Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Antivir: TR/Crypt.ZPACK.50636 (https://www.trojaner-board.de/149941-antivir-tr-crypt-zpack-50636-a.html)

KuniP 18.02.2014 11:27
Antivir: TR/Crypt.ZPACK.50636
 
Hallo,

gleicher bzw ähnlicher Fall wie hier:
http://www.trojaner-board.de/136453-...t-de-spam.html

Mail mit Betreff
"Foto 14 02 2014"
und Anhang
"Foto_14_02_2014_IMG_125934.zip"
wurde geöffnet :-(

Antivir sagte:
Code:
In der Datei 'C:\Users\UP\AppData\Local\Temp\Rar$DI90.576\Foto_14_02_2014_IMG_125934.JPEG.PIF'
wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.ZPACK.50636' [trojan] gefunden.
Ausgeführte Aktion: Zugriff verweigern
Code:
In der Datei 'C:\Users\UP\AppData\Local\Temp\Rar$DI90.576\Foto_14_02_2014_IMG_125934.JPEG.PIF'
wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.ZPACK.50636' [trojan] gefunden.
Ausgeführte Aktion: Übergeben an Scanner

Was sollte ich tun?

Danke Euch mal wieder... :-(

schrauber 18.02.2014 11:31
hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)


KuniP 18.02.2014 11:55

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 16-02-2014
Ran by UP (administrator) on UP-PC on 18-02-2014 11:42:57
Running from C:\Users\UP\Desktop
Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(APN LLC.) C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe
(Renesas Electronics Corporation) C:\Program Files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Brother Industries, Ltd.) C:\Program Files\Browny02\Brother\BrStMonW.exe
(Brother Industries, Ltd.) C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
(APN) C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
() C:\Program Files\JFritz\jfritz.exe
(ICS) C:\Program Files\ICS\CashM\cashm.exe
(Brother Industries, Ltd.) C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
(Oracle Corporation) C:\Program Files\Java\jre7\launch4j-tmp\jfritz.exe
(Brother Industries, Ltd.) C:\Program Files\Brother\Brmfcmon\BrMfimon.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Star Finanz-Software Entwicklung und Vertriebs GmbH) C:\Program Files\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\system32\UI0Detect.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version7\TeamViewer.exe
(Brother Industries, Ltd.) C:\Program Files\Browny02\BrYNSvc.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version7\tv_w32.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jucheck.exe
(TeamViewer GmbH) c:\program files\teamviewer\version7\TeamViewer_Desktop.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [NUSB3MON] - C:\Program Files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [10082920 2011-05-03] (Realtek Semiconductor)
HKLM\...\Run: [BrStsMon00] - C:\Program Files\Browny02\Brother\BrStMonW.exe [2621440 2010-06-10] (Brother Industries, Ltd.)
HKLM\...\Run: [BrMfcWnd] - C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM\...\Run: [ControlCenter3] - C:\Program Files\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM\...\Run: [StartCCC] - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642656 2013-03-28] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [ApnTBMon] - C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1778640 2014-01-11] (APN)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-17] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
Startup: C:\Users\UP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CashMaster starten.lnk
ShortcutTarget: CashMaster starten.lnk -> C:\Program Files\ICS\CashM\cashm.exe (ICS)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x7858A50A8866CD01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
SearchScopes: HKLM - DefaultScope value is missing.
BHO: SteadyVideoBHO Class - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_07-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_07-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_07-windows-i586.cab
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Winsock: Catalog9 01 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 02 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 03 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 04 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 05 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 06 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 07 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 08 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 33 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\UP\AppData\Roaming\Mozilla\Firefox\Profiles\qets9qo8.default
FF DefaultSearchEngine: Ask Search
FF SearchEngineOrder.1: Ask Search
FF SelectedSearchEngine: user_pref("browser.search.selectedEngine", "");
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_44.dll ()
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf - C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll No File
FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF SearchPlugin: C:\Users\UP\AppData\Roaming\Mozilla\Firefox\Profiles\qets9qo8.default\searchplugins\ask-search.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF HKLM\...\Firefox\Extensions: [gcffxtbr@WeatherBlink.com] - C:\Program Files\WeatherBlink\bar\1.bin

