 01949572 _____ (Farbar) C:\Users\Rodenwald\Downloads\FRST64.exe

2013-09-13 07:56 - 2013-09-13 07:56 - 00000000 ____D C:\Intel

2013-09-13 03:40 - 2013-09-13 03:40 - 97412816 _____ C:\Windows\SysWOW64\짔¦

2013-09-12 03:08 - 2013-08-10 07:22 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2013-09-12 03:08 - 2013-08-10 07:22 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2013-09-12 03:08 - 2013-08-10 07:22 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2013-09-12 03:08 - 2013-08-10 07:21 - 19246592 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2013-09-12 03:08 - 2013-08-10 07:21 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2013-09-12 03:08 - 2013-08-10 07:21 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2013-09-12 03:08 - 2013-08-10 07:20 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2013-09-12 03:08 - 2013-08-10 07:20 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2013-09-12 03:08 - 2013-08-10 07:20 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2013-09-12 03:08 - 2013-08-10 07:20 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2013-09-12 03:08 - 2013-08-10 07:20 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2013-09-12 03:08 - 2013-08-10 07:20 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll

2013-09-12 03:08 - 2013-08-10 07:20 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2013-09-12 03:08 - 2013-08-10 07:20 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2013-09-12 03:08 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2013-09-12 03:08 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2013-09-12 03:08 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2013-09-12 03:08 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2013-09-12 03:08 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2013-09-12 03:08 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2013-09-12 03:08 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2013-09-12 03:08 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2013-09-12 03:08 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2013-09-12 03:08 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll

2013-09-12 03:08 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2013-09-12 03:08 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2013-09-12 03:08 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2013-09-12 03:08 - 2013-08-10 05:17 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2013-09-12 03:08 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2013-09-12 03:08 - 2013-08-10 04:27 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe

2013-09-12 03:08 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe

2013-09-12 00:22 - 2013-09-12 00:21 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys

2013-09-11 22:20 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2013-09-11 22:20 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys

2013-09-11 22:20 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2013-09-11 22:20 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll

2013-09-11 22:20 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll

2013-09-11 22:20 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll

2013-09-11 22:20 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll

2013-09-11 22:20 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll

2013-09-11 22:20 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll

2013-09-11 22:20 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll

2013-09-11 22:20 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe

2013-09-11 22:20 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe

2013-09-11 22:20 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll

2013-09-11 22:20 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll

2013-09-11 22:20 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll

2013-09-11 22:20 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll

2013-09-11 22:20 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll

2013-09-11 22:20 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe

2013-09-11 22:20 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe

2013-09-11 22:20 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe

2013-09-11 22:20 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll

2013-09-11 22:20 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe

2013-09-11 22:20 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe

2013-09-11 22:20 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll

2013-09-11 22:20 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll

2013-09-11 22:20 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll

2013-09-11 22:20 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll

2013-09-11 22:20 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2013-09-11 22:20 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll

2013-09-11 22:10 - 2013-09-11 22:10 - 00000000 ____D C:\Users\Rodenwald\AppData\Roaming\Avira

2013-09-11 22:08 - 2013-09-11 22:08 - 00891144 _____ C:\Users\Rodenwald\Downloads\SecurityCheck.exe

2013-09-11 22:07 - 2013-09-11 22:07 - 02347384 _____ (ESET) C:\Users\Rodenwald\Downloads\esetsmartinstaller_enu.exe

2013-09-11 18:19 - 2013-09-11 18:19 - 00000000 ____D C:\Program Files (x86)\Avira

2013-09-11 18:19 - 2013-09-11 18:18 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys

2013-09-11 18:19 - 2013-09-11 18:18 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

2013-09-11 18:19 - 2013-09-11 18:18 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys

2013-09-11 18:01 - 2013-09-11 18:01 - 02092792 _____ C:\Users\Rodenwald\Downloads\avira_free_antivirus.exe

