| shylabutch | 24.11.2013 01:41 |
Oh, danke aharonov, das ging aber sehr schnell!
Zu Schritt 1: die ersten beiden habe ich deinstalliert, beim dritten kam folgende Meldung:
"Bei der Deinstallation von Wsys Control 15.2.12652 ist ein Fehler aufgetreten. Möglicherweise wurde es bereits deinstalliert. Möchten Sie Wsys Control 15.2.12652 aus der Liste der Programme und Funktionen entfernen?"
Um zu sehen, ob so eine Datei noch auf meinem Rechner ist, habe ich dann eine Windows-Suche nach "wsys" gestartet (die ich aber abgebrochen habe, weil es viel zu lange dauerte), während dieser Suche kamen wieder zwei Meldungen von antivir, die ich der Vollständigkeit halber auch poste:
"Die Datei 'C:\Users\Irene\AppData\Local\Temp\fullpackage_temp1385170244\tmp\eGdpSvc.exe' enthielt einen Virus oder unerwünschtes Programm 'TR/Wysotot.Gen' [trojan]. Durchgeführte Aktion(en): Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4d6973d7.qua' verschoben!"
und
"Die Datei 'C:\Users\Irene\AppData\Local\Temp\is1590112554\1021463_stp\uninstaller.exe' enthielt einen Virus oder unerwünschtes Programm 'ADWARE/InstallCore.Gen' [adware]. Durchgeführte Aktion(en): Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '55f35da9.qua' verschoben!"
Und hier dann die logfiles:
AdwCleaner[S1].txt: Code:
# AdwCleaner v3.012 - Bericht erstellt am 23/11/2013 um 21:35:25
# Updated 11/11/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Irene - IRENE-NB
# Gestartet von : C:\Users\Irene\Desktop\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\eSafe
Datei Gelöscht : C:\Windows\System32\Tasks\Desk 365 RunAsStdUser
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\WLXQuickTimeShellExt.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\DeskSvc
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WsysSvc
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_hjsplit_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_hjsplit_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Daten Wiederhergestellt : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command
Schlüssel Gelöscht : HKCU\Software\InstallCore
Schlüssel Gelöscht : HKLM\Software\aartemisSoftware
Schlüssel Gelöscht : HKLM\Software\eSafeSecControl
Schlüssel Gelöscht : HKLM\Software\hdcode
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WsysControl
***** [ Browser ] *****
-\\ Internet Explorer v10.0.9200.16736
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
-\\ Mozilla Firefox v24.0 (de)
[ Datei : C:\Users\Irene\AppData\Roaming\Mozilla\Firefox\Profiles\u69jpjj0.default\prefs.js ]
*************************
AdwCleaner[R0].txt - [2933 octets] - [06/09/2013 22:13:58]
AdwCleaner[R1].txt - [2867 octets] - [10/09/2013 21:12:05]
AdwCleaner[R2].txt - [2925 octets] - [07/10/2013 00:38:24]
AdwCleaner[R3].txt - [5057 octets] - [23/11/2013 21:26:31]
AdwCleaner[S0].txt - [2994 octets] - [06/09/2013 22:23:50]
AdwCleaner[S1].txt - [4041 octets] - [23/11/2013 21:35:25]
########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [4101 octets] ##########
Bei der Ausführung von ComboFix kam zweimal die Meldung, dass antivir aktiviert sei. Nach dem ersten Mal hab ich extra noch mal nachgeschaut, da stand eindeutig "deaktiviert", er behauptete dann aber, es sei immer noch aktiviert, er scanne dann aber trotzdem. Und es kam noch eine Meldung, die ich leider zu schnell weggeklickt habe, dass irgendeine Datei nicht vorhanden sei.
ComboFix.txt: Code:
ComboFix 13-11-23.02 - Irene 23.11.2013 21:55:47.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.3959.2737 [GMT 1:00]
ausgeführt von:: c:\users\Irene\Desktop\ComboFix.exe
AV: Avira Desktop *Enabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Enabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\install.exe
c:\programdata\561
c:\programdata\561\655921.dat
c:\programdata\561\655921.dll
c:\programdata\561\msxx.dat
c:\programdata\561\vvve.dat
c:\programdata\561\wjdj.dat
c:\users\Irene\AppData\Local\Microsoft\Windows\Temporary Internet Files\{409CEB1D-8BB9-41FE-B796-70632B0D9532}.xps
c:\users\Irene\AppData\Local\Microsoft\Windows\Temporary Internet Files\{54CFD7E5-B913-4343-AC44-2E9990524D4E}.xps
c:\users\Irene\AppData\Local\Microsoft\Windows\Temporary Internet Files\{822E50B6-4243-4C9E-8337-A4401590458C}.xps
c:\users\Irene\AppData\Local\Microsoft\Windows\Temporary Internet Files\{83FF754B-6AD1-483D-8286-B086F532DDAF}.xps
c:\windows\SysWow64\FlashPlayerApp.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-10-23 bis 2013-11-23 ))))))))))))))))))))))))))))))
.
