Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Regelmäßig neue Tabs zu Online-Casinos (https://www.trojaner-board.de/153304-regelmaessig-neue-tabs-online-casinos.html)

BlueSkyX 01.05.2014 14:16
Regelmäßig neue Tabs zu Online-Casinos
 
Bin eigentlich äußerst vorsichtig was Klicks und Downloads im Internet angeht, aber befürchte jetzt habe ich mir doch was eingefangen.

Und zwar werden Links in Chrome teilweise durch eine Art unsichtbares Popup geblockt. Will ich den Link anklicken, geht ein neues Tab auf und ich werde auf eine Seite mit einem Online-Casino (meist von stake7) umgeleitet.

Rechner läuft mit Win7 64bit, Browser ist Chrome in der aktuellsten Version.

Hatte schon die Vermutung, dass AdBlock Plus das Popup ausblendet, es aber immer noch irgendwie aktiv ist. Es ist dann völlig egal an welcher Stelle auf der Seite ich die Maus habe, unten in der Statusleiste wird dann immer der Link (tracking.syncedvision.com/aff_ad ....) angezeigt.

FRST-Log habe ich mal angehängt. Gmer stürzt bei mir beim Scan immer ab.

schrauber 01.05.2014 15:33
Hi,

Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.
.

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
http://www.trojaner-board.de/picture...&pictureid=307

BlueSkyX 01.05.2014 16:00
Sorry, wusste ich nicht. Dachte das wäre übersichtlicher. ;)


FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-05-2014
Ran by Andreas (administrator) on SUGOSG06 on 01-05-2014 15:02:40
Running from \\DISKSTATION\Daten\Andreas\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(cFos Software GmbH) C:\Program Files\ASRock\XFast LAN\spd.exe
(Brio) C:\Program Files\FolderSize\FolderSizeSvc.exe
(Nero AG) C:\Program Files (x86)\HTC\HTC Sync Manager\HSMServiceEntry.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
() C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
() C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Motorola Mobility LLC) C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe
() C:\Program Files (x86)\OpenVPN Technologies\OpenVPN Client\core\capiws.exe
() C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
(Motorola) C:\Program Files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe
(Samsung Electronics Co., Ltd.) C:\Windows\System32\RAPID\SamsungRapidSvc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
() C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe
(CyberGhost S.R.L) C:\Program Files\CyberGhost 5\Service.exe
(Motorola Mobility LLC) C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperAgent.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\RAPID\CacheFilter\SamsungRapidApp.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Google Inc.) C:\Users\Andreas\AppData\Local\Programs\Google\MusicManager\MusicManager.exe
(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe
(Dropbox, Inc.) C:\Users\Andreas\AppData\Roaming\Dropbox\bin\Dropbox.exe
(shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\concentr.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(CANON INC.) C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe
() C:\Program Files (x86)\HTC\HTC Sync Manager\HTC Sync\adb.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\tv_x64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AcroRd32.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AcroRd32.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Farbar) \\DISKSTATION\Daten\Andreas\Downloads\FRST64.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13307496 2011-10-17] (Realtek Semiconductor)
HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [1744152 2011-10-07] (Logitech, Inc.)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\System32\LogiLDA.dll [1832760 2012-09-20] (Logitech, Inc.)
HKLM\...\Run: [SamsungRapidApp] => C:\Program Files (x86)\Samsung\RAPID\CacheFilter\SamsungRapidApp.exe [109280 2013-07-29] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2012-02-01] (Intel Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [FreePDF Assistant] => C:\Program Files (x86)\FreePDF_XP\fpassist.exe [371200 2011-02-23] (shbox.de)
HKLM-x32\...\Run: [ConnectionCenter] => C:\Program Files (x86)\Citrix\ICA Client\concentr.exe [304568 2010-10-12] (Citrix Systems, Inc.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-12] (Apple Inc.)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [IJNetworkScanUtility] => C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE [128352 2010-01-18] (CANON INC.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKU\S-1-5-21-3291593815-3517969547-2110794811-1000\...\Run: [zASRockInstantBoot] => [X]
HKU\S-1-5-21-3291593815-3517969547-2110794811-1000\...\Run: [Google Update] => C:\Users\Andreas\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2012-07-21] (Google Inc.)
HKU\S-1-5-21-3291593815-3517969547-2110794811-1000\...\Run: [28596EBF51226B4B83700C29A4E9D9372DDCBD84._service_run] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [841032 2014-04-24] (Google Inc.)
HKU\S-1-5-21-3291593815-3517969547-2110794811-1000\...\Run: [MusicManager] => C:\Users\Andreas\AppData\Local\Programs\Google\MusicManager\MusicManager.exe [7382528 2014-03-03] (Google Inc.)
HKU\S-1-5-21-3291593815-3517969547-2110794811-1000\...\Run: [CyberGhost] => C:\Program Files\CyberGhost 5\CyberGhost.EXE [403568 2014-04-14] (CyberGhost S.R.L.)
HKU\S-1-5-21-3291593815-3517969547-2110794811-1000\...\Run: [GoogleChromeAutoLaunch_46A172103AF55F16E10754CCD32BD34E] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [841032 2014-04-24] (Google Inc.)
HKU\S-1-5-21-3291593815-3517969547-2110794811-1000\...\Policies\system: [LogonHoursAction] 2
HKU\S-1-5-21-3291593815-3517969547-2110794811-1000\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\S-1-5-21-3291593815-3517969547-2110794811-1000\...\MountPoints2: {4e5cc2be-6e00-11e3-adf7-bc5ff439549e} - H:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-3291593815-3517969547-2110794811-1000\...\MountPoints2: {817c7800-bc5b-11e2-9217-bc5ff439549e} - G:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-3291593815-3517969547-2110794811-1000\...\MountPoints2: {899d644c-243b-11e2-ac3c-806e6f6e6963} - D:\start.exe /auto
HKU\S-1-5-21-3291593815-3517969547-2110794811-1000\...\MountPoints2: {a6f61501-ef5c-11e1-a88a-bc5ff439549e} - F:\LaunchU3.exe -a
HKU\S-1-5-21-3291593815-3517969547-2110794811-1000\...\MountPoints2: {a6f6150c-ef5c-11e1-a88a-bc5ff439549e} - G:\LaunchU3.exe -a
AppInit_DLLs-x32: c:\progra~3\browse~1\261125~1.80\{c16c1~1\browse~1.dll => "c:\progra~3\browse~1\261125~1.80\{c16c1~1\browse~1.dll" File Not Found
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\OpenVPN Client.lnk
ShortcutTarget: OpenVPN Client.lnk -> C:\Program Files (x86)\OpenVPN Technologies\OpenVPN Client\core\uiboot.exe ()
Startup: C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Andreas\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Andreas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Andreas\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
GroupPolicyUsers\S-1-5-21-3291593815-3517969547-2110794811-1004\User: Group Policy restriction detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x14B359218820CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=SPLEP1&pc=SPLH
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=SPLEP1&pc=SPLH
SearchScopes: HKCU - {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL =
SearchScopes: HKCU - {74D50120-5482-4DAC-BFC6-F0086185D948} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3175297&CUI=UN29224930983016181&UM=2
SearchScopes: HKCU - {76B748B7-49A2-4735-9F73-EC4A1CB06067} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-devicevm&type=PROTOSV
SearchScopes: HKCU - {B6412957-EC42-49d3-9C34-143AC4FBF3BF} URL = hxxp://www.google.com/cse?cx=partner-pub-3794288947762788%3A4107735745&ie=UTF-8&q=&sa=Search&siteurl=www.google.com%2Fcse%2Fhome%3Fcx%3Dpartner-pub-3794288947762788%3A4107735745&q={searchTerms}
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
DPF: HKLM {AA570693-00E2-4907-B6F1-60A1199B030C} https://juniper.net/dana-cached/sc/JuniperSetupClient64.cab
DPF: HKLM-x32 {1E2941E3-8E63-11D4-9D5A-00902742D6E0} https://mymail.lanxess.com/static/iNotesCheck.cab
DPF: HKLM-x32 {238F6F83-B8B4-11CF-8771-00A024541EE3} https://de-fft1.dbrasweb.db.com/dana/download/wficat.cab?url=/dana/term/winlaunchterm.cgi?op=DownloadCitrixCab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://uk-cdc2.dbrasweb.db.com/dana-cached/sc/JuniperSetupClient.cab
Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter-x32: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_206.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_206.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @logitech.com/HarmonyRemote,version=1.0.0 - C:\Program Files (x86)\Logitech\Harmony Remote Driver\NprtHarmonyPlugin.dll (Logitech Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.4 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Andreas\AppData\Local\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Andreas\AppData\Local\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)

