Trojaner-Board - Doppelunterstreichungen bei Firefox und Google Chrome

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Doppelunterstreichungen bei Firefox und Google Chrome (https://www.trojaner-board.de/145955-doppelunterstreichungen-firefox-google-chrome.html)

Doppelunterstreichungen bei Firefox und Google Chrome

Hallo.
Seit 2 Tagen erscheinen beim Aufruf von Firefox und Google Chrome doppelt unterstrichene grüne Wörter mit Werbeeinblendungen usw. Da dieses Problem schon in tb beschrieben wurde, habe ich entsprechend der Antwort von Michael (ich hoffe, dass ich mir den Namen richtig gemerkt habe) Farbar Recovery Scan Tool heruntergeladen und durchlaufen lassen. Die Dateien FRST.txt und Addition.txt füge ich bei.

Ich bin kein IT-Spezialist, kenne aber die grundsätzlichen Möglichkeiten und hoffe daher, dass ich den Erklärungen folgen kann. Schon jetzt vielen Dank!

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-12-2013

Ran by Lokaladmin (administrator) on PCWG1300 on 11-12-2013 23:45:56

Running from C:\Users\Lokaladmin\AppData\Local\Downloads

Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 11

Boot Mode: Normal
 

==================== Processes (Whitelisted) =================
 

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE

(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe

(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe

(Gladinet, INC) C:\Program Files (x86)\Nuance\Nuance Cloud Connector\GladFileMonSvc.exe

(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe

() C:\Program Files (x86)\Nuance\Nuance Cloud Connector\WOSVSSSvr.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\HelperService.exe

(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\ConversionService.exe

(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PDF Professional 8\PDFProFiltSrv.exe

(Samsung Electronics Co., Ltd.) C:\Windows\System32\spool\drivers\x64\3\NetFaxServer64.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe

(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\Remote Management System\ManagementAgentNT.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\Remote Management System\RouterNT.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe

(Uwe Sieber - www.uwe-sieber.de) C:\Program Files\USBDLM\USBDLM.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

() C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe

(Ulead Systems, Inc.) C:\Program Files (x86)\Ulead Systems\Ulead PhotoImpact 6\ABMTSR.EXE

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe

(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\concentr.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe

(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\OmniPage18\omnipage.exe

(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe

(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PDF Professional 8\PdfPro8Hook.exe

(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe

(Uwe Sieber - www.uwe-sieber.de) C:\Program Files\USBDLM\USBDLM_usr.exe

(Nico Mak Computing) C:\Program Files (x86)\WinZip Malware Protector\WinZipMalwareProtector.exe

(Gladinet, INC) C:\Program Files (x86)\Nuance\Nuance Cloud Connector\GladinetClient.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13192848 2012-08-30] (Realtek Semiconductor)

HKLM\...\Run: [HotKeysCmds] - C:\windows\system32\hkcmd.exe [ ] ()

HKLM\...\Run: [CDAServer] - C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe [456704 2012-02-20] ()

HKLM\...\Run: [CanonSolutionMenu] - C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.EXE [689488 2008-03-11] (CANON INC.)

Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)

HKLM\...\Policies\Explorer: [NoWelcomeScreen] 1

HKCU\...\Policies\Explorer: [NoDesktopCleanupWizard] 1

MountPoints2: {4ec55f1e-cdb0-11e2-8897-10604b852c3e} - F:\LaunchU3.exe -a

HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [290688 2012-10-24] (Intel Corporation)

HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-11-29] (Intel Corporation)

HKLM-x32\...\Run: [ConnectionCenter] - C:\Program Files (x86)\Citrix\ICA Client\concentr.exe [309184 2012-03-28] (Citrix Systems, Inc.)

HKLM-x32\...\Run: [Sophos AutoUpdate Monitor] - C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe [929272 2013-02-13] (Sophos Limited)

HKLM-x32\...\Run: [OmniPage Preload] - C:\Program Files (x86)\Nuance\OmniPage18\omnipage.exe [1467240 2011-07-13] (Nuance Communications, Inc.)

HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [162856 2013-07-22] (Geek Software GmbH)

HKLM-x32\...\Run: [PDF8 Registry Controller] - C:\Program Files (x86)\Nuance\PDF Professional 8\RegistryController.exe [178576 2012-10-23] (Nuance Communications, Inc.)

HKLM-x32\...\Run: [PDFProHook] - C:\Program Files (x86)\Nuance\PDF Professional 8\PdfPro8Hook.exe [2013072 2012-10-23] (Nuance Communications, Inc.)

HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] - C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [707984 2013-10-10] (Cisco Systems, Inc.)

HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

HKLM-x32\...\Run: [mobilegeni daemon] - C:\Program Files (x86)\Mobogenie\DaemonProcess.exe

AppInit_DLLs: C:\Program Files (x86)\Sophos\Sophos Anti-Virus\sophos_detoured_x64.dll [217672 2013-10-21] (Sophos Limited)

AppInit_DLLs-x32: c:\progra~2\sophos\sophos~1\sophos~1.dll [275352 2013-10-21] (Sophos Limited)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.lmu.de/

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x6D65629BD7C3CD01

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE

StartMenuInternet: IEXPLORE.EXE - c:\program files (x86)\internet explorer\iexplore.exe

BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GmbH)

BHO-x32: PlusIEEventHelper Class - {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - C:\Program Files (x86)\Nuance\PDF Professional 8\bin\PlusIEContextMenu.dll (Zeon Corporation)

BHO-x32: SwissAcademic.Citavi.Picker.IEPicker - {609D670F-B735-4da7-AC6D-F3BD358E325E} - C:\Windows\\SysWOW64\mscoree.dll (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Show-Password - {8ce16b24-784d-4da6-9986-866250aa8596} - C:\Program Files (x86)\Show-Password\136.dll ()

BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: ZeonIEEventHelper Class - {C7DA0384-42AA-428c-B832-88AC343DE1A8} - C:\Program Files (x86)\Nuance\PDF Professional 8\bin\gzeoniefavclient.dll (Zeon Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM-x32 - Nuance PDF - {BCCE15AE-AC7E-4bc9-94AF-2A714A412BCB} - C:\Program Files (x86)\Nuance\PDF Professional 8\bin\gzeoniefavclient.dll (Zeon Corporation)

Toolbar: HKLM-x32 - PDF Architect Toolbar - {25A3A431-30BB-47C8-AD6A-E1063801134F} - C:\Program Files (x86)\PDF Architect\PDFIEPlugin.dll (pdfforge GmbH)

DPF: HKLM-x32 {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: HKLM-x32 {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} hxxp://h20614.www2.hp.com/ediags/gmd/Install/Cab/hpdetect119b.cab

DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter-x32: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Winsock: Catalog9 01 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)

Winsock: Catalog9 02 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)

Winsock: Catalog9 03 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)

Winsock: Catalog9 04 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)

Winsock: Catalog9 05 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)

Winsock: Catalog9 06 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)

Winsock: Catalog9 07 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)

Winsock: Catalog9 08 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)

Winsock: Catalog9 19 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)

Winsock: Catalog9-x64 01 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)

Winsock: Catalog9-x64 02 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)

Winsock: Catalog9-x64 03 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)

Winsock: Catalog9-x64 04 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)

Winsock: Catalog9-x64 05 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)

Winsock: Catalog9-x64 06 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)

Winsock: Catalog9-x64 07 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)

Winsock: Catalog9-x64 08 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)

Winsock: Catalog9-x64 19 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
 

FireFox:

========

FF ProfilePath: C:\Users\Lokaladmin\AppData\Roaming\Mozilla\Firefox\Profiles\gg6wiobf.default

FF user.js: detected! => C:\Users\Lokaladmin\AppData\Roaming\Mozilla\Firefox\Profiles\gg6wiobf.default\user.js

FF Homepage: hxxp://www.google.de/

FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()

FF Plugin: @microsoft.com/GENUINE - C:\windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()

FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\windows\SysWOW64\Adobe\Director\np32dsw_1200112.dll (Adobe Systems, Inc.)

FF Plugin-x32: @caminova.com/DjVuPlugin - C:\Program Files (x86)\Caminova\Document Express DjVu Plug-in\npdjvu.dll (Caminova, Inc.)

FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/GENUINE - C:\windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @videolan.org/vlc,version=2.0.4 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: @videolan.org/vlc,version=2.0.8 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: @videolan.org/vlc,version=2.1.1 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin-x32: ZEON/PDF,version=2.0 - C:\Program Files (x86)\Nuance\PDF Professional 8\bin\nppdf.dll (Zeon Corporation)

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: Tube Dimmer - C:\Users\Lokaladmin\AppData\Roaming\Mozilla\Firefox\Profiles\gg6wiobf.default\Extensions\support@tubedimmerapp.com

FF Extension: WOT - C:\Users\Lokaladmin\AppData\Roaming\Mozilla\Firefox\Profiles\gg6wiobf.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}

FF Extension: DownloadHelper - C:\Users\Lokaladmin\AppData\Roaming\Mozilla\Firefox\Profiles\gg6wiobf.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}

FF Extension: nuance - C:\Users\Lokaladmin\AppData\Roaming\Mozilla\Firefox\Profiles\gg6wiobf.default\Extensions\nuance@pdf8

FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox

FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox

FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt

FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt

FF HKCU\...\Firefox\Extensions: [{da6d9f64-0bec-427b-a62d-6f6f6ce72768}] - C:\Program Files (x86)\Show-Password\136.xpi

FF Extension: No Name - C:\Program Files (x86)\Show-Password\136.xpi
 

Chrome: 

=======

CHR HomePage: 

CHR RestoreOnStartup: "hxxp://www.google.de/"

CHR DefaultSearchKeyword: google.de

CHR DefaultSearchProvider: Google

CHR DefaultSearchURL: {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:bookmarkBarPinned}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}

CHR DefaultNewTabURL: {google:baseURL}_/chrome/newtab?{google:RLZ}{google:instantExtendedEnabledParameter}{google:ntpIsThemedParameter}ie={inputEncoding}

CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\PepperFlash\pepflashplayer.dll ()

CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\pdf.dll ()

CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll No File

CHR Plugin: (Java(TM) Platform SE 7 U9) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

CHR Plugin: (Java Deployment Toolkit 7.0.90.5) - C:\Windows\SysWOW64\npDeployJava1.dll No File

CHR Extension: (Google Drive) - C:\Users\Lokaladmin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0

CHR Extension: (YouTube) - C:\Users\Lokaladmin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0

CHR Extension: (Google Search) - C:\Users\Lokaladmin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0

CHR Extension: (Show-Password) - C:\Users\Lokaladmin\AppData\Local\Google\Chrome\User Data\Default\Extensions\logekkkdbdidmmcgkonmmonclldogceg\1.136_0

CHR Extension: (Google Wallet) - C:\Users\Lokaladmin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0

CHR Extension: (Gmail) - C:\Users\Lokaladmin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0

CHR HKLM-x32\...\Chrome\Extension: [logekkkdbdidmmcgkonmmonclldogceg] - C:\Program Files (x86)\Show-Password\136.crx

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
 

==================== Services (Whitelisted) =================
 

R2 GladFileMonSvc; C:\Program Files (x86)\Nuance\Nuance Cloud Connector\GladFileMonSvc.exe [29592 2012-09-24] (Gladinet, INC)

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)

R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)

R2 PDFProFiltSrv; C:\Program Files (x86)\Nuance\PDF Professional 8\PDFProFiltSrv.exe [135056 2012-10-23] (Nuance Communications, Inc.)

R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [201360 2012-08-31] (Realtek Semiconductor)

R2 Samsung Network Fax Server; C:\windows\system32\spool\drivers\x64\3\NetFaxServer64.exe [239616 2012-08-07] (Samsung Electronics Co., Ltd.)

R2 SAVAdminService; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe [290296 2013-10-21] (Sophos Limited)

R2 SAVService; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe [206328 2013-10-21] (Sophos Limited)

S3 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1328736 2012-09-24] (Secunia)

R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [656480 2012-09-24] (Secunia)

R2 Sophos Agent; C:\Program Files (x86)\Sophos\Remote Management System\ManagementAgentNT.exe [289856 2013-02-01] (Sophos Limited)

R2 Sophos AutoUpdate Service; C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe [237048 2013-02-13] (Sophos Limited)

R2 Sophos Message Router; C:\Program Files (x86)\Sophos\Remote Management System\RouterNT.exe [818240 2013-02-01] (Sophos Limited)

R2 Sophos Web Control Service; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe [357400 2013-02-01] (Sophos Limited)

R2 swi_service; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe [3109880 2013-10-21] (Sophos Limited)

S2 swi_update_64; C:\ProgramData\Sophos\Web Intelligence\swi_update_64.exe [2012152 2013-10-21] (Sophos Limited)

R2 USBDLM; C:\Program Files\USBDLM\USBDLM.exe [451560 2012-09-09] (Uwe Sieber - www.uwe-sieber.de)

S3 uvnc_service; C:\Program Files (x86)\UltraVNC\WinVNC.exe [2015968 2012-02-14] (UltraVNC)
 

==================== Drivers (Whitelisted) ====================
 

R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)

R1 SAVOnAccess; C:\Windows\System32\DRIVERS\savonaccess.sys [154952 2013-02-01] (Sophos Limited)

S3 sdcfilter; C:\Windows\System32\DRIVERS\sdcfilter.sys [36640 2013-02-01] (Sophos Limited)

S4 SophosBootDriver; C:\Windows\System32\DRIVERS\SophosBootDriver.sys [25608 2013-02-01] (Sophos Plc)

R3 SRS_PremiumSound_Service; C:\Windows\System32\drivers\srs_PremiumSound_amd64.sys [513312 2011-07-18] ()

S3 vpnva; C:\Windows\System32\DRIVERS\vpnva64-6.sys [52080 2013-10-10] (Cisco Systems, Inc.)
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-12-11 23:45 - 2013-12-11 23:45 - 00000000 ____D C:\FRST

2013-12-10 18:26 - 2013-12-10 18:26 - 00001115 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-12-10 18:26 - 2013-12-10 18:26 - 00000000 ____D C:\Users\Lokaladmin\AppData\Roaming\Malwarebytes

2013-12-10 18:26 - 2013-12-10 18:26 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-12-10 18:26 - 2013-12-10 18:26 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-12-10 18:26 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys

2013-12-09 23:35 - 2013-12-11 22:53 - 00003116 _____ C:\windows\System32\Tasks\WinZip Malware Protector_startup

2013-12-09 23:35 - 2013-12-11 07:24 - 00000000 ____D C:\Program Files (x86)\WinZip Malware Protector

2013-12-09 23:35 - 2013-12-09 23:35 - 00001195 _____ C:\Users\Public\Desktop\WinZip Malware Protector.lnk

2013-12-09 23:35 - 2013-12-09 23:35 - 00000000 ____D C:\Users\Lokaladmin\AppData\Roaming\Nico Mak Computing

2013-12-09 23:35 - 2013-12-09 23:35 - 00000000 ____D C:\ProgramData\Nico Mak Computing

2013-12-09 23:35 - 2013-03-15 17:10 - 00020480 _____ C:\windows\system32\wsusnative64.exe

2013-12-09 16:32 - 2013-12-10 18:46 - 00000000 ____D C:\ProgramData\Updater

2013-12-09 16:32 - 2013-12-10 18:46 - 00000000 ____D C:\ProgramData\RHelpers

2013-12-09 16:32 - 2013-12-09 16:32 - 00000000 ____D C:\Users\Lokaladmin\Documents\StreamTransport

2013-12-09 16:31 - 2013-12-11 22:52 - 00000414 _____ C:\windows\Tasks\Show-Password Update.job

2013-12-09 16:31 - 2013-12-09 23:15 - 00000000 ____D C:\Program Files (x86)\Mobogenie

2013-12-09 16:31 - 2013-12-09 21:52 - 00000000 ____D C:\Users\Lokaladmin\AppData\Local\Mobogenie

2013-12-09 16:31 - 2013-12-09 16:46 - 00000340 _____ C:\Users\Lokaladmin\daemonprocess.txt

2013-12-09 16:31 - 2013-12-09 16:31 - 00003072 _____ C:\windows\System32\Tasks\Show-Password Update

2013-12-09 16:31 - 2013-12-09 16:31 - 00000000 ____D C:\Users\Lokaladmin\Documents\Mobogenie

2013-12-09 16:31 - 2013-12-09 16:31 - 00000000 ____D C:\Users\Lokaladmin\AppData\Local\cache

2013-12-09 16:31 - 2013-12-09 16:31 - 00000000 ____D C:\Program Files (x86)\Show-Password

2013-12-09 10:18 - 2013-10-14 18:00 - 00028368 _____ (Microsoft Corporation) C:\windows\system32\IEUDINIT.EXE

2013-12-09 10:16 - 2013-12-09 10:16 - 23212032 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 17142784 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 12995584 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 11220992 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 05765120 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 04240384 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 02764288 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb

2013-12-09 10:16 - 2013-12-09 10:16 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb

2013-12-09 10:16 - 2013-12-09 10:16 - 02332160 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 02166272 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 01993728 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl

2013-12-09 10:16 - 2013-12-09 10:16 - 01926656 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl

2013-12-09 10:16 - 2013-12-09 10:16 - 01818112 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 01394176 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 01228800 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 01156608 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 01051136 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00942592 _____ (Microsoft Corporation) C:\windows\system32\jsIntl.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00940032 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00817664 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00774144 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00708608 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00703488 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00645120 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsIntl.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00626176 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00616104 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dat

2013-12-09 10:16 - 2013-12-09 10:16 - 00616104 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dat

2013-12-09 10:16 - 2013-12-09 10:16 - 00610304 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00574976 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00553472 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00548352 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00523776 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00454656 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00453120 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00440832 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00413696 _____ (Microsoft Corporation) C:\windows\system32\html.iec

2013-12-09 10:16 - 2013-12-09 10:16 - 00367104 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00337408 _____ (Microsoft Corporation) C:\windows\SysWOW64\html.iec

2013-12-09 10:16 - 2013-12-09 10:16 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00263376 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00247808 _____ (Microsoft Corporation) C:\windows\system32\msls31.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00244736 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00243200 _____ (Microsoft Corporation) C:\windows\system32\webcheck.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00238288 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00235520 _____ (Microsoft Corporation) C:\windows\system32\url.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00235008 _____ (Microsoft Corporation) C:\windows\system32\elshyph.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00233472 _____ (Microsoft Corporation) C:\windows\SysWOW64\url.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00218624 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00208384 _____ (Microsoft Corporation) C:\windows\SysWOW64\webcheck.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00195584 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00194048 _____ (Microsoft Corporation) C:\windows\SysWOW64\elshyph.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00182272 _____ (Microsoft Corporation) C:\windows\SysWOW64\msls31.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00167424 _____ (Microsoft Corporation) C:\windows\system32\iexpress.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00164864 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00151552 _____ (Microsoft Corporation) C:\windows\SysWOW64\iexpress.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00147968 _____ (Microsoft Corporation) C:\windows\system32\occache.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00143872 _____ (Microsoft Corporation) C:\windows\system32\wextract.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00139264 _____ (Microsoft Corporation) C:\windows\SysWOW64\wextract.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00139264 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00135680 _____ (Microsoft Corporation) C:\windows\system32\iepeers.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00131072 _____ (Microsoft Corporation) C:\windows\system32\IEAdvpack.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00127488 _____ (Microsoft Corporation) C:\windows\SysWOW64\occache.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00116736 _____ (Microsoft Corporation) C:\windows\SysWOW64\iepeers.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00112128 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00111616 _____ (Microsoft Corporation) C:\windows\SysWOW64\IEAdvpack.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00111616 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00105984 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00101376 _____ (Microsoft Corporation) C:\windows\system32\inseng.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00090112 _____ (Microsoft Corporation) C:\windows\system32\SetIEInstalledDate.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00086016 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00086016 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00084992 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00083968 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00083456 _____ (Microsoft Corporation) C:\windows\SysWOW64\inseng.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00081408 _____ (Microsoft Corporation) C:\windows\system32\icardie.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00077312 _____ (Microsoft Corporation) C:\windows\system32\tdc.ocx

