Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   WIN7x64: "Gesellschaft zur Verfügung von Urheberrechtsverletzungen e.V." - Abgesicherter Modus nicht möglich - bereits einiges versucht (https://www.trojaner-board.de/146483-win7x64-gesellschaft-verfuegung-urheberrechtsverletzungen-e-v-abgesicherter-modus-moeglich-bereits-einiges-versucht.html)

tf13 22.12.2013 13:55
WIN7x64: "Gesellschaft zur Verfügung von Urheberrechtsverletzungen e.V." - Abgesicherter Modus nicht möglich - bereits einiges versucht
 
Hallo
Habe mir einen Trojaner eingefangen, den ich leider mit allen Versuchen bisher nicht entfernen konnte. Windows 7 64 bit - abgesicherter Modus nicht möglich, da er beim Versuch automatisch heruntergefahren wird. Bitte dringend um Hilfe!

Problem: Beim normalen Start kommt eine Meldung von "Gesellschaft zur Verfügung von Urheberrechtsverletzungen e.V.", die 100 Euro von mir wollen. Wenn noch andere Informationen benötigt werden, werde ich diese umgehend hinzufügen!

Vielen Dank!

schrauber 22.12.2013 14:24
hi,

Scan mit Farbar's Recovery Scan Tool (Recovery Mode - Windows Vista, 7, 8)
Hinweise für Windows 8-Nutzer: Anleitung 1 (FRST-Variante) und Anleitung 2 (zweiter Teil)
  • Downloade dir bitte die passende Version des Tools (im Zweifel beide) und speichere diese auf einen USB Stick: FRST Download FRST 32-Bit | FRST 64-Bit
  • Schließe den USB Stick an das infizierte System an und boote das System in die System Reparatur Option.
  • Scanne jetzt nach der bebilderten Anleitung oder verwende die folgende Kurzanleitung:
Über den Boot Manager:
  • Starte den Rechner neu.
  • Während dem Hochfahren drücke mehrmals die F8 Taste
  • Wähle nun Computer reparieren.
  • Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".
Mit Windows CD/DVD (auch bei Windows 8 möglich):
  • Lege die Windows CD in dein Laufwerk.
  • Starte den Rechner neu und starte von der CD.
  • Wähle die Spracheinstellungen und klicke "Weiter".
  • Klicke auf Computerreparaturoptionen !
  • Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".
Wähle in den Reparaturoptionen: Eingabeaufforderung
  • Gib nun bitte notepad ein und drücke Enter.
  • Im öffnenden Textdokument: Datei > Speichern unter... und wähle Computer.
    Hier wird dir der Laufwerksbuchstabe deines USB Sticks angezeigt, merke ihn dir.
  • Schließe Notepad wieder
  • Gib nun bitte folgenden Befehl ein.
    e:\frst.exe bzw. e:\frst64.exe
    Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks, den du dir gemerkt hast. Gegebenfalls anpassen.
  • Akzeptiere den Disclaimer mit Ja und klicke Untersuchen
Das Tool erstellt eine FRST.txt auf deinem USB Stick. Poste den Inhalt bitte hier nach Möglichkeit in Code-Tags (Anleitung).


tf13 22.12.2013 15:19
Vielen Dank für die schnelle Rückmeldung. Anbei finden Sie meinen Log.



FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 20-12-2013 02
Ran by SYSTEM on MININT-R12U8FI on 22-12-2013 15:13:16
Running from G:\
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Recovery

The current controlset is ControlSet002
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.

==================== Registry (Whitelisted) ==================

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-18] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [ControlCenter4] - C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [139264 2011-04-20] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsMon00] - C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [2629632 2011-10-07] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [162856 2013-06-10] (Geek Software GmbH)
HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [154144 2009-11-25] ()
HKU\Default User\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [154144 2009-11-25] ()
HKU\Wolfgang\...\Run: [RoboForm] - C:\Program Files (x86)\Siber Systems\AI RoboForm\robotaskbaricon.exe [109784 2013-06-30] (Siber Systems)
HKU\Wolfgang\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2009-10-20] (Google Inc.)
Startup: C:\Users\Wolfgang\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0zj2q3fr.lnk
ShortcutTarget: 0zj2q3fr.lnk -> C:\PROGRA~3\\rf3q2jz0.jss (hxxp://tortoisesvn.net)
Startup: C:\Users\Wolfgang\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk ->  (No File)