Chrome:
=======
CHR HomePage: hxxp://de.yahoo.com/
CHR StartupUrls: "hxxp://de.yahoo.com/", "hxxp://portal.lanxess/Intranet/Intranet_Portal_R6.nsf/id/HomeDE"
CHR Extension: (Entanglement Web App) - C:\Users\Andreas\AppData\Local\Google\Chrome\User Data\Default\Extensions\aciahcmjmecflokailenpkdchphgkefd [2014-04-30]
CHR Extension: (Angry Birds) - C:\Users\Andreas\AppData\Local\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj [2014-04-30]
CHR Extension: (SmallringFX MetalSliver Theme) - C:\Users\Andreas\AppData\Local\Google\Chrome\User Data\Default\Extensions\amoaokkohdcekgomnddkdfocbifmiafo [2014-04-30]
CHR Extension: (Google Docs) - C:\Users\Andreas\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-04-30]
CHR Extension: (Google Drive) - C:\Users\Andreas\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-04-30]
CHR Extension: (Schalten Sie das Licht) - C:\Users\Andreas\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfbmjmiodbnnpllbbbfblcplfjjepjdn [2014-04-30]
CHR Extension: (YouTube) - C:\Users\Andreas\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-04-30]
CHR Extension: (Google Cast) - C:\Users\Andreas\AppData\Local\Google\Chrome\User Data\Default\Extensions\boadgeojelhgndaghljhdicfkmllpafd [2014-04-30]
CHR Extension: (Adblock Plus) - C:\Users\Andreas\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-04-30]
CHR Extension: (Google-Suche) - C:\Users\Andreas\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-04-30]
CHR Extension: (Full Screen Weather) - C:\Users\Andreas\AppData\Local\Google\Chrome\User Data\Default\Extensions\fkkaebihfmbofclegkcfkkemepfehibg [2014-04-30]
CHR Extension: (Rummikub) - C:\Users\Andreas\AppData\Local\Google\Chrome\User Data\Default\Extensions\inkiliggodjonlfmnpchdgikolcbopif [2014-04-30]
CHR Extension: (uTorrent for Google Chrome) - C:\Users\Andreas\AppData\Local\Google\Chrome\User Data\Default\Extensions\jjhaafelbmbpohgmabippkndaaikgdih [2014-04-30]
CHR Extension: (Premiumize.me) - C:\Users\Andreas\AppData\Local\Google\Chrome\User Data\Default\Extensions\lojbjecfjcnaledoelddkcjlifhhfebm [2014-04-30]
CHR Extension: (Plants vs Zombies) - C:\Users\Andreas\AppData\Local\Google\Chrome\User Data\Default\Extensions\mmcegpfdgcoclcdfkjahiimlikdpnina [2014-04-30]
CHR Extension: (Billiard Blitz Hustle) - C:\Users\Andreas\AppData\Local\Google\Chrome\User Data\Default\Extensions\mplabfkieobnpmnagmbjaclnnbnppgnb [2014-04-30]
CHR Extension: (Google Wallet) - C:\Users\Andreas\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-30]
CHR Extension: (Google Mail) - C:\Users\Andreas\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-04-30]
CHR HKLM-x32\...\Chrome\Extension: [ocmdmaijlphjhhbhfailbdhmfcfpfken] - C:\ProgramData\Download and Sa\ocmdmaijlphjhhbhfailbdhmfcfpfken.crx [2014-04-30]
CHR HKLM-x32\...\Chrome\Extension: [oikliheaihindkomebcajofjponhlhhh] - C:\Users\Andreas\AppData\Local\CRE\oikliheaihindkomebcajofjponhlhhh.crx [2013-03-27]
CHR HKLM-x32\...\Chrome\Extension: [omaonpoimgkmbllpdihbnmgphjoipdhf] - C:\Program Files (x86)\Logitech\Harmony Remote Driver\harmony_chrome.crx [2012-12-20]