2013-12-09 10:16 - 2013-12-09 10:16 - 00074240 _____ (Microsoft Corporation) C:\windows\SysWOW64\SetIEInstalledDate.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00069632 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00069120 _____ (Microsoft Corporation) C:\windows\SysWOW64\icardie.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00066048 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\tdc.ocx

2013-12-09 10:16 - 2013-12-09 10:16 - 00062464 _____ (Microsoft Corporation) C:\windows\system32\pngfilt.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00056832 _____ (Microsoft Corporation) C:\windows\SysWOW64\pngfilt.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00052224 _____ (Microsoft Corporation) C:\windows\system32\msfeedsbs.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00051200 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00048640 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmler.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\mshtmler.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00048128 _____ (Microsoft Corporation) C:\windows\system32\imgutil.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeedsbs.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00040448 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00036352 _____ (Microsoft Corporation) C:\windows\SysWOW64\imgutil.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00034816 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00033792 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00032768 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00030208 _____ (Microsoft Corporation) C:\windows\system32\licmgr10.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00024576 _____ (Microsoft Corporation) C:\windows\SysWOW64\licmgr10.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00013824 _____ (Microsoft Corporation) C:\windows\system32\mshta.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00013312 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshta.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00013312 _____ (Microsoft Corporation) C:\windows\system32\msfeedssync.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00012800 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeedssync.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll

2013-12-09 10:15 - 2013-12-09 10:18 - 00009768 _____ C:\windows\IE11_main.log

2013-12-09 10:07 - 2013-12-09 10:07 - 00264616 _____ (Oracle Corporation) C:\windows\SysWOW64\javaws.exe

2013-12-09 10:07 - 2013-12-09 10:07 - 00175016 _____ (Oracle Corporation) C:\windows\SysWOW64\javaw.exe

2013-12-09 10:07 - 2013-12-09 10:07 - 00174504 _____ (Oracle Corporation) C:\windows\SysWOW64\java.exe

2013-12-09 10:07 - 2013-12-09 10:07 - 00096168 _____ (Oracle Corporation) C:\windows\SysWOW64\WindowsAccessBridge-32.dll

2013-12-09 10:07 - 2013-12-09 10:07 - 00000000 ____D C:\ProgramData\Oracle

2013-12-09 10:07 - 2013-12-09 10:07 - 00000000 ____D C:\Program Files (x86)\Java

2013-12-09 09:44 - 2013-12-09 09:44 - 00002195 _____ C:\Users\Public\Desktop\WinZip.lnk

2013-12-09 09:44 - 2013-12-09 09:44 - 00000000 ____D C:\Users\Lokaladmin\AppData\Local\WinZip

2013-12-09 09:44 - 2013-12-09 09:44 - 00000000 ____D C:\ProgramData\WinZip

2013-12-09 09:44 - 2013-12-09 09:44 - 00000000 ____D C:\Program Files\WinZip

2013-12-01 11:38 - 2013-12-01 11:38 - 00000000 _____ C:\windows\system32\vireng.log

2013-11-19 12:48 - 2013-11-19 12:48 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2013-11-18 16:33 - 2013-10-04 03:28 - 00190464 _____ (Microsoft Corporation) C:\windows\system32\SmartcardCredentialProvider.dll

2013-11-18 16:33 - 2013-10-04 03:25 - 00197120 _____ (Microsoft Corporation) C:\windows\system32\credui.dll

2013-11-18 16:33 - 2013-10-04 03:24 - 01930752 _____ (Microsoft Corporation) C:\windows\system32\authui.dll

2013-11-18 16:33 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\windows\SysWOW64\SmartcardCredentialProvider.dll

2013-11-18 16:33 - 2013-10-04 02:56 - 01796096 _____ (Microsoft Corporation) C:\windows\SysWOW64\authui.dll

2013-11-18 16:33 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\credui.dll

2013-11-18 16:32 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll

2013-11-18 16:32 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\windows\SysWOW64\crypt32.dll

2013-11-18 16:32 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys

2013-11-18 16:32 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys

2013-11-18 16:32 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll

2013-11-18 16:32 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll

2013-11-18 16:32 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll

2013-11-18 16:32 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll

2013-11-18 16:32 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll

2013-11-18 16:32 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll

2013-11-18 16:32 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\sspicli.dll

2013-11-18 16:32 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll

2013-11-18 16:32 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\windows\SysWOW64\secur32.dll

2013-11-18 16:32 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncrypt.dll

2013-11-18 16:32 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe

2013-11-18 16:32 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\windows\system32\Drivers\cng.sys

2013-11-18 16:31 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\windows\system32\nshwfp.dll

2013-11-18 16:31 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\windows\system32\IKEEXT.DLL

2013-11-18 16:31 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\windows\system32\FWPUCLNT.DLL

2013-11-18 16:31 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\windows\SysWOW64\nshwfp.dll

2013-11-18 16:31 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\windows\SysWOW64\FWPUCLNT.DLL

2013-11-18 16:31 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\windows\system32\gdi32.dll

2013-11-18 16:31 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\windows\SysWOW64\gdi32.dll

2013-11-18 16:31 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\windows\system32\Drivers\afd.sys

2013-11-18 16:31 - 2013-09-04 13:12 - 00343040 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbhub.sys

2013-11-18 16:31 - 2013-09-04 13:11 - 00325120 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbport.sys

2013-11-18 16:31 - 2013-09-04 13:11 - 00099840 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbccgp.sys

2013-11-18 16:31 - 2013-09-04 13:11 - 00052736 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbehci.sys

2013-11-18 16:31 - 2013-09-04 13:11 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbuhci.sys

2013-11-18 16:31 - 2013-09-04 13:11 - 00025600 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbohci.sys

2013-11-18 16:31 - 2013-09-04 13:11 - 00007808 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbd.sys

2013-11-12 16:03 - 2013-11-12 16:03 - 00000000 ____D C:\Program Files\WinDjView

2013-11-12 15:37 - 2013-11-12 15:37 - 00001746 _____ C:\Users\Lokaladmin\Desktop\Caminova - Verknüpfung.lnk

2013-11-12 15:36 - 2013-11-12 15:36 - 00000000 ____D C:\Program Files (x86)\Caminova
 

==================== One Month Modified Files and Folders =======
 

2013-12-11 23:45 - 2013-12-11 23:45 - 00000000 ____D C:\FRST

2013-12-11 23:21 - 2013-02-10 00:05 - 00000000 ____D C:\Users\Lokaladmin\Documents\Outlook-Dateien

2013-12-11 23:03 - 2012-11-19 15:13 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job

2013-12-11 22:59 - 2009-07-14 11:57 - 00701310 _____ C:\windows\system32\perfh007.dat

2013-12-11 22:59 - 2009-07-14 11:57 - 00150210 _____ C:\windows\system32\perfc007.dat

2013-12-11 22:59 - 2009-07-14 06:13 - 01620612 _____ C:\windows\system32\PerfStringBackup.INI

2013-12-11 22:59 - 2009-07-14 05:45 - 00012272 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-12-11 22:59 - 2009-07-14 05:45 - 00012272 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-12-11 22:55 - 2013-05-22 21:01 - 00000000 ____D C:\Users\Lokaladmin\AppData\Local\gladinet

2013-12-11 22:55 - 2013-01-31 14:26 - 01924779 _____ C:\windows\WindowsUpdate.log

2013-12-11 22:53 - 2013-12-09 23:35 - 00003116 _____ C:\windows\System32\Tasks\WinZip Malware Protector_startup

2013-12-11 22:52 - 2013-12-09 16:31 - 00000414 _____ C:\windows\Tasks\Show-Password Update.job

2013-12-11 22:52 - 2012-11-19 15:09 - 00001106 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-12-11 22:52 - 2009-07-14 06:08 - 00000006 ____H C:\windows\Tasks\SA.DAT

2013-12-11 22:52 - 2009-07-14 05:51 - 00062690 _____ C:\windows\setupact.log

2013-12-11 22:51 - 2012-11-19 15:09 - 00001110 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-12-11 18:42 - 2013-02-15 10:09 - 00000099 _____ C:\Users\Public\LMDebug.log

2013-12-11 18:03 - 2012-11-19 15:13 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe

2013-12-11 18:03 - 2012-11-19 15:13 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl

2013-12-11 18:03 - 2012-11-19 15:13 - 00003822 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater

2013-12-11 07:24 - 2013-12-09 23:35 - 00000000 ____D C:\Program Files (x86)\WinZip Malware Protector

2013-12-10 18:54 - 2012-11-14 16:52 - 00549204 _____ C:\windows\PFRO.log

2013-12-10 18:46 - 2013-12-09 16:32 - 00000000 ____D C:\ProgramData\Updater

2013-12-10 18:46 - 2013-12-09 16:32 - 00000000 ____D C:\ProgramData\RHelpers

2013-12-10 18:26 - 2013-12-10 18:26 - 00001115 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-12-10 18:26 - 2013-12-10 18:26 - 00000000 ____D C:\Users\Lokaladmin\AppData\Roaming\Malwarebytes

2013-12-10 18:26 - 2013-12-10 18:26 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-12-10 18:26 - 2013-12-10 18:26 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-12-10 12:55 - 2013-02-09 12:03 - 00000000 ____D C:\Users\Lokaladmin\AppData\Roaming\The Master Genealogist v8

2013-12-09 23:35 - 2013-12-09 23:35 - 00001195 _____ C:\Users\Public\Desktop\WinZip Malware Protector.lnk

2013-12-09 23:35 - 2013-12-09 23:35 - 00000000 ____D C:\Users\Lokaladmin\AppData\Roaming\Nico Mak Computing

2013-12-09 23:35 - 2013-12-09 23:35 - 00000000 ____D C:\ProgramData\Nico Mak Computing

2013-12-09 23:29 - 2013-05-12 09:52 - 00015344 _____ C:\Users\Lokaladmin\AppData\Local\internal.grp

2013-12-09 23:15 - 2013-12-09 16:31 - 00000000 ____D C:\Program Files (x86)\Mobogenie

2013-12-09 21:52 - 2013-12-09 16:31 - 00000000 ____D C:\Users\Lokaladmin\AppData\Local\Mobogenie

2013-12-09 16:46 - 2013-12-09 16:31 - 00000340 _____ C:\Users\Lokaladmin\daemonprocess.txt

2013-12-09 16:32 - 2013-12-09 16:32 - 00000000 ____D C:\Users\Lokaladmin\Documents\StreamTransport

2013-12-09 16:31 - 2013-12-09 16:31 - 00003072 _____ C:\windows\System32\Tasks\Show-Password Update

2013-12-09 16:31 - 2013-12-09 16:31 - 00000000 ____D C:\Users\Lokaladmin\Documents\Mobogenie

2013-12-09 16:31 - 2013-12-09 16:31 - 00000000 ____D C:\Users\Lokaladmin\AppData\Local\cache

2013-12-09 16:31 - 2013-12-09 16:31 - 00000000 ____D C:\Program Files (x86)\Show-Password

2013-12-09 16:31 - 2013-01-31 14:53 - 00000000 ____D C:\Users\Lokaladmin

2013-12-09 15:51 - 2013-08-24 05:38 - 00001072 _____ C:\Users\Public\Desktop\VLC media player.lnk

2013-12-09 15:50 - 2013-01-31 14:53 - 00000000 ____D C:\Users\Lokaladmin\AppData\Roaming\vlc

2013-12-09 15:10 - 2009-07-14 04:20 - 00000000 ____D C:\windows\rescache

2013-12-09 13:14 - 2013-03-03 12:19 - 00000000 ___RD C:\Users\Lokaladmin\Virtual Machines

2013-12-09 10:24 - 2013-01-31 14:53 - 00001427 _____ C:\Users\Lokaladmin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2013-12-09 10:22 - 2009-07-14 04:20 - 00000000 ____D C:\windows\PolicyDefinitions

2013-12-09 10:20 - 2013-05-22 17:13 - 01597700 _____ C:\windows\SysWOW64\PerfStringBackup.INI

2013-12-09 10:18 - 2013-12-09 10:15 - 00009768 _____ C:\windows\IE11_main.log

2013-12-09 10:16 - 2013-12-09 10:16 - 23212032 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 17142784 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 12995584 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 11220992 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 05765120 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 04240384 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 02764288 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb

2013-12-09 10:16 - 2013-12-09 10:16 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb

2013-12-09 10:16 - 2013-12-09 10:16 - 02332160 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 02166272 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 01993728 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl

2013-12-09 10:16 - 2013-12-09 10:16 - 01926656 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl

2013-12-09 10:16 - 2013-12-09 10:16 - 01818112 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 01394176 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 01228800 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 01156608 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 01051136 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00942592 _____ (Microsoft Corporation) C:\windows\system32\jsIntl.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00940032 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00817664 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00774144 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00708608 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00703488 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00645120 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsIntl.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00626176 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00616104 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dat

2013-12-09 10:16 - 2013-12-09 10:16 - 00616104 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dat

2013-12-09 10:16 - 2013-12-09 10:16 - 00610304 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00574976 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00553472 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00548352 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00523776 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00454656 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00453120 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00440832 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00413696 _____ (Microsoft Corporation) C:\windows\system32\html.iec

2013-12-09 10:16 - 2013-12-09 10:16 - 00367104 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00337408 _____ (Microsoft Corporation) C:\windows\SysWOW64\html.iec

2013-12-09 10:16 - 2013-12-09 10:16 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00263376 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00247808 _____ (Microsoft Corporation) C:\windows\system32\msls31.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00244736 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00243200 _____ (Microsoft Corporation) C:\windows\system32\webcheck.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00238288 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00235520 _____ (Microsoft Corporation) C:\windows\system32\url.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00235008 _____ (Microsoft Corporation) C:\windows\system32\elshyph.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00233472 _____ (Microsoft Corporation) C:\windows\SysWOW64\url.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00218624 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00208384 _____ (Microsoft Corporation) C:\windows\SysWOW64\webcheck.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00195584 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00194048 _____ (Microsoft Corporation) C:\windows\SysWOW64\elshyph.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00182272 _____ (Microsoft Corporation) C:\windows\SysWOW64\msls31.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00167424 _____ (Microsoft Corporation) C:\windows\system32\iexpress.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00164864 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00151552 _____ (Microsoft Corporation) C:\windows\SysWOW64\iexpress.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00147968 _____ (Microsoft Corporation) C:\windows\system32\occache.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00143872 _____ (Microsoft Corporation) C:\windows\system32\wextract.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00139264 _____ (Microsoft Corporation) C:\windows\SysWOW64\wextract.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00139264 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00135680 _____ (Microsoft Corporation) C:\windows\system32\iepeers.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00131072 _____ (Microsoft Corporation) C:\windows\system32\IEAdvpack.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00127488 _____ (Microsoft Corporation) C:\windows\SysWOW64\occache.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00116736 _____ (Microsoft Corporation) C:\windows\SysWOW64\iepeers.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00112128 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00111616 _____ (Microsoft Corporation) C:\windows\SysWOW64\IEAdvpack.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00111616 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00105984 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00101376 _____ (Microsoft Corporation) C:\windows\system32\inseng.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00090112 _____ (Microsoft Corporation) C:\windows\system32\SetIEInstalledDate.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00086016 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00086016 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00084992 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00083968 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00083456 _____ (Microsoft Corporation) C:\windows\SysWOW64\inseng.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00081408 _____ (Microsoft Corporation) C:\windows\system32\icardie.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00077312 _____ (Microsoft Corporation) C:\windows\system32\tdc.ocx

2013-12-09 10:16 - 2013-12-09 10:16 - 00074240 _____ (Microsoft Corporation) C:\windows\SysWOW64\SetIEInstalledDate.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00069632 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00069120 _____ (Microsoft Corporation) C:\windows\SysWOW64\icardie.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00066048 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\tdc.ocx

2013-12-09 10:16 - 2013-12-09 10:16 - 00062464 _____ (Microsoft Corporation) C:\windows\system32\pngfilt.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00056832 _____ (Microsoft Corporation) C:\windows\SysWOW64\pngfilt.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00052224 _____ (Microsoft Corporation) C:\windows\system32\msfeedsbs.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00051200 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00048640 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmler.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\mshtmler.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00048128 _____ (Microsoft Corporation) C:\windows\system32\imgutil.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeedsbs.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00040448 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00036352 _____ (Microsoft Corporation) C:\windows\SysWOW64\imgutil.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00034816 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00033792 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00032768 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00030208 _____ (Microsoft Corporation) C:\windows\system32\licmgr10.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00024576 _____ (Microsoft Corporation) C:\windows\SysWOW64\licmgr10.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00013824 _____ (Microsoft Corporation) C:\windows\system32\mshta.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00013312 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshta.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00013312 _____ (Microsoft Corporation) C:\windows\system32\msfeedssync.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00012800 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeedssync.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll

2013-12-09 10:07 - 2013-12-09 10:07 - 00264616 _____ (Oracle Corporation) C:\windows\SysWOW64\javaws.exe

2013-12-09 10:07 - 2013-12-09 10:07 - 00175016 _____ (Oracle Corporation) C:\windows\SysWOW64\javaw.exe

2013-12-09 10:07 - 2013-12-09 10:07 - 00174504 _____ (Oracle Corporation) C:\windows\SysWOW64\java.exe

2013-12-09 10:07 - 2013-12-09 10:07 - 00096168 _____ (Oracle Corporation) C:\windows\SysWOW64\WindowsAccessBridge-32.dll

2013-12-09 10:07 - 2013-12-09 10:07 - 00000000 ____D C:\ProgramData\Oracle

2013-12-09 10:07 - 2013-12-09 10:07 - 00000000 ____D C:\Program Files (x86)\Java

2013-12-09 09:44 - 2013-12-09 09:44 - 00002195 _____ C:\Users\Public\Desktop\WinZip.lnk

2013-12-09 09:44 - 2013-12-09 09:44 - 00000000 ____D C:\Users\Lokaladmin\AppData\Local\WinZip

2013-12-09 09:44 - 2013-12-09 09:44 - 00000000 ____D C:\ProgramData\WinZip

2013-12-09 09:44 - 2013-12-09 09:44 - 00000000 ____D C:\Program Files\WinZip

2013-12-06 11:18 - 2013-02-09 11:29 - 00000000 ____D C:\Users\Lokaladmin\AppData\Roaming\WinEdt

2013-12-05 15:56 - 2013-01-31 14:53 - 00000000 ____D C:\Users\Lokaladmin\AppData\Local\Microsoft Help

2013-12-05 14:53 - 2012-11-19 15:09 - 00002181 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2013-12-04 12:00 - 2013-02-01 11:50 - 00000542 _____ C:\windows\Tasks\Tägliche zeitgesteuerte Überprüfung.job