.
2013-11-23 21:19 . 2013-11-23 21:19 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-11-23 10:13 . 2013-11-23 10:13 -------- d-----w- C:\FRST
2013-11-23 01:10 . 2013-10-12 08:43 15404544 ----a-w- c:\windows\system32\ieframe.dll
2013-11-23 01:10 . 2013-10-12 08:43 19269632 ----a-w- c:\windows\system32\mshtml.dll
2013-11-23 01:03 . 2013-10-03 02:23 404480 ----a-w- c:\windows\system32\gdi32.dll
2013-11-23 01:03 . 2013-10-03 02:00 311808 ----a-w- c:\windows\SysWow64\gdi32.dll
2013-11-23 01:03 . 2013-10-12 02:30 830464 ----a-w- c:\windows\system32\nshwfp.dll
2013-11-23 01:03 . 2013-10-12 02:29 859648 ----a-w- c:\windows\system32\IKEEXT.DLL
2013-11-23 01:03 . 2013-10-12 02:29 324096 ----a-w- c:\windows\system32\FWPUCLNT.DLL
2013-11-23 01:03 . 2013-10-12 02:03 656896 ----a-w- c:\windows\SysWow64\nshwfp.dll
2013-11-23 01:03 . 2013-10-12 02:01 216576 ----a-w- c:\windows\SysWow64\FWPUCLNT.DLL
2013-10-29 18:56 . 2013-10-29 18:57 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-10-29 18:56 . 2013-10-29 18:57 -------- d-----w- c:\program files\iTunes
2013-10-29 18:56 . 2013-10-29 18:57 -------- d-----w- c:\program files (x86)\iTunes
2013-10-29 18:56 . 2013-10-29 18:56 -------- d-----w- c:\program files\iPod
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-11-23 01:07 . 2010-05-30 11:24 82896128 ----a-w- c:\windows\system32\MRT.exe
2013-09-21 00:49 . 2011-05-25 18:32 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-09-15 15:31 . 2012-12-20 22:02 499712 ----a-w- c:\windows\SysWow64\msvcp71.dll
2013-09-15 15:31 . 2012-12-20 22:02 348160 ----a-w- c:\windows\SysWow64\msvcr71.dll
2013-09-12 21:08 . 2013-09-12 21:08 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-09-12 21:08 . 2013-09-12 21:09 868264 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
2013-09-12 21:08 . 2010-07-01 21:22 790440 ----a-w- c:\windows\SysWow64\deployJava1.dll
2013-09-08 02:30 . 2013-10-08 23:52 1903552 ----a-w- c:\windows\system32\drivers\tcpip.sys
2013-09-08 02:27 . 2013-10-08 23:52 327168 ----a-w- c:\windows\system32\mswsock.dll
2013-09-08 02:03 . 2013-10-08 23:52 231424 ----a-w- c:\windows\SysWow64\mswsock.dll
2013-09-05 21:29 . 2013-05-07 16:17 81112 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2013-09-05 21:29 . 2013-03-27 23:05 132088 ----a-w- c:\windows\system32\drivers\avipbb.sys
2013-09-05 21:29 . 2013-03-27 23:05 105344 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2013-09-04 12:12 . 2013-10-08 23:49 343040 ----a-w- c:\windows\system32\drivers\usbhub.sys
2013-09-04 12:11 . 2013-10-08 23:49 325120 ----a-w- c:\windows\system32\drivers\usbport.sys
2013-09-04 12:11 . 2013-10-08 23:49 99840 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2013-09-04 12:11 . 2013-10-08 23:49 52736 ----a-w- c:\windows\system32\drivers\usbehci.sys
2013-09-04 12:11 . 2013-10-08 23:49 30720 ----a-w- c:\windows\system32\drivers\usbuhci.sys
2013-09-04 12:11 . 2013-10-08 23:49 25600 ----a-w- c:\windows\system32\drivers\usbohci.sys
2013-09-04 12:11 . 2013-10-08 23:49 7808 ----a-w- c:\windows\system32\drivers\usbd.sys
2013-09-02 20:10 . 2013-09-02 20:10 73728 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-09-02 20:10 . 2013-09-02 20:10 719360 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-09-02 20:10 . 2013-09-02 20:10 61952 ----a-w- c:\windows\SysWow64\tdc.ocx
2013-09-02 20:10 . 2013-09-02 20:10 523264 ----a-w- c:\windows\SysWow64\vbscript.dll
2013-09-02 20:10 . 2013-09-02 20:10 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2013-09-02 20:10 . 2013-09-02 20:10 38400 ----a-w- c:\windows\SysWow64\imgutil.dll
2013-09-02 20:10 . 2013-09-02 20:10 361984 ----a-w- c:\windows\SysWow64\html.iec
2013-09-02 20:10 . 2013-09-02 20:10 226304 ----a-w- c:\windows\system32\elshyph.dll
2013-09-02 20:10 . 2013-09-02 20:10 185344 ----a-w- c:\windows\SysWow64\elshyph.dll
2013-09-02 20:10 . 2013-09-02 20:10 158720 ----a-w- c:\windows\SysWow64\msls31.dll
2013-09-02 20:10 . 2013-09-02 20:10 150528 ----a-w- c:\windows\SysWow64\iexpress.exe
2013-09-02 20:10 . 2013-09-02 20:10 138752 ----a-w- c:\windows\SysWow64\wextract.exe
2013-09-02 20:10 . 2013-09-02 20:10 137216 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2013-09-02 20:10 . 2013-09-02 20:10 12800 ----a-w- c:\windows\SysWow64\mshta.exe
2013-09-02 20:10 . 2013-09-02 20:10 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-09-02 20:10 . 2013-09-02 20:10 1054720 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-09-02 20:10 . 2013-09-02 20:10 97280 ----a-w- c:\windows\system32\mshtmled.dll