==================== Services (Whitelisted) =================

R2 cFosSpeedS; C:\Program Files\ASRock\XFast LAN\spd.exe [395136 2011-10-19] (cFos Software GmbH)
R2 CGVPNCliService; C:\Program Files\CyberGhost 5\Service.exe [64624 2014-04-14] (CyberGhost S.R.L)
R2 FolderSize; C:\Program Files\FolderSize\FolderSizeSvc.exe [167936 2010-04-06] (Brio)
R2 HTCMonitorService; C:\Program Files (x86)\HTC\HTC Sync Manager\HSMServiceEntry.exe [87368 2013-11-10] (Nero AG)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [128280 2012-02-21] ()
R2 ISCTAgent; C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe [133632 2012-02-09] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2012-02-21] (Intel Corporation)
R2 Motorola Device Manager; C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe [137528 2013-11-15] (Motorola Mobility LLC)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation)
R2 OpenVPNAccessClient; C:\Program Files (x86)\OpenVPN Technologies\OpenVPN Client\core\capiws.exe [24064 2010-08-12] ()
R2 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [167424 2012-12-07] ()
R2 SamsungRapidSvc; C:\Windows\System32\RAPID\SamsungRapidSvc.exe [27360 2013-07-29] (Samsung Electronics Co., Ltd.)
R2 UsbClientService; C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe [248736 2013-11-14] ()