2013-09-11 17:24 - 2013-09-11 17:24 - 00001083 _____ C:\Users\Rodenwald\Desktop\JRT.txt

2013-09-11 17:20 - 2013-08-07 04:22 - 00278800 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

2013-09-11 17:07 - 2013-09-11 17:07 - 01029490 _____ (Thisisu) C:\Users\Rodenwald\Desktop\JRT.exe

2013-09-11 17:05 - 2013-09-11 17:05 - 00001174 _____ C:\Users\Rodenwald\Downloads\AdwCleaner[S2].txt

2013-09-11 16:56 - 2013-09-11 16:56 - 01037278 _____ C:\Users\Rodenwald\Desktop\adwcleaner(1).exe

2013-09-11 16:35 - 2013-09-11 16:35 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Rodenwald\Downloads\mbam-setup-1.75.0.1300.exe

2013-09-11 15:21 - 2013-09-11 15:21 - 00000657 _____ C:\Users\Rodenwald\Downloads\Gmer_AbgesicherterModus.log

2013-09-11 15:10 - 2013-09-11 15:10 - 00006725 _____ C:\Users\Rodenwald\Downloads\Gmer.txt

2013-09-11 14:50 - 2013-09-11 14:50 - 00377856 _____ C:\Users\Rodenwald\Downloads\rygoqjug.exe

2013-09-11 14:48 - 2013-09-11 14:49 - 00027254 _____ C:\Users\Rodenwald\Downloads\Addition.txt

2013-09-11 14:47 - 2013-09-11 14:47 - 00000000 ____D C:\FRST

2013-09-11 14:44 - 2013-09-11 14:44 - 00000480 _____ C:\Users\Rodenwald\Downloads\defogger_disable.log

2013-09-11 14:44 - 2013-09-11 14:44 - 00000000 _____ C:\Users\Rodenwald\defogger_reenable

2013-09-11 14:43 - 2013-09-11 14:43 - 00050477 _____ C:\Users\Rodenwald\Downloads\Defogger.exe

2013-09-10 22:01 - 2013-07-09 11:14 - 00001820 _____ C:\Users\Rodenwald\Desktop\delfolders.bat

2013-09-10 21:58 - 2013-09-10 22:15 - 00000029 _____ C:\Users\Rodenwald\Desktop\Shutme.bat

2013-09-10 21:53 - 2013-09-10 21:53 - 00240532 _____ C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Trojaner-Board.html

2013-09-10 21:53 - 2013-09-10 21:53 - 00117440 _____ C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Seite 2 - Trojaner-Board.html

2013-09-10 21:53 - 2013-09-10 21:53 - 00091410 _____ C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Seite 3 - Trojaner-Board.html

2013-09-10 21:53 - 2013-09-10 21:53 - 00000000 ____D C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Trojaner-Board_files

2013-09-10 21:53 - 2013-09-10 21:53 - 00000000 ____D C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Seite 3 - Trojaner-Board_files

2013-09-10 21:53 - 2013-09-10 21:53 - 00000000 ____D C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Seite 2 - Trojaner-Board_files

2013-09-10 21:26 - 2013-09-10 22:03 - 00181064 _____ (Sysinternals) C:\Windows\PSEXESVC.EXE

2013-09-10 21:17 - 2013-09-11 16:36 - 00001117 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-09-10 21:15 - 2013-09-10 21:15 - 03268369 _____ C:\Users\Rodenwald\Downloads\tweaking.com_windows_repair_aio.zip

2013-09-10 21:15 - 2013-09-10 21:15 - 00000000 ____D C:\Users\Rodenwald\Downloads\tweaking.com_windows_repair_aio

2013-09-10 21:09 - 2013-09-10 21:09 - 00686017 _____ C:\Users\Rodenwald\Desktop\SysInspector-RW-PC-130910-2103.zip