2013-09-02 20:10 . 2013-09-02 20:10 92160 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-09-02 20:10 . 2013-09-02 20:10 905728 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-09-02 20:10 . 2013-09-02 20:10 81408 ----a-w- c:\windows\system32\icardie.dll
2013-09-02 20:10 . 2013-09-02 20:10 77312 ----a-w- c:\windows\system32\tdc.ocx
2013-09-02 20:10 . 2013-09-02 20:10 762368 ----a-w- c:\windows\system32\ieapfltr.dll
2013-09-02 20:10 . 2013-09-02 20:10 62976 ----a-w- c:\windows\system32\pngfilt.dll
2013-09-02 20:10 . 2013-09-02 20:10 599552 ----a-w- c:\windows\system32\vbscript.dll
2013-09-02 20:10 . 2013-09-02 20:10 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2013-09-02 20:10 . 2013-09-02 20:10 51200 ----a-w- c:\windows\system32\imgutil.dll
2013-09-02 20:10 . 2013-09-02 20:10 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-09-02 20:10 . 2013-09-02 20:10 452096 ----a-w- c:\windows\system32\dxtmsft.dll
2013-09-02 20:10 . 2013-09-02 20:10 441856 ----a-w- c:\windows\system32\html.iec
2013-09-02 20:10 . 2013-09-02 20:10 281600 ----a-w- c:\windows\system32\dxtrans.dll
2013-09-02 20:10 . 2013-09-02 20:10 27648 ----a-w- c:\windows\system32\licmgr10.dll
2013-09-02 20:10 . 2013-09-02 20:10 270848 ----a-w- c:\windows\system32\iedkcs32.dll
2013-09-02 20:10 . 2013-09-02 20:10 247296 ----a-w- c:\windows\system32\webcheck.dll
2013-09-02 20:10 . 2013-09-02 20:10 235008 ----a-w- c:\windows\system32\url.dll
2013-09-02 20:10 . 2013-09-02 20:10 23040 ----a-w- c:\windows\SysWow64\licmgr10.dll
2013-09-02 20:10 . 2013-09-02 20:10 216064 ----a-w- c:\windows\system32\msls31.dll
2013-09-02 20:10 . 2013-09-02 20:10 197120 ----a-w- c:\windows\system32\msrating.dll
2013-09-02 20:10 . 2013-09-02 20:10 173568 ----a-w- c:\windows\system32\ieUnatt.exe
2013-09-02 20:10 . 2013-09-02 20:10 167424 ----a-w- c:\windows\system32\iexpress.exe
2013-09-02 20:10 . 2013-09-02 20:10 1509376 ----a-w- c:\windows\system32\inetcpl.cpl
2013-09-02 20:10 . 2013-09-02 20:10 149504 ----a-w- c:\windows\system32\occache.dll
2013-09-02 20:10 . 2013-09-02 20:10 144896 ----a-w- c:\windows\system32\wextract.exe
2013-09-02 20:10 . 2013-09-02 20:10 1441280 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2013-09-02 20:10 . 2013-09-02 20:10 1400416 ----a-w- c:\windows\system32\ieapfltr.dat
2013-09-02 20:10 . 2013-09-02 20:10 13824 ----a-w- c:\windows\system32\mshta.exe
2013-09-02 20:10 . 2013-09-02 20:10 136192 ----a-w- c:\windows\system32\iepeers.dll
2013-09-02 20:10 . 2013-09-02 20:10 135680 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-09-02 20:10 . 2013-09-02 20:10 12800 ----a-w- c:\windows\system32\msfeedssync.exe
2013-09-02 20:10 . 2013-09-02 20:10 102912 ----a-w- c:\windows\system32\inseng.dll
2013-09-02 20:09 . 2013-09-02 20:09 9728 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-09-02 20:09 . 2013-09-02 20:09 9728 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-09-02 20:09 . 2013-09-02 20:09 5632 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-09-02 20:09 . 2013-09-02 20:09 5632 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-09-02 20:09 . 2013-09-02 20:09 5632 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-09-02 20:09 . 2013-09-02 20:09 5632 ---ha-w- c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-09-02 20:09 . 2013-09-02 20:09 522752 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2013-09-02 20:09 . 2013-09-02 20:09 465920 ----a-w- c:\windows\system32\WMPhoto.dll
2013-09-02 20:09 . 2013-09-02 20:09 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll
2013-09-02 20:09 . 2013-09-02 20:09 4096 ---ha-w- c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2013-09-02 20:09 . 2013-09-02 20:09 364544 ----a-w- c:\windows\SysWow64\XpsGdiConverter.dll
2013-09-02 20:09 . 2013-09-02 20:09 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-09-02 20:09 . 2013-09-02 20:09 3584 ---ha-w- c:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-09-02 20:09 . 2013-09-02 20:09 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll
2013-09-02 20:09 . 2013-09-02 20:09 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-09-02 20:09 . 2013-09-02 20:09 3072 ---ha-w- c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2013-09-02 20:09 . 2013-09-02 20:09 3072 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-09-02 20:09 . 2013-09-02 20:09 2776576 ----a-w- c:\windows\system32\msmpeg2vdec.dll
2013-09-02 20:09 . 2013-09-02 20:09 2560 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-09-02 20:09 . 2013-09-02 20:09 2560 ---ha-w- c:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-09-02 20:09 . 2013-09-02 20:09 2284544 ----a-w- c:\windows\SysWow64\msmpeg2vdec.dll