==================== Drivers (Whitelisted) ====================

S3 AirDisplay; C:\Windows\System32\DRIVERS\AVVideoCard.sys [15808 2012-09-24] (Windows (R) Win 7 DDK provider)
S3 AirDisplayMirror; C:\Windows\System32\DRIVERS\AVVideoCardMirror.sys [15808 2012-09-24] (Windows (R) Win 7 DDK provider)
R0 AsrRamDisk; C:\Windows\System32\DRIVERS\AsrRamDisk.sys [31016 2012-01-13] (ASRock Inc.)
R3 avmaudio; C:\Windows\System32\DRIVERS\avmaudio.sys [116096 2012-11-18] (AVM Berlin)
R3 avmaura; C:\Windows\System32\DRIVERS\avmaura.sys [116480 2012-12-18] (AVM Berlin)
S3 FNETTBOH_305; C:\Windows\System32\drivers\FNETTBOH_305.SYS [32320 2012-11-01] (FNet Co., Ltd.)
R1 FNETURPX; C:\Windows\System32\drivers\FNETURPX.SYS [15936 2012-07-20] (FNet Co., Ltd.)
S3 HtcVCom32; C:\Windows\System32\DRIVERS\HtcVComV64.sys [121800 2010-03-09] (QUALCOMM Incorporated)
R3 ikbevent; C:\Windows\System32\DRIVERS\ikbevent.sys [25536 2012-02-09] ()
R3 imsevent; C:\Windows\System32\DRIVERS\imsevent.sys [25536 2012-02-09] ()
R3 ISCT; C:\Windows\System32\DRIVERS\ISCTD64.sys [44992 2012-02-09] ()
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation)
R1 NEOFLTR_710_20169; C:\Windows\system32\Drivers\NEOFLTR_710_20169.SYS [99152 2012-01-13] (Juniper Networks)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation)
S3 RRNetCap; C:\Windows\System32\DRIVERS\rrnetcap.sys [37480 2010-11-16] (RapidSolution Software AG)
R3 RRNetCapMP; C:\Windows\System32\DRIVERS\rrnetcap.sys [37480 2010-11-16] (RapidSolution Software AG)
R0 SamsungRapidDiskFltr; C:\Windows\System32\DRIVERS\SamsungRapidDiskFltr.sys [240864 2013-07-29] (Samsung Electronics Co., Ltd.)
R0 SamsungRapidFSFltr; C:\Windows\System32\DRIVERS\SamsungRapidFSFltr.sys [111328 2013-07-29] (Samsung Electronics Co., Ltd.)
S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
S3 tapoas; C:\Windows\System32\DRIVERS\tapoas.sys [30720 2010-08-03] (The OpenVPN Project)
R3 WPRO_41_2001; C:\Windows\System32\drivers\WPRO_41_2001.sys [34752 2014-04-30] ()
S3 AxtuDrv; \??\C:\Windows\SysWOW64\Drivers\AxtuDrv.sys [X]
S3 dgderdrv; System32\drivers\dgderdrv.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-10 12:59 - 2014-05-10 12:59 - 00000000 ____D () C:\ProgramData\Cypheros
2014-05-10 12:59 - 2013-07-12 18:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Haali Media Splitter
2014-04-30 19:19 - 2014-05-01 14:24 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-30 19:19 - 2014-04-30 19:24 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-30 19:19 - 2014-04-30 19:19 - 00004108 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-04-30 19:19 - 2014-04-30 19:19 - 00003856 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-04-30 19:19 - 2014-04-30 19:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-04-30 19:19 - 2014-04-30 19:19 - 00000000 ____D () C:\Program Files (x86)\Google
2014-04-27 08:11 - 2014-04-27 08:11 - 00000000 __SHD () C:\Users\Nico\AppData\Local\EmieUserList
2014-04-27 08:11 - 2014-04-27 08:11 - 00000000 __SHD () C:\Users\Nico\AppData\Local\EmieSiteList
2014-04-22 18:33 - 2014-04-22 18:38 - 00000000 ____D () C:\Users\Andreas\AppData\Local\CyberGhost
2014-04-22 18:33 - 2014-04-22 18:33 - 00000000 ____D () C:\Program Files\TAP-Windows
2014-04-22 18:32 - 2014-04-22 18:33 - 00000000 ____D () C:\Program Files\CyberGhost 5
2014-04-22 18:32 - 2014-04-22 18:32 - 00001728 _____ () C:\Users\Andreas\Desktop\CyberGhost 5.lnk
2014-04-22 18:32 - 2014-04-22 18:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CyberGhost 5
2014-04-22 18:25 - 2014-04-29 17:44 - 00000000 ____D () C:\Users\Andreas\AppData\Local\IE Tab
2014-04-18 17:43 - 2014-04-18 17:46 - 00000000 ____D () C:\Users\Andreas\Desktop\iPhone Andrea
2014-04-18 17:24 - 2014-04-18 17:24 - 00001783 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-04-18 17:24 - 2014-04-18 17:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-04-18 17:24 - 2014-04-18 17:24 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-04-18 17:24 - 2014-04-18 17:24 - 00000000 ____D () C:\Program Files\iTunes
2014-04-18 17:24 - 2014-04-18 17:24 - 00000000 ____D () C:\Program Files\iPod
2014-04-18 17:24 - 2014-04-18 17:24 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-04-16 11:10 - 2014-04-18 12:47 - 00000000 ____D () C:\Program Files\Windows Home Server
2014-04-15 09:52 - 2014-04-15 09:52 - 00000000 __SHD () C:\Users\Andreas\AppData\Local\EmieUserList
2014-04-15 09:52 - 2014-04-15 09:52 - 00000000 __SHD () C:\Users\Andreas\AppData\Local\EmieSiteList
2014-04-15 09:49 - 2014-04-15 09:49 - 00002102 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk
2014-04-12 21:13 - 2014-04-12 21:13 - 00000000 ____D () C:\Users\Andreas\Downloads\jd1420
2014-04-12 19:20 - 2014-04-12 19:20 - 00000000 ____D () C:\Users\Andreas\AppData\Roaming\Acronis
2014-04-12 12:15 - 2014-04-12 12:15 - 00000000 __SHD () C:\Users\Andrea\AppData\Local\EmieUserList
2014-04-12 12:15 - 2014-04-12 12:15 - 00000000 __SHD () C:\Users\Andrea\AppData\Local\EmieSiteList
2014-04-12 10:51 - 2014-04-12 10:51 - 00000000 ____D () C:\Users\Nico\AppData\Roaming\Motorola Mobility