2013-09-10 21:03 - 2013-09-10 21:03 - 04919312 _____ C:\Users\Rodenwald\Downloads\SysInspector_1.2.42.zip

2013-09-10 21:03 - 2013-09-10 21:03 - 00000000 ____D C:\Users\Rodenwald\Downloads\SysInspector_1.2.42

2013-09-10 20:54 - 2013-09-10 20:54 - 00000000 ____D C:\Windows\ERUNT

2013-09-10 20:34 - 2013-09-11 16:36 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-09-10 20:34 - 2013-09-10 20:34 - 00000000 ____D C:\Users\Rodenwald\AppData\Roaming\Malwarebytes

2013-09-10 20:34 - 2013-09-10 20:34 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-09-10 20:34 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2013-09-10 19:58 - 2013-09-10 19:58 - 00119925 _____ C:\Users\Rodenwald\Desktop\bookmarks.html

2013-09-09 20:14 - 2013-09-11 16:59 - 00000000 ____D C:\AdwCleaner

2013-09-09 20:13 - 2013-09-09 20:13 - 01037278 _____ C:\Users\Rodenwald\Downloads\AdwCleaner.exe

2013-08-17 16:32 - 2013-09-13 10:35 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2013-08-16 16:26 - 2013-08-16 16:26 - 00000815 _____ C:\Users\Public\Desktop\PowerTeacher.lnk

2013-08-16 16:26 - 2013-08-16 16:26 - 00000000 ____D C:\ProgramData\PowerTeacher

2013-08-15 11:38 - 2013-08-15 11:38 - 00344832 _____ C:\Users\Rodenwald\Downloads\documents-export-2013-08-15.zip

2013-08-14 22:28 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL

2013-08-14 22:28 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL

2013-08-14 22:28 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll

2013-08-14 22:28 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll

2013-08-14 22:28 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll

2013-08-14 22:28 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll

2013-08-14 22:28 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll

2013-08-14 22:28 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll

2013-08-14 22:28 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll

2013-08-14 22:28 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll

2013-08-14 22:28 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll

2013-08-14 22:28 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll

2013-08-14 22:28 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll

2013-08-14 22:28 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll

2013-08-14 22:28 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2013-08-14 22:28 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
 

==================== One Month Modified Files and Folders =======
 

2013-09-13 10:36 - 2013-09-13 10:35 - 00000000 ____D C:\Users\Rodenwald\AppData\Roaming\Mozilla

2013-09-13 10:35 - 2013-09-13 10:35 - 00001155 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk

2013-09-13 10:35 - 2013-09-13 10:35 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2013-09-13 10:35 - 2013-08-17 16:32 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2013-09-13 10:31 - 2013-09-13 10:31 - 22240760 _____ (Mozilla) C:\Users\Rodenwald\Downloads\Firefox_Setup_23.0.1.exe

2013-09-13 10:30 - 2012-11-08 13:45 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-09-13 09:40 - 2013-09-13 09:40 - 97443711 _____ C:\Windows\SysWOW64\ﰡ

2013-09-13 08:24 - 2013-09-13 08:24 - 01949572 _____ (Farbar) C:\Users\Rodenwald\Downloads\FRST64.exe

2013-09-13 08:19 - 2012-11-08 13:45 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2013-09-13 08:19 - 2012-11-08 13:45 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2013-09-13 08:19 - 2012-11-08 13:45 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

2013-09-13 08:19 - 2012-11-04 22:23 - 00000000 ____D C:\Users\Rodenwald\AppData\Local\Adobe

2013-09-13 08:01 - 2009-07-14 06:45 - 00017376 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-09-13 08:01 - 2009-07-14 06:45 - 00017376 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-09-13 07:56 - 2013-09-13 07:56 - 00000000 ____D C:\Intel

2013-09-13 07:56 - 2013-07-21 23:29 - 00008370 _____ C:\Windows\setupact.log

2013-09-13 07:56 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-09-13 07:55 - 2013-07-21 23:28 - 00110198 _____ C:\Windows\PFRO.log