========================== Services (Whitelisted) =================

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [291840 2013-03-28] (Advanced Micro Devices, Inc.)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440376 2013-12-17] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-19] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1011768 2013-12-17] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2014-01-11] (APN LLC.)
R3 BrYNSvc; C:\Program Files\Browny02\BrYNSvc.exe [245760 2010-01-25] (Brother Industries, Ltd.)
S2 StarMoney 7.0 OnlineUpdate; C:\Program Files\StarMoney 7.0\ouservice\StarMoneyOnlineUpdate.exe [554160 2011-11-08] (Star Finanz - Software Entwicklung und Vertriebs GmbH)
S2 StarMoney 8.0 OnlineUpdate; C:\Program Files\StarMoney 8.0\ouservice\StarMoneyOnlineUpdate.exe [699680 2012-12-21] (Star Finanz - Software Entwicklung und Vertriebs GmbH)
R2 StarMoney 9.0 OnlineUpdate; C:\Program Files\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe [663184 2014-01-27] (Star Finanz-Software Entwicklung und Vertriebs GmbH)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135648 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-19] (Avira Operations GmbH & Co. KG)
R2 CBN; C:\Windows\System32\Drivers\CBN.SYS [17408 2011-06-20] (MARX Datentechnik GmbH )
S3 netr28u; C:\Windows\System32\DRIVERS\netr28u.sys [657408 2009-07-13] (Ralink Technology Corp.)
S3 nusb3hub; C:\Windows\System32\DRIVERS\nusb3hub.sys [63872 2011-02-10] (Renesas Electronics Corporation)
S3 nusb3xhc; C:\Windows\System32\DRIVERS\nusb3xhc.sys [141952 2011-02-10] (Renesas Electronics Corporation)
R1 OxPPort; C:\Windows\System32\DRIVERS\OxPPort.sys [82048 2008-07-31] (OEM)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-08-07] (Avira GmbH)
S3 amdiox86; system32\DRIVERS\amdiox86.sys [X]
S3 catchme; \??\C:\Users\UP\AppData\Local\Temp\catchme.sys [X]
S3 OxMf; system32\DRIVERS\OxMf.sys [X]
S3 OxSer; system32\DRIVERS\OxSer.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-02-18 11:42 - 2014-02-18 11:43 - 00011502 _____ () C:\Users\UP\Desktop\FRST.txt
2014-02-18 11:42 - 2014-02-18 11:42 - 00000000 ____D () C:\FRST
2014-02-18 11:41 - 2014-02-18 11:41 - 01141248 _____ (Farbar) C:\Users\UP\Desktop\FRST.exe
2014-02-18 10:11 - 2014-02-18 10:11 - 00000000 ____D () C:\Users\UP\AppData\Local\{A666324B-8D05-42B9-9ABA-5CBD2C832237}
2014-02-15 09:59 - 2014-02-15 10:00 - 00000000 ____D () C:\Users\UP\AppData\Local\{CF797748-0DF1-4F4B-8C7B-C7161F6509AD}
2014-02-14 19:29 - 2014-02-06 11:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-14 19:29 - 2014-02-06 11:19 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-02-14 19:29 - 2014-02-06 11:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-02-14 19:29 - 2014-02-06 11:00 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-02-14 19:29 - 2014-02-06 10:57 - 02168320 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-14 19:29 - 2014-02-06 10:52 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-14 19:29 - 2014-02-06 10:52 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-02-14 19:29 - 2014-02-06 10:49 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-14 19:29 - 2014-02-06 10:47 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-14 19:29 - 2014-02-06 10:47 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-02-14 19:29 - 2014-02-06 10:46 - 00553472 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-02-14 19:29 - 2014-02-06 10:34 - 00208896 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-02-14 19:29 - 2014-02-06 10:25 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-02-14 19:29 - 2014-02-06 10:13 - 00524288 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-14 19:29 - 2014-02-06 10:09 - 01964032 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-14 