==================== Services (Whitelisted) =================

S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-18] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG)
S2 DevoloNetworkService; C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe [3128856 2012-02-28] (devolo AG)
S2 KMService; C:\Windows\SysWow64\srvany.exe [8192 2003-04-18] ()
S2 MSSQL$MSSMLBIZ; c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
S4 PDFProFiltSrvPP; C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [144672 2010-03-09] (Nuance Communications, Inc.)
S4 RS_Service; C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe [253952 2009-07-10] (Acer Incorporated)
S2 StarMoney 9.0 OnlineUpdate; C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe [663184 2013-10-11] (Star Finanz-Software Entwicklung und Vertriebs GmbH)
S2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe [2365792 2012-09-19] (TuneUp Software)
S2 Winmgmt; C:\PROGRA~3\\0zj2q3fr.zvv [61540 2013-12-22] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG)
S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG)
S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)
S3 avmaudio; C:\Windows\System32\DRIVERS\avmaudio.sys [116096 2010-11-28] (AVM Berlin)
S3 avmaura; C:\Windows\System32\DRIVERS\avmaura.sys [116480 2012-12-16] (AVM Berlin)
S3 CH341SER; C:\Windows\System32\Drivers\CH341S64.SYS [58368 2009-06-02] (www.winchiphead.com)
S3 CH341SER_A64; C:\Windows\System32\Drivers\CH341S64.SYS [58368 2009-06-02] (www.winchiphead.com)
S0 FSProFilter; C:\Windows\System32\Drivers\FSPFltd.sys [54848 2010-07-22] (FSPro Labs)
S3 hwusbdev; C:\Windows\System32\DRIVERS\ewusbdev.sys [113792 2009-06-22] (Huawei Technologies Co., Ltd.)
S3 int15.sys; C:\Windows\System32\OEM\Factory\int15.sys [17952 2008-03-28] (Acer, Inc.)
S2 NPF_devolo; C:\Windows\sysWOW64\drivers\npf_devolo.sys [34048 2012-01-31] (CACE Technologies)
S3 StkCMini; C:\Windows\System32\Drivers\StkCMini.sys [1816968 2010-04-16] (Syntek)
S3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesDriver64.sys [11880 2012-09-19] (TuneUp Software)
S3 cpuz133; \??\C:\Users\Wolfgang\AppData\Local\Temp\cpuz133\cpuz133_x64.sys [x]
S3 dgderdrv; System32\drivers\dgderdrv.sys [x]
S2 regi; \??\C:\Windows\system32\drivers\regi.sys [x]
S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [x]
S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-12-22 17:46 - 2013-12-22 18:48 - 00139040 _____ C:\OTL.Txt
2013-12-22 15:12 - 2013-12-22 15:12 - 00000000 ____D C:\FRST
2013-12-22 12:07 - 2013-12-22 12:07 - 00276480 _____ C:\Windows\Minidump\122213-22807-01.dmp
2013-12-22 12:05 - 2013-12-22 12:05 - 00276480 _____ C:\Windows\Minidump\122213-66862-01.dmp
2013-12-22 09:36 - 2013-12-22 09:36 - 00006576 ____N C:\bootsqm.dat
2013-12-22 09:29 - 2013-12-22 09:29 - 00276536 _____ C:\Windows\Minidump\122213-19484-01.dmp
2013-12-22 09:28 - 2013-12-22 09:28 - 00276480 _____ C:\Windows\Minidump\122213-65317-01.dmp
2013-12-22 09:26 - 2013-12-22 09:26 - 00000000 ____D C:\ProgramData\HitmanPro
2013-12-22 09:26 - 2013-12-22 09:26 - 00000000 _____ C:\Windows\Minidump\122213-63866-01.dmp
2013-12-22 09:25 - 2013-12-22 12:06 - 397490613 _____ C:\Windows\MEMORY.DMP
2013-12-22 08:32 - 2013-12-22 08:32 - 00000298 ____H C:\Windows\Tasks\User_Feed_Synchronization-{C04CE4A3-31BF-4700-ACCF-DE1A1FA1635C}.job
2013-12-22 07:51 - 2013-12-22 07:51 - 00000291 _____ C:\ProgramData\0zj2q3fr.reg
2013-12-22 07:50 - 2013-12-22 13:20 - 95025368 ____T C:\ProgramData\0zj2q3fr.fee
2013-12-22 07:50 - 2013-12-22 13:20 - 00000000 _____ C:\ProgramData\0zj2q3fr.odd
2013-12-22 07:50 - 2013-12-22 07:50 - 00230912 _____ (hxxp://tortoisesvn.net) C:\ProgramData\rf3q2jz0.jss
2013-12-22 07:50 - 2013-12-22 07:50 - 00061540 ____T (Microsoft Corporation) C:\ProgramData\0zj2q3fr.zvv
2013-12-20 19:37 - 2013-12-20 19:38 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-18 20:49 - 2013-12-18 20:49 - 00019018 _____ C:\Windows\PFRO.log
2013-12-15 18:24 - 2013-12-21 09:40 - 00011126 _____ C:\Users\Wolfgang\Desktop\ip adressen.xlsx
2013-12-15 18:15 - 2013-12-22 13:19 - 00003440 _____ C:\Windows\setupact.log
2013-12-15 18:15 - 2013-12-15 18:15 - 00000000 _____ C:\Windows\setuperr.log
2013-12-15 07:36 - 2013-12-15 07:36 - 16383031 _____ C:\Users\Wolfgang\Desktop\XS_TB-2.5_7270_v2_05.53-freetz-devel-11286M.de.zip
2013-12-14 09:24 - 2013-05-10 06:56 - 14631424 _____ (Microsoft Corporation) C:\Windows\System32\wmp.dll
2013-12-14 09:24 - 2013-05-10 06:56 - 12625920 _____ (Microsoft Corporation) C:\Windows\System32\wmploc.DLL
2013-12-14 09:24 - 2013-05-10 05:56 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2013-12-14 09:24 - 2013-05-10 05:56 - 11410432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2013-12-14 09:22 - 2013-11-26 12:54 - 23183360 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-12-14 09:22 - 2013-11-26 11:19 - 02724864 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-12-14 09:22 - 2013-11-26 11:18 - 00004096 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollectorres.dll