2013-09-13 04:13 - 2012-11-01 13:31 - 01296315 _____ C:\Windows\WindowsUpdate.log

2013-09-13 03:40 - 2013-09-13 03:40 - 97412816 _____ C:\Windows\SysWOW64\짔¦

2013-09-13 03:03 - 2010-04-13 04:55 - 00000000 ____D C:\ProgramData\Microsoft Help

2013-09-12 17:40 - 2012-11-04 23:30 - 00000000 ____D C:\Users\Rodenwald\AppData\Roaming\Skype

2013-09-12 04:41 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache

2013-09-12 03:29 - 2012-11-01 13:39 - 00000000 ___RD C:\Users\Rodenwald\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

2013-09-12 03:29 - 2012-11-01 13:39 - 00000000 ___RD C:\Users\Rodenwald\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools

2013-09-12 03:28 - 2013-07-21 23:29 - 00427160 _____ C:\Windows\system32\FNTCACHE.DAT

2013-09-12 00:21 - 2013-09-12 00:22 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys

2013-09-11 22:10 - 2013-09-11 22:10 - 00000000 ____D C:\Users\Rodenwald\AppData\Roaming\Avira

2013-09-11 22:08 - 2013-09-11 22:08 - 00891144 _____ C:\Users\Rodenwald\Downloads\SecurityCheck.exe

2013-09-11 22:08 - 2012-11-01 22:21 - 00654400 _____ C:\Windows\system32\perfh007.dat

2013-09-11 22:08 - 2012-11-01 22:21 - 00130240 _____ C:\Windows\system32\perfc007.dat

2013-09-11 22:08 - 2009-07-14 07:13 - 01498742 _____ C:\Windows\system32\PerfStringBackup.INI

2013-09-11 22:07 - 2013-09-11 22:07 - 02347384 _____ (ESET) C:\Users\Rodenwald\Downloads\esetsmartinstaller_enu.exe

2013-09-11 18:19 - 2013-09-11 18:19 - 00000000 ____D C:\Program Files (x86)\Avira

2013-09-11 18:19 - 2012-11-01 21:47 - 00000000 ____D C:\ProgramData\Avira

2013-09-11 18:18 - 2013-09-11 18:19 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys

2013-09-11 18:18 - 2013-09-11 18:19 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

2013-09-11 18:18 - 2013-09-11 18:19 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys

2013-09-11 18:01 - 2013-09-11 18:01 - 02092792 _____ C:\Users\Rodenwald\Downloads\avira_free_antivirus.exe

2013-09-11 17:24 - 2013-09-11 17:24 - 00001083 _____ C:\Users\Rodenwald\Desktop\JRT.txt

2013-09-11 17:07 - 2013-09-11 17:07 - 01029490 _____ (Thisisu) C:\Users\Rodenwald\Desktop\JRT.exe

2013-09-11 17:05 - 2013-09-11 17:05 - 00001174 _____ C:\Users\Rodenwald\Downloads\AdwCleaner[S2].txt

2013-09-11 16:59 - 2013-09-09 20:14 - 00000000 ____D C:\AdwCleaner

2013-09-11 16:56 - 2013-09-11 16:56 - 01037278 _____ C:\Users\Rodenwald\Desktop\adwcleaner(1).exe

2013-09-11 16:36 - 2013-09-10 21:17 - 00001117 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-09-11 16:36 - 2013-09-10 20:34 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-09-11 16:35 - 2013-09-11 16:35 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Rodenwald\Downloads\mbam-setup-1.75.0.1300.exe

2013-09-11 15:21 - 2013-09-11 15:21 - 00000657 _____ C:\Users\Rodenwald\Downloads\Gmer_AbgesicherterModus.log

2013-09-11 15:10 - 2013-09-11 15:10 - 00006725 _____ C:\Users\Rodenwald\Downloads\Gmer.txt