2013-12-04 10:10 - 2013-05-09 09:38 - 00000000 ____D C:\nbwin

2013-12-02 20:09 - 2009-07-14 06:32 - 00000000 ____D C:\windows\system32\FxsTmp

2013-12-01 11:38 - 2013-12-01 11:38 - 00000000 _____ C:\windows\system32\vireng.log

2013-12-01 10:46 - 2012-11-19 15:09 - 00004106 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA

2013-12-01 10:46 - 2012-11-19 15:09 - 00003854 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore

2013-11-20 17:58 - 2012-11-19 14:59 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2013-11-20 09:37 - 2013-01-31 15:08 - 00000000 ____D C:\ProgramData\Cisco

2013-11-20 09:37 - 2013-01-31 15:08 - 00000000 ____D C:\Program Files (x86)\Cisco

2013-11-19 12:48 - 2013-11-19 12:48 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2013-11-19 03:33 - 2012-11-16 10:16 - 00267936 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe

2013-11-18 16:44 - 2012-11-16 12:13 - 00000000 ____D C:\ProgramData\Microsoft Help

2013-11-18 16:43 - 2013-08-24 21:30 - 00000000 ____D C:\windows\system32\MRT

2013-11-18 16:42 - 2012-11-16 10:59 - 82896128 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe

2013-11-18 10:29 - 2013-01-31 14:53 - 00000000 ____D C:\Users\Lokaladmin\AppData\Local\Adobe

2013-11-12 16:03 - 2013-11-12 16:03 - 00000000 ____D C:\Program Files\WinDjView

2013-11-12 15:37 - 2013-11-12 15:37 - 00001746 _____ C:\Users\Lokaladmin\Desktop\Caminova - Verknüpfung.lnk

2013-11-12 15:36 - 2013-11-12 15:36 - 00000000 ____D C:\Program Files (x86)\Caminova
 

Files to move or delete:

====================

C:\Users\Lokaladmin\pdf8_ret_O2013_Update_x64.exe
 
 

Some content of TEMP:

====================

C:\Users\Lokaladmin\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe

C:\Users\Lokaladmin\AppData\Local\Temp\Mobogenie_Setup_2.1.23_515.exe

C:\Users\Lokaladmin\AppData\Local\Temp\Show-Password_1030-8101.exe

C:\Users\Lokaladmin\AppData\Local\Temp\vlc-2.1.1-win32.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-12-10 01:36
 

==================== End Of Log ============================

Code:



==================== Memory info =========================== 
 

Percentage of memory in use: 29%

Total physical RAM: 8066.95 MB

Available physical RAM: 5683.05 MB

Total Pagefile: 16132.07 MB

Available Pagefile: 13541.91 MB

Total Virtual: 8192 MB

Available Virtual: 8191.81 MB
 

==================== Drives ================================
 

Drive c: (System) (Fixed) (Total:117.19 GB) (Free:35.3 GB) NTFS

Drive d: (Daten) (Fixed) (Total:814.23 GB) (Free:361.6 GB) NTFS

Drive e: (HDD2) (Fixed) (Total:465.76 GB) (Free:153.76 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 55F6CCAC)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=117 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=814 GB) - (Type=07 NTFS)
 

========================================================

Disk: 1 (Size: 466 GB) (Disk ID: BA62E5A4)

Partition 1: (Not Active) - (Size=466 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

hi,

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Danke, Schrauber, für die schnelle Reaktion.

Hier zunächst die mbam-log-Datei:

Code:

Malwarebytes Anti-Malware (PRO) 1.75.0.1300

www.malwarebytes.org
 

Datenbank Version: v2013.12.12.04
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 11.0.9600.16428

Lokaladmin :: PCWG1300 [Administrator]
 

Schutz: Aktiviert
 

12.12.2013 10:22:16

mbam-log-2013-12-12 (10-22-16).txt
 

Art des Suchlaufs: Quick-Scan

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 214636

Laufzeit: 2 Minute(n), 31 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

Weiteres folgt.
Boethius

Hier folgt die Adw-Datei:

AdwCleaner Logfile:

Code:

# AdwCleaner v3.015 - Bericht erstellt am 12/12/2013 um 10:52:09

# Updated 10/12/2013 von Xplode

# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)

# Benutzername : Lokaladmin - PCWG1300

# Gestartet von : C:\Users\Lokaladmin\AppData\Local\Downloads\adwcleaner.exe

# Option : Löschen
 

***** [ Dienste ] *****
 
 

***** [ Dateien / Ordner ] *****
 

Ordner Gelöscht : C:\ProgramData\boost_interprocess

Ordner Gelöscht : C:\Program Files (x86)\Show-Password

Ordner Gelöscht : C:\Users\LOKALA~1\AppData\Local\Temp\OCS

Ordner Gelöscht : C:\Users\Lokaladmin\AppData\Roaming\pdfforge

Datei Gelöscht : C:\Users\Lokaladmin\AppData\Roaming\Mozilla\Firefox\Profiles\gg6wiobf.default\user.js
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{25A3A431-30BB-47C8-AD6A-E1063801134F}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{25A3A431-30BB-47C8-AD6A-E1063801134F}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{25A3A431-30BB-47C8-AD6A-E1063801134F}

Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{25A3A431-30BB-47C8-AD6A-E1063801134F}]

Schlüssel Gelöscht : HKCU\Software\FLEXnet

Schlüssel Gelöscht : HKCU\Software\OCS

Schlüssel Gelöscht : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\DynConIE

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Show-Password

Schlüssel Gelöscht : HKLM\Software\{1146AC44-2F03-4431-B4FD-889BC837521F}

Schlüssel Gelöscht : HKLM\Software\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
 

***** [ Browser ] *****
 

-\\ Internet Explorer v11.0.9600.16428
 
 

-\\ Mozilla Firefox v25.0.1 (de)
 

[ Datei : C:\Users\Lokaladmin\AppData\Roaming\Mozilla\Firefox\Profiles\gg6wiobf.default\prefs.js ]
 
 

-\\ Google Chrome v31.0.1650.63
 

[ Datei : C:\Users\Lokaladmin\AppData\Local\Google\Chrome\User Data\Default\preferences ]
 
 

*************************
 

AdwCleaner[R0].txt - [2279 octets] - [12/12/2013 10:50:15]

AdwCleaner[S0].txt - [2112 octets] - [12/12/2013 10:52:09]
 

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2172 octets] ##########

--- --- ---

Weiteres folgt.
Boethius

Jetzt die jrt-Datei.

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.0.8 (11.05.2013:1)

OS: Windows 7 Professional x64

Ran by Lokaladmin on 12.12.2013 at 11:05:09,96

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 

~~~ Services
 
 
 

~~~ Registry Values
 
 
 

~~~ Registry Keys
 
 
 

~~~ Files
 
 
 

~~~ Folders
 
 
 

~~~ FireFox
 

Emptied folder: C:\Users\Lokaladmin\AppData\Roaming\mozilla\firefox\profiles\gg6wiobf.default\minidumps [47 files]
 