2013-12-14 09:22 - 2013-11-26 11:11 - 17112576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-12-14 09:22 - 2013-11-26 10:48 - 00066048 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-12-14 09:22 - 2013-11-26 10:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\System32\ieetwproxystub.dll
2013-12-14 09:22 - 2013-11-26 10:41 - 02764288 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-12-14 09:22 - 2013-11-26 10:29 - 00053760 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-12-14 09:22 - 2013-11-26 10:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-12-14 09:22 - 2013-11-26 10:23 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-12-14 09:22 - 2013-11-26 10:21 - 00574976 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-12-14 09:22 - 2013-11-26 10:18 - 00139264 _____ (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-12-14 09:22 - 2013-11-26 10:18 - 00111616 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollector.exe
2013-12-14 09:22 - 2013-11-26 10:16 - 00708608 _____ (Microsoft Corporation) C:\Windows\System32\jscript9diag.dll
2013-12-14 09:22 - 2013-11-26 09:57 - 00218624 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-12-14 09:22 - 2013-11-26 09:38 - 02166784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-12-14 09:22 - 2013-11-26 09:38 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-12-14 09:22 - 2013-11-26 09:35 - 05769216 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-12-14 09:22 - 2013-11-26 09:32 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-12-14 09:22 - 2013-11-26 09:28 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2013-12-14 09:22 - 2013-11-26 09:16 - 04243968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-12-14 09:22 - 2013-11-26 09:02 - 01995264 _____ (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-12-14 09:22 - 2013-11-26 08:48 - 12996608 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-12-14 09:22 - 2013-11-26 08:32 - 01928192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-12-14 09:22 - 2013-11-26 08:26 - 11221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-12-14 09:22 - 2013-11-26 08:07 - 02334208 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-12-14 09:22 - 2013-11-26 07:40 - 01395200 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-12-14 09:22 - 2013-11-26 07:34 - 00817664 _____ (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2013-12-14 09:22 - 2013-11-26 07:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-12-14 09:22 - 2013-11-26 07:33 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-12-14 09:22 - 2013-11-26 07:27 - 01157632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-12-14 08:25 - 2013-12-15 07:51 - 00000000 ____D C:\Program Files (x86)\V-CamShow
2013-12-12 19:28 - 2013-11-23 19:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-12-12 19:28 - 2013-11-23 18:47 - 00465920 _____ (Microsoft Corporation) C:\Windows\System32\WMPhoto.dll
2013-12-12 19:28 - 2013-11-12 03:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\System32\tzres.dll
2013-12-12 19:28 - 2013-11-12 03:07 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-12-12 19:28 - 2013-10-30 03:32 - 00335360 _____ (Microsoft Corporation) C:\Windows\System32\msieftp.dll
2013-12-12 19:28 - 2013-10-30 03:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll
2013-12-12 19:28 - 2013-10-30 02:24 - 03155968 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys
2013-12-12 19:28 - 2013-10-19 03:18 - 00081408 _____ (Microsoft Corporation) C:\Windows\System32\imagehlp.dll
2013-12-12 19:28 - 2013-10-19 02:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2013-12-12 19:28 - 2013-10-12 03:32 - 00150016 _____ (Microsoft Corporation) C:\Windows\System32\wshom.ocx
2013-12-12 19:28 - 2013-10-12 03:31 - 00202752 _____ (Microsoft Corporation) C:\Windows\System32\scrrun.dll
2013-12-12 19:28 - 2013-10-12 03:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshom.ocx
2013-12-12 19:28 - 2013-10-12 03:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll
2013-12-12 19:28 - 2013-10-12 02:33 - 00168960 _____ (Microsoft Corporation) C:\Windows\System32\wscript.exe
2013-12-12 19:28 - 2013-10-12 02:33 - 00156160 _____ (Microsoft Corporation) C:\Windows\System32\cscript.exe
2013-12-12 19:28 - 2013-10-12 02:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscript.exe
2013-12-12 19:28 - 2013-10-12 02:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe
2013-12-12 19:28 - 2013-10-04 03:16 - 00116736 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\drmk.sys