19:29 - 2014-02-06 09:41 - 01820160 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-14 19:29 - 2014-02-06 09:36 - 01156096 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-14 19:29 - 2014-02-06 09:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-02-14 19:28 - 2014-02-06 11:38 - 17103872 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-14 19:28 - 2014-02-06 10:25 - 04244480 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-14 19:28 - 2014-02-06 10:03 - 11266048 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-14 19:16 - 2013-12-21 09:56 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-02-14 12:46 - 2014-02-14 12:46 - 00000000 ____D () C:\Users\UP\AppData\Local\{53DB692D-94BE-419E-8275-C26553A38CB7}
2014-02-14 08:56 - 2014-01-01 00:05 - 00420008 _____ () C:\Windows\system32\locale.nls
2014-02-14 08:56 - 2013-12-25 00:09 - 01987584 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-02-14 08:56 - 2013-12-06 03:02 - 01237504 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-02-14 08:56 - 2013-12-06 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-02-14 08:56 - 2013-12-04 03:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll
2014-02-14 08:56 - 2013-12-04 03:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll
2014-02-14 08:56 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll
2014-02-14 08:56 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll
2014-02-14 08:56 - 2013-12-04 03:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll
2014-02-14 08:56 - 2013-12-04 02:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe
2014-02-14 08:56 - 2013-12-04 02:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe
2014-02-14 08:56 - 2013-12-04 02:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe
2014-02-14 08:56 - 2013-12-04 02:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe
2014-02-14 08:56 - 2013-11-26 09:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2014-02-13 10:38 - 2014-02-13 10:39 - 00000000 ____D () C:\Users\UP\AppData\Local\{9D29CC3A-E4E3-4F28-B264-921692D02196}
2014-02-12 09:00 - 2014-02-12 09:00 - 00000000 ____D () C:\Users\UP\AppData\Local\{E759892A-13F6-4AC1-97E7-4F836DFE7728}
2014-02-11 11:21 - 2014-02-11 11:22 - 00000000 ____D () C:\Users\UP\AppData\Local\{1DCF65B6-ACCA-46EE-9445-CF628AF9FDF1}
2014-02-08 09:36 - 2014-02-08 09:36 - 00000000 ____D () C:\Users\UP\AppData\Local\{05FB8020-E0B2-42B0-8081-AFCEC41ABF1D}
2014-02-07 15:40 - 2014-02-07 15:41 - 00000000 ____D () C:\Users\UP\AppData\Local\{75908841-A0A3-4D33-ADC1-DFA291D50AC9}
2014-02-06 11:17 - 2014-02-06 11:17 - 00000000 ____D () C:\Users\UP\AppData\Local\{6C2F377A-2375-42FD-A58E-36DD045A1B60}
2014-02-05 08:55 - 2014-02-05 08:55 - 00000000 ____D () C:\Users\UP\AppData\Local\{B1B0E3E3-119D-4EE9-BE97-EE6DB831E7F9}
2014-02-04 10:20 - 2014-02-04 10:20 - 00000000 ____D () C:\Users\UP\AppData\Local\{AE2826C9-88A8-42F9-8A86-15006BC31278}
2014-02-01 09:53 - 2014-02-01 09:53 - 00000000 ____D () C:\Users\UP\AppData\Local\{C44682F2-A2A6-4A72-8D31-193AEAF20C55}
2014-01-31 12:57 - 2014-01-31 12:57 - 00000000 ____D () C:\Users\UP\AppData\Local\{74126091-6B30-422B-B6F4-1213AF805F24}
2014-01-30 08:58 - 2014-01-30 08:58 - 00000000 ____D () C:\Users\UP\AppData\Local\{7B612224-DF10-410D-B3C8-F631261E5A8C}
2014-01-29 09:13 - 2014-01-29 09:13 - 00000000 ____D () C:\Users\UP\AppData\Local\{8D1E78EF-FF7E-45CC-8518-87545BCD8767}
2014-01-25 14:32 - 2014-01-25 14:32 - 00000000 ____D () C:\Users\UP\AppData\Local\{29D7A13E-6AF6-486D-B84E-9628F9DB474E}
2014-01-23 12:00 - 2014-01-23 12:01 - 00000000 ____D () C:\Users\UP\AppData\Local\{ECED7E1E-ABA9-4317-9865-39375F81843B}
2014-01-22 15:39 - 2014-01-22 15:39 - 00000000 ____D () C:\Users\UP\AppData\Local\{CB95F4F7-9017-4D5B-B163-4317B936C76A}