2014-04-11 17:32 - 2014-03-06 12:21 - 23549440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-11 17:32 - 2014-03-06 11:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-11 17:32 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-04-11 17:32 - 2014-03-06 11:19 - 17387008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-11 17:32 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-11 17:32 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-04-11 17:32 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-04-11 17:32 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-11 17:32 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-11 17:32 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-11 17:32 - 2014-03-06 10:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-11 17:32 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-11 17:32 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-04-11 17:32 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-04-11 17:32 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-04-11 17:32 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-04-11 17:32 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-11 17:32 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-04-11 17:32 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-11 17:32 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-04-11 17:32 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-04-11 17:32 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-04-11 17:32 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-04-11 17:32 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-11 17:32 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-04-11 17:32 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-04-11 17:32 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-04-11 17:32 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-04-11 17:32 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-04-11 17:32 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-04-11 17:32 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-04-11 17:32 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-04-11 17:32 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-04-11 17:32 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-11 17:32 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-04-11 17:32 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-04-11 17:32 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-04-11 17:32 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-04-11 17:32 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-11 17:32 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-04-11 17:32 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-04-11 17:32 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-04-11 17:32 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-11 17:32 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-11 17:32 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-04-11 17:32 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-04-11 17:32 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-04-11 17:32 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-04-09 19:28 - 2014-05-01 15:02 - 00000000 ____D () C:\FRST
2014-04-09 19:26 - 2014-04-09 19:26 - 00000000 ____D () C:\Users\Andreas\AppData\Roaming\TrojanHunter
2014-04-09 19:26 - 2014-04-09 19:26 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-04-09 15:51 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-09 15:51 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-09 15:51 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-09 15:51 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-09 15:51 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-09 15:51 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-09 15:51 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-09 15:51 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-09 15:51 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-09 15:51 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-09 15:51 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-04-09 15:51 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-09 15:51 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-09 15:51 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-09 15:51 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-09 15:51 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-04-09 15:51 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-04-08 19:07 - 2014-04-12 11:01 - 00000000 ____D () C:\Program Files (x86)\TrojanHunter 5.5
2014-04-08 19:07 - 2014-04-08 19:08 - 00059392 ____R () C:\Windows\SysWOW64\streamhlp.dll
2014-04-08 18:56 - 2014-04-11 18:20 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-04-06 16:55 - 2014-04-06 16:55 - 00000000 ____D () C:\Users\Andreas\Downloads\German TOP100 07.04.2014
2014-04-06 16:54 - 2014-04-06 16:54 - 00000000 ____D () C:\Users\Andreas\Downloads\TOP50 Dance Charts 7.4.2014
2014-04-01 07:25 - 2014-04-01 07:25 - 00004891 _____ () C:\Users\Andrea\Desktop\Der kleine Marienkäfer Ludwig.odt