2013-12-12 19:28 - 2013-10-04 02:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\portcls.sys
2013-11-25 19:52 - 2013-10-14 18:00 - 00028368 _____ (Microsoft Corporation) C:\Windows\System32\IEUDINIT.EXE
2013-11-25 19:47 - 2013-11-25 19:47 - 01228800 _____ (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00942592 _____ (Microsoft Corporation) C:\Windows\System32\jsIntl.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00940032 _____ (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2013-11-25 19:47 - 2013-11-25 19:47 - 00774144 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00626176 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-11-25 19:47 - 2013-11-25 19:47 - 00616104 _____ (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat
2013-11-25 19:47 - 2013-11-25 19:47 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00548352 _____ (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00453120 _____ (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00413696 _____ (Microsoft Corporation) C:\Windows\System32\html.iec
2013-11-25 19:47 - 2013-11-25 19:47 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-11-25 19:47 - 2013-11-25 19:47 - 00296960 _____ (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00263376 _____ (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00247808 _____ (Microsoft Corporation) C:\Windows\System32\msls31.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00243200 _____ (Microsoft Corporation) C:\Windows\System32\webcheck.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00235520 _____ (Microsoft Corporation) C:\Windows\System32\url.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00235008 _____ (Microsoft Corporation) C:\Windows\System32\elshyph.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00195584 _____ (Microsoft Corporation) C:\Windows\System32\msrating.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00167424 _____ (Microsoft Corporation) C:\Windows\System32\iexpress.exe
2013-11-25 19:47 - 2013-11-25 19:47 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-11-25 19:47 - 2013-11-25 19:47 - 00147968 _____ (Microsoft Corporation) C:\Windows\System32\occache.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00143872 _____ (Microsoft Corporation) C:\Windows\System32\wextract.exe
2013-11-25 19:47 - 2013-11-25 19:47 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-11-25 19:47 - 2013-11-25 19:47 - 00135680 _____ (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00131072 _____ (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-11-25 19:47 - 2013-11-25 19:47 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00105984 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00101376 _____ (Microsoft Corporation) C:\Windows\System32\inseng.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00090112 _____ (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe
2013-11-25 19:47 - 2013-11-25 19:47 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00086016 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-11-25 19:47 - 2013-11-25 19:47 - 00084992 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00083968 _____ (Microsoft Corporation) C:\Windows\System32\MshtmlDac.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00081408 _____ (Microsoft Corporation) C:\Windows\System32\icardie.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00077312 _____ (Microsoft Corporation) C:\Windows\System32\tdc.ocx
2013-11-25 19:47 - 2013-11-25 19:47 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-11-25 19:47 - 2013-11-25 19:47 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-11-25 19:47 - 2013-11-25 19:47 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-11-25 19:47 - 2013-11-25 19:47 - 00062464 _____ (Microsoft Corporation) C:\Windows\System32\pngfilt.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00052224 _____ (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00048640 _____ (Microsoft Corporation) C:\Windows\System32\mshtmler.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00048128 _____ (Microsoft Corporation) C:\Windows\System32\imgutil.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00040448 _____ (Microsoft Corporation) C:\Windows\System32\JavaScriptCollectionAgent.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00030208 _____ (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00013824 _____ (Microsoft Corporation) C:\Windows\System32\mshta.exe
2013-11-25 19:47 - 2013-11-25 19:47 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-11-25 19:47 - 2013-11-25 19:47 - 00013312 _____ (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2013-11-25 19:47 - 2013-11-25 19:47 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe

==================== One Month Modified Files and Folders =======

2013-12-22 18:48 - 2013-12-22 17:46 - 00139040 _____ C:\OTL.Txt
2013-12-22 17:42 - 2010-04-11 12:28 - 00000000 ____D C:\users\Wolfgang
2013-12-22 15:12 - 2013-12-22 15:12 - 00000000 ____D C:\FRST
2013-12-22 13:20 - 2013-12-22 07:50 - 95025368 ____T C:\ProgramData\0zj2q3fr.fee
2013-12-22 13:20 - 2013-12-22 07:50 - 00000000 _____ C:\ProgramData\0zj2q3fr.odd
2013-12-22 13:19 - 2013-12-15 18:15 - 00003440 _____ C:\Windows\setupact.log
2013-12-22 13:19 - 2009-07-14 06:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-12-22 13:19 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-12-22 12:25 - 2009-07-14 05:45 - 00018736 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-12-22 12:25 - 2009-07-14 05:45 - 00018736 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-12-22 12:20 - 2012-08-07 18:02 - 00000000 ___RD C:\Users\Wolfgang\Dropbox
2013-12-22 12:20 - 2012-08-07 17:34 - 00000000 ____D C:\Users\Wolfgang\AppData\Roaming\Dropbox
2013-12-22 12:11 - 2013-05-01 16:40 - 00001037 _____ C:\Users\Wolfgang\Desktop\Dropbox.lnk
2013-12-22 12:07 - 2013-12-22 12:07 - 00276480 _____ C:\Windows\Minidump\122213-22807-01.dmp
2013-12-22 12:07 - 2010-08-15 13:59 - 00000000 ____D C:\Windows\Minidump
2013-12-22 12:06 - 2013-12-22 09:25 - 397490613 _____ C:\Windows\MEMORY.DMP
2013-12-22 12:05 - 2013-12-22 12:05 - 00276480 _____ C:\Windows\Minidump\122213-66862-01.dmp
2013-12-22 11:54 - 2010-11-07 09:05 - 01174429 _____ C:\Windows\WindowsUpdate.log
2013-12-22 10:58 - 2012-04-05 10:11 - 00000000 ____D C:\FTP
2013-12-22 09:41 - 2013-04-17 06:42 - 00000000 ____D C:\Program Files (x86)\StarMoney 9.0
2013-12-22 09:36 - 2013-12-22 09:36 - 00006576 ____N C:\bootsqm.dat
2013-12-22 09:29 - 2013-12-22 09:29 - 00276536 _____ C:\Windows\Minidump\122213-19484-01.dmp
2013-12-22 09:28 - 2013-12-22 09:28 - 00276480 _____ C:\Windows\Minidump\122213-65317-01.dmp
2013-12-22 09:26 - 2013-12-22 09:26 - 00000000 ____D C:\ProgramData\HitmanPro
2013-12-22 09:26 - 2013-12-22 09:26 - 00000000 _____ C:\Windows\Minidump\122213-63866-01.dmp
2013-12-22 08:32 - 2013-12-22 08:32 - 00000298 ____H C:\Windows\Tasks\User_Feed_Synchronization-{C04CE4A3-31BF-4700-ACCF-DE1A1FA1635C}.job
2013-12-22 07:51 - 2013-12-22 07:51 - 00000291 _____ C:\ProgramData\0zj2q3fr.reg
2013-12-22 07:50 - 2013-12-22 07:50 - 00230912 _____ (hxxp://tortoisesvn.net) C:\ProgramData\rf3q2jz0.jss
2013-12-22 07:50 - 2013-12-22 07:50 - 00061540 ____T (Microsoft Corporation) C:\ProgramData\0zj2q3fr.zvv
2013-12-22 06:23 - 2013-04-28 15:09 - 00000452 _____ C:\Windows\System32\Drivers\etc\hosts.ics