==================== One Month Modified Files and Folders =======

2014-02-18 11:43 - 2014-02-18 11:42 - 00011502 _____ () C:\Users\UP\Desktop\FRST.txt
2014-02-18 11:42 - 2014-02-18 11:42 - 00000000 ____D () C:\FRST
2014-02-18 11:41 - 2014-02-18 11:41 - 01141248 _____ (Farbar) C:\Users\UP\Desktop\FRST.exe
2014-02-18 10:54 - 2011-06-19 19:32 - 01665871 _____ () C:\Windows\WindowsUpdate.log
2014-02-18 10:11 - 2014-02-18 10:11 - 00000000 ____D () C:\Users\UP\AppData\Local\{A666324B-8D05-42B9-9ABA-5CBD2C832237}
2014-02-18 09:05 - 2009-07-14 05:34 - 00016192 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-18 09:05 - 2009-07-14 05:34 - 00016192 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-18 09:03 - 2013-11-02 12:54 - 00000000 ____D () C:\Program Files\StarMoney 9.0
2014-02-18 08:57 - 2012-01-06 15:08 - 00000000 ____D () C:\Users\UP\AppData\Roaming\JFritz
2014-02-15 12:22 - 2012-09-13 10:59 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-15 10:00 - 2014-02-15 09:59 - 00000000 ____D () C:\Users\UP\AppData\Local\{CF797748-0DF1-4F4B-8C7B-C7161F6509AD}
2014-02-15 09:44 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\rescache
2014-02-15 09:28 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-02-15 09:01 - 2011-06-19 19:45 - 01512418 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-15 08:55 - 2009-07-14 05:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-15 08:55 - 2009-07-14 05:39 - 00058762 _____ () C:\Windows\setupact.log
2014-02-14 19:24 - 2013-08-16 18:22 - 00000000 ____D () C:\Windows\system32\MRT
2014-02-14 19:22 - 2011-06-22 07:56 - 85946576 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-02-14 19:15 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-02-14 12:46 - 2014-02-14 12:46 - 00000000 ____D () C:\Users\UP\AppData\Local\{53DB692D-94BE-419E-8275-C26553A38CB7}
2014-02-13 10:39 - 2014-02-13 10:38 - 00000000 ____D () C:\Users\UP\AppData\Local\{9D29CC3A-E4E3-4F28-B264-921692D02196}
2014-02-12 09:00 - 2014-02-12 09:00 - 00000000 ____D () C:\Users\UP\AppData\Local\{E759892A-13F6-4AC1-97E7-4F836DFE7728}
2014-02-11 11:22 - 2014-02-11 11:21 - 00000000 ____D () C:\Users\UP\AppData\Local\{1DCF65B6-ACCA-46EE-9445-CF628AF9FDF1}
2014-02-08 09:36 - 2014-02-08 09:36 - 00000000 ____D () C:\Users\UP\AppData\Local\{05FB8020-E0B2-42B0-8081-AFCEC41ABF1D}
2014-02-08 08:44 - 2009-07-14 05:53 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-02-07 15:41 - 2014-02-07 15:40 - 00000000 ____D () C:\Users\UP\AppData\Local\{75908841-A0A3-4D33-ADC1-DFA291D50AC9}
2014-02-06 11:47 - 2011-06-20 19:50 - 00001101 _____ () C:\Windows\Brpfx04a.ini
2014-02-06 11:38 - 2014-02-14 19:28 - 17103872 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-06 11:20 - 2014-02-14 19:29 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-06 11:19 - 2014-02-14 19:29 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-02-06 11:17 - 2014-02-06 11:17 - 00000000 ____D () C:\Users\UP\AppData\Local\{6C2F377A-2375-42FD-A58E-36DD045A1B60}