 
 

~~~ Event Viewer Logs were cleared
 
 
 
 
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 12.12.2013 at 11:11:07,56

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST-file folgt.

Jetzt noch die aktullen FRST-files.

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-12-2013

Ran by Lokaladmin (administrator) on PCWG1300 on 12-12-2013 11:22:54

Running from C:\Users\Lokaladmin\AppData\Local\Downloads

Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 11

Boot Mode: Normal
 

==================== Processes (Whitelisted) =================
 

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe

(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe

(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe

(Gladinet, INC) C:\Program Files (x86)\Nuance\Nuance Cloud Connector\GladFileMonSvc.exe

(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe

() C:\Program Files (x86)\Nuance\Nuance Cloud Connector\WOSVSSSvr.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\HelperService.exe

(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\ConversionService.exe

(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PDF Professional 8\PDFProFiltSrv.exe

(Samsung Electronics Co., Ltd.) C:\Windows\System32\spool\drivers\x64\3\NetFaxServer64.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe

(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\Remote Management System\ManagementAgentNT.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\Remote Management System\RouterNT.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe

(Uwe Sieber - www.uwe-sieber.de) C:\Program Files\USBDLM\USBDLM.exe

(Uwe Sieber - www.uwe-sieber.de) C:\Program Files\USBDLM\USBDLM_usr.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

() C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe

(Ulead Systems, Inc.) C:\Program Files (x86)\Ulead Systems\Ulead PhotoImpact 6\ABMTSR.EXE

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe

(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\concentr.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe

(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\OmniPage18\omnipage.exe

(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe

(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PDF Professional 8\PdfPro8Hook.exe

(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe

(Nico Mak Computing) C:\Program Files (x86)\WinZip Malware Protector\WinZipMalwareProtector.exe

(Gladinet, INC) C:\Program Files (x86)\Nuance\Nuance Cloud Connector\GladinetClient.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13192848 2012-08-30] (Realtek Semiconductor)

HKLM\...\Run: [HotKeysCmds] - C:\windows\system32\hkcmd.exe [ ] ()

HKLM\...\Run: [CDAServer] - C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe [456704 2012-02-20] ()

HKLM\...\Run: [CanonSolutionMenu] - C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.EXE [689488 2008-03-11] (CANON INC.)

Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)

HKLM\...\Policies\Explorer: [NoWelcomeScreen] 1

HKCU\...\Policies\Explorer: [NoDesktopCleanupWizard] 1

MountPoints2: {4ec55f1e-cdb0-11e2-8897-10604b852c3e} - F:\LaunchU3.exe -a

HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [290688 2012-10-24] (Intel Corporation)

HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-11-29] (Intel Corporation)

HKLM-x32\...\Run: [ConnectionCenter] - C:\Program Files (x86)\Citrix\ICA Client\concentr.exe [309184 2012-03-28] (Citrix Systems, Inc.)

HKLM-x32\...\Run: [Sophos AutoUpdate Monitor] - C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe [929272 2013-02-13] (Sophos Limited)

HKLM-x32\...\Run: [OmniPage Preload] - C:\Program Files (x86)\Nuance\OmniPage18\omnipage.exe [1467240 2011-07-13] (Nuance Communications, Inc.)

HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [162856 2013-07-22] (Geek Software GmbH)

HKLM-x32\...\Run: [PDF8 Registry Controller] - C:\Program Files (x86)\Nuance\PDF Professional 8\RegistryController.exe [178576 2012-10-23] (Nuance Communications, Inc.)

HKLM-x32\...\Run: [PDFProHook] - C:\Program Files (x86)\Nuance\PDF Professional 8\PdfPro8Hook.exe [2013072 2012-10-23] (Nuance Communications, Inc.)

HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] - C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [707984 2013-10-10] 
 

(Cisco Systems, Inc.)

HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

HKLM-x32\...\Run: [mobilegeni daemon] - C:\Program Files (x86)\Mobogenie\DaemonProcess.exe

AppInit_DLLs: C:\Program Files (x86)\Sophos\Sophos Anti-Virus\sophos_detoured_x64.dll [217672 2013-10-21] (Sophos Limited)

AppInit_DLLs-x32: c:\progra~2\sophos\sophos~1\sophos~1.dll [275352 2013-10-21] (Sophos Limited)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.lmu.de/

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x6D65629BD7C3CD01

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE

StartMenuInternet: IEXPLORE.EXE - c:\program files (x86)\internet explorer\iexplore.exe

BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GmbH)

BHO-x32: PlusIEEventHelper Class - {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - C:\Program Files (x86)\Nuance\PDF Professional 8\bin\PlusIEContextMenu.dll (Zeon 
 

Corporation)

BHO-x32: SwissAcademic.Citavi.Picker.IEPicker - {609D670F-B735-4da7-AC6D-F3BD358E325E} - C:\Windows\\SysWOW64\mscoree.dll (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Show-Password - {8ce16b24-784d-4da6-9986-866250aa8596} - C:\Program Files (x86)\Show-Password\136.dll No File

BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft 
 

Corporation)

BHO-x32: ZeonIEEventHelper Class - {C7DA0384-42AA-428c-B832-88AC343DE1A8} - C:\Program Files (x86)\Nuance\PDF Professional 8\bin\gzeoniefavclient.dll (Zeon Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM-x32 - Nuance PDF - {BCCE15AE-AC7E-4bc9-94AF-2A714A412BCB} - C:\Program Files (x86)\Nuance\PDF Professional 8\bin\gzeoniefavclient.dll (Zeon Corporation)

DPF: HKLM-x32 {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: HKLM-x32 {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} hxxp://h20614.www2.hp.com/ediags/gmd/Install/Cab/hpdetect119b.cab

DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter-x32: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Winsock: Catalog9 01 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)

Winsock: Catalog9 02 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)

Winsock: Catalog9 03 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)

Winsock: Catalog9 04 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)

Winsock: Catalog9 05 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)

Winsock: Catalog9 06 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)

Winsock: Catalog9 07 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)

Winsock: Catalog9 08 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)

Winsock: Catalog9 19 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)

Winsock: Catalog9-x64 01 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)

Winsock: Catalog9-x64 02 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)

Winsock: Catalog9-x64 03 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)

Winsock: Catalog9-x64 04 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)

Winsock: Catalog9-x64 05 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)

Winsock: Catalog9-x64 06 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)

Winsock: Catalog9-x64 07 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)

Winsock: Catalog9-x64 08 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)

Winsock: Catalog9-x64 19 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
 

FireFox:

========

FF ProfilePath: C:\Users\Lokaladmin\AppData\Roaming\Mozilla\Firefox\Profiles\gg6wiobf.default

FF Homepage: hxxp://www.google.de/

FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()

FF Plugin: @microsoft.com/GENUINE - C:\windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()

FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\windows\SysWOW64\Adobe\Director\np32dsw_1200112.dll (Adobe Systems, Inc.)

FF Plugin-x32: @caminova.com/DjVuPlugin - C:\Program Files (x86)\Caminova\Document Express DjVu Plug-in\npdjvu.dll (Caminova, Inc.)

FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/GENUINE - C:\windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @videolan.org/vlc,version=2.0.4 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: @videolan.org/vlc,version=2.0.8 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: @videolan.org/vlc,version=2.1.1 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin-x32: ZEON/PDF,version=2.0 - C:\Program Files (x86)\Nuance\PDF Professional 8\bin\nppdf.dll (Zeon Corporation)

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: Tube Dimmer - C:\Users\Lokaladmin\AppData\Roaming\Mozilla\Firefox\Profiles\gg6wiobf.default\Extensions\support@tubedimmerapp.com

FF Extension: WOT - C:\Users\Lokaladmin\AppData\Roaming\Mozilla\Firefox\Profiles\gg6wiobf.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}

FF Extension: DownloadHelper - C:\Users\Lokaladmin\AppData\Roaming\Mozilla\Firefox\Profiles\gg6wiobf.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}

FF Extension: nuance - C:\Users\Lokaladmin\AppData\Roaming\Mozilla\Firefox\Profiles\gg6wiobf.default\Extensions\nuance@pdf8

FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox

FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox

FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt

FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt

FF HKCU\...\Firefox\Extensions: [{da6d9f64-0bec-427b-a62d-6f6f6ce72768}] - C:\Program Files (x86)\Show-Password\136.xpi
 

Chrome: 

=======

CHR HomePage: 

CHR RestoreOnStartup: "hxxp://www.google.de/"

CHR DefaultSearchKeyword: google.de

CHR DefaultSearchProvider: Google

CHR DefaultSearchURL: {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}
 

{google:bookmarkBarPinned}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}

CHR DefaultNewTabURL: {google:baseURL}_/chrome/newtab?{google:RLZ}{google:instantExtendedEnabledParameter}{google:ntpIsThemedParameter}ie={inputEncoding}

CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\PepperFlash\pepflashplayer.dll ()

CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\pdf.dll ()

CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll No File

CHR Plugin: (Java(TM) Platform SE 7 U9) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

CHR Plugin: (Java Deployment Toolkit 7.0.90.5) - C:\Windows\SysWOW64\npDeployJava1.dll No File

CHR Extension: (Google Drive) - C:\Users\Lokaladmin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0

CHR Extension: (YouTube) - C:\Users\Lokaladmin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0

CHR Extension: (Google Search) - C:\Users\Lokaladmin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0

CHR Extension: (Google Wallet) - C:\Users\Lokaladmin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0

CHR Extension: (Gmail) - C:\Users\Lokaladmin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0

CHR HKLM-x32\...\Chrome\Extension: [logekkkdbdidmmcgkonmmonclldogceg] - C:\Program Files (x86)\Show-Password\136.crx

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
 

==================== Services (Whitelisted) =================
 

R2 GladFileMonSvc; C:\Program Files (x86)\Nuance\Nuance Cloud Connector\GladFileMonSvc.exe [29592 2012-09-24] (Gladinet, INC)

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)

R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)

R2 PDFProFiltSrv; C:\Program Files (x86)\Nuance\PDF Professional 8\PDFProFiltSrv.exe [135056 2012-10-23] (Nuance Communications, Inc.)

R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [201360 2012-08-31] (Realtek Semiconductor)

R2 Samsung Network Fax Server; C:\windows\system32\spool\drivers\x64\3\NetFaxServer64.exe [239616 2012-08-07] (Samsung Electronics Co., Ltd.)

R2 SAVAdminService; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe [290296 2013-10-21] (Sophos Limited)

R2 SAVService; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe [206328 2013-10-21] (Sophos Limited)

S3 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1328736 2012-09-24] (Secunia)

R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [656480 2012-09-24] (Secunia)

R2 Sophos Agent; C:\Program Files (x86)\Sophos\Remote Management System\ManagementAgentNT.exe [289856 2013-02-01] (Sophos Limited)

R2 Sophos AutoUpdate Service; C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe [237048 2013-02-13] (Sophos Limited)

R2 Sophos Message Router; C:\Program Files (x86)\Sophos\Remote Management System\RouterNT.exe [818240 2013-02-01] (Sophos Limited)

R2 Sophos Web Control Service; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe [357400 2013-02-01] (Sophos Limited)

R2 swi_service; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe [3109880 2013-10-21] (Sophos Limited)

S2 swi_update_64; C:\ProgramData\Sophos\Web Intelligence\swi_update_64.exe [2012152 2013-10-21] (Sophos Limited)

R2 USBDLM; C:\Program Files\USBDLM\USBDLM.exe [451560 2012-09-09] (Uwe Sieber - www.uwe-sieber.de)

S3 uvnc_service; C:\Program Files (x86)\UltraVNC\WinVNC.exe [2015968 2012-02-14] (UltraVNC)
 

==================== Drivers (Whitelisted) ====================
 

R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)

R1 SAVOnAccess; C:\Windows\System32\DRIVERS\savonaccess.sys [154952 2013-02-01] (Sophos Limited)

S3 sdcfilter; C:\Windows\System32\DRIVERS\sdcfilter.sys [36640 2013-02-01] (Sophos Limited)

S4 SophosBootDriver; C:\Windows\System32\DRIVERS\SophosBootDriver.sys [25608 2013-02-01] (Sophos Plc)

R3 SRS_PremiumSound_Service; C:\Windows\System32\drivers\srs_PremiumSound_amd64.sys [513312 2011-07-18] ()

S3 vpnva; C:\Windows\System32\DRIVERS\vpnva64-6.sys [52080 2013-10-10] (Cisco Systems, Inc.)
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-12-12 11:11 - 2013-12-12 11:11 - 00000767 _____ C:\Users\Lokaladmin\Desktop\JRT.txt

2013-12-12 11:05 - 2013-12-12 11:05 - 00000000 ____D C:\windows\ERUNT

2013-12-12 11:03 - 2013-12-12 11:03 - 01034531 _____ (Thisisu) C:\Users\Lokaladmin\Desktop\JRT.exe

2013-12-12 10:47 - 2013-12-12 10:52 - 00000000 ____D C:\AdwCleaner

2013-12-12 10:46 - 2013-12-12 10:46 - 01226802 _____ C:\Users\Lokaladmin\Desktop\adwcleaner.exe

2013-12-12 09:54 - 2013-12-12 09:54 - 00001597 _____ C:\Users\Lokaladmin\Desktop\FRST64.exe - Verknüpfung.lnk

2013-12-11 23:45 - 2013-12-12 09:58 - 00000000 ____D C:\FRST

2013-12-10 18:26 - 2013-12-10 18:26 - 00001115 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-12-10 18:26 - 2013-12-10 18:26 - 00000000 ____D C:\Users\Lokaladmin\AppData\Roaming\Malwarebytes

2013-12-10 18:26 - 2013-12-10 18:26 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-12-10 18:26 - 2013-12-10 18:26 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-12-10 18:26 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys

2013-12-09 23:35 - 2013-12-12 10:53 - 00003116 _____ C:\windows\System32\Tasks\WinZip Malware Protector_startup

2013-12-09 23:35 - 2013-12-11 07:24 - 00000000 ____D C:\Program Files (x86)\WinZip Malware Protector

2013-12-09 23:35 - 2013-12-09 23:35 - 00001195 _____ C:\Users\Public\Desktop\WinZip Malware Protector.lnk

2013-12-09 23:35 - 2013-12-09 23:35 - 00000000 ____D C:\Users\Lokaladmin\AppData\Roaming\Nico Mak Computing

2013-12-09 23:35 - 2013-12-09 23:35 - 00000000 ____D C:\ProgramData\Nico Mak Computing

2013-12-09 23:35 - 2013-03-15 17:10 - 00020480 _____ C:\windows\system32\wsusnative64.exe

2013-12-09 16:32 - 2013-12-10 18:46 - 00000000 ____D C:\ProgramData\Updater

2013-12-09 16:32 - 2013-12-10 18:46 - 00000000 ____D C:\ProgramData\RHelpers

2013-12-09 16:32 - 2013-12-09 16:32 - 00000000 ____D C:\Users\Lokaladmin\Documents\StreamTransport

2013-12-09 16:31 - 2013-12-12 10:53 - 00000414 _____ C:\windows\Tasks\Show-Password Update.job

2013-12-09 16:31 - 2013-12-09 23:15 - 00000000 ____D C:\Program Files (x86)\Mobogenie

2013-12-09 16:31 - 2013-12-09 21:52 - 00000000 ____D C:\Users\Lokaladmin\AppData\Local\Mobogenie

2013-12-09 16:31 - 2013-12-09 16:46 - 00000340 _____ C:\Users\Lokaladmin\daemonprocess.txt

2013-12-09 16:31 - 2013-12-09 16:31 - 00003072 _____ C:\windows\System32\Tasks\Show-Password Update

2013-12-09 16:31 - 2013-12-09 16:31 - 00000000 ____D C:\Users\Lokaladmin\Documents\Mobogenie

2013-12-09 16:31 - 2013-12-09 16:31 - 00000000 ____D C:\Users\Lokaladmin\AppData\Local\cache

2013-12-09 10:18 - 2013-10-14 18:00 - 00028368 _____ (Microsoft Corporation) C:\windows\system32\IEUDINIT.EXE

2013-12-09 10:16 - 2013-12-09 10:16 - 23212032 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 17142784 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 12995584 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 11220992 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 05765120 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 04240384 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 02764288 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb

2013-12-09 10:16 - 2013-12-09 10:16 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb

2013-12-09 10:16 - 2013-12-09 10:16 - 02332160 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 02166272 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 01993728 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl

2013-12-09 10:16 - 2013-12-09 10:16 - 01926656 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl

2013-12-09 10:16 - 2013-12-09 10:16 - 01818112 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 01394176 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 01228800 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 01156608 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 01051136 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00942592 _____ (Microsoft Corporation) C:\windows\system32\jsIntl.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00940032 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00817664 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00774144 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00708608 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00703488 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00645120 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsIntl.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00626176 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00616104 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dat

2013-12-09 10:16 - 2013-12-09 10:16 - 00616104 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dat

2013-12-09 10:16 - 2013-12-09 10:16 - 00610304 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00574976 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00553472 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00548352 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00523776 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00454656 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00453120 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00440832 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00413696 _____ (Microsoft Corporation) C:\windows\system32\html.iec

2013-12-09 10:16 - 2013-12-09 10:16 - 00367104 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00337408 _____ (Microsoft Corporation) C:\windows\SysWOW64\html.iec

2013-12-09 10:16 - 2013-12-09 10:16 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00263376 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00247808 _____ (Microsoft Corporation) C:\windows\system32\msls31.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00244736 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00243200 _____ (Microsoft Corporation) C:\windows\system32\webcheck.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00238288 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00235520 _____ (Microsoft Corporation) C:\windows\system32\url.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00235008 _____ (Microsoft Corporation) C:\windows\system32\elshyph.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00233472 _____ (Microsoft Corporation) C:\windows\SysWOW64\url.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00218624 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00208384 _____ (Microsoft Corporation) C:\windows\SysWOW64\webcheck.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00195584 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00194048 _____ (Microsoft Corporation) C:\windows\SysWOW64\elshyph.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00182272 _____ (Microsoft Corporation) C:\windows\SysWOW64\msls31.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00167424 _____ (Microsoft Corporation) C:\windows\system32\iexpress.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00164864 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00151552 _____ (Microsoft Corporation) C:\windows\SysWOW64\iexpress.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00147968 _____ (Microsoft Corporation) C:\windows\system32\occache.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00143872 _____ (Microsoft Corporation) C:\windows\system32\wextract.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00139264 _____ (Microsoft Corporation) C:\windows\SysWOW64\wextract.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00139264 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00135680 _____ (Microsoft Corporation) C:\windows\system32\iepeers.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00131072 _____ (Microsoft Corporation) C:\windows\system32\IEAdvpack.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00127488 _____ (Microsoft Corporation) C:\windows\SysWOW64\occache.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00116736 _____ (Microsoft Corporation) C:\windows\SysWOW64\iepeers.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00112128 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00111616 _____ (Microsoft Corporation) C:\windows\SysWOW64\IEAdvpack.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00111616 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00105984 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00101376 _____ (Microsoft Corporation) C:\windows\system32\inseng.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00090112 _____ (Microsoft Corporation) C:\windows\system32\SetIEInstalledDate.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00086016 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00086016 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00084992 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00083968 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00083456 _____ (Microsoft Corporation) C:\windows\SysWOW64\inseng.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00081408 _____ (Microsoft Corporation) C:\windows\system32\icardie.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00077312 _____ (Microsoft Corporation) C:\windows\system32\tdc.ocx

2013-12-09 10:16 - 2013-12-09 10:16 - 00074240 _____ (Microsoft Corporation) C:\windows\SysWOW64\SetIEInstalledDate.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00069632 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00069120 _____ (Microsoft Corporation) C:\windows\SysWOW64\icardie.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00066048 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\tdc.ocx

2013-12-09 10:16 - 2013-12-09 10:16 - 00062464 _____ (Microsoft Corporation) C:\windows\system32\pngfilt.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00056832 _____ (Microsoft Corporation) C:\windows\SysWOW64\pngfilt.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00052224 _____ (Microsoft Corporation) C:\windows\system32\msfeedsbs.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00051200 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00048640 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmler.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\mshtmler.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00048128 _____ (Microsoft Corporation) C:\windows\system32\imgutil.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeedsbs.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00040448 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00036352 _____ (Microsoft Corporation) C:\windows\SysWOW64\imgutil.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00034816 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00033792 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00032768 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00030208 _____ (Microsoft Corporation) C:\windows\system32\licmgr10.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00024576 _____ (Microsoft Corporation) C:\windows\SysWOW64\licmgr10.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00013824 _____ (Microsoft Corporation) C:\windows\system32\mshta.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00013312 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshta.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00013312 _____ (Microsoft Corporation) C:\windows\system32\msfeedssync.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00012800 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeedssync.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll

2013-12-09 10:15 - 2013-12-09 10:18 - 00009768 _____ C:\windows\IE11_main.log

2013-12-09 10:07 - 2013-12-09 10:07 - 00264616 _____ (Oracle Corporation) C:\windows\SysWOW64\javaws.exe

2013-12-09 10:07 - 2013-12-09 10:07 - 00175016 _____ (Oracle Corporation) C:\windows\SysWOW64\javaw.exe

2013-12-09 10:07 - 2013-12-09 10:07 - 00174504 _____ (Oracle Corporation) C:\windows\SysWOW64\java.exe

2013-12-09 10:07 - 2013-12-09 10:07 - 00096168 _____ (Oracle Corporation) C:\windows\SysWOW64\WindowsAccessBridge-32.dll

2013-12-09 10:07 - 2013-12-09 10:07 - 00000000 ____D C:\ProgramData\Oracle

2013-12-09 10:07 - 2013-12-09 10:07 - 00000000 ____D C:\Program Files (x86)\Java

2013-12-09 09:44 - 2013-12-09 09:44 - 00002195 _____ C:\Users\Public\Desktop\WinZip.lnk

2013-12-09 09:44 - 2013-12-09 09:44 - 00000000 ____D C:\Users\Lokaladmin\AppData\Local\WinZip

2013-12-09 09:44 - 2013-12-09 09:44 - 00000000 ____D C:\ProgramData\WinZip

2013-12-09 09:44 - 2013-12-09 09:44 - 00000000 ____D C:\Program Files\WinZip

2013-12-01 11:38 - 2013-12-01 11:38 - 00000000 _____ C:\windows\system32\vireng.log

2013-11-19 12:48 - 2013-11-19 12:48 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2013-11-18 16:33 - 2013-10-04 03:28 - 00190464 _____ (Microsoft Corporation) C:\windows\system32\SmartcardCredentialProvider.dll

2013-11-18 16:33 - 2013-10-04 03:25 - 00197120 _____ (Microsoft Corporation) C:\windows\system32\credui.dll

2013-11-18 16:33 - 2013-10-04 03:24 - 01930752 _____ (Microsoft Corporation) C:\windows\system32\authui.dll

2013-11-18 16:33 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\windows\SysWOW64\SmartcardCredentialProvider.dll

2013-11-18 16:33 - 2013-10-04 02:56 - 01796096 _____ (Microsoft Corporation) C:\windows\SysWOW64\authui.dll

2013-11-18 16:33 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\credui.dll

2013-11-18 16:32 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll

2013-11-18 16:32 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\windows\SysWOW64\crypt32.dll

2013-11-18 16:32 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys

2013-11-18 16:32 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys

2013-11-18 16:32 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll

2013-11-18 16:32 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll

2013-11-18 16:32 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll

2013-11-18 16:32 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll

2013-11-18 16:32 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll

2013-11-18 16:32 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll

2013-11-18 16:32 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\sspicli.dll

2013-11-18 16:32 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll

2013-11-18 16:32 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\windows\SysWOW64\secur32.dll

2013-11-18 16:32 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncrypt.dll

2013-11-18 16:32 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe

2013-11-18 16:32 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\windows\system32\Drivers\cng.sys

2013-11-18 16:31 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\windows\system32\nshwfp.dll

2013-11-18 16:31 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\windows\system32\IKEEXT.DLL

2013-11-18 16:31 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\windows\system32\FWPUCLNT.DLL

2013-11-18 16:31 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\windows\SysWOW64\nshwfp.dll

2013-11-18 16:31 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\windows\SysWOW64\FWPUCLNT.DLL

2013-11-18 16:31 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\windows\system32\gdi32.dll

2013-11-18 16:31 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\windows\SysWOW64\gdi32.dll

2013-11-18 16:31 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\windows\system32\Drivers\afd.sys

2013-11-18 16:31 - 2013-09-04 13:12 - 00343040 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbhub.sys

2013-11-18 16:31 - 2013-09-04 13:11 - 00325120 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbport.sys

2013-11-18 16:31 - 2013-09-04 13:11 - 00099840 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbccgp.sys

2013-11-18 16:31 - 2013-09-04 13:11 - 00052736 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbehci.sys

2013-11-18 16:31 - 2013-09-04 13:11 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbuhci.sys

2013-11-18 16:31 - 2013-09-04 13:11 - 00025600 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbohci.sys

2013-11-18 16:31 - 2013-09-04 13:11 - 00007808 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbd.sys

2013-11-12 16:03 - 2013-11-12 16:03 - 00000000 ____D C:\Program Files\WinDjView

2013-11-12 15:37 - 2013-11-12 15:37 - 00001746 _____ C:\Users\Lokaladmin\Desktop\Caminova - Verknüpfung.lnk

2013-11-12 15:36 - 2013-11-12 15:36 - 00000000 ____D C:\Program Files (x86)\Caminova
 

==================== One Month Modified Files and Folders =======
 

2013-12-12 11:11 - 2013-12-12 11:11 - 00000767 _____ C:\Users\Lokaladmin\Desktop\JRT.txt

2013-12-12 11:05 - 2013-12-12 11:05 - 00000000 ____D C:\windows\ERUNT

2013-12-12 11:03 - 2013-12-12 11:03 - 01034531 _____ (Thisisu) C:\Users\Lokaladmin\Desktop\JRT.exe

2013-12-12 11:03 - 2012-11-19 15:13 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job

2013-12-12 11:00 - 2009-07-14 05:45 - 00012272 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-12-12 11:00 - 2009-07-14 05:45 - 00012272 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-12-12 10:57 - 2009-07-14 11:57 - 00701310 _____ C:\windows\system32\perfh007.dat

2013-12-12 10:57 - 2009-07-14 11:57 - 00150210 _____ C:\windows\system32\perfc007.dat

2013-12-12 10:57 - 2009-07-14 06:13 - 01620612 _____ C:\windows\system32\PerfStringBackup.INI

2013-12-12 10:56 - 2013-01-31 14:26 - 01945143 _____ C:\windows\WindowsUpdate.log

2013-12-12 10:55 - 2013-05-22 21:01 - 00000000 ____D C:\Users\Lokaladmin\AppData\Local\gladinet

2013-12-12 10:54 - 2013-02-10 00:05 - 00000000 ____D C:\Users\Lokaladmin\Documents\Outlook-Dateien

2013-12-12 10:53 - 2013-12-09 23:35 - 00003116 _____ C:\windows\System32\Tasks\WinZip Malware Protector_startup

2013-12-12 10:53 - 2013-12-09 16:31 - 00000414 _____ C:\windows\Tasks\Show-Password Update.job

2013-12-12 10:53 - 2012-11-19 15:09 - 00001106 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-12-12 10:53 - 2009-07-14 06:08 - 00000006 ____H C:\windows\Tasks\SA.DAT

2013-12-12 10:53 - 2009-07-14 05:51 - 00062802 _____ C:\windows\setupact.log

2013-12-12 10:52 - 2013-12-12 10:47 - 00000000 ____D C:\AdwCleaner

2013-12-12 10:51 - 2012-11-19 15:09 - 00001110 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-12-12 10:46 - 2013-12-12 10:46 - 01226802 _____ C:\Users\Lokaladmin\Desktop\adwcleaner.exe

2013-12-12 09:58 - 2013-12-11 23:45 - 00000000 ____D C:\FRST

2013-12-12 09:54 - 2013-12-12 09:54 - 00001597 _____ C:\Users\Lokaladmin\Desktop\FRST64.exe - Verknüpfung.lnk

2013-12-12 09:51 - 2013-02-15 10:09 - 00000099 _____ C:\Users\Public\LMDebug.log

2013-12-11 18:03 - 2012-11-19 15:13 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe

2013-12-11 18:03 - 2012-11-19 15:13 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl

2013-12-11 18:03 - 2012-11-19 15:13 - 00003822 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater

2013-12-11 07:24 - 2013-12-09 23:35 - 00000000 ____D C:\Program Files (x86)\WinZip Malware Protector

2013-12-10 18:54 - 2012-11-14 16:52 - 00549204 _____ C:\windows\PFRO.log

2013-12-10 18:46 - 2013-12-09 16:32 - 00000000 ____D C:\ProgramData\Updater

2013-12-10 18:46 - 2013-12-09 16:32 - 00000000 ____D C:\ProgramData\RHelpers

2013-12-10 18:26 - 2013-12-10 18:26 - 00001115 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-12-10 18:26 - 2013-12-10 18:26 - 00000000 ____D C:\Users\Lokaladmin\AppData\Roaming\Malwarebytes

2013-12-10 18:26 - 2013-12-10 18:26 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-12-10 18:26 - 2013-12-10 18:26 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-12-10 12:55 - 2013-02-09 12:03 - 00000000 ____D C:\Users\Lokaladmin\AppData\Roaming\The Master Genealogist v8

2013-12-09 23:35 - 2013-12-09 23:35 - 00001195 _____ C:\Users\Public\Desktop\WinZip Malware Protector.lnk

2013-12-09 23:35 - 2013-12-09 23:35 - 00000000 ____D C:\Users\Lokaladmin\AppData\Roaming\Nico Mak Computing

2013-12-09 23:35 - 2013-12-09 23:35 - 00000000 ____D C:\ProgramData\Nico Mak Computing

2013-12-09 23:29 - 2013-05-12 09:52 - 00015344 _____ C:\Users\Lokaladmin\AppData\Local\internal.grp

2013-12-09 23:15 - 2013-12-09 16:31 - 00000000 ____D C:\Program Files (x86)\Mobogenie

2013-12-09 21:52 - 2013-12-09 16:31 - 00000000 ____D C:\Users\Lokaladmin\AppData\Local\Mobogenie

2013-12-09 16:46 - 2013-12-09 16:31 - 00000340 _____ C:\Users\Lokaladmin\daemonprocess.txt

2013-12-09 16:32 - 2013-12-09 16:32 - 00000000 ____D C:\Users\Lokaladmin\Documents\StreamTransport

2013-12-09 16:31 - 2013-12-09 16:31 - 00003072 _____ C:\windows\System32\Tasks\Show-Password Update

2013-12-09 16:31 - 2013-12-09 16:31 - 00000000 ____D C:\Users\Lokaladmin\Documents\Mobogenie

2013-12-09 16:31 - 2013-12-09 16:31 - 00000000 ____D C:\Users\Lokaladmin\AppData\Local\cache

2013-12-09 16:31 - 2013-01-31 14:53 - 00000000 ____D C:\Users\Lokaladmin

2013-12-09 15:51 - 2013-08-24 05:38 - 00001072 _____ C:\Users\Public\Desktop\VLC media player.lnk

2013-12-09 15:50 - 2013-01-31 14:53 - 00000000 ____D C:\Users\Lokaladmin\AppData\Roaming\vlc

2013-12-09 15:10 - 2009-07-14 04:20 - 00000000 ____D C:\windows\rescache

2013-12-09 13:14 - 2013-03-03 12:19 - 00000000 ___RD C:\Users\Lokaladmin\Virtual Machines

2013-12-09 10:24 - 2013-01-31 14:53 - 00001427 _____ C:\Users\Lokaladmin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2013-12-09 10:22 - 2009-07-14 04:20 - 00000000 ____D C:\windows\PolicyDefinitions

2013-12-09 10:20 - 2013-05-22 17:13 - 01597700 _____ C:\windows\SysWOW64\PerfStringBackup.INI

2013-12-09 10:18 - 2013-12-09 10:15 - 00009768 _____ C:\windows\IE11_main.log

2013-12-09 10:16 - 2013-12-09 10:16 - 23212032 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 17142784 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 12995584 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 11220992 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 05765120 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 04240384 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 02764288 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb

2013-12-09 10:16 - 2013-12-09 10:16 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb

2013-12-09 10:16 - 2013-12-09 10:16 - 02332160 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 02166272 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 01993728 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl

2013-12-09 10:16 - 2013-12-09 10:16 - 01926656 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl

2013-12-09 10:16 - 2013-12-09 10:16 - 01818112 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 01394176 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 01228800 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 01156608 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 01051136 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00942592 _____ (Microsoft Corporation) C:\windows\system32\jsIntl.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00940032 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00817664 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00774144 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00708608 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00703488 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00645120 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsIntl.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00626176 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00616104 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dat

2013-12-09 10:16 - 2013-12-09 10:16 - 00616104 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dat

2013-12-09 10:16 - 2013-12-09 10:16 - 00610304 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00574976 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00553472 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00548352 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00523776 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00454656 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00453120 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00440832 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00413696 _____ (Microsoft Corporation) C:\windows\system32\html.iec

2013-12-09 10:16 - 2013-12-09 10:16 - 00367104 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00337408 _____ (Microsoft Corporation) C:\windows\SysWOW64\html.iec

2013-12-09 10:16 - 2013-12-09 10:16 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00263376 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00247808 _____ (Microsoft Corporation) C:\windows\system32\msls31.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00244736 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00243200 _____ (Microsoft Corporation) C:\windows\system32\webcheck.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00238288 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00235520 _____ (Microsoft Corporation) C:\windows\system32\url.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00235008 _____ (Microsoft Corporation) C:\windows\system32\elshyph.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00233472 _____ (Microsoft Corporation) C:\windows\SysWOW64\url.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00218624 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00208384 _____ (Microsoft Corporation) C:\windows\SysWOW64\webcheck.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00195584 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00194048 _____ (Microsoft Corporation) C:\windows\SysWOW64\elshyph.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00182272 _____ (Microsoft Corporation) C:\windows\SysWOW64\msls31.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00167424 _____ (Microsoft Corporation) C:\windows\system32\iexpress.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00164864 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00151552 _____ (Microsoft Corporation) C:\windows\SysWOW64\iexpress.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00147968 _____ (Microsoft Corporation) C:\windows\system32\occache.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00143872 _____ (Microsoft Corporation) C:\windows\system32\wextract.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00139264 _____ (Microsoft Corporation) C:\windows\SysWOW64\wextract.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00139264 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00135680 _____ (Microsoft Corporation) C:\windows\system32\iepeers.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00131072 _____ (Microsoft Corporation) C:\windows\system32\IEAdvpack.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00127488 _____ (Microsoft Corporation) C:\windows\SysWOW64\occache.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00116736 _____ (Microsoft Corporation) C:\windows\SysWOW64\iepeers.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00112128 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00111616 _____ (Microsoft Corporation) C:\windows\SysWOW64\IEAdvpack.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00111616 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00105984 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00101376 _____ (Microsoft Corporation) C:\windows\system32\inseng.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00090112 _____ (Microsoft Corporation) C:\windows\system32\SetIEInstalledDate.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00086016 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00086016 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00084992 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00083968 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00083456 _____ (Microsoft Corporation) C:\windows\SysWOW64\inseng.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00081408 _____ (Microsoft Corporation) C:\windows\system32\icardie.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00077312 _____ (Microsoft Corporation) C:\windows\system32\tdc.ocx

2013-12-09 10:16 - 2013-12-09 10:16 - 00074240 _____ (Microsoft Corporation) C:\windows\SysWOW64\SetIEInstalledDate.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00069632 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00069120 _____ (Microsoft Corporation) C:\windows\SysWOW64\icardie.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00066048 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\tdc.ocx

2013-12-09 10:16 - 2013-12-09 10:16 - 00062464 _____ (Microsoft Corporation) C:\windows\system32\pngfilt.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00056832 _____ (Microsoft Corporation) C:\windows\SysWOW64\pngfilt.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00052224 _____ (Microsoft Corporation) C:\windows\system32\msfeedsbs.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00051200 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00048640 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmler.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\mshtmler.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00048128 _____ (Microsoft Corporation) C:\windows\system32\imgutil.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeedsbs.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00040448 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00036352 _____ (Microsoft Corporation) C:\windows\SysWOW64\imgutil.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00034816 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00033792 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00032768 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00030208 _____ (Microsoft Corporation) C:\windows\system32\licmgr10.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00024576 _____ (Microsoft Corporation) C:\windows\SysWOW64\licmgr10.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00013824 _____ (Microsoft Corporation) C:\windows\system32\mshta.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00013312 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshta.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00013312 _____ (Microsoft Corporation) C:\windows\system32\msfeedssync.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00012800 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeedssync.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll

2013-12-09 10:07 - 2013-12-09 10:07 - 00264616 _____ (Oracle Corporation) C:\windows\SysWOW64\javaws.exe

2013-12-09 10:07 - 2013-12-09 10:07 - 00175016 _____ (Oracle Corporation) C:\windows\SysWOW64\javaw.exe

2013-12-09 10:07 - 2013-12-09 10:07 - 00174504 _____ (Oracle Corporation) C:\windows\SysWOW64\java.exe

2013-12-09 10:07 - 2013-12-09 10:07 - 00096168 _____ (Oracle Corporation) C:\windows\SysWOW64\WindowsAccessBridge-32.dll

2013-12-09 10:07 - 2013-12-09 10:07 - 00000000 ____D C:\ProgramData\Oracle

2013-12-09 10:07 - 2013-12-09 10:07 - 00000000 ____D C:\Program Files (x86)\Java

2013-12-09 09:44 - 2013-12-09 09:44 - 00002195 _____ C:\Users\Public\Desktop\WinZip.lnk

2013-12-09 09:44 - 2013-12-09 09:44 - 00000000 ____D C:\Users\Lokaladmin\AppData\Local\WinZip

2013-12-09 09:44 - 2013-12-09 09:44 - 00000000 ____D C:\ProgramData\WinZip

2013-12-09 09:44 - 2013-12-09 09:44 - 00000000 ____D C:\Program Files\WinZip

2013-12-06 11:18 - 2013-02-09 11:29 - 00000000 ____D C:\Users\Lokaladmin\AppData\Roaming\WinEdt

2013-12-05 15:56 - 2013-01-31 14:53 - 00000000 ____D C:\Users\Lokaladmin\AppData\Local\Microsoft Help

2013-12-05 14:53 - 2012-11-19 15:09 - 00002181 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2013-12-04 12:00 - 2013-02-01 11:50 - 00000542 _____ C:\windows\Tasks\Tägliche zeitgesteuerte Überprüfung.job

2013-12-04 10:10 - 2013-05-09 09:38 - 00000000 ____D C:\nbwin

2013-12-02 20:09 - 2009-07-14 06:32 - 00000000 ____D C:\windows\system32\FxsTmp

2013-12-01 11:38 - 2013-12-01 11:38 - 00000000 _____ C:\windows\system32\vireng.log

2013-12-01 10:46 - 2012-11-19 15:09 - 00004106 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA

2013-12-01 10:46 - 2012-11-19 15:09 - 00003854 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore

2013-11-20 17:58 - 2012-11-19 14:59 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2013-11-20 09:37 - 2013-01-31 15:08 - 00000000 ____D C:\ProgramData\Cisco

2013-11-20 09:37 - 2013-01-31 15:08 - 00000000 ____D C:\Program Files (x86)\Cisco

2013-11-19 12:48 - 2013-11-19 12:48 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2013-11-19 03:33 - 2012-11-16 10:16 - 00267936 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe

2013-11-18 16:44 - 2012-11-16 12:13 - 00000000 ____D C:\ProgramData\Microsoft Help

2013-11-18 16:43 - 2013-08-24 21:30 - 00000000 ____D C:\windows\system32\MRT

2013-11-18 16:42 - 2012-11-16 10:59 - 82896128 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe

2013-11-18 10:29 - 2013-01-31 14:53 - 00000000 ____D C:\Users\Lokaladmin\AppData\Local\Adobe

2013-11-12 16:03 - 2013-11-12 16:03 - 00000000 ____D C:\Program Files\WinDjView

2013-11-12 15:37 - 2013-11-12 15:37 - 00001746 _____ C:\Users\Lokaladmin\Desktop\Caminova - Verknüpfung.lnk

2013-11-12 15:36 - 2013-11-12 15:36 - 00000000 ____D C:\Program Files (x86)\Caminova
 

Files to move or delete:

====================

C:\Users\Lokaladmin\pdf8_ret_O2013_Update_x64.exe
 
 

Some content of TEMP:

====================

C:\Users\Lokaladmin\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe

C:\Users\Lokaladmin\AppData\Local\Temp\Mobogenie_Setup_2.1.23_515.exe

C:\Users\Lokaladmin\AppData\Local\Temp\Show-Password_1030-8101.exe

C:\Users\Lokaladmin\AppData\Local\Temp\vlc-2.1.1-win32.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-12-10 01:36
 

==================== End Of Log ============================

--- --- ---

--- --- ---

HTML-Code:



==================== Memory info =========================== 
 

Percentage of memory in use: 29%

Total physical RAM: 8066.95 MB

Available physical RAM: 5683.05 MB

Total Pagefile: 16132.07 MB

Available Pagefile: 13541.91 MB

Total Virtual: 8192 MB

Available Virtual: 8191.81 MB
 

==================== Drives ================================
 

Drive c: (System) (Fixed) (Total:117.19 GB) (Free:35.3 GB) NTFS

Drive d: (Daten) (Fixed) (Total:814.23 GB) (Free:361.6 GB) NTFS

Drive e: (HDD2) (Fixed) (Total:465.76 GB) (Free:153.76 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 55F6CCAC)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=117 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=814 GB) - (Type=07 NTFS)
 

========================================================

Disk: 1 (Size: 466 GB) (Disk ID: BA62E5A4)

Partition 1: (Not Active) - (Size=466 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

==================== Memory info =========================== 
 

Percentage of memory in use: 31%

Total physical RAM: 8066.95 MB

Available physical RAM: 5536.68 MB

Total Pagefile: 16132.07 MB

Available Pagefile: 13366.07 MB

Total Virtual: 8192 MB

Available Virtual: 8191.81 MB
 

==================== Drives ================================
 

Drive c: (System) (Fixed) (Total:117.19 GB) (Free:35.3 GB) NTFS

Drive d: (Daten) (Fixed) (Total:814.23 GB) (Free:361.6 GB) NTFS

Drive e: (HDD2) (Fixed) (Total:465.76 GB) (Free:153.76 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 55F6CCAC)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=117 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=814 GB) - (Type=07 NTFS)
 

========================================================

Disk: 1 (Size: 466 GB) (Disk ID: BA62E5A4)

Partition 1: (Not Active) - (Size=466 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

==================== Memory info =========================== 
 

Percentage of memory in use: 31%

Total physical RAM: 8066.95 MB

Available physical RAM: 5499.77 MB

Total Pagefile: 16132.07 MB

Available Pagefile: 13373.09 MB

Total Virtual: 8192 MB

Available Virtual: 8191.82 MB
 

==================== Drives ================================
 

Drive c: (System) (Fixed) (Total:117.19 GB) (Free:35.3 GB) NTFS

Drive d: (Daten) (Fixed) (Total:814.23 GB) (Free:361.6 GB) NTFS

Drive e: (HDD2) (Fixed) (Total:465.76 GB) (Free:153.76 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 55F6CCAC)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=117 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=814 GB) - (Type=07 NTFS)
 

========================================================

Disk: 1 (Size: 466 GB) (Disk ID: BA62E5A4)

Partition 1: (Not Active) - (Size=466 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

==================== Memory info =========================== 
 

Percentage of memory in use: 27%

Total physical RAM: 8066.95 MB

Available physical RAM: 5825.19 MB

Total Pagefile: 16132.07 MB

Available Pagefile: 13747.93 MB

Total Virtual: 8192 MB

Available Virtual: 8191.81 MB
 

==================== Drives ================================
 

Drive c: (System) (Fixed) (Total:117.19 GB) (Free:35.27 GB) NTFS

Drive d: (Daten) (Fixed) (Total:814.23 GB) (Free:361.6 GB) NTFS

Drive e: (HDD2) (Fixed) (Total:465.76 GB) (Free:153.76 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 55F6CCAC)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=117 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=814 GB) - (Type=07 NTFS)
 

========================================================

Disk: 1 (Size: 466 GB) (Disk ID: BA62E5A4)

Partition 1: (Not Active) - (Size=466 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

Ich hoffe, dass ich alles richtig gemacht habe.

Viele Grüße (und vielen Dank)
Boethius

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6920

# api_version=3.0.2

# EOSSerial=03238c8a9aa4c54c8d3bcbade308fb53

# engine=16247

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=false

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2013-12-12 10:53:36

# local_time=2013-12-12 11:53:36 (+0100, Mitteleuropäische Zeit  )

# country="Germany"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=5893 16776573 100 94 49206 138518666 0 0

# compatibility_mode=8449 16775165 50 96 145306 27177762 18503 0

# scanned=1260777

# found=2

# cleaned=0

# scan_time=20684

sh=C4D9D3FB9795D0C2A544C8EB5EDA8AF65E56BCE7 ft=1 fh=1eca68baa6aef1eb vn="a variant of Win32/AdWare.AddLyrics.Y application" ac=I fn="C:\AdwCleaner\Quarantine\C
 

\Program Files (x86)\Show-Password\Uninstall.exe.vir"

sh=DCB806D131084D2BB8FFA3CC268FD31E50698A32 ft=1 fh=403247ecc79571cb vn="multiple threats" ac=I fn="C:\Users\Lokaladmin\AppData\Local\Temp\Show-Password_1030
 

-8101.exe"

Code:

 Results of screen317's Security Check version 0.99.77  

 Windows 7 Service Pack 1 x64 (UAC is enabled)  

 Internet Explorer 11  
 ``````````````Antivirus/Firewall Check:`````````````` 