2013-09-02 20:09 . 2013-09-02 20:09 1682432 ----a-w- c:\windows\system32\XpsPrint.dll
2013-09-02 20:09 . 2013-09-02 20:09 1158144 ----a-w- c:\windows\SysWow64\XpsPrint.dll
2013-09-02 20:09 . 2013-09-02 20:09 10752 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-09-02 20:09 . 2013-09-02 20:09 10752 ---ha-w- c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-09-02 20:09 . 2013-09-02 20:09 648192 ----a-w- c:\windows\system32\d3d10level9.dll
2013-09-02 20:09 . 2013-09-02 20:09 604160 ----a-w- c:\windows\SysWow64\d3d10level9.dll
2013-09-02 20:09 . 2013-09-02 20:09 417792 ----a-w- c:\windows\SysWow64\WMPhoto.dll
2013-09-02 20:09 . 2013-09-02 20:09 3928064 ----a-w- c:\windows\system32\d2d1.dll
2013-09-02 20:09 . 2013-09-02 20:09 363008 ----a-w- c:\windows\system32\dxgi.dll
2013-09-02 20:09 . 2013-09-02 20:09 3419136 ----a-w- c:\windows\SysWow64\d2d1.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2009-12-24 284696]
"BackupManagerTray"="c:\program files (x86)\NewTech Infosystems\Packard Bell MyBackup\BackupManagerTray.exe" [2010-01-13 263936]
"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2010-01-22 1287760]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
"FILSHtray"="c:\program files (x86)\FILSHtray\FILSHtray.exe" [2012-02-06 597504]
"CanonSolutionMenuEx"="c:\program files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE" [2011-08-04 1612920]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-09-05 347192]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888]
"TkBellExe"="c:\program files (x86)\Real\RealPlayer\update\realsched.exe" [2013-09-15 295512]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-10-23 152392]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [x]
R3 HauppaugeTVServer;HauppaugeTVServer;c:\progra~2\WinTV\HCWTVS~1.EXE;c:\progra~2\WinTV\HCWTVS~1.EXE [x]
R3 hcw95bda;Hauppauge MOD7700 Tuner Driver;c:\windows\system32\Drivers\hcw95bda.sys;c:\windows\SYSNATIVE\Drivers\hcw95bda.sys [x]
R3 hcw95rc;Hauppauge MOD7700 IR Driver;c:\windows\system32\DRIVERS\hcw95rc.sys;c:\windows\SYSNATIVE\DRIVERS\hcw95rc.sys [x]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys;c:\windows\SYSNATIVE\DRIVERS\netaapl64.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\System32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TurboBoost;TurboBoost;c:\program files\Intel\TurboBoost\TurboBoost.exe;c:\program files\Intel\TurboBoost\TurboBoost.exe [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S2 AdobeActiveFileMonitor7.0;Adobe Active File Monitor V7;c:\program files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe;c:\program files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 DsiWMIService;Dritek WMI Service;c:\program files (x86)\Launch Manager\dsiwmis.exe;c:\program files (x86)\Launch Manager\dsiwmis.exe [x]
S2 EPGService;EPGService;c:\progra~2\WinTV\EPG Services\System\EPGService.exe;c:\progra~2\WinTV\EPG Services\System\EPGService.exe [x]
S2 ePowerSvc;Acer ePower Service;c:\program files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe;c:\program files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe [x]
S2 Greg_Service;GRegService;c:\program files (x86)\Packard Bell\Registration\GregHSRW.exe;c:\program files (x86)\Packard Bell\Registration\GregHSRW.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Packard Bell MyBackup\IScheduleSvc.exe;c:\program files (x86)\NewTech Infosystems\Packard Bell MyBackup\IScheduleSvc.exe [x]
S2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe;c:\program files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [x]
S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys;c:\windows\SYSNATIVE\DRIVERS\TurboB.sys [x]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S2 Updater Service;Updater Service;c:\program files\Packard Bell\Packard Bell Updater\UpdaterService.exe;c:\program files\Packard Bell\Packard Bell Updater\UpdaterService.exe [x]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys;c:\windows\SYSNATIVE\DRIVERS\HECIx64.sys [x]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys;c:\windows\SYSNATIVE\DRIVERS\Impcd.sys [x]
S3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys;c:\windows\SYSNATIVE\DRIVERS\k57nd60a.sys [x]
S3 rtl8192se;Realtek Wireless LAN 802.11n PCI-E NIC NT Driver;c:\windows\system32\DRIVERS\rtl8192se.sys;c:\windows\SYSNATIVE\DRIVERS\rtl8192se.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2013-11-23 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 00:49]
.