2014-02-06 11:01 - 2014-02-14 19:29 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-02-06 11:00 - 2014-02-14 19:29 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-02-06 10:57 - 2014-02-14 19:29 - 02168320 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-06 10:52 - 2014-02-14 19:29 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-06 10:52 - 2014-02-14 19:29 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-02-06 10:49 - 2014-02-14 19:29 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-06 10:47 - 2014-02-14 19:29 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-06 10:47 - 2014-02-14 19:29 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-02-06 10:46 - 2014-02-14 19:29 - 00553472 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-02-06 10:34 - 2014-02-14 19:29 - 00208896 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-02-06 10:25 - 2014-02-14 19:29 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-02-06 10:25 - 2014-02-14 19:28 - 04244480 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-06 10:13 - 2014-02-14 19:29 - 00524288 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-06 10:09 - 2014-02-14 19:29 - 01964032 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-06 10:03 - 2014-02-14 19:28 - 11266048 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-06 09:41 - 2014-02-14 19:29 - 01820160 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-06 09:36 - 2014-02-14 19:29 - 01156096 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-06 09:34 - 2014-02-14 19:29 - 00703488 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-02-05 11:22 - 2012-09-13 10:59 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-02-05 11:22 - 2012-09-13 10:59 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-02-05 08:55 - 2014-02-05 08:55 - 00000000 ____D () C:\Users\UP\AppData\Local\{B1B0E3E3-119D-4EE9-BE97-EE6DB831E7F9}
2014-02-04 10:20 - 2014-02-04 10:20 - 00000000 ____D () C:\Users\UP\AppData\Local\{AE2826C9-88A8-42F9-8A86-15006BC31278}
2014-02-01 09:53 - 2014-02-01 09:53 - 00000000 ____D () C:\Users\UP\AppData\Local\{C44682F2-A2A6-4A72-8D31-193AEAF20C55}
2014-01-31 12:57 - 2014-01-31 12:57 - 00000000 ____D () C:\Users\UP\AppData\Local\{74126091-6B30-422B-B6F4-1213AF805F24}
2014-01-30 08:58 - 2014-01-30 08:58 - 00000000 ____D () C:\Users\UP\AppData\Local\{7B612224-DF10-410D-B3C8-F631261E5A8C}
2014-01-29 09:13 - 2014-01-29 09:13 - 00000000 ____D () C:\Users\UP\AppData\Local\{8D1E78EF-FF7E-45CC-8518-87545BCD8767}
2014-01-28 18:16 - 2014-01-17 14:38 - 00000000 ____D () C:\Users\UP\Desktop\preise neu
2014-01-25 14:32 - 2014-01-25 14:32 - 00000000 ____D () C:\Users\UP\AppData\Local\{29D7A13E-6AF6-486D-B84E-9628F9DB474E}
2014-01-23 12:01 - 2014-01-23 12:00 - 00000000 ____D () C:\Users\UP\AppData\Local\{ECED7E1E-ABA9-4317-9865-39375F81843B}
2014-01-22 15:39 - 2014-01-22 15:39 - 00000000 ____D () C:\Users\UP\AppData\Local\{CB95F4F7-9017-4D5B-B163-4317B936C76A}