Sophos Anti-Virus   

 WMI entry may not exist for antivirus; attempting automatic update. 
 `````````Anti-malware/Other Utilities Check:````````` 

 Secunia PSI (3.0.0.4001)   

 Malwarebytes Anti-Malware Version 1.75.0.1300  

 Java 7 Update 45  

 Adobe Flash Player 11.9.900.170  

 Adobe Reader XI  

 Mozilla Firefox (25.0.1) 

 Mozilla Thunderbird (17.0.4) 

 Google Chrome 31.0.1650.57  

 Google Chrome 31.0.1650.63  

 Google Chrome Plugins...  
 ````````Process Check: objlist.exe by Laurent````````  

 Malwarebytes Anti-Malware mbamservice.exe  

 Malwarebytes Anti-Malware mbamgui.exe  

 Sophos Sophos Anti-Virus SavService.exe  

 Sophos Sophos Anti-Virus SAVAdminService.exe  

 Sophos Sophos Anti-Virus Web Control swc_service.exe 

 Sophos Sophos Anti-Virus Web Intelligence swi_service.exe 

 Malwarebytes' Anti-Malware mbamscheduler.exe   

 WinZip Malware Protector WinZipMalwareProtector.exe   
 `````````````````System Health check````````````````` 

 Total Fragmentation on Drive C:  
 ````````````````````End of Log``````````````````````

Neuer FRST.log:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-12-2013 03

Ran by Lokaladmin (administrator) on PCWG1300 on 13-12-2013 00:13:40

Running from C:\Users\Lokaladmin\AppData\Local\Downloads

Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 11

Boot Mode: Normal
 

==================== Processes (Whitelisted) =================
 

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE

(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe

(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe

(Gladinet, INC) C:\Program Files (x86)\Nuance\Nuance Cloud Connector\GladFileMonSvc.exe

(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe

() C:\Program Files (x86)\Nuance\Nuance Cloud Connector\WOSVSSSvr.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\HelperService.exe

(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\ConversionService.exe

(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PDF Professional 8\PDFProFiltSrv.exe

(Samsung Electronics Co., Ltd.) C:\Windows\System32\spool\drivers\x64\3\NetFaxServer64.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe

(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\Remote Management System\ManagementAgentNT.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\Remote Management System\RouterNT.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe

(Uwe Sieber - www.uwe-sieber.de) C:\Program Files\USBDLM\USBDLM.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

() C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe

(Ulead Systems, Inc.) C:\Program Files (x86)\Ulead Systems\Ulead PhotoImpact 6\ABMTSR.EXE

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe

(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\concentr.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe

(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\OmniPage18\omnipage.exe

(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe

(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe

(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PDF Professional 8\PdfPro8Hook.exe

(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Gladinet, INC) C:\Program Files (x86)\Nuance\Nuance Cloud Connector\GladinetClient.exe

(Uwe Sieber - www.uwe-sieber.de) C:\Program Files\USBDLM\USBDLM_usr.exe

(Nico Mak Computing) C:\Program Files (x86)\WinZip Malware Protector\WinZipMalwareProtector.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Ghisler Software GmbH) C:\Program Files\totalcmd\TOTALCMD64.EXE
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13192848 2012-08-30] (Realtek Semiconductor)

HKLM\...\Run: [HotKeysCmds] - C:\windows\system32\hkcmd.exe [ ] ()

HKLM\...\Run: [CDAServer] - C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe [456704 2012-02-20] ()

HKLM\...\Run: [CanonSolutionMenu] - C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.EXE [689488 2008-03-11] (CANON INC.)

Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)

HKLM\...\Policies\Explorer: [NoWelcomeScreen] 1

HKCU\...\Policies\Explorer: [NoDesktopCleanupWizard] 1

MountPoints2: {4ec55f1e-cdb0-11e2-8897-10604b852c3e} - I:\LaunchU3.exe -a

HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [290688 2012-10-24] (Intel Corporation)

HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-11-29] (Intel Corporation)

HKLM-x32\...\Run: [ConnectionCenter] - C:\Program Files (x86)\Citrix\ICA Client\concentr.exe [309184 2012-03-28] (Citrix Systems, Inc.)

HKLM-x32\...\Run: [Sophos AutoUpdate Monitor] - C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe [929272 2013-02-13] (Sophos Limited)

HKLM-x32\...\Run: [OmniPage Preload] - C:\Program Files (x86)\Nuance\OmniPage18\omnipage.exe [1467240 2011-07-13] (Nuance Communications, Inc.)

HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [162856 2013-07-22] (Geek Software GmbH)

HKLM-x32\...\Run: [PDF8 Registry Controller] - C:\Program Files (x86)\Nuance\PDF Professional 8\RegistryController.exe [178576 2012-10-23] (Nuance Communications, Inc.)

HKLM-x32\...\Run: [PDFProHook] - C:\Program Files (x86)\Nuance\PDF Professional 8\PdfPro8Hook.exe [2013072 2012-10-23] (Nuance Communications, Inc.)

HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] - C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [707984 2013-10-10] (Cisco Systems, Inc.)

HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

HKLM-x32\...\Run: [mobilegeni daemon] - C:\Program Files (x86)\Mobogenie\DaemonProcess.exe

AppInit_DLLs: C:\Program Files (x86)\Sophos\Sophos Anti-Virus\sophos_detoured_x64.dll [217672 2013-10-21] (Sophos Limited)

AppInit_DLLs-x32: c:\progra~2\sophos\sophos~1\sophos~1.dll [275352 2013-10-21] (Sophos Limited)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.lmu.de/

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x6D65629BD7C3CD01

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE

StartMenuInternet: IEXPLORE.EXE - c:\program files (x86)\internet explorer\iexplore.exe

BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GmbH)

BHO-x32: PlusIEEventHelper Class - {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - C:\Program Files (x86)\Nuance\PDF Professional 8\bin\PlusIEContextMenu.dll (Zeon Corporation)

BHO-x32: SwissAcademic.Citavi.Picker.IEPicker - {609D670F-B735-4da7-AC6D-F3BD358E325E} - C:\Windows\\SysWOW64\mscoree.dll (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Show-Password - {8ce16b24-784d-4da6-9986-866250aa8596} - C:\Program Files (x86)\Show-Password\136.dll No File

BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: ZeonIEEventHelper Class - {C7DA0384-42AA-428c-B832-88AC343DE1A8} - C:\Program Files (x86)\Nuance\PDF Professional 8\bin\gzeoniefavclient.dll (Zeon Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM-x32 - Nuance PDF - {BCCE15AE-AC7E-4bc9-94AF-2A714A412BCB} - C:\Program Files (x86)\Nuance\PDF Professional 8\bin\gzeoniefavclient.dll (Zeon Corporation)

DPF: HKLM-x32 {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: HKLM-x32 {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} hxxp://h20614.www2.hp.com/ediags/gmd/Install/Cab/hpdetect119b.cab

DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter-x32: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Winsock: Catalog9 01 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)

Winsock: Catalog9 02 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)

Winsock: Catalog9 03 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)

Winsock: Catalog9 04 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)

Winsock: Catalog9 05 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)

Winsock: Catalog9 06 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)

Winsock: Catalog9 07 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)

Winsock: Catalog9 08 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)

Winsock: Catalog9 19 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)

Winsock: Catalog9-x64 01 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)

Winsock: Catalog9-x64 02 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)

Winsock: Catalog9-x64 03 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)

Winsock: Catalog9-x64 04 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)

Winsock: Catalog9-x64 05 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)

Winsock: Catalog9-x64 06 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)

Winsock: Catalog9-x64 07 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)

Winsock: Catalog9-x64 08 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)

Winsock: Catalog9-x64 19 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
 

FireFox:

========

FF ProfilePath: C:\Users\Lokaladmin\AppData\Roaming\Mozilla\Firefox\Profiles\gg6wiobf.default

FF Homepage: hxxp://www.google.de/

FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()

FF Plugin: @microsoft.com/GENUINE - C:\windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()

FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\windows\SysWOW64\Adobe\Director\np32dsw_1200112.dll (Adobe Systems, Inc.)

FF Plugin-x32: @caminova.com/DjVuPlugin - C:\Program Files (x86)\Caminova\Document Express DjVu Plug-in\npdjvu.dll (Caminova, Inc.)

FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/GENUINE - C:\windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @videolan.org/vlc,version=2.0.4 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: @videolan.org/vlc,version=2.0.8 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: @videolan.org/vlc,version=2.1.1 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin-x32: ZEON/PDF,version=2.0 - C:\Program Files (x86)\Nuance\PDF Professional 8\bin\nppdf.dll (Zeon Corporation)

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: Tube Dimmer - C:\Users\Lokaladmin\AppData\Roaming\Mozilla\Firefox\Profiles\gg6wiobf.default\Extensions\support@tubedimmerapp.com

FF Extension: WOT - C:\Users\Lokaladmin\AppData\Roaming\Mozilla\Firefox\Profiles\gg6wiobf.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}

FF Extension: DownloadHelper - C:\Users\Lokaladmin\AppData\Roaming\Mozilla\Firefox\Profiles\gg6wiobf.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}

FF Extension: nuance - C:\Users\Lokaladmin\AppData\Roaming\Mozilla\Firefox\Profiles\gg6wiobf.default\Extensions\nuance@pdf8

FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox

FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox

FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt

FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt

FF HKCU\...\Firefox\Extensions: [{da6d9f64-0bec-427b-a62d-6f6f6ce72768}] - C:\Program Files (x86)\Show-Password\136.xpi
 

Chrome: 

=======

CHR HomePage: 

CHR RestoreOnStartup: "hxxp://www.google.de/"

CHR DefaultSearchKeyword: google.de

CHR DefaultSearchProvider: Google

CHR DefaultSearchURL: {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:bookmarkBarPinned}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}

CHR DefaultNewTabURL: {google:baseURL}_/chrome/newtab?{google:RLZ}{google:instantExtendedEnabledParameter}{google:ntpIsThemedParameter}ie={inputEncoding}

CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\PepperFlash\pepflashplayer.dll ()

CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\pdf.dll ()

CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll No File

CHR Plugin: (Java(TM) Platform SE 7 U9) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

CHR Plugin: (Java Deployment Toolkit 7.0.90.5) - C:\Windows\SysWOW64\npDeployJava1.dll No File

CHR Extension: (Google Drive) - C:\Users\Lokaladmin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0

CHR Extension: (YouTube) - C:\Users\Lokaladmin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0

CHR Extension: (Google Search) - C:\Users\Lokaladmin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0

CHR Extension: (Google Wallet) - C:\Users\Lokaladmin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0

CHR Extension: (Gmail) - C:\Users\Lokaladmin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0

CHR HKLM-x32\...\Chrome\Extension: [logekkkdbdidmmcgkonmmonclldogceg] - C:\Program Files (x86)\Show-Password\136.crx

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
 

==================== Services (Whitelisted) =================
 

R2 GladFileMonSvc; C:\Program Files (x86)\Nuance\Nuance Cloud Connector\GladFileMonSvc.exe [29592 2012-09-24] (Gladinet, INC)

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)

R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)

R2 PDFProFiltSrv; C:\Program Files (x86)\Nuance\PDF Professional 8\PDFProFiltSrv.exe [135056 2012-10-23] (Nuance Communications, Inc.)

R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [201360 2012-08-31] (Realtek Semiconductor)

R2 Samsung Network Fax Server; C:\windows\system32\spool\drivers\x64\3\NetFaxServer64.exe [239616 2012-08-07] (Samsung Electronics Co., Ltd.)

R2 SAVAdminService; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe [290296 2013-10-21] (Sophos Limited)

R2 SAVService; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe [206328 2013-10-21] (Sophos Limited)

S3 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1328736 2012-09-24] (Secunia)

R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [656480 2012-09-24] (Secunia)

R2 Sophos Agent; C:\Program Files (x86)\Sophos\Remote Management System\ManagementAgentNT.exe [289856 2013-02-01] (Sophos Limited)

R2 Sophos AutoUpdate Service; C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe [237048 2013-02-13] (Sophos Limited)

R2 Sophos Message Router; C:\Program Files (x86)\Sophos\Remote Management System\RouterNT.exe [818240 2013-02-01] (Sophos Limited)

R2 Sophos Web Control Service; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe [357400 2013-02-01] (Sophos Limited)

R2 swi_service; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe [3109880 2013-10-21] (Sophos Limited)

S2 swi_update_64; C:\ProgramData\Sophos\Web Intelligence\swi_update_64.exe [2012152 2013-10-21] (Sophos Limited)

R2 USBDLM; C:\Program Files\USBDLM\USBDLM.exe [451560 2012-09-09] (Uwe Sieber - www.uwe-sieber.de)

S3 uvnc_service; C:\Program Files (x86)\UltraVNC\WinVNC.exe [2015968 2012-02-14] (UltraVNC)
 

==================== Drivers (Whitelisted) ====================
 

R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)

R1 SAVOnAccess; C:\Windows\System32\DRIVERS\savonaccess.sys [154952 2013-02-01] (Sophos Limited)

S3 sdcfilter; C:\Windows\System32\DRIVERS\sdcfilter.sys [36640 2013-02-01] (Sophos Limited)

S4 SophosBootDriver; C:\Windows\System32\DRIVERS\SophosBootDriver.sys [25608 2013-02-01] (Sophos Plc)

R3 SRS_PremiumSound_Service; C:\Windows\System32\drivers\srs_PremiumSound_amd64.sys [513312 2011-07-18] ()

S3 vpnva; C:\Windows\System32\DRIVERS\vpnva64-6.sys [52080 2013-10-10] (Cisco Systems, Inc.)
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-12-13 00:13 - 2013-12-13 00:13 - 00001163 _____ C:\Users\Lokaladmin\Desktop\SecurityCheck.exe - Verknüpfung.lnk

2013-12-12 11:11 - 2013-12-12 11:11 - 00000767 _____ C:\Users\Lokaladmin\Desktop\JRT.txt

2013-12-12 11:05 - 2013-12-12 11:05 - 00000000 ____D C:\windows\ERUNT

2013-12-12 11:03 - 2013-12-12 11:03 - 01034531 _____ (Thisisu) C:\Users\Lokaladmin\Desktop\JRT.exe

2013-12-12 10:47 - 2013-12-12 10:52 - 00000000 ____D C:\AdwCleaner

2013-12-12 10:46 - 2013-12-12 10:46 - 01226802 _____ C:\Users\Lokaladmin\Desktop\adwcleaner.exe

2013-12-12 09:54 - 2013-12-12 09:54 - 00001597 _____ C:\Users\Lokaladmin\Desktop\FRST64.exe - Verknüpfung.lnk

2013-12-11 23:45 - 2013-12-13 00:13 - 00000000 ____D C:\FRST

2013-12-10 18:26 - 2013-12-10 18:26 - 00001115 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-12-10 18:26 - 2013-12-10 18:26 - 00000000 ____D C:\Users\Lokaladmin\AppData\Roaming\Malwarebytes

2013-12-10 18:26 - 2013-12-10 18:26 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-12-10 18:26 - 2013-12-10 18:26 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-12-10 18:26 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys

2013-12-09 23:35 - 2013-12-12 17:40 - 00003114 _____ C:\windows\System32\Tasks\WinZip Malware Protector_startup

2013-12-09 23:35 - 2013-12-11 07:24 - 00000000 ____D C:\Program Files (x86)\WinZip Malware Protector

2013-12-09 23:35 - 2013-12-09 23:35 - 00001195 _____ C:\Users\Public\Desktop\WinZip Malware Protector.lnk

2013-12-09 23:35 - 2013-12-09 23:35 - 00000000 ____D C:\Users\Lokaladmin\AppData\Roaming\Nico Mak Computing

2013-12-09 23:35 - 2013-12-09 23:35 - 00000000 ____D C:\ProgramData\Nico Mak Computing

2013-12-09 23:35 - 2013-03-15 17:10 - 00020480 _____ C:\windows\system32\wsusnative64.exe

2013-12-09 16:32 - 2013-12-10 18:46 - 00000000 ____D C:\ProgramData\Updater

2013-12-09 16:32 - 2013-12-10 18:46 - 00000000 ____D C:\ProgramData\RHelpers

2013-12-09 16:32 - 2013-12-09 16:32 - 00000000 ____D C:\Users\Lokaladmin\Documents\StreamTransport

2013-12-09 16:31 - 2013-12-12 17:40 - 00000414 _____ C:\windows\Tasks\Show-Password Update.job

2013-12-09 16:31 - 2013-12-09 23:15 - 00000000 ____D C:\Program Files (x86)\Mobogenie

2013-12-09 16:31 - 2013-12-09 21:52 - 00000000 ____D C:\Users\Lokaladmin\AppData\Local\Mobogenie

2013-12-09 16:31 - 2013-12-09 16:46 - 00000340 _____ C:\Users\Lokaladmin\daemonprocess.txt

2013-12-09 16:31 - 2013-12-09 16:31 - 00003072 _____ C:\windows\System32\Tasks\Show-Password Update

2013-12-09 16:31 - 2013-12-09 16:31 - 00000000 ____D C:\Users\Lokaladmin\Documents\Mobogenie

2013-12-09 16:31 - 2013-12-09 16:31 - 00000000 ____D C:\Users\Lokaladmin\AppData\Local\cache

2013-12-09 10:18 - 2013-10-14 18:00 - 00028368 _____ (Microsoft Corporation) C:\windows\system32\IEUDINIT.EXE

2013-12-09 10:16 - 2013-12-09 10:16 - 23212032 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 17142784 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 12995584 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 11220992 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 05765120 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 04240384 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 02764288 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb

2013-12-09 10:16 - 2013-12-09 10:16 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb

2013-12-09 10:16 - 2013-12-09 10:16 - 02332160 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 02166272 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 01993728 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl

2013-12-09 10:16 - 2013-12-09 10:16 - 01926656 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl

2013-12-09 10:16 - 2013-12-09 10:16 - 01818112 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 01394176 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 01228800 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 01156608 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 01051136 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00942592 _____ (Microsoft Corporation) C:\windows\system32\jsIntl.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00940032 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00817664 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00774144 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00708608 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00703488 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00645120 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsIntl.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00626176 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00616104 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dat

2013-12-09 10:16 - 2013-12-09 10:16 - 00616104 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dat

2013-12-09 10:16 - 2013-12-09 10:16 - 00610304 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00574976 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00553472 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00548352 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00523776 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00454656 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00453120 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00440832 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00413696 _____ (Microsoft Corporation) C:\windows\system32\html.iec

2013-12-09 10:16 - 2013-12-09 10:16 - 00367104 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00337408 _____ (Microsoft Corporation) C:\windows\SysWOW64\html.iec

2013-12-09 10:16 - 2013-12-09 10:16 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00263376 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00247808 _____ (Microsoft Corporation) C:\windows\system32\msls31.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00244736 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00243200 _____ (Microsoft Corporation) C:\windows\system32\webcheck.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00238288 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00235520 _____ (Microsoft Corporation) C:\windows\system32\url.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00235008 _____ (Microsoft Corporation) C:\windows\system32\elshyph.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00233472 _____ (Microsoft Corporation) C:\windows\SysWOW64\url.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00218624 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00208384 _____ (Microsoft Corporation) C:\windows\SysWOW64\webcheck.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00195584 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00194048 _____ (Microsoft Corporation) C:\windows\SysWOW64\elshyph.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00182272 _____ (Microsoft Corporation) C:\windows\SysWOW64\msls31.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00167424 _____ (Microsoft Corporation) C:\windows\system32\iexpress.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00164864 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00151552 _____ (Microsoft Corporation) C:\windows\SysWOW64\iexpress.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00147968 _____ (Microsoft Corporation) C:\windows\system32\occache.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00143872 _____ (Microsoft Corporation) C:\windows\system32\wextract.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00139264 _____ (Microsoft Corporation) C:\windows\SysWOW64\wextract.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00139264 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00135680 _____ (Microsoft Corporation) C:\windows\system32\iepeers.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00131072 _____ (Microsoft Corporation) C:\windows\system32\IEAdvpack.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00127488 _____ (Microsoft Corporation) C:\windows\SysWOW64\occache.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00116736 _____ (Microsoft Corporation) C:\windows\SysWOW64\iepeers.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00112128 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00111616 _____ (Microsoft Corporation) C:\windows\SysWOW64\IEAdvpack.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00111616 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00105984 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00101376 _____ (Microsoft Corporation) C:\windows\system32\inseng.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00090112 _____ (Microsoft Corporation) C:\windows\system32\SetIEInstalledDate.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00086016 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00086016 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00084992 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00083968 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00083456 _____ (Microsoft Corporation) C:\windows\SysWOW64\inseng.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00081408 _____ (Microsoft Corporation) C:\windows\system32\icardie.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00077312 _____ (Microsoft Corporation) C:\windows\system32\tdc.ocx

2013-12-09 10:16 - 2013-12-09 10:16 - 00074240 _____ (Microsoft Corporation) C:\windows\SysWOW64\SetIEInstalledDate.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00069632 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00069120 _____ (Microsoft Corporation) C:\windows\SysWOW64\icardie.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00066048 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\tdc.ocx

2013-12-09 10:16 - 2013-12-09 10:16 - 00062464 _____ (Microsoft Corporation) C:\windows\system32\pngfilt.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00056832 _____ (Microsoft Corporation) C:\windows\SysWOW64\pngfilt.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00052224 _____ (Microsoft Corporation) C:\windows\system32\msfeedsbs.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00051200 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00048640 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmler.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\mshtmler.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00048128 _____ (Microsoft Corporation) C:\windows\system32\imgutil.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeedsbs.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00040448 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00036352 _____ (Microsoft Corporation) C:\windows\SysWOW64\imgutil.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00034816 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00033792 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00032768 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00030208 _____ (Microsoft Corporation) C:\windows\system32\licmgr10.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00024576 _____ (Microsoft Corporation) C:\windows\SysWOW64\licmgr10.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00013824 _____ (Microsoft Corporation) C:\windows\system32\mshta.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00013312 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshta.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00013312 _____ (Microsoft Corporation) C:\windows\system32\msfeedssync.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00012800 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeedssync.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll

2013-12-09 10:15 - 2013-12-09 10:18 - 00009768 _____ C:\windows\IE11_main.log

2013-12-09 10:07 - 2013-12-09 10:07 - 00264616 _____ (Oracle Corporation) C:\windows\SysWOW64\javaws.exe

2013-12-09 10:07 - 2013-12-09 10:07 - 00175016 _____ (Oracle Corporation) C:\windows\SysWOW64\javaw.exe

2013-12-09 10:07 - 2013-12-09 10:07 - 00174504 _____ (Oracle Corporation) C:\windows\SysWOW64\java.exe

2013-12-09 10:07 - 2013-12-09 10:07 - 00096168 _____ (Oracle Corporation) C:\windows\SysWOW64\WindowsAccessBridge-32.dll

2013-12-09 10:07 - 2013-12-09 10:07 - 00000000 ____D C:\ProgramData\Oracle

2013-12-09 10:07 - 2013-12-09 10:07 - 00000000 ____D C:\Program Files (x86)\Java

2013-12-09 09:44 - 2013-12-09 09:44 - 00002195 _____ C:\Users\Public\Desktop\WinZip.lnk

2013-12-09 09:44 - 2013-12-09 09:44 - 00000000 ____D C:\Users\Lokaladmin\AppData\Local\WinZip

2013-12-09 09:44 - 2013-12-09 09:44 - 00000000 ____D C:\ProgramData\WinZip

2013-12-09 09:44 - 2013-12-09 09:44 - 00000000 ____D C:\Program Files\WinZip

2013-12-01 11:38 - 2013-12-01 11:38 - 00000000 _____ C:\windows\system32\vireng.log

2013-11-19 12:48 - 2013-11-19 12:48 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2013-11-18 16:33 - 2013-10-04 03:28 - 00190464 _____ (Microsoft Corporation) C:\windows\system32\SmartcardCredentialProvider.dll

2013-11-18 16:33 - 2013-10-04 03:25 - 00197120 _____ (Microsoft Corporation) C:\windows\system32\credui.dll

2013-11-18 16:33 - 2013-10-04 03:24 - 01930752 _____ (Microsoft Corporation) C:\windows\system32\authui.dll

2013-11-18 16:33 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\windows\SysWOW64\SmartcardCredentialProvider.dll

2013-11-18 16:33 - 2013-10-04 02:56 - 01796096 _____ (Microsoft Corporation) C:\windows\SysWOW64\authui.dll

2013-11-18 16:33 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\credui.dll

2013-11-18 16:32 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll

2013-11-18 16:32 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\windows\SysWOW64\crypt32.dll

2013-11-18 16:32 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys

2013-11-18 16:32 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys

2013-11-18 16:32 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll

2013-11-18 16:32 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll

2013-11-18 16:32 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll

2013-11-18 16:32 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll

2013-11-18 16:32 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll

2013-11-18 16:32 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll

2013-11-18 16:32 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\sspicli.dll