==================== One Month Modified Files and Folders =======

2014-05-10 12:59 - 2014-05-10 12:59 - 00000000 ____D () C:\ProgramData\Cypheros
2014-05-01 15:02 - 2014-04-09 19:28 - 00000000 ____D () C:\FRST
2014-05-01 14:51 - 2012-07-22 19:06 - 00000000 ____D () C:\Users\Andreas\AppData\Local\Thunderbird
2014-05-01 14:30 - 2012-07-21 13:48 - 00001128 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3291593815-3517969547-2110794811-1000UA.job
2014-05-01 14:24 - 2014-04-30 19:19 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-01 14:12 - 2013-03-27 19:46 - 00000000 ____D () C:\Program Files\JDownloader 2
2014-05-01 14:08 - 2012-07-29 17:08 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-01 11:17 - 2012-07-20 17:07 - 01583378 _____ () C:\Windows\WindowsUpdate.log
2014-04-30 19:25 - 2009-07-14 06:45 - 00013728 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-30 19:25 - 2009-07-14 06:45 - 00013728 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-30 19:24 - 2014-04-30 19:19 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-30 19:22 - 2009-07-14 19:58 - 03840504 _____ () C:\Windows\system32\perfh007.dat
2014-04-30 19:22 - 2009-07-14 19:58 - 01125460 _____ () C:\Windows\system32\perfc007.dat
2014-04-30 19:22 - 2009-07-14 07:13 - 00006264 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-30 19:19 - 2014-04-30 19:19 - 00004108 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-04-30 19:19 - 2014-04-30 19:19 - 00003856 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-04-30 19:19 - 2014-04-30 19:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-04-30 19:19 - 2014-04-30 19:19 - 00000000 ____D () C:\Program Files (x86)\Google
2014-04-30 19:19 - 2012-07-21 13:48 - 00000000 ____D () C:\Users\Andreas\AppData\Local\Google
2014-04-30 19:18 - 2014-03-09 14:47 - 00094656 _____ (CACE Technologies) C:\Windows\system32\WPRO_41_2001woem.tmp
2014-04-30 19:18 - 2013-05-14 08:04 - 00000000 ____D () C:\Users\Andreas\AppData\Local\HTC MediaHub
2014-04-30 19:18 - 2013-03-24 21:10 - 00000000 ___RD () C:\Users\Andreas\Dropbox
2014-04-30 19:18 - 2013-03-24 21:08 - 00000000 ____D () C:\Users\Andreas\AppData\Roaming\Dropbox
2014-04-30 19:18 - 2012-07-20 17:18 - 00034752 _____ () C:\Windows\system32\Drivers\WPRO_41_2001.sys
2014-04-30 19:18 - 2012-07-20 17:17 - 00000828 _____ () C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job
2014-04-30 19:18 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-30 19:18 - 2009-07-14 06:51 - 00079890 _____ () C:\Windows\setupact.log
2014-04-30 19:17 - 2012-07-20 17:23 - 01277708 _____ () C:\Windows\PFRO.log
2014-04-30 18:33 - 2012-07-29 15:34 - 00000000 ____D () C:\Users\Andreas\AppData\Roaming\vlc
2014-04-30 17:38 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\system32\FxsTmp
2014-04-30 09:30 - 2012-07-21 13:48 - 00001076 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3291593815-3517969547-2110794811-1000Core.job
2014-04-30 08:15 - 2013-09-10 17:44 - 00000000 ___RD () C:\Users\Andrea\Dropbox
2014-04-30 08:15 - 2013-09-10 17:38 - 00000000 ____D () C:\Users\Andrea\AppData\Roaming\Dropbox
2014-04-29 17:44 - 2014-04-22 18:25 - 00000000 ____D () C:\Users\Andreas\AppData\Local\IE Tab
2014-04-29 10:50 - 2012-07-20 17:17 - 00000830 _____ () C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job
2014-04-29 10:08 - 2012-07-29 17:08 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-04-29 10:08 - 2012-07-29 17:08 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-04-29 10:08 - 2012-07-29 17:08 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-04-29 08:17 - 2013-05-15 15:20 - 00000000 ____D () C:\Users\Andrea\AppData\Local\HTC MediaHub
2014-04-27 08:13 - 2013-02-08 14:47 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-04-27 08:11 - 2014-04-27 08:11 - 00000000 __SHD () C:\Users\Nico\AppData\Local\EmieUserList
2014-04-27 08:11 - 2014-04-27 08:11 - 00000000 __SHD () C:\Users\Nico\AppData\Local\EmieSiteList
2014-04-25 21:00 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-04-23 19:43 - 2012-08-21 13:40 - 00000000 ____D () C:\Users\Andreas\AppData\Local\CrashDumps
2014-04-22 18:38 - 2014-04-22 18:33 - 00000000 ____D () C:\Users\Andreas\AppData\Local\CyberGhost
2014-04-22 18:33 - 2014-04-22 18:33 - 00000000 ____D () C:\Program Files\TAP-Windows
2014-04-22 18:33 - 2014-04-22 18:32 - 00000000 ____D () C:\Program Files\CyberGhost 5
2014-04-22 18:32 - 2014-04-22 18:32 - 00001728 _____ () C:\Users\Andreas\Desktop\CyberGhost 5.lnk
2014-04-22 18:32 - 2014-04-22 18:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CyberGhost 5
2014-04-21 13:41 - 2013-04-17 08:19 - 00000000 ____D () C:\Program Files (x86)\DAEMON Tools Pro
2014-04-21 12:11 - 2014-01-02 18:49 - 00000000 ____D () C:\Program Files (x86)\Steuer 2013
2014-04-21 12:11 - 2012-08-26 11:36 - 00000898 _____ () C:\Windows\wiso.ini
2014-04-21 12:11 - 2012-08-26 11:25 - 00000000 ____D () C:\ProgramData\Buhl Data Service GmbH
2014-04-18 17:46 - 2014-04-18 17:43 - 00000000 ____D () C:\Users\Andreas\Desktop\iPhone Andrea
2014-04-18 17:24 - 2014-04-18 17:24 - 00001783 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-04-18 17:24 - 2014-04-18 17:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-04-18 17:24 - 2014-04-18 17:24 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-04-18 17:24 - 2014-04-18 17:24 - 00000000 ____D () C:\Program Files\iTunes