Some content of TEMP:
====================
C:\Users\UP\AppData\Local\Temp\APNSetup.exe
C:\Users\UP\AppData\Local\Temp\AskSLib.dll
C:\Users\UP\AppData\Local\Temp\avgnt.exe
C:\Users\UP\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\UP\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\UP\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-02-08 10:37

==================== End Of Log ============================
--- --- ---


Code:
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 16-02-2014
Ran by UP at 2014-02-18 11:43:55
Running from C:\Users\UP\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

Adobe Flash Player 12 ActiveX (Version: 12.0.0.44 - Adobe Systems Incorporated)
Adobe Flash Player 12 Plugin (Version: 12.0.0.44 - Adobe Systems Incorporated)
AMD Accelerated Video Transcoding (Version: 12.10.100.30328 - Advanced Micro Devices, Inc.) Hidden
AMD APP SDK Runtime (Version: 2.4.650.9 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Install Manager (Version: 8.0.911.0 - Advanced Micro Devices, Inc.)
AMD Drag and Drop Transcoding (Version: 2.00.0000 - ATI Technologies Inc.) Hidden
AMD Fuel (Version: 2013.0328.2218.38225 - Ihr Firmenname) Hidden
AMD Media Foundation Decoders (Version: 1.0.80328.2203 - Advanced Micro Devices, Inc.) Hidden
AMD Steady Video Plug-In  (Version: 2.06.0000 - AMD) Hidden
AMD VISION Engine Control Center (Version: 2013.0328.2218.38225 - Ihr Firmenname) Hidden
Ask Toolbar (Version: 12.10.0.18 - APN, LLC) <==== ATTENTION
Avira Free Antivirus (Version: 14.0.2.286 - Avira)
Brother MFL-Pro Suite MFC-5890CN (Version: 1.0.1.0 - Brother Industries, Ltd.)
CashMaster V1.40.021 (Version: 1.40.0021 - ICS)
Catalyst Control Center - Branding (Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (Version: 2013.0328.2218.38225 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (Version: 2013.0328.2218.38225 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (Version: 2013.0328.2218.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
ccc-utility (Version: 2013.0328.2218.38225 - Advanced Micro Devices, Inc.) Hidden
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
Foxit Reader 5.0 (Version: 5.0.1.0527 - Foxit Corporation)
HL-2250DN (Version: 1.0.6.0 - Brother Industries, Ltd.)
Java 7 Update 45 (Version: 7.0.450 - Oracle)
Java Auto Updater (Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
JFritz 0.7.4.2 (Version:  - JFritz Team)
Junk Mail filter update (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 26.0 (x86 de) (Version: 26.0 - Mozilla)
Mozilla Maintenance Service (Version: 26.0 - Mozilla)
MSVCRT (Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0 - Microsoft Corporation)
OpenOffice.org 3.3 (Version: 3.3.9567 - OpenOffice.org)
Realtek Ethernet Controller Driver (Version: 7.43.321.2011 - Realtek)
Realtek High Definition Audio Driver (Version: 6.0.1.6363 - Realtek Semiconductor Corp.)
Renesas Electronics USB 3.0 Host Controller Driver (Version: 2.0.34.0 - Renesas Electronics Corporation)
Renesas Electronics USB 3.0 Host Controller Driver (Version: 2.0.34.0 - Renesas Electronics Corporation) Hidden
StarMoney (Version: 2.0 - StarFinanz) Hidden
StarMoney (Version: 3.0.0.124 - StarFinanz) Hidden
StarMoney (Version: 4.0.0.203 - StarFinanz) Hidden
StarMoney 7.0  (Version: 7.0 - Star Finanz GmbH)
StarMoney 8.0  (Version: 8.0 - Star Finanz GmbH)
StarMoney 9.0  (Version: 9.0 - Star Finanz GmbH)
TeamViewer 7 (Version: 7.0.14563 - TeamViewer)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (Version: 3 - Microsoft Corporation)
Windows Live Communications Platform (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (Version: 15.4.3555.0308 - Microsoft Corporation)
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0 - Microsoft Corporation) Hidden
Windows Live Installer (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mail (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live SOXE (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
WinRAR 4.01 (32-Bit) (Version: 4.01.0 - win.rar GmbH)

==================== Restore Points  =========================

09-01-2014 09:38:14 Geplanter Prüfpunkt
15-01-2014 17:16:27 Windows Update
23-01-2014 08:37:23 Geplanter Prüfpunkt
31-01-2014 09:24:35 Geplanter Prüfpunkt
07-02-2014 09:29:39 Geplanter Prüfpunkt
14-02-2014 09:34:48 Geplanter Prüfpunkt
14-02-2014 18:15:18 Windows Update

==================== Hosts content: ==========================

2009-07-14 03:04 - 2013-06-12 16:31 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1      localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {55F48CA3-FFFF-4982-8697-3B093CD5B396} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files\Ask.com\UpdateTask.exe <==== ATTENTION
Task: {DF9DD232-602C-4B00-8DE4-EC2C8B31B79A} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-02-05] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2011-06-19 19:47 - 2011-05-28 21:04 - 00140288 _____ () C:\Program Files\WinRAR\rarext.dll
2012-01-06 14:40 - 2009-02-27 16:38 - 00139264 ____R () C:\Program Files\Brother\BrUtilities\BrLogAPI.dll
2012-01-06 15:08 - 2013-05-22 12:40 - 00202752 _____ () C:\Program Files\JFritz\jfritz.exe
2000-07-27 01:13 - 2000-07-27 00:13 - 00053760 _____ () C:\Program Files\ICS\CashM\zlib.dll
1996-10-11 02:02 - 2011-06-20 18:51 - 00043520 _____ () C:\Windows\system32\CBNDLL.DLL
2013-03-28 21:29 - 2013-03-28 21:29 - 00095232 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2014-01-04 12:42 - 2014-01-04 12:42 - 03559024 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\Users\UP\Documents\heo.eml:OECustomProperty
AlternateDataStreams: C:\Users\UP\Documents\theo.eml:OECustomProperty

==================== Safe Mode (whitelisted) ===================


==================== Disabled items from MSCONFIG ==============


==================== Faulty Device Manager Devices =============

Name: Renesas Electronics USB 3.0 Host Controller
Description: Renesas Electronics USB 3.0 Host Controller
Class Guid: {36fc9e60-c465-11cf-8056-444553540000}
Manufacturer: Renesas Electronics
Service: nusb3xhc
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (02/08/2014 10:58:05 AM) (Source: Brother BrLog) (User: )
Description: STI BrtSTI: [2014/02/08 10:58:05.352]: [00002800]: SendSKeySettingToDevice:: Snmp Load Error[-1] To[192.168.178.27]