2013-11-18 16:32 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll

2013-11-18 16:32 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\windows\SysWOW64\secur32.dll

2013-11-18 16:32 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncrypt.dll

2013-11-18 16:32 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe

2013-11-18 16:32 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\windows\system32\Drivers\cng.sys

2013-11-18 16:31 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\windows\system32\nshwfp.dll

2013-11-18 16:31 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\windows\system32\IKEEXT.DLL

2013-11-18 16:31 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\windows\system32\FWPUCLNT.DLL

2013-11-18 16:31 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\windows\SysWOW64\nshwfp.dll

2013-11-18 16:31 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\windows\SysWOW64\FWPUCLNT.DLL

2013-11-18 16:31 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\windows\system32\gdi32.dll

2013-11-18 16:31 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\windows\SysWOW64\gdi32.dll

2013-11-18 16:31 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\windows\system32\Drivers\afd.sys

2013-11-18 16:31 - 2013-09-04 13:12 - 00343040 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbhub.sys

2013-11-18 16:31 - 2013-09-04 13:11 - 00325120 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbport.sys

2013-11-18 16:31 - 2013-09-04 13:11 - 00099840 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbccgp.sys

2013-11-18 16:31 - 2013-09-04 13:11 - 00052736 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbehci.sys

2013-11-18 16:31 - 2013-09-04 13:11 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbuhci.sys

2013-11-18 16:31 - 2013-09-04 13:11 - 00025600 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbohci.sys

2013-11-18 16:31 - 2013-09-04 13:11 - 00007808 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbd.sys
 

==================== One Month Modified Files and Folders =======
 

2013-12-13 00:13 - 2013-12-13 00:13 - 00001163 _____ C:\Users\Lokaladmin\Desktop\SecurityCheck.exe - Verknüpfung.lnk

2013-12-13 00:13 - 2013-12-11 23:45 - 00000000 ____D C:\FRST

2013-12-13 00:13 - 2013-02-10 00:05 - 00000000 ____D C:\Users\Lokaladmin\Documents\Outlook-Dateien

2013-12-13 00:03 - 2012-11-19 15:13 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job

2013-12-12 23:51 - 2012-11-19 15:09 - 00001110 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-12-12 17:47 - 2009-07-14 11:57 - 00704858 _____ C:\windows\system32\perfh007.dat

2013-12-12 17:47 - 2009-07-14 11:57 - 00151258 _____ C:\windows\system32\perfc007.dat

2013-12-12 17:47 - 2009-07-14 06:13 - 01629372 _____ C:\windows\system32\PerfStringBackup.INI

2013-12-12 17:47 - 2009-07-14 05:45 - 00012272 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-12-12 17:47 - 2009-07-14 05:45 - 00012272 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-12-12 17:43 - 2013-01-31 14:26 - 01949493 _____ C:\windows\WindowsUpdate.log

2013-12-12 17:42 - 2013-05-22 21:01 - 00000000 ____D C:\Users\Lokaladmin\AppData\Local\gladinet

2013-12-12 17:40 - 2013-12-09 23:35 - 00003114 _____ C:\windows\System32\Tasks\WinZip Malware Protector_startup

2013-12-12 17:40 - 2013-12-09 16:31 - 00000414 _____ C:\windows\Tasks\Show-Password Update.job

2013-12-12 17:40 - 2012-11-19 15:09 - 00001106 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-12-12 17:40 - 2009-07-14 06:08 - 00000006 ____H C:\windows\Tasks\SA.DAT

2013-12-12 17:39 - 2009-07-14 05:51 - 00062858 _____ C:\windows\setupact.log

2013-12-12 11:40 - 2013-05-22 17:13 - 01652590 _____ C:\windows\SysWOW64\PerfStringBackup.INI

2013-12-12 11:11 - 2013-12-12 11:11 - 00000767 _____ C:\Users\Lokaladmin\Desktop\JRT.txt

2013-12-12 11:05 - 2013-12-12 11:05 - 00000000 ____D C:\windows\ERUNT

2013-12-12 11:03 - 2013-12-12 11:03 - 01034531 _____ (Thisisu) C:\Users\Lokaladmin\Desktop\JRT.exe

2013-12-12 10:52 - 2013-12-12 10:47 - 00000000 ____D C:\AdwCleaner

2013-12-12 10:46 - 2013-12-12 10:46 - 01226802 _____ C:\Users\Lokaladmin\Desktop\adwcleaner.exe

2013-12-12 09:54 - 2013-12-12 09:54 - 00001597 _____ C:\Users\Lokaladmin\Desktop\FRST64.exe - Verknüpfung.lnk

2013-12-12 09:51 - 2013-02-15 10:09 - 00000099 _____ C:\Users\Public\LMDebug.log

2013-12-11 18:03 - 2012-11-19 15:13 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe

2013-12-11 18:03 - 2012-11-19 15:13 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl

2013-12-11 18:03 - 2012-11-19 15:13 - 00003822 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater

2013-12-11 07:24 - 2013-12-09 23:35 - 00000000 ____D C:\Program Files (x86)\WinZip Malware Protector

2013-12-10 18:54 - 2012-11-14 16:52 - 00549204 _____ C:\windows\PFRO.log

2013-12-10 18:46 - 2013-12-09 16:32 - 00000000 ____D C:\ProgramData\Updater

2013-12-10 18:46 - 2013-12-09 16:32 - 00000000 ____D C:\ProgramData\RHelpers

2013-12-10 18:26 - 2013-12-10 18:26 - 00001115 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-12-10 18:26 - 2013-12-10 18:26 - 00000000 ____D C:\Users\Lokaladmin\AppData\Roaming\Malwarebytes

2013-12-10 18:26 - 2013-12-10 18:26 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-12-10 18:26 - 2013-12-10 18:26 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-12-10 12:55 - 2013-02-09 12:03 - 00000000 ____D C:\Users\Lokaladmin\AppData\Roaming\The Master Genealogist v8

2013-12-09 23:35 - 2013-12-09 23:35 - 00001195 _____ C:\Users\Public\Desktop\WinZip Malware Protector.lnk

2013-12-09 23:35 - 2013-12-09 23:35 - 00000000 ____D C:\Users\Lokaladmin\AppData\Roaming\Nico Mak Computing

2013-12-09 23:35 - 2013-12-09 23:35 - 00000000 ____D C:\ProgramData\Nico Mak Computing

2013-12-09 23:29 - 2013-05-12 09:52 - 00015344 _____ C:\Users\Lokaladmin\AppData\Local\internal.grp

2013-12-09 23:15 - 2013-12-09 16:31 - 00000000 ____D C:\Program Files (x86)\Mobogenie

2013-12-09 21:52 - 2013-12-09 16:31 - 00000000 ____D C:\Users\Lokaladmin\AppData\Local\Mobogenie

2013-12-09 16:46 - 2013-12-09 16:31 - 00000340 _____ C:\Users\Lokaladmin\daemonprocess.txt

2013-12-09 16:32 - 2013-12-09 16:32 - 00000000 ____D C:\Users\Lokaladmin\Documents\StreamTransport

2013-12-09 16:31 - 2013-12-09 16:31 - 00003072 _____ C:\windows\System32\Tasks\Show-Password Update

2013-12-09 16:31 - 2013-12-09 16:31 - 00000000 ____D C:\Users\Lokaladmin\Documents\Mobogenie

2013-12-09 16:31 - 2013-12-09 16:31 - 00000000 ____D C:\Users\Lokaladmin\AppData\Local\cache

2013-12-09 16:31 - 2013-01-31 14:53 - 00000000 ____D C:\Users\Lokaladmin

2013-12-09 15:51 - 2013-08-24 05:38 - 00001072 _____ C:\Users\Public\Desktop\VLC media player.lnk

2013-12-09 15:50 - 2013-01-31 14:53 - 00000000 ____D C:\Users\Lokaladmin\AppData\Roaming\vlc

2013-12-09 15:10 - 2009-07-14 04:20 - 00000000 ____D C:\windows\rescache

2013-12-09 13:14 - 2013-03-03 12:19 - 00000000 ___RD C:\Users\Lokaladmin\Virtual Machines

2013-12-09 10:24 - 2013-01-31 14:53 - 00001427 _____ C:\Users\Lokaladmin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2013-12-09 10:22 - 2009-07-14 04:20 - 00000000 ____D C:\windows\PolicyDefinitions

2013-12-09 10:18 - 2013-12-09 10:15 - 00009768 _____ C:\windows\IE11_main.log

2013-12-09 10:16 - 2013-12-09 10:16 - 23212032 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 17142784 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 12995584 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 11220992 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 05765120 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 04240384 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 02764288 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb

2013-12-09 10:16 - 2013-12-09 10:16 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb

2013-12-09 10:16 - 2013-12-09 10:16 - 02332160 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 02166272 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 01993728 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl

2013-12-09 10:16 - 2013-12-09 10:16 - 01926656 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl

2013-12-09 10:16 - 2013-12-09 10:16 - 01818112 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 01394176 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 01228800 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 01156608 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 01051136 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00942592 _____ (Microsoft Corporation) C:\windows\system32\jsIntl.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00940032 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00817664 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00774144 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00708608 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00703488 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00645120 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsIntl.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00626176 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00616104 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dat

2013-12-09 10:16 - 2013-12-09 10:16 - 00616104 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dat

2013-12-09 10:16 - 2013-12-09 10:16 - 00610304 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00574976 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00553472 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00548352 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00523776 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00454656 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00453120 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00440832 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00413696 _____ (Microsoft Corporation) C:\windows\system32\html.iec

2013-12-09 10:16 - 2013-12-09 10:16 - 00367104 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00337408 _____ (Microsoft Corporation) C:\windows\SysWOW64\html.iec

2013-12-09 10:16 - 2013-12-09 10:16 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00263376 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00247808 _____ (Microsoft Corporation) C:\windows\system32\msls31.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00244736 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00243200 _____ (Microsoft Corporation) C:\windows\system32\webcheck.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00238288 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00235520 _____ (Microsoft Corporation) C:\windows\system32\url.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00235008 _____ (Microsoft Corporation) C:\windows\system32\elshyph.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00233472 _____ (Microsoft Corporation) C:\windows\SysWOW64\url.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00218624 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00208384 _____ (Microsoft Corporation) C:\windows\SysWOW64\webcheck.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00195584 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00194048 _____ (Microsoft Corporation) C:\windows\SysWOW64\elshyph.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00182272 _____ (Microsoft Corporation) C:\windows\SysWOW64\msls31.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00167424 _____ (Microsoft Corporation) C:\windows\system32\iexpress.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00164864 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00151552 _____ (Microsoft Corporation) C:\windows\SysWOW64\iexpress.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00147968 _____ (Microsoft Corporation) C:\windows\system32\occache.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00143872 _____ (Microsoft Corporation) C:\windows\system32\wextract.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00139264 _____ (Microsoft Corporation) C:\windows\SysWOW64\wextract.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00139264 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00135680 _____ (Microsoft Corporation) C:\windows\system32\iepeers.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00131072 _____ (Microsoft Corporation) C:\windows\system32\IEAdvpack.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00127488 _____ (Microsoft Corporation) C:\windows\SysWOW64\occache.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00116736 _____ (Microsoft Corporation) C:\windows\SysWOW64\iepeers.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00112128 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00111616 _____ (Microsoft Corporation) C:\windows\SysWOW64\IEAdvpack.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00111616 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00105984 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00101376 _____ (Microsoft Corporation) C:\windows\system32\inseng.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00090112 _____ (Microsoft Corporation) C:\windows\system32\SetIEInstalledDate.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00086016 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00086016 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00084992 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00083968 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00083456 _____ (Microsoft Corporation) C:\windows\SysWOW64\inseng.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00081408 _____ (Microsoft Corporation) C:\windows\system32\icardie.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00077312 _____ (Microsoft Corporation) C:\windows\system32\tdc.ocx

2013-12-09 10:16 - 2013-12-09 10:16 - 00074240 _____ (Microsoft Corporation) C:\windows\SysWOW64\SetIEInstalledDate.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00069632 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00069120 _____ (Microsoft Corporation) C:\windows\SysWOW64\icardie.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00066048 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\tdc.ocx

2013-12-09 10:16 - 2013-12-09 10:16 - 00062464 _____ (Microsoft Corporation) C:\windows\system32\pngfilt.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00056832 _____ (Microsoft Corporation) C:\windows\SysWOW64\pngfilt.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00052224 _____ (Microsoft Corporation) C:\windows\system32\msfeedsbs.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00051200 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00048640 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmler.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\mshtmler.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00048128 _____ (Microsoft Corporation) C:\windows\system32\imgutil.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeedsbs.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00040448 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00036352 _____ (Microsoft Corporation) C:\windows\SysWOW64\imgutil.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00034816 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00033792 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00032768 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00030208 _____ (Microsoft Corporation) C:\windows\system32\licmgr10.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00024576 _____ (Microsoft Corporation) C:\windows\SysWOW64\licmgr10.dll

2013-12-09 10:16 - 2013-12-09 10:16 - 00013824 _____ (Microsoft Corporation) C:\windows\system32\mshta.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00013312 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshta.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00013312 _____ (Microsoft Corporation) C:\windows\system32\msfeedssync.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00012800 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeedssync.exe

2013-12-09 10:16 - 2013-12-09 10:16 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll

2013-12-09 10:07 - 2013-12-09 10:07 - 00264616 _____ (Oracle Corporation) C:\windows\SysWOW64\javaws.exe

2013-12-09 10:07 - 2013-12-09 10:07 - 00175016 _____ (Oracle Corporation) C:\windows\SysWOW64\javaw.exe

2013-12-09 10:07 - 2013-12-09 10:07 - 00174504 _____ (Oracle Corporation) C:\windows\SysWOW64\java.exe

2013-12-09 10:07 - 2013-12-09 10:07 - 00096168 _____ (Oracle Corporation) C:\windows\SysWOW64\WindowsAccessBridge-32.dll

2013-12-09 10:07 - 2013-12-09 10:07 - 00000000 ____D C:\ProgramData\Oracle

2013-12-09 10:07 - 2013-12-09 10:07 - 00000000 ____D C:\Program Files (x86)\Java

2013-12-09 09:44 - 2013-12-09 09:44 - 00002195 _____ C:\Users\Public\Desktop\WinZip.lnk

2013-12-09 09:44 - 2013-12-09 09:44 - 00000000 ____D C:\Users\Lokaladmin\AppData\Local\WinZip

2013-12-09 09:44 - 2013-12-09 09:44 - 00000000 ____D C:\ProgramData\WinZip

2013-12-09 09:44 - 2013-12-09 09:44 - 00000000 ____D C:\Program Files\WinZip

2013-12-06 11:18 - 2013-02-09 11:29 - 00000000 ____D C:\Users\Lokaladmin\AppData\Roaming\WinEdt

2013-12-05 15:56 - 2013-01-31 14:53 - 00000000 ____D C:\Users\Lokaladmin\AppData\Local\Microsoft Help

2013-12-05 14:53 - 2012-11-19 15:09 - 00002181 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2013-12-04 12:00 - 2013-02-01 11:50 - 00000542 _____ C:\windows\Tasks\Tägliche zeitgesteuerte Überprüfung.job

2013-12-04 10:10 - 2013-05-09 09:38 - 00000000 ____D C:\nbwin

2013-12-02 20:09 - 2009-07-14 06:32 - 00000000 ____D C:\windows\system32\FxsTmp

2013-12-01 11:38 - 2013-12-01 11:38 - 00000000 _____ C:\windows\system32\vireng.log

2013-12-01 10:46 - 2012-11-19 15:09 - 00004106 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA

2013-12-01 10:46 - 2012-11-19 15:09 - 00003854 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore

2013-11-20 17:58 - 2012-11-19 14:59 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2013-11-20 09:37 - 2013-01-31 15:08 - 00000000 ____D C:\ProgramData\Cisco

2013-11-20 09:37 - 2013-01-31 15:08 - 00000000 ____D C:\Program Files (x86)\Cisco

2013-11-19 12:48 - 2013-11-19 12:48 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2013-11-19 03:33 - 2012-11-16 10:16 - 00267936 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe

2013-11-18 16:44 - 2012-11-16 12:13 - 00000000 ____D C:\ProgramData\Microsoft Help

2013-11-18 16:43 - 2013-08-24 21:30 - 00000000 ____D C:\windows\system32\MRT

2013-11-18 16:42 - 2012-11-16 10:59 - 82896128 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe

2013-11-18 10:29 - 2013-01-31 14:53 - 00000000 ____D C:\Users\Lokaladmin\AppData\Local\Adobe
 

Files to move or delete:

====================

C:\Users\Lokaladmin\pdf8_ret_O2013_Update_x64.exe
 
 

Some content of TEMP:

====================

C:\Users\Lokaladmin\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe

C:\Users\Lokaladmin\AppData\Local\Temp\Mobogenie_Setup_2.1.23_515.exe

C:\Users\Lokaladmin\AppData\Local\Temp\Show-Password_1030-8101.exe

C:\Users\Lokaladmin\AppData\Local\Temp\vlc-2.1.1-win32.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-12-10 01:36
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 12-12-2013 03

Ran by Lokaladmin at 2013-12-13 00:14:09

Running from C:\Users\Lokaladmin\AppData\Local\Downloads

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

AV: Sophos Anti-Virus (Enabled - Up to date) {65FBD860-96D8-75EF-C7ED-7BE27E6C498A}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Sophos Anti-Virus (Enabled - Up to date) {DE9A3984-B0E2-7A61-FD5D-409005EB0337}
 

==================== Installed Programs ======================
 

7-Zip 9.20 (x64 edition) (Version: 9.20.00.0)

ACDSee Foto-Manager 12 (x32 Version: 12.0.344)

Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.170)

Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.170)

Adobe Reader XI (11.0.05) - Deutsch (x32 Version: 11.0.05)

Adobe Shockwave Player 12.0 (x32 Version: 12.0.0.112)

ArcSoft PhotoStudio 5.5 (x32)

Canon MP Navigator EX 2.0 (x32)

Canon Utilities Solution Menu (x32)

CanoScan 5600F Scanner Driver

CDBurnerXP (x32 Version: 4.5.1.4003)

Cisco AnyConnect Secure Mobility Client  (x32 Version: 3.1.04072)

Cisco AnyConnect Secure Mobility Client (x32 Version: 3.1.04072)

Citavi (x32 Version: 3.3.0.0)

Citrix Online Plug-in - Web (x32 Version: 12.3.0.8)

Citrix Online Plug-in (DV) (x32 Version: 12.3.0.8)

Citrix Online Plug-in (HDX) (x32 Version: 12.3.0.8)

Citrix Online Plug-in (USB) (x32 Version: 12.3.0.8)

Citrix Online Plug-in (Web) (x32 Version: 12.3.0.8)

Combined Community Codec Pack 2011-11-11 (x32 Version: 2011.11.11.0)

Common Desktop Agent (Version: 1.62.0)

CSVed 2.2.3 (x32 Version: 2.2.3)

Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32)

Die große media Mahjongg-Sammlung (x32 Version: 1.0)

Document Express DjVu Plug-in (x32 Version: 6.1.31831)

EndNote X6 (x32 Version: 16.0.0.6348)

ffdshow v1.2.4422 [2012-04-09] (x32 Version: 1.2.4422.0)