2013-09-11 14:50 - 2013-09-11 14:50 - 00377856 _____ C:\Users\Rodenwald\Downloads\rygoqjug.exe

2013-09-11 14:49 - 2013-09-11 14:48 - 00027254 _____ C:\Users\Rodenwald\Downloads\Addition.txt

2013-09-11 14:47 - 2013-09-11 14:47 - 00000000 ____D C:\FRST

2013-09-11 14:44 - 2013-09-11 14:44 - 00000480 _____ C:\Users\Rodenwald\Downloads\defogger_disable.log

2013-09-11 14:44 - 2013-09-11 14:44 - 00000000 _____ C:\Users\Rodenwald\defogger_reenable

2013-09-11 14:44 - 2012-11-01 13:36 - 00000000 ____D C:\Users\Rodenwald

2013-09-11 14:43 - 2013-09-11 14:43 - 00050477 _____ C:\Users\Rodenwald\Downloads\Defogger.exe

2013-09-10 22:15 - 2013-09-10 21:58 - 00000029 _____ C:\Users\Rodenwald\Desktop\Shutme.bat

2013-09-10 22:03 - 2013-09-10 21:26 - 00181064 _____ (Sysinternals) C:\Windows\PSEXESVC.EXE

2013-09-10 21:59 - 2009-07-14 04:34 - 00000514 _____ C:\Windows\win.ini

2013-09-10 21:53 - 2013-09-10 21:53 - 00240532 _____ C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Trojaner-Board.html

2013-09-10 21:53 - 2013-09-10 21:53 - 00117440 _____ C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Seite 2 - Trojaner-Board.html

2013-09-10 21:53 - 2013-09-10 21:53 - 00091410 _____ C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Seite 3 - Trojaner-Board.html

2013-09-10 21:53 - 2013-09-10 21:53 - 00000000 ____D C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Trojaner-Board_files

2013-09-10 21:53 - 2013-09-10 21:53 - 00000000 ____D C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Seite 3 - Trojaner-Board_files

2013-09-10 21:53 - 2013-09-10 21:53 - 00000000 ____D C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Seite 2 - Trojaner-Board_files

2013-09-10 21:52 - 2013-07-21 14:11 - 00111288 _____ C:\Users\Rodenwald\AppData\Local\GDIPFONTCACHEV1.DAT

2013-09-10 21:15 - 2013-09-10 21:15 - 03268369 _____ C:\Users\Rodenwald\Downloads\tweaking.com_windows_repair_aio.zip

2013-09-10 21:15 - 2013-09-10 21:15 - 00000000 ____D C:\Users\Rodenwald\Downloads\tweaking.com_windows_repair_aio

2013-09-10 21:09 - 2013-09-10 21:09 - 00686017 _____ C:\Users\Rodenwald\Desktop\SysInspector-RW-PC-130910-2103.zip

2013-09-10 21:03 - 2013-09-10 21:03 - 04919312 _____ C:\Users\Rodenwald\Downloads\SysInspector_1.2.42.zip

2013-09-10 21:03 - 2013-09-10 21:03 - 00000000 ____D C:\Users\Rodenwald\Downloads\SysInspector_1.2.42

2013-09-10 20:54 - 2013-09-10 20:54 - 00000000 ____D C:\Windows\ERUNT

2013-09-10 20:34 - 2013-09-10 20:34 - 00000000 ____D C:\Users\Rodenwald\AppData\Roaming\Malwarebytes

2013-09-10 20:34 - 2013-09-10 20:34 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-09-10 19:58 - 2013-09-10 19:58 - 00119925 _____ C:\Users\Rodenwald\Desktop\bookmarks.html

2013-09-09 20:13 - 2013-09-09 20:13 - 01037278 _____ C:\Users\Rodenwald\Downloads\AdwCleaner.exe

2013-09-03 10:59 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT

2013-08-30 09:48 - 2013-02-05 13:22 - 00000000 ___RD C:\Program Files (x86)\Skype