2013-10-13 c:\windows\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-417431293-3989558265-3207654682-1000.job
- c:\program files (x86)\RealNetworks\RealDownloader\recordingmanager.exe [2013-08-14 13:19]
.
2013-10-13 c:\windows\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-417431293-3989558265-3207654682-1000.job
- c:\program files (x86)\Real\RealUpgrade\realupgrade.exe [2013-08-14 15:13]
.
2013-09-03 c:\windows\Tasks\ReclaimerResumeInstall_Irene.job
- c:\users\Irene\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.60\agent\rnupgagent.exe [2013-09-03 22:10]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-01-25 17398376]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-12-29 9913376]
"Acer ePower Management"="c:\program files\Packard Bell\Packard Bell Power Management\ePowerTray.exe" [2010-01-18 832544]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2011-03-15 2779024]
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = https://www.google.de/
uLocal Page = c:\windows\system32\blank.htm
mDefault_Search_URL = hxxp://www.google.com
mDefault_Page_URL = about:blank
mStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Page = hxxp://www.google.com
uInternet Settings,ProxyOverride = *.local
IE: An OneNote s&enden - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1 192.168.2.1
DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - hxxp://cam-01.doldernetwork.ch/activex/AMC.cab
FF - ProfilePath - c:\users\Irene\AppData\Roaming\Mozilla\Firefox\Profiles\u69jpjj0.default\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Notify-homkido - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-Hauppauge WinTV DVB-T EPG Service - c:\windows\System32\UNWISE.EXE
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,db,61,72,57,ca,20,f2,48,94,30,e7,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,db,61,72,57,ca,20,f2,48,94,30,e7,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_175_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_175_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_175_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_175_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_175.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_175.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_175.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_175.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-11-23 22:21:58
ComboFix-quarantined-files.txt 2013-11-23 21:21
.
Vor Suchlauf: 10 Verzeichnis(se), 223.523.479.552 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 224.951.816.192 Bytes frei
.
- - End Of File - - FA5A121284786A6E5A93FE8816017496
FRST Logfile:
FRST Logfile: Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-11-2013
Ran by Irene (administrator) on IRENE-NB on 23-11-2013 23:17:50
Running from C:\Users\Irene\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Hauppauge Computer Works) C:\Program Files (x86)\WinTV\EPG Services\System\EPGService.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe
(Acer Incorporated) C:\Program Files (x86)\Packard Bell\Registration\GregHSRW.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\IScheduleSvc.exe
() C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
(Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
(Acer) C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\BackupManagerTray.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(FILSH Media GmbH) C:\Program Files (x86)\FILSHtray\FILSHtray.exe
(CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerEvent.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [NvCplDaemon] - RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1890088 2009-12-10] (Synaptics Incorporated)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [9913376 2009-12-29] (Realtek Semiconductor)
HKLM\...\Run: [Acer ePower Management] - C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe [832544 2010-01-18] (Acer Incorporated)
HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE [2779024 2011-03-15] (CANON INC.)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2009-12-24] (Intel Corporation)
HKLM-x32\...\Run: [BackupManagerTray] - C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\BackupManagerTray.exe [263936 2010-01-13] (NewTech Infosystems, Inc.)
HKLM-x32\...\Run: [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe [1287760 2010-01-22] (Dritek System Inc.)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [FILSHtray] - C:\Program Files (x86)\FILSHtray\FILSHtray.exe [597504 2012-02-06] (FILSH Media GmbH)
HKLM-x32\...\Run: [CanonSolutionMenuEx] - C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1612920 2011-08-04] (CANON INC.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-05] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [TkBellExe] - C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe [295512 2013-09-15] (RealNetworks, Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-10-23] (Apple Inc.)
HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Packard Bell\Screensaver\run_Packard Bell.exe [162336 2009-07-22] ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll No File
BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
BHO-x32: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
DPF: HKLM-x32 {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx
DPF: HKLM-x32 {DE625294-70E6-45ED-B895-CFFA13AEB044} hxxp://cam-01.doldernetwork.ch/activex/AMC.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Irene\AppData\Roaming\Mozilla\Firefox\Profiles\u69jpjj0.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin-x32: @java.com/DTPlugin,version=10.40.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.40.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @real.com/nppl3260;version=16.0.3.51 - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpchromebrowserrecordext;version=15.0.6.14 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprphtml5videoshim;version=15.0.6.14 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=16.0.3.51 - c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF HKLM-x32\...\Firefox\Extensions: [{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF HKLM-x32\...\Firefox\Extensions: [{DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 EPGService; C:\Program Files (x86)\WinTV\EPG Services\System\EPGService.exe [436224 2008-04-09] (Hauppauge Computer Works)
R2 ePowerSvc; C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe [842784 2010-01-18] (Acer Incorporated)
R2 Greg_Service; C:\Program Files (x86)\Packard Bell\Registration\GregHSRW.exe [1150496 2009-08-28] (Acer Incorporated)
S3 HauppaugeTVServer; C:\Program Files (x86)\WinTV\HCWTVServer.exe [815104 2008-03-31] (Hauppauge Computer Works)
R2 NTI IScheduleSvc; C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\IScheduleSvc.exe [255744 2010-01-07] (NewTech Infosystems, Inc.)
R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-08-14] ()
R2 Updater Service; C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe [240160 2009-07-04] (Acer)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-05] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-09-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-03-28] (Avira Operations GmbH & Co. KG)
S3 hcw95bda; C:\Windows\System32\Drivers\hcw95bda.sys [919552 2008-04-17] (Hauppauge Computer Works, Inc.)
S3 hcw95rc; C:\Windows\System32\DRIVERS\hcw95rc.sys [47232 2008-04-17] (Hauppauge Computer Works, Inc.)
R2 TurboB; C:\Windows\System32\DRIVERS\TurboB.sys [13784 2009-11-02] ()
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-11-23 23:17 - 2013-11-23 23:17 - 00015484 _____ C:\Users\Irene\Desktop\FRST.txt
2013-11-23 23:12 - 2013-11-23 23:12 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-11-23 23:03 - 2013-11-23 22:21 - 00027160 _____ C:\Users\Irene\Desktop\ComboFix.txt
2013-11-23 22:21 - 2013-11-23 22:21 - 00027160 _____ C:\ComboFix.txt
2013-11-23 21:53 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2013-11-23 21:53 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2013-11-23 21:53 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-11-23 21:53 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-11-23 21:53 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-11-23 21:53 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2013-11-23 21:53 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2013-11-23 21:53 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2013-11-23 21:52 - 2013-11-23 22:22 - 00000000 ____D C:\Qoobox
2013-11-23 21:52 - 2013-11-23 22:20 - 00000000 ____D C:\Windows\erdnt
2013-11-23 21:45 - 2013-11-23 21:46 - 05149261 ____R (Swearware) C:\Users\Irene\Desktop\ComboFix.exe
2013-11-23 21:40 - 2013-11-23 21:40 - 00004201 _____ C:\Users\Irene\Desktop\AdwCleaner[S1].txt
2013-11-23 21:23 - 2013-11-23 21:23 - 01085542 _____ C:\Users\Irene\Desktop\adwcleaner.exe
2013-11-23 12:46 - 2013-11-23 12:46 - 00016588 _____ C:\Users\Irene\Desktop\quarantaene.txt
2013-11-23 12:10 - 2013-11-23 12:10 - 00001376 _____ C:\Users\Irene\Desktop\Gmer.txt
2013-11-23 11:57 - 2013-11-23 11:57 - 00377856 _____ C:\Users\Irene\Desktop\gmer_2.1.19163.exe
2013-11-23 11:16 - 2013-11-23 11:17 - 00024260 _____ C:\Users\Irene\Desktop\Addition1.txt
2013-11-23 11:14 - 2013-11-23 11:17 - 00032881 _____ C:\Users\Irene\Desktop\FRST1.txt
2013-11-23 11:13 - 2013-11-23 11:13 - 00000000 ____D C:\FRST
2013-11-23 11:07 - 2013-11-23 11:07 - 01957916 _____ (Farbar) C:\Users\Irene\Desktop\FRST64.exe
2013-11-23 11:04 - 2013-11-23 11:04 - 00000472 _____ C:\Users\Irene\Desktop\defogger_disable.log
2013-11-23 11:04 - 2013-11-23 11:04 - 00000000 _____ C:\Users\Irene\defogger_reenable
2013-11-23 11:03 - 2013-11-23 11:03 - 00050477 _____ C:\Users\Irene\Desktop\Defogger.exe
2013-11-23 11:00 - 2013-11-23 11:00 - 00050477 _____ C:\Users\Irene\Downloads\Defogger.exe
2013-11-23 02:21 - 2013-11-23 02:20 - 00680560 _____ C:\Users\Irene\Desktop\ZipExtractorSetup.exe
2013-11-23 02:20 - 2013-11-23 02:20 - 00680560 _____ C:\Users\Irene\Downloads\ZipExtractorSetup.exe