2014-04-18 17:24 - 2014-04-18 17:24 - 00000000 ____D () C:\Program Files\iPod
2014-04-18 17:24 - 2014-04-18 17:24 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-04-18 13:30 - 2014-02-07 19:36 - 00000000 ____D () C:\Users\Andrea\Documents\Outlook-Dateien
2014-04-18 13:20 - 2014-02-17 19:24 - 00000000 ____D () C:\Users\Andrea\AppData\Local\1AE9F09C-5C3C-4830-8FB6-99A77C710642.aplzod
2014-04-18 13:08 - 2014-01-02 16:41 - 00002250 ____H () C:\Users\Andreas\Documents\Default.rdp
2014-04-18 12:47 - 2014-04-16 11:10 - 00000000 ____D () C:\Program Files\Windows Home Server
2014-04-18 12:47 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
2014-04-16 08:56 - 2012-11-09 09:17 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-04-15 09:52 - 2014-04-15 09:52 - 00000000 __SHD () C:\Users\Andreas\AppData\Local\EmieUserList
2014-04-15 09:52 - 2014-04-15 09:52 - 00000000 __SHD () C:\Users\Andreas\AppData\Local\EmieSiteList
2014-04-15 09:50 - 2012-07-20 18:26 - 00000000 ____D () C:\Users\Andreas\AppData\Local\Adobe
2014-04-15 09:49 - 2014-04-15 09:49 - 00002102 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk
2014-04-15 09:49 - 2014-03-23 13:27 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-04-12 21:13 - 2014-04-12 21:13 - 00000000 ____D () C:\Users\Andreas\Downloads\jd1420
2014-04-12 19:20 - 2014-04-12 19:20 - 00000000 ____D () C:\Users\Andreas\AppData\Roaming\Acronis
2014-04-12 12:15 - 2014-04-12 12:15 - 00000000 __SHD () C:\Users\Andrea\AppData\Local\EmieUserList
2014-04-12 12:15 - 2014-04-12 12:15 - 00000000 __SHD () C:\Users\Andrea\AppData\Local\EmieSiteList
2014-04-12 12:14 - 2013-02-21 19:07 - 00000680 __RSH () C:\Users\Andrea\ntuser.pol
2014-04-12 12:14 - 2012-07-24 19:43 - 00000000 ____D () C:\Users\Andrea
2014-04-12 11:01 - 2014-04-08 19:07 - 00000000 ____D () C:\Program Files (x86)\TrojanHunter 5.5
2014-04-12 10:51 - 2014-04-12 10:51 - 00000000 ____D () C:\Users\Nico\AppData\Roaming\Motorola Mobility
2014-04-12 10:51 - 2013-07-24 15:22 - 00000000 ____D () C:\Users\Nico\AppData\Local\HTC MediaHub
2014-04-12 10:51 - 2013-02-21 19:11 - 00091128 _____ () C:\Users\Nico\AppData\Local\GDIPFONTCACHEV1.DAT
2014-04-12 10:51 - 2013-02-21 19:11 - 00001326 __RSH () C:\Users\Nico\ntuser.pol
2014-04-12 10:51 - 2013-02-21 19:11 - 00000000 ____D () C:\Users\Nico\AppData\Local\VirtualStore
2014-04-12 10:51 - 2013-02-21 19:11 - 00000000 ____D () C:\Users\Nico
2014-04-11 21:30 - 2013-02-21 19:07 - 00000680 __RSH () C:\Users\Andreas\ntuser.pol
2014-04-11 21:30 - 2012-07-20 17:08 - 00000000 ____D () C:\Users\Andreas
2014-04-11 21:27 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Public\Libraries
2014-04-11 19:17 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-04-11 18:20 - 2014-04-08 18:56 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-04-11 17:39 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-04-11 17:37 - 2012-09-22 09:04 - 00000857 _____ () C:\Windows\system32\Drivers\etc\hosts.bak
2014-04-11 17:29 - 2012-11-11 21:52 - 00000000 ____D () C:\Users\Andrea\AppData\Roaming\vlc
2014-04-10 08:22 - 2012-07-24 20:16 - 00000000 ____D () C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Juniper Networks
2014-04-10 07:27 - 2012-10-05 19:14 - 00000000 ____D () C:\Program Files (x86)\Samsung
2014-04-09 22:58 - 2013-07-28 10:09 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-09 22:58 - 2012-07-22 19:09 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-04-09 22:56 - 2012-07-21 13:52 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-04-09 19:26 - 2014-04-09 19:26 - 00000000 ____D () C:\Users\Andreas\AppData\Roaming\TrojanHunter
2014-04-09 19:26 - 2014-04-09 19:26 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-04-08 20:16 - 2012-07-20 17:18 - 00117436 _____ () C:\Windows\DPINST.LOG
2014-04-08 20:15 - 2013-11-17 12:59 - 00000000 ____D () C:\Users\Andreas\AppData\Roaming\Opera Software
2014-04-08 20:15 - 2013-11-17 12:59 - 00000000 ____D () C:\Users\Andreas\AppData\Local\Opera Software
2014-04-08 20:15 - 2013-11-17 12:59 - 00000000 ____D () C:\Program Files (x86)\Opera
2014-04-08 20:12 - 2012-07-20 17:14 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-04-08 19:08 - 2014-04-08 19:07 - 00059392 ____R () C:\Windows\SysWOW64\streamhlp.dll
2014-04-06 16:55 - 2014-04-06 16:55 - 00000000 ____D () C:\Users\Andreas\Downloads\German TOP100 07.04.2014
2014-04-06 16:54 - 2014-04-06 16:54 - 00000000 ____D () C:\Users\Andreas\Downloads\TOP50 Dance Charts 7.4.2014
2014-04-05 09:25 - 2012-07-21 13:48 - 00004102 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3291593815-3517969547-2110794811-1000UA
2014-04-05 09:25 - 2012-07-21 13:48 - 00003706 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3291593815-3517969547-2110794811-1000Core
2014-04-03 18:21 - 2012-07-21 21:40 - 00002117 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2014-04-03 18:21 - 2012-07-21 21:40 - 00001912 _____ () C:\Windows\epplauncher.mif
2014-04-03 18:21 - 2012-07-21 21:40 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2014-04-03 18:21 - 2012-07-21 21:40 - 00000000 ____D () C:\Program Files (x86)\Microsoft Security Client
2014-04-01 07:25 - 2014-04-01 07:25 - 00004891 _____ () C:\Users\Andrea\Desktop\Der kleine Marienkäfer Ludwig.odt