2013-08-30 09:48 - 2012-11-04 23:30 - 00000000 ____D C:\ProgramData\Skype

2013-08-29 14:40 - 2013-07-18 00:23 - 00000000 ____D C:\Windows\system32\MRT

2013-08-29 14:38 - 2012-11-10 23:39 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2013-08-16 16:26 - 2013-08-16 16:26 - 00000815 _____ C:\Users\Public\Desktop\PowerTeacher.lnk

2013-08-16 16:26 - 2013-08-16 16:26 - 00000000 ____D C:\ProgramData\PowerTeacher

2013-08-15 11:38 - 2013-08-15 11:38 - 00344832 _____ C:\Users\Rodenwald\Downloads\documents-export-2013-08-15.zip

2013-08-15 07:12 - 2009-07-27 22:41 - 00000000 ____D C:\Windows\Panther
 

Files to move or delete:

====================

C:\Users\Rodenwald\AppData\Local\Temp\mbam-setup.exe

C:\Users\Rodenwald\AppData\Local\Temp\Quarantine.exe
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-09-12 00:52
 

==================== End Of Log ============================

--- --- ---

ja, noch immer in beiden Browsern.

Lade SystemLook von jpshortstuff von einem der folgenden Spiegel herunter und speichere das Tool auf dem Desktop.
SystemLook (64 bit)

Doppelklicke auf die SystemLook_x64.exe, um das Tool zu starten.
Kopiere den Inhalt der folgenden Codebox in das Textfeld des Tools:

Code:

:filefind *ihavenet* :regfind ihavenet
Klicke nun auf den Button Look, um den Scan zu starten.
Der Suchlauf kann einige Zeit dauern.
Wenn der Suchlauf beendet ist, wird sich Dein Editor mit den Ergebnissen öffnen, poste diese in deinen Thread.
Die Ergebnisse werden auf dem Desktop als SystemLook.txt gespeichert.

Hallo,
hier:

Code:

SystemLook 30.07.11 by jpshortstuff

Log created at 21:41 on 13/09/2013 by Rodenwald

Administrator - Elevation successful
 

========== filefind ==========
 

Searching for "*ihavenet*"

C:\Dokumente und Einstellungen\Rodenwald\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\02GTFM6F\ihavenet_com[1].htm        --a---- 1335 bytes        [12:48 13/09/2013]        [12:48 13/09/2013] F86844CC2B98EC7EC57305091533EF89

C:\Dokumente und Einstellungen\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Seite 2 - Trojaner-Board.html        --a---- 117440 bytes        [19:53 10/09/2013]        [19:53 10/09/2013] 92E8A9B5279FCEF03782400FAD4FE882

C:\Dokumente und Einstellungen\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Seite 3 - Trojaner-Board.html        --a---- 91410 bytes        [19:53 10/09/2013]        [19:53 10/09/2013] DE29A6E27E2EE01E4465C4CDB9C5B5E6

C:\Dokumente und Einstellungen\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Trojaner-Board.html        --a---- 240532 bytes        [19:53 10/09/2013]        [19:53 10/09/2013] 272DA30EBB5390BE85A358820564B1C6

C:\Dokumente und Einstellungen\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Seite 2 - Trojaner-Board_files\59688d1378153396t-ihavenet-trojaner-meinem-pc-image002.jpg        --a---- 1749 bytes        [19:53 10/09/2013]        [19:53 10/09/2013] 4776EC979F10CE8C554905517ACD1920

C:\Dokumente und Einstellungen\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Seite 2 - Trojaner-Board_files\59688d1378153405-ihavenet-trojaner-meinem-pc-image002.jpg        --a---- 25394 bytes        [19:53 10/09/2013]        [19:53 10/09/2013] 82B9C59DC3C00F774FF1F8F4AB1A6804