2013-11-23 02:11 - 2013-10-12 09:45 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-23 02:11 - 2013-10-12 09:45 - 01364992 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-23 02:11 - 2013-10-12 09:45 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-23 02:11 - 2013-10-12 09:43 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-23 02:11 - 2013-10-12 09:43 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-23 02:11 - 2013-10-12 09:43 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-23 02:11 - 2013-10-12 09:43 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-23 02:11 - 2013-10-12 09:43 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-23 02:11 - 2013-10-12 09:43 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-23 02:11 - 2013-10-12 09:43 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-23 02:11 - 2013-10-12 09:43 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-23 02:11 - 2013-10-12 09:43 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-23 02:11 - 2013-10-12 08:03 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-23 02:11 - 2013-10-12 08:03 - 01138176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-11-23 02:11 - 2013-10-12 08:02 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-23 02:11 - 2013-10-12 08:02 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-23 02:11 - 2013-10-12 08:02 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-11-23 02:11 - 2013-10-12 08:02 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-11-23 02:11 - 2013-10-12 08:02 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-11-23 02:11 - 2013-10-12 08:02 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-11-23 02:11 - 2013-10-12 08:02 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-11-23 02:11 - 2013-10-12 08:02 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-11-23 02:11 - 2013-10-12 08:02 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-11-23 02:11 - 2013-10-12 07:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-23 02:11 - 2013-10-12 07:08 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-11-23 02:11 - 2013-10-12 06:44 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-23 02:11 - 2013-10-12 06:15 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-11-23 02:10 - 2013-10-12 09:43 - 19269632 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-23 02:10 - 2013-10-12 09:43 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-23 02:10 - 2013-10-12 08:02 - 14355968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-23 02:10 - 2013-10-12 08:02 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-23 02:04 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-11-23 02:04 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-11-23 02:04 - 2013-10-04 03:28 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll
2013-11-23 02:04 - 2013-10-04 03:25 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll
2013-11-23 02:04 - 2013-10-04 03:24 - 01930752 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2013-11-23 02:04 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SmartcardCredentialProvider.dll
2013-11-23 02:04 - 2013-10-04 02:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2013-11-23 02:04 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credui.dll
2013-11-23 02:04 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-11-23 02:04 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-11-23 02:04 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2013-11-23 02:04 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2013-11-23 02:04 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2013-11-23 02:04 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2013-11-23 02:04 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-11-23 02:04 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-11-23 02:04 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2013-11-23 02:04 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2013-11-23 02:04 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-11-23 02:04 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2013-11-23 02:04 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2013-11-23 02:04 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2013-11-23 02:04 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-11-23 02:03 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2013-11-23 02:03 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2013-11-23 02:03 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2013-11-23 02:03 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2013-11-23 02:03 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2013-11-23 02:03 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2013-11-23 02:03 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2013-10-29 19:57 - 2013-10-29 19:57 - 00001755 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-10-29 19:56 - 2013-10-29 19:57 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-10-29 19:56 - 2013-10-29 19:57 - 00000000 ____D C:\Program Files\iTunes