Some content of TEMP:
====================
C:\Users\Andrea\AppData\Local\Temp\dsHostCheckerSetup.exe
C:\Users\Andrea\AppData\Local\Temp\JuniperSetupClientInstaller.exe
C:\Users\Andreas\AppData\Local\Temp\2zcr2433.e4f.exe
C:\Users\Andreas\AppData\Local\Temp\917b0b87-3358-4e79-93de-3dfc2fc99ed0.exe
C:\Users\Nico\AppData\Local\Temp\dsHostCheckerSetup.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-04-29 06:52

==================== End Of Log ============================
--- --- ---

schrauber 02.05.2014 07:42
Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.

BlueSkyX 02.05.2014 17:03
Haben alle drei etwas gefunden. Das meiste ging Richtung "CONDUIT".

Malwarebytes LOG

Code:
Malwarebytes Anti-Malware
www.malwarebytes.org

Suchlauf Datum: 02.05.2014
Suchlauf-Zeit: 16:32:00
Logdatei:
Administrator: Ja

Version: 2.00.1.1004
Malware Datenbank: v2014.05.02.08
Rootkit Datenbank: v2014.03.27.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Chameleon: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Andreas

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 328590
Verstrichene Zeit: 12 Min, 22 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Shuriken: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 0
(No malicious items detected)

Registrierungswerte: 2
PUP.Optional.ConduitSearchProtect, HKU\S-1-5-21-3291593815-3517969547-2110794811-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|SearchProtect, C:\Users\Andrea\AppData\Roaming\SearchProtect\bin\cltmng.exe, In Quarantäne, [837d49b723dd41bf22e9554a58ab4eb2]
PUP.Optional.ConduitSearchProtect, HKU\S-1-5-21-3291593815-3517969547-2110794811-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|SearchProtect, C:\Users\Nico\AppData\Roaming\SearchProtect\bin\cltmng.exe, In Quarantäne, [6c9416eab44c20e014f7594610f3dc24]

Registrierungsdaten: 0
(No malicious items detected)

Ordner: 0
(No malicious items detected)

Dateien: 0
(No malicious items detected)

Physische Sektoren: 0
(No malicious items detected)


(end)
AdwCleaner LOG

AdwCleaner Logfile:
Code:
# AdwCleaner v3.205 - Bericht erstellt am 02/05/2014 um 16:37:42
# Aktualisiert 28/04/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Andreas - SUGOSG06
# Gestartet von : \\DISKSTATION\Daten\Andreas\Downloads\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Users\Andrea\.android
Ordner Gelöscht : C:\Users\Andreas\.android
Ordner Gelöscht : C:\Users\Andreas\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\Andreas\AppData\Roaming\SendSpace
Ordner Gelöscht : C:\Users\Nico\.android
Datei Gelöscht : C:\Windows\System32\Tasks\BrowserProtect

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FFE66D00-A56A-4F7F-81D7-4A28C5816D6C}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{DC84D6F4-ABF5-441D-BDEF-65F3F4D7AABE}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{483830EE-A4CD-4B71-B0A3-3D82E62A6909}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\SmartBar
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Conduit
Daten Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - c:\progra~3\browse~1\261125~1.80\{c16c1~1\browse~1.dll

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17041


-\\ Google Chrome v34.0.1847.131

[ Datei : C:\Users\Andrea\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Gelöscht [Search Provider] : hxxp://www.qipu.de/stoebern/{searchTerms}/shop/relevance/

[ Datei : C:\Users\Andreas\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Gelöscht [Search Provider] : hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3175297&CUI=UN29224930983016181&UM=2
Gelöscht [Search Provider] : hxxp://www1.delta-search.com/?q={searchTerms}&babsrc=NT_ss&s=web&rlz=0&as=0&ac=0
Gelöscht [Search Provider] : hxxp://isearch.avg.com/search?cid={95990CDE-B696-4E88-A70C-608DE2BD1579}&mid=d1d899849bdc47d08001bd2b2bb0feea-ad1491be2ce6c122f6b66faa90e70c2decf7d34c&lang=de&ds=AVG&pr=fr&d=2012-05-24 19:25:59&v=11.0.0.9&sap=dsp&q={searchTerms}
Gelöscht [Search Provider] : hxxp://www.qipu.de/stoebern/{searchTerms}/shop/relevance/
Gelöscht [Search Provider] : hxxp://www.qipu.de/stoebern/{searchTerms}/shop/relevance/

*************************

AdwCleaner[R0].txt - [3177 octets] - [02/05/2014 16:35:39]
AdwCleaner[S0].txt - [2922 octets] - [02/05/2014 16:37:42]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2982 octets] ##########
--- --- ---

[/CODE]

Junkware Removal Tool LOG

JRT Logfile:
Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Home Premium x64
Ran by Andreas on 02.05.2014 at 16:40:15,02
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3291593815-3517969547-2110794811-1000\Software\sweetim
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{74D50120-5482-4DAC-BFC6-F0086185D948}



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 02.05.2014 at 16:44:23,95
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
--- --- ---


Hat aber leider nichts geholfen. :(

Jetzt kommen noch irgendwelche Fake-Update-Meldungen für Java und Flash dazu. Gerade hat sich ungefragt eine Datei "PlayerSetup.exe" für irgendeinen Videoplayer runtergeladen. :eek:

Was mir gerade aufgefallen ist:

Bei einer erneuten Suche mit AdwCleaner waren alle Sucheinträge unter Chrome wieder da. :(

schrauber 04.05.2014 07:07
Revo Uninstaller - Download - Filepony
damit Chrome deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren.

Dann:
https://support.google.com/chrome/answer/3296214?hl=de

Dann nochmal AdwCleaner.


Alle Zeitangaben in WEZ +1. Es ist jetzt 02:28 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131