C:\Dokumente und Einstellungen\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Seite 2 - Trojaner-Board_files\ihavenet-trojaner-meinem-pc_ltr.gif        --a---- 1035 bytes        [19:53 10/09/2013]        [19:53 10/09/2013] 279A7CCAE1D652E0EB03D9FB5B067B16

C:\Dokumente und Einstellungen\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Seite 3 - Trojaner-Board_files\ihavenet-trojaner-meinem-pc_ltr.gif        --a---- 1035 bytes        [19:53 10/09/2013]        [19:53 10/09/2013] 279A7CCAE1D652E0EB03D9FB5B067B16

C:\Dokumente und Einstellungen\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Trojaner-Board_files\ihavenet-trojaner-meinem-pc_ltr.gif        --a---- 1035 bytes        [19:53 10/09/2013]        [19:53 10/09/2013] 279A7CCAE1D652E0EB03D9FB5B067B16

C:\Users\Rodenwald\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\02GTFM6F\ihavenet_com[1].htm        --a---- 1335 bytes        [12:48 13/09/2013]        [12:48 13/09/2013] F86844CC2B98EC7EC57305091533EF89

C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Seite 2 - Trojaner-Board.html        --a---- 117440 bytes        [19:53 10/09/2013]        [19:53 10/09/2013] 92E8A9B5279FCEF03782400FAD4FE882

C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Seite 3 - Trojaner-Board.html        --a---- 91410 bytes        [19:53 10/09/2013]        [19:53 10/09/2013] DE29A6E27E2EE01E4465C4CDB9C5B5E6

C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Trojaner-Board.html        --a---- 240532 bytes        [19:53 10/09/2013]        [19:53 10/09/2013] 272DA30EBB5390BE85A358820564B1C6

C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Seite 2 - Trojaner-Board_files\59688d1378153396t-ihavenet-trojaner-meinem-pc-image002.jpg        --a---- 1749 bytes        [19:53 10/09/2013]        [19:53 10/09/2013] 4776EC979F10CE8C554905517ACD1920

C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Seite 2 - Trojaner-Board_files\59688d1378153405-ihavenet-trojaner-meinem-pc-image002.jpg        --a---- 25394 bytes        [19:53 10/09/2013]        [19:53 10/09/2013] 82B9C59DC3C00F774FF1F8F4AB1A6804

C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Seite 2 - Trojaner-Board_files\ihavenet-trojaner-meinem-pc_ltr.gif        --a---- 1035 bytes        [19:53 10/09/2013]        [19:53 10/09/2013] 279A7CCAE1D652E0EB03D9FB5B067B16

C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Seite 3 - Trojaner-Board_files\ihavenet-trojaner-meinem-pc_ltr.gif        --a---- 1035 bytes        [19:53 10/09/2013]        [19:53 10/09/2013] 279A7CCAE1D652E0EB03D9FB5B067B16

C:\Users\Rodenwald\Desktop\ihavenet Trojaner auf meinem PC - Trojaner-Board_files\ihavenet-trojaner-meinem-pc_ltr.gif        --a---- 1035 bytes        [19:53 10/09/2013]        [19:53 10/09/2013] 279A7CCAE1D652E0EB03D9FB5B067B16
 

========== regfind ==========
 

Searching for "ihavenet"

No data found.
 

-= EOF =-

Die Files auf dem Desktop sind von der Freundin vor unserer Aktion zum Thema erforschte Seiten, die sie dort gespeichert hat.

Hier noch zwei Infos, die vielleicht wichtig sind:

Wenn in der Taskleiste bei Skype per rechter Maustaste auf "Skype beenden" geklickt wird, so wird nicht Skype beendet, statt dessen öffnet sich der Explorer mit C:\Windows\System32\

Das Taskleisten-Symbol des neu installierten Firefox ist nicht das übliche sondern dieses "habe kein richtiges Symbol"-weiße Blatt mit einen Windowsfenster drin.

Keine Ahnung, ob das von Bedeutung ist...
Gruß
Felix