2013-10-29 19:56 - 2013-10-29 19:57 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-10-29 19:56 - 2013-10-29 19:56 - 00000000 ____D C:\Program Files\iPod
==================== One Month Modified Files and Folders =======
2013-11-23 23:18 - 2013-11-23 23:17 - 00015484 _____ C:\Users\Irene\Desktop\FRST.txt
2013-11-23 23:18 - 2009-07-14 05:45 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-23 23:18 - 2009-07-14 05:45 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-23 23:14 - 2010-03-17 07:13 - 01134863 _____ C:\Windows\WindowsUpdate.log
2013-11-23 23:13 - 2010-03-17 16:03 - 00654400 _____ C:\Windows\system32\perfh007.dat
2013-11-23 23:13 - 2010-03-17 16:03 - 00130240 _____ C:\Windows\system32\perfc007.dat
2013-11-23 23:13 - 2009-07-14 06:13 - 01498742 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-23 23:12 - 2013-11-23 23:12 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-11-23 23:12 - 2012-04-02 21:02 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-11-23 23:12 - 2012-04-02 21:02 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-23 23:12 - 2011-05-25 19:32 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-11-23 23:10 - 2012-12-29 02:17 - 00003362 _____ C:\Windows\System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-417431293-3989558265-3207654682-1000
2013-11-23 23:10 - 2012-12-29 02:17 - 00003228 _____ C:\Windows\System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-417431293-3989558265-3207654682-1000
2013-11-23 23:09 - 2010-01-29 22:37 - 00332092 _____ C:\Windows\PFRO.log
2013-11-23 23:09 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-23 23:09 - 2009-07-14 05:51 - 00166637 _____ C:\Windows\setupact.log
2013-11-23 22:22 - 2013-11-23 21:52 - 00000000 ____D C:\Qoobox
2013-11-23 22:22 - 2009-07-14 04:20 - 00000000 __RHD C:\Users\Default
2013-11-23 22:21 - 2013-11-23 23:03 - 00027160 _____ C:\Users\Irene\Desktop\ComboFix.txt
2013-11-23 22:21 - 2013-11-23 22:21 - 00027160 _____ C:\ComboFix.txt
2013-11-23 22:20 - 2013-11-23 21:52 - 00000000 ____D C:\Windows\erdnt
2013-11-23 22:19 - 2009-07-14 03:34 - 00000215 _____ C:\Windows\system.ini
2013-11-23 21:46 - 2013-11-23 21:45 - 05149261 ____R (Swearware) C:\Users\Irene\Desktop\ComboFix.exe
2013-11-23 21:40 - 2013-11-23 21:40 - 00004201 _____ C:\Users\Irene\Desktop\AdwCleaner[S1].txt
2013-11-23 21:35 - 2013-09-06 22:13 - 00000000 ____D C:\AdwCleaner
2013-11-23 21:23 - 2013-11-23 21:23 - 01085542 _____ C:\Users\Irene\Desktop\adwcleaner.exe
2013-11-23 17:20 - 2013-09-22 14:12 - 00001119 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-11-23 17:20 - 2010-05-22 17:18 - 00001313 _____ C:\Users\Irene\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-11-23 12:46 - 2013-11-23 12:46 - 00016588 _____ C:\Users\Irene\Desktop\quarantaene.txt
2013-11-23 12:10 - 2013-11-23 12:10 - 00001376 _____ C:\Users\Irene\Desktop\Gmer.txt
2013-11-23 11:57 - 2013-11-23 11:57 - 00377856 _____ C:\Users\Irene\Desktop\gmer_2.1.19163.exe
2013-11-23 11:19 - 2013-09-08 10:43 - 00000000 ____D C:\Users\Irene\Internet-Einstellungen
2013-11-23 11:17 - 2013-11-23 11:16 - 00024260 _____ C:\Users\Irene\Desktop\Addition1.txt
2013-11-23 11:17 - 2013-11-23 11:14 - 00032881 _____ C:\Users\Irene\Desktop\FRST1.txt
2013-11-23 11:13 - 2013-11-23 11:13 - 00000000 ____D C:\FRST
2013-11-23 11:07 - 2013-11-23 11:07 - 01957916 _____ (Farbar) C:\Users\Irene\Desktop\FRST64.exe
2013-11-23 11:04 - 2013-11-23 11:04 - 00000472 _____ C:\Users\Irene\Desktop\defogger_disable.log
2013-11-23 11:04 - 2013-11-23 11:04 - 00000000 _____ C:\Users\Irene\defogger_reenable
2013-11-23 11:04 - 2010-05-22 17:16 - 00000000 ____D C:\Users\Irene
2013-11-23 11:03 - 2013-11-23 11:03 - 00050477 _____ C:\Users\Irene\Desktop\Defogger.exe
2013-11-23 11:00 - 2013-11-23 11:00 - 00050477 _____ C:\Users\Irene\Downloads\Defogger.exe
2013-11-23 02:20 - 2013-11-23 02:21 - 00680560 _____ C:\Users\Irene\Desktop\ZipExtractorSetup.exe
2013-11-23 02:20 - 2013-11-23 02:20 - 00680560 _____ C:\Users\Irene\Downloads\ZipExtractorSetup.exe
2013-11-23 02:11 - 2010-01-29 22:17 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-11-23 02:09 - 2013-07-12 07:23 - 00000000 ____D C:\Windows\system32\MRT
2013-11-23 02:07 - 2010-05-30 12:24 - 82896128 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-11-11 22:56 - 2010-06-15 22:06 - 00000000 ____D C:\Users\Irene\SPD
2013-10-29 19:57 - 2013-10-29 19:57 - 00001755 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-10-29 19:57 - 2013-10-29 19:56 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-10-29 19:57 - 2013-10-29 19:56 - 00000000 ____D C:\Program Files\iTunes
2013-10-29 19:57 - 2013-10-29 19:56 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-10-29 19:56 - 2013-10-29 19:56 - 00000000 ____D C:\Program Files\iPod
Files to move or delete:
====================
C:\Users\Irene\hjsplit.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-11-23 22:54
==================== End Of Log ============================
--- --- ---
--- --- --- |
AdwCleaner auf deinen Desktop.
Aktualität von System und Software