Error: (02/08/2014 10:57:52 AM) (Source: Brother BrLog) (User: )
Description: STI BrtSTI: [2014/02/08 10:57:52.341]: [00002800]: SendSKeySettingToDevice:: Snmp Load Error[-1] To[192.168.178.27]

Error: (02/08/2014 10:57:39 AM) (Source: Brother BrLog) (User: )
Description: STI BrtSTI: [2014/02/08 10:57:39.814]: [00002800]: GetDeviceIpAddress: GetAddressByName [BRN001BA9810DB2] Error

Error: (02/07/2014 03:40:57 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: wlmail.exe, Version: 15.4.3555.308, Zeitstempel: 0x4f59707e
Name des fehlerhaften Moduls: UIRibbon.dll, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7ba15
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0003c702
ID des fehlerhaften Prozesses: 0x%9
Startzeit der fehlerhaften Anwendung: 0xwlmail.exe0
Pfad der fehlerhaften Anwendung: wlmail.exe1
Pfad des fehlerhaften Moduls: wlmail.exe2
Berichtskennung: wlmail.exe3

Error: (02/07/2014 11:17:28 AM) (Source: Brother BrLog) (User: )
Description: TWN BrtTWN: [2014/02/07 11:17:28.434]: [00002116]: Initialize TwdsMain Class failed!

Error: (02/07/2014 11:17:28 AM) (Source: Brother BrLog) (User: )
Description: TWN BrtTWN: [2014/02/07 11:17:28.434]: [00002116]: ##### Fatal ERROR!! Create STI-device failed! #####

Error: (02/06/2014 11:47:42 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d6727a7
Name des fehlerhaften Moduls: SHELL32.dll, Version: 6.1.7601.18222, Zeitstempel: 0x51f1d731
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000b4b6d
ID des fehlerhaften Prozesses: 0x6ac
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3

Error: (02/04/2014 02:17:21 PM) (Source: Brother BrLog) (User: )
Description: STI BrtSTI: [2014/02/04 14:17:21.755]: [00002852]: SendSKeySettingToDevice:: Snmp Load Error[-1] To[192.168.178.27]

Error: (02/04/2014 02:16:49 PM) (Source: Brother BrLog) (User: )
Description: STI BrtSTI: [2014/02/04 14:16:49.806]: [00002852]: GetDeviceIpAddress: GetAddressByName [BRN001BA9810DB2] Error

Error: (02/04/2014 02:16:19 PM) (Source: Brother BrLog) (User: )
Description: STI BrtSTI: [2014/02/04 14:16:19.760]: [00002852]: SendSKeySettingToDevice:: Snmp Load Error[-1] To[192.168.178.27]


System errors:
=============
Error: (02/18/2014 08:57:59 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Gemeinsame Nutzung der Internetverbindung" ist vom Dienst "RAS-Verbindungsverwaltung" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068

Error: (02/18/2014 08:57:59 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "RAS-Verbindungsverwaltung" ist vom Dienst "SSTP-Dienst" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%0

Error: (02/18/2014 08:57:37 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst StarMoney 8.0 OnlineUpdate erreicht.

Error: (02/18/2014 08:57:32 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst StarMoney 7.0 OnlineUpdate erreicht.

Error: (02/18/2014 08:57:01 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Aufgabenplanung" ist vom Dienst "Windows-Ereignisprotokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1053

Error: (02/18/2014 08:57:00 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows-Audio" ist vom Dienst "Windows-Audio-Endpunkterstellung" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1053

Error: (02/18/2014 08:57:00 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows-Audio-Endpunkterstellung" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053

Error: (02/18/2014 08:57:00 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows-Audio-Endpunkterstellung erreicht.

Error: (02/18/2014 08:56:30 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows-Ereignisprotokoll" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053

Error: (02/18/2014 08:56:30 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows-Ereignisprotokoll erreicht.