Free YouTube Download version 3.2.14.1022 (x32 Version: 3.2.14.1022)

Google Chrome (x32 Version: 65.61.49216)

Google Update Helper (x32 Version: 1.3.22.3)

GPL Ghostscript (Version: 9.07)

GSview 5.0 (Version: 5.0)

HP Product Detection (x32 Version: 11.14.0004)

Intel(R) Control Center (x32 Version: 1.2.1.1007)

Intel(R) Network Connections 17.2.154.0 (Version: 17.2.154.0)

Intel(R) Processor Graphics (x32 Version: 9.17.10.2932)

Intel(R) Rapid Storage Technology (x32 Version: 11.0.0.1032)

Intel(R) USB 3.0 eXtensible Host Controller Driver (x32 Version: 1.0.6.245)

JabRef 2.9.2 (x32 Version: 2.9.2)

Java 7 Update 45 (x32 Version: 7.0.450)

Java Auto Updater (x32 Version: 2.1.9.8)

Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)

Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)

Microsoft .NET Framework 4.5.1 (Version: 4.5.50938)

Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000)

Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000)

Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000)

Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000)

Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000)

Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000)

Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000)

Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000)

Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000)

Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000)

Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000)

Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000)

Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000)

Microsoft Office Standard 2010 (x32 Version: 14.0.7015.1000)

Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000)

Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193)

Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)

Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.59192)

Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)

MiKTeX 2.9 (x32 Version: 2.9)

Mozilla Firefox 25.0.1 (x86 de) (x32 Version: 25.0.1)

Mozilla Maintenance Service (x32 Version: 25.0.1)

Mozilla Thunderbird 17.0.4 (x86 de) (x32 Version: 17.0.4)

MPC-HC 1.6.4.6052 (x32 Version: 1.6.4.6052)

NAVIGON Fresh 3.4.1 (x32 Version: 3.4.1)

Nota Bene 10 Beta.15 (x32 Version: 10.0.23)

Nuance Cloud Connector (x32 Version: 3.2.960)

Nuance OmniPage 18 (x32 Version: 18.1.0000)

Nuance PDF Converter Professional 8 (Version: 8.10.6267)

Nuance PDF Converter Professional 8 Update x64 (Version: 8.11.0000)

OpenOffice.org 3.4.1 (x32 Version: 3.41.9593)

PDF Architect (x32 Version: 1.1.83.9982)

PDF Split And Merge Basic (Version: 2.2.2)

PDF24 Creator 5.7.0 (x32)

PDFCreator (x32 Version: 1.7.1)

Realtek High Definition Audio Driver (x32 Version: 6.0.1.6730)

ResearchSoft Direct Export Helper (x32)

Samsung Easy Document Creator (x32 Version: 1.04.06 (07.08.2012))

Samsung Easy Printer Manager (x32 Version: 1.02.63.01(09.08.2012))

Samsung Network PC Fax (x32 Version: 1.06.32 (17.07.2012))

Samsung OCR Software (x32 Version: 1.00.05 (10.07.2012))

Samsung Scan Process Machine (x32 Version: 1.00.20.02)

Samsung SCX-472x Series (x32 Version: 1.20 (09.10.2012))

Scansoft PDF Professional (x32)

Secunia PSI (3.0.0.4001) (x32 Version: 3.0.0.4001)

Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32)

Show-Password (x32)

SNS Upload for Easy Document Creator (x32 Version: 1.0.0)

Solitaire Master 2 (x32)

Sophos Anti-Virus (x32 Version: 10.3.1)

Sophos AutoUpdate (x32 Version: 2.9.0.344)

Sophos Remote Management System (x32 Version: 3.4.1)

SRS Premium Sound for HP (Version: 1.12.7600)

swMSM (x32 Version: 12.0.0.1)

The Master Genealogist v8 (x32 Version: 8.08.0000)

Total Commander 64-bit (Remove or Repair) (Version: 8.01)

Ulead Drop Spot 1.0 (x32)

Ulead PhotoImpact 6 (x32)

UltraVnc (x32 Version: 1.0.9.62)

Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (x32)

Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (x32)

Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (x32)

Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (x32)

Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (x32)

Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (x32)

Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32)

Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (x32)

Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition (x32)

Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition (x32)

Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (x32)

Update for Microsoft Word 2010 (KB2827323) 32-Bit Edition (x32)

Updater (x32 Version: 2.6.48)

USB Drive Letter Manager (x64) (Version: 4.7.1.0)

VLC media player 2.1.1 (x32 Version: 2.1.1)

WinDjView 2.0.2 (Version: 2.0.2)

Windows XP Mode (Version: 1.3.7600.16422)

WinEdt (x32)

WinZip 18.0 (Version: 18.0.10661)

WinZip Malware Protector (x32 Version: 2.1.1000.10798)
 

==================== Restore Points  =========================
 
 

==================== Hosts content: ==========================
 

2009-07-14 03:34 - 2013-12-11 16:29 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {2C132C1E-006A-440F-9A32-B78922D69C0A} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-04-04] (Adobe Systems Incorporated)

Task: {3AC0AE38-CA06-43AB-9283-1C872787841C} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2013-07-02] (Oracle Corporation)

Task: {43E0601E-075E-4077-ADA2-2961B792EF9D} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-11-19] (Google Inc.)

Task: {4BEA25FE-B5AE-464E-8C9E-F38B6F1A11A6} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-11-19] (Google Inc.)

Task: {7BEEE175-0D6A-4623-AF7B-C837F5DC6E74} - System32\Tasks\{1D4E25B7-90C5-4B81-8723-E1E9866AB8CC} => D:\LA\LARS.EXE

Task: {956CAC34-7C6D-417C-856F-09CB9EF3FF8B} - System32\Tasks\Tägliche zeitgesteuerte Überprüfung => C:\Program Files (x86)\Sophos\Sophos Anti-Virus\BackgroundScanClient.exe [2013-10-21] (Sophos Limited)

Task: {AEEA7CED-B930-41ED-9094-B8E91D7C2071} - System32\Tasks\{ABC850CD-290C-4174-AD60-BC9214B11215} => C:\Program Files (x86)\PDF Labs\PDFtk Server\bin\pdftk.exe

Task: {B0A69312-495B-49C6-AB93-C1F3296B099E} - System32\Tasks\Show-Password Update => C:\Program Files (x86)\Show-Password\Show_Password.exe

Task: {DBFC9BEF-B39F-495B-84A0-77BE92CF33FD} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-11] (Adobe Systems Incorporated)

Task: {EDA7B09E-94AE-4EC6-B130-D1A989049C33} - System32\Tasks\IPv4 Adresse in DNS registrieren => C:\Windows\System32\ipconfig.exe [2009-07-14] (Microsoft Corporation)

Task: {FAA0FB62-0B4F-4D98-9064-3207877FEA46} - System32\Tasks\WinZip Malware Protector_startup => C:\Program Files (x86)\WinZip Malware Protector\WinZipMalwareProtector.exe [2013-07-15] (Nico Mak Computing)

Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\windows\Tasks\Show-Password Update.job => C:\Program Files (x86)\Show-Password\Show_Password.exe

Task: C:\windows\Tasks\Tägliche zeitgesteuerte Überprüfung.job => C:\Program Files (x86)\Sophos\Sophos Anti-Virus\BackgroundScanClient.exe
 

==================== Loaded Modules (whitelisted) =============
 

2012-08-13 11:27 - 2012-08-13 11:27 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll

2012-02-20 22:23 - 2012-02-20 22:23 - 00051200 _____ () C:\Program Files\Common Files\Common Desktop Agent\CDASrvPS.dll

2012-09-23 23:30 - 2012-09-23 23:30 - 00292760 _____ () C:\Program Files (x86)\Nuance\Nuance Cloud Connector\sqlite3.dll

2012-09-23 23:30 - 2012-09-23 23:30 - 00079768 _____ () C:\Program Files (x86)\Nuance\Nuance Cloud Connector\zlib125.dll

2012-09-23 23:30 - 2012-09-23 23:30 - 00016280 _____ () C:\Program Files (x86)\Nuance\Nuance Cloud Connector\WOSMui.dll

2013-02-01 11:30 - 2013-02-01 11:30 - 01055808 _____ () C:\Program Files (x86)\Sophos\Remote Management System\ACE.dll

2013-02-01 11:30 - 2013-02-01 11:30 - 01539136 _____ () C:\Program Files (x86)\Sophos\Remote Management System\TAO.dll

2013-02-01 11:30 - 2013-02-01 11:30 - 00183360 _____ () C:\Program Files (x86)\Sophos\Remote Management System\TAO_DynamicAny.dll

2013-02-01 11:30 - 2013-02-01 11:30 - 00760896 _____ () C:\Program Files (x86)\Sophos\Remote Management System\LIBEAY32.dll

2013-02-01 11:30 - 2013-02-01 11:30 - 00146496 _____ () C:\Program Files (x86)\Sophos\Remote Management System\SSLEAY32.dll

2013-02-01 11:30 - 2013-02-01 11:30 - 00076864 _____ () C:\Program Files (x86)\Sophos\Remote Management System\ACE_SSL.dll

2013-02-01 11:30 - 2013-02-01 11:30 - 00535616 _____ () C:\Program Files (x86)\Sophos\Remote Management System\TAO_PortableServer.dll

2013-02-01 11:30 - 2013-02-01 11:30 - 00244800 _____ () C:\Program Files (x86)\Sophos\Remote Management System\TAO_SSLIOP.DLL

2013-02-01 11:30 - 2013-02-01 11:30 - 00740416 _____ () C:\Program Files (x86)\Sophos\Remote Management System\TAO_Security.dll

2013-02-01 11:30 - 2013-02-01 11:30 - 00039488 _____ () C:\Program Files (x86)\Sophos\Remote Management System\TAO_Valuetype.dll

2013-02-01 11:30 - 2013-02-01 11:30 - 00244800 _____ () C:\Program Files (x86)\Sophos\Remote Management System\TAO_SSLIOP.dll

2013-02-12 16:04 - 2000-10-03 19:52 - 00020480 _____ () C:\Program Files (x86)\Ulead Systems\Ulead PhotoImpact 6\u32sn.dll

2012-09-23 23:31 - 2012-09-23 23:31 - 00157592 _____ () C:\Program Files (x86)\Nuance\Nuance Cloud Connector\WOSMui_GER.dll

2012-09-23 23:35 - 2012-09-23 23:35 - 00251800 _____ () C:\Program Files (x86)\Nuance\Nuance Cloud Connector\WOSBr_nuance.dll

2013-12-09 23:35 - 2013-02-28 16:53 - 00886272 _____ () C:\Program Files (x86)\WinZip Malware Protector\System.Data.SQLite.dll

2013-12-09 23:35 - 2013-07-15 16:53 - 01717936 _____ () C:\Program Files (x86)\WinZip Malware Protector\aspsys.dll

2013-12-09 23:35 - 2013-02-28 16:53 - 00168448 _____ () C:\Program Files (x86)\WinZip Malware Protector\UNRAR.DLL

2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\Microsoft Shared\office14\Cultures\office.odf

2012-10-23 22:28 - 2012-10-23 22:28 - 00623504 _____ () C:\Program Files (x86)\Common Files\ScanSoft Shared\PDF8\OutlookAddin.dll

2013-03-12 02:32 - 2013-03-12 02:32 - 00341832 _____ () C:\Program Files (x86)\Common Files\ScanSoft Shared\PDF8\MailProcessor7.dll

2013-02-14 14:46 - 2013-02-14 14:46 - 01044048 _____ () C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll

2013-12-05 14:53 - 2013-12-04 03:47 - 00702416 _____ () C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\libglesv2.dll

2013-12-05 14:53 - 2013-12-04 03:47 - 00099792 _____ () C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\libegl.dll

2013-12-05 14:53 - 2013-12-04 03:48 - 04055504 _____ () C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\pdf.dll

2013-12-05 14:53 - 2013-12-04 03:48 - 00399312 _____ () C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\ppGoogleNaClPluginChrome.dll

2013-12-05 14:53 - 2013-12-04 03:47 - 01619408 _____ () C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\ffmpegsumo.dll

2013-08-30 21:33 - 2013-08-30 21:33 - 00172032 _____ () C:\windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\991a8d378a3e64b31c0f4770ba9ae071\IsdiInterop.ni.dll

2012-11-16 10:39 - 2011-11-29 20:00 - 00059392 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll

2013-12-05 14:53 - 2013-12-04 03:48 - 13586896 _____ () C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\PepperFlash\pepflashplayer.dll
 

==================== Alternate Data Streams (whitelisted) =========
 

AlternateDataStreams: C:\ProgramData\TEMP:A303874F

AlternateDataStreams: C:\ProgramData\TEMP:AEC0AC81
 

==================== Safe Mode (whitelisted) ===================
 

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SAVService => ""="service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SAVService => ""="service"
 

==================== Faulty Device Manager Devices =============
 

Name: L:\

Description: MS/MS-Pro/HG    

Class Guid: {eec5ad98-8080-425f-922a-dabf3de3f69a}

Manufacturer: Generic-

Service: WUDFRd

Problem: : This device cannot start. (Code10)

Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.

On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
 

Name: Standardtastatur (PS/2)

Description: Standardtastatur (PS/2)

Class Guid: {4d36e96b-e325-11ce-bfc1-08002be10318}

Manufacturer: (Standardtastaturen)

Service: i8042prt

Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)

Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.

Devices stay in this state if they have been prepared for removal.

After you remove the device, this error disappears.Remove the device, and this error should be resolved.
 

Name: M:\

Description: SD/MMC/MS/MSPRO 

Class Guid: {eec5ad98-8080-425f-922a-dabf3de3f69a}

Manufacturer: Generic-

Service: WUDFRd

Problem: : This device cannot start. (Code10)

Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.

On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
 

Name: I:\

Description: Cruzer          

Class Guid: {eec5ad98-8080-425f-922a-dabf3de3f69a}

Manufacturer: SanDisk 

Service: WUDFRd

Problem: : This device cannot start. (Code10)

Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.

On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
 

Name: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64

Description: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64

Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}

Manufacturer: Cisco Systems

Service: vpnva

Problem: : This device is disabled. (Code 22)

Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
 

Name: K:\

Description: SD/MMC          

Class Guid: {eec5ad98-8080-425f-922a-dabf3de3f69a}

Manufacturer: Generic-

Service: WUDFRd

Problem: : This device cannot start. (Code10)

Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.

On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
 

Name: J:\

Description: SM/xD-Picture   

Class Guid: {eec5ad98-8080-425f-922a-dabf3de3f69a}

Manufacturer: Generic-

Service: WUDFRd

Problem: : This device cannot start. (Code10)

Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.

On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
 

Name: I:\

Description: Compact Flash   

Class Guid: {eec5ad98-8080-425f-922a-dabf3de3f69a}

Manufacturer: Generic-

Service: WUDFRd

Problem: : This device cannot start. (Code10)

Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.

On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (12/12/2013 11:57:14 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in

Manifest- oder Richtliniendatei "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit

einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 

Error: (12/12/2013 06:05:58 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in

Manifest- oder Richtliniendatei "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit

einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 

Error: (12/12/2013 06:05:52 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in

Manifest- oder Richtliniendatei "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit

einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 

Error: (12/12/2013 06:05:52 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in

Manifest- oder Richtliniendatei "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit

einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 

Error: (12/12/2013 06:05:42 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in

Manifest- oder Richtliniendatei "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit

einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 
 

System errors:

=============
 

Microsoft Office Sessions:

=========================

Error: (12/12/2013 11:57:14 PM) (Source: SideBySide)(User: )

Description: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe
 

Error: (12/12/2013 06:05:58 PM) (Source: SideBySide)(User: )

Description: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Lokaladmin\AppData\Local\Downloads\esetsmartinstaller_enu.exe
 

Error: (12/12/2013 06:05:52 PM) (Source: SideBySide)(User: )

Description: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Lokaladmin\AppData\Local\Downloads\esetsmartinstaller_enu.exe
 

Error: (12/12/2013 06:05:52 PM) (Source: SideBySide)(User: )

Description: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Lokaladmin\AppData\Local\Downloads\esetsmartinstaller_enu.exe
 

Error: (12/12/2013 06:05:42 PM) (Source: SideBySide)(User: )

Description: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Lokaladmin\AppData\Local\Downloads\esetsmartinstaller_enu.exe
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 42%

Total physical RAM: 8066.95 MB

Available physical RAM: 4654.17 MB

Total Pagefile: 16132.07 MB

Available Pagefile: 13206.24 MB

Total Virtual: 8192 MB

Available Virtual: 8191.81 MB
 

==================== Drives ================================
 

Drive c: (System) (Fixed) (Total:117.19 GB) (Free:38.51 GB) NTFS

Drive d: (Daten) (Fixed) (Total:814.23 GB) (Free:363.39 GB) NTFS

Drive e: (HDD2) (Fixed) (Total:465.76 GB) (Free:153.76 GB) NTFS

Drive f: () (Removable) (Total:1.92 GB) (Free:1.13 GB) FAT

Drive g: () (Fixed) (Total:931.51 GB) (Free:271.45 GB) NTFS

Drive i: (U3 System) (CDROM) (Total:0.01 GB) (Free:0 GB) CDFS

Drive j: () (Removable) (Total:7.47 GB) (Free:3.71 GB) FAT32

Drive k: () (Removable) (Total:7.52 GB) (Free:7.43 GB) FAT32
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 55F6CCAC)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=117 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=814 GB) - (Type=07 NTFS)
 

========================================================

Disk: 1 (Size: 466 GB) (Disk ID: BA62E5A4)

Partition 1: (Not Active) - (Size=466 GB) - (Type=07 NTFS)
 

========================================================

Disk: 7 (Size: 932 GB) (Disk ID: E9C5E594)

Partition 1: (Not Active) - (Size=932 GB) - (Type=07 NTFS)
 

========================================================

Disk: 8 (Size: 2 GB) (Disk ID: 91F72D24)

Partition 1: (Active) - (Size=2 GB) - (Type=06)
 

========================================================

Disk: 9 (Size: 7 GB) (Disk ID: 00000000)

Partition 1: (Not Active) - (Size=7 GB) - (Type=0B)
 

========================================================

Disk: 10 (Size: 8 GB) (Disk ID: 6E652072)

No partition Table on disk 10.
 

==================== End Of Log ============================

Es sieht ja so aus, dass "Störenfriede" gefunden sind. Wäre schön!

Viele Grüße
Boethius

Hallo schrauber,

es sieht so aus, dass das Problem auf meinem Computer gelöst ist. Jedenfalls sehe ich keine Doppeltunterstreichungen mehr. Wenn es so ist, so danke ich Dir GANZ herzlich.

Kannst Du aus meinen Files entnehmen, wo ich den Trojaner eingefangen habe oder was ich falsch gemacht habe? Ich würde gern in Zukunft Ähnliches vermeiden.

Da Ihr wahrscheinlich (weitgehend) ehrenamtlich arbeitet, möchte ich etwas spenden. Dafür ist ja sicherlich der Link da. Ein etwas deutlicherer Hinweis auf die Möglichkeit zu spenden wäre wohl sinnvoll. Vermutlich vergessen viele Nutzer der Seite, dass nur Fachleute die Probleme lösen können, und das würde man sonst teuer bezahlen.

Also noch einmal ganz herzlichen Dank!
Boethius

Woher das kommt ist leider nie nachzuvollziehen.

Fertig :)

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Hallo schrauber,

Habe alle Deine Vorschläge befolgt. Hoffentlich gibt es jetzt keine neuen Probleme.

Noch einmal vielen Dank.
Boethius