Microsoft Office Sessions:
=========================
Error: (02/08/2014 10:58:05 AM) (Source: Brother BrLog)(User: )
Description: STIBrtSTI: [2014/02/08 10:58:05.352]: [00002800]: SendSKeySettingToDevice:: Snmp Load Error[-1] To[192.168.178.27]

Error: (02/08/2014 10:57:52 AM) (Source: Brother BrLog)(User: )
Description: STIBrtSTI: [2014/02/08 10:57:52.341]: [00002800]: SendSKeySettingToDevice:: Snmp Load Error[-1] To[192.168.178.27]

Error: (02/08/2014 10:57:39 AM) (Source: Brother BrLog)(User: )
Description: STIBrtSTI: [2014/02/08 10:57:39.814]: [00002800]: GetDeviceIpAddress: GetAddressByName [BRN001BA9810DB2] Error

Error: (02/07/2014 03:40:57 PM) (Source: Application Error)(User: )
Description: wlmail.exe15.4.3555.3084f59707eUIRibbon.dll6.1.7601.175144ce7ba15c00000050003c702

Error: (02/07/2014 11:17:28 AM) (Source: Brother BrLog)(User: )
Description: TWNBrtTWN: [2014/02/07 11:17:28.434]: [00002116]: Initialize TwdsMain Class failed!

Error: (02/07/2014 11:17:28 AM) (Source: Brother BrLog)(User: )
Description: TWNBrtTWN: [2014/02/07 11:17:28.434]: [00002116]: ##### Fatal ERROR!! Create STI-device failed! #####

Error: (02/06/2014 11:47:42 AM) (Source: Application Error)(User: )
Description: Explorer.EXE6.1.7601.175674d6727a7SHELL32.dll6.1.7601.1822251f1d731c0000005000b4b6d6ac01cf230f971d1779C:\Windows\Explorer.EXEC:\Windows\system32\SHELL32.dll1a57be0d-8f1c-11e3-82b8-6c626d3b2ddb

Error: (02/04/2014 02:17:21 PM) (Source: Brother BrLog)(User: )
Description: STIBrtSTI: [2014/02/04 14:17:21.755]: [00002852]: SendSKeySettingToDevice:: Snmp Load Error[-1] To[192.168.178.27]

Error: (02/04/2014 02:16:49 PM) (Source: Brother BrLog)(User: )
Description: STIBrtSTI: [2014/02/04 14:16:49.806]: [00002852]: GetDeviceIpAddress: GetAddressByName [BRN001BA9810DB2] Error

Error: (02/04/2014 02:16:19 PM) (Source: Brother BrLog)(User: )
Description: STIBrtSTI: [2014/02/04 14:16:19.760]: [00002852]: SendSKeySettingToDevice:: Snmp Load Error[-1] To[192.168.178.27]


CodeIntegrity Errors:
===================================
  Date: 2011-09-08 11:13:03.719
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\l3codeca.acm" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2011-09-08 09:44:06.533
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\l3codeca.acm" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2011-07-20 14:46:56.372
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\l3codeca.acm" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2011-07-20 14:37:07.766
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\l3codeca.acm" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2011-06-24 12:05:31.102
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\l3codeca.acm" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2011-06-24 11:34:38.083
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\l3codeca.acm" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2011-06-24 11:05:24.013
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\l3codeca.acm" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2011-06-21 11:44:47.159
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\l3codeca.acm" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info ===========================

Percentage of memory in use: 38%
Total physical RAM: 2556.64 MB
Available physical RAM: 1577.78 MB
Total Pagefile: 5111.56 MB
Available Pagefile: 3543.27 MB
Total Virtual: 2047.88 MB
Available Virtual: 1894.93 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:97.56 GB) (Free:67.02 GB) NTFS
Drive d: () (Fixed) (Total:368.1 GB) (Free:366.74 GB) NTFS
Drive z: (FRITZ.NAS) (Network) (Total:3.6 GB) (Free:3.44 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 430C920D)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=98 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=368 GB) - (Type=07 NTFS)

==================== End Of Log ============================

schrauber 19.02.2014 11:43
Sieht gut aus, scheint als ob Antivir mal seinen Job gemacht hat.


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


KuniP 20.02.2014 11:18
Keine Funde, hatte leider direkt deinstalliert, somit keine Logdatei.
Aber es stand im Bildschirm am Schluss überall 0.

schrauber 21.02.2014 09:56
Dann is alles gut :)

KuniP 21.02.2014 13:02
ok, danke!

schrauber 22.02.2014 13:25
Gern Geschehen :)


Alle Zeitangaben in WEZ +1. Es ist jetzt 00:15 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131