2013-12-21 09:45 - 2012-04-28 06:09 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-12-21 09:40 - 2013-12-15 18:24 - 00011126 _____ C:\Users\Wolfgang\Desktop\ip adressen.xlsx
2013-12-21 07:56 - 2009-10-20 00:51 - 00000000 ____D C:\Program Files (x86)\Google
2013-12-20 19:38 - 2013-12-20 19:37 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-19 20:05 - 2009-07-14 06:13 - 01769676 _____ C:\Windows\System32\PerfStringBackup.INI
2013-12-19 20:05 - 2009-07-02 17:08 - 00757616 _____ C:\Windows\System32\perfh007.dat
2013-12-19 20:05 - 2009-07-02 17:08 - 00172936 _____ C:\Windows\System32\perfc007.dat
2013-12-18 20:49 - 2013-12-18 20:49 - 00019018 _____ C:\Windows\PFRO.log
2013-12-18 20:49 - 2013-08-18 14:49 - 00000000 ____D C:\ProgramData\seavenshare!
2013-12-18 18:19 - 2013-05-07 16:41 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avnetflt.sys
2013-12-18 18:19 - 2013-03-30 07:02 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avipbb.sys
2013-12-18 18:19 - 2013-03-30 07:02 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avgntflt.sys
2013-12-15 20:24 - 2010-09-12 17:35 - 00000000 ____D C:\Program Files (x86)\Biet-O-Matic
2013-12-15 18:15 - 2013-12-15 18:15 - 00000000 _____ C:\Windows\setuperr.log
2013-12-15 10:35 - 2013-07-08 10:45 - 00000000 ____D C:\Users\Wolfgang\Desktop\Essen_Trinken
2013-12-15 08:20 - 2013-09-27 16:47 - 00000000 ____D C:\Program Files (x86)\JDownloader
2013-12-15 07:51 - 2013-12-14 08:25 - 00000000 ____D C:\Program Files (x86)\V-CamShow
2013-12-15 07:51 - 2010-04-17 08:24 - 00000000 ____D C:\Program Files (x86)\CCleaner
2013-12-15 07:36 - 2013-12-15 07:36 - 16383031 _____ C:\Users\Wolfgang\Desktop\XS_TB-2.5_7270_v2_05.53-freetz-devel-11286M.de.zip
2013-12-15 05:18 - 2012-12-06 20:40 - 00003086 _____ C:\Windows\System32\Tasks\{5FEC34F1-308C-4A14-849B-49DE915BAC42}
2013-12-14 19:45 - 2011-01-07 10:37 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-12-14 19:44 - 2007-07-12 02:49 - 00000000 ____D C:\Windows\Panther
2013-12-14 19:42 - 2011-11-12 08:00 - 00000000 ____D C:\Users\Wolfgang\AppData\Roaming\1&1
2013-12-14 19:39 - 2010-04-11 13:07 - 00000000 ____D C:\Users\Wolfgang\AppData\Local\Google
2013-12-14 19:35 - 2013-07-08 10:42 - 00000000 ___RD C:\Users\Wolfgang\Desktop\Hardware
2013-12-14 18:00 - 1998-06-24 01:00 - 00203576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RICHTX32.OCX
2013-12-14 10:09 - 2009-07-14 06:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2013-12-14 10:06 - 2009-07-14 05:45 - 05020592 _____ C:\Windows\System32\FNTCACHE.DAT
2013-12-14 10:02 - 2012-07-01 11:38 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-12-14 09:24 - 2009-10-20 00:39 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-12-14 09:20 - 2013-08-17 03:59 - 00000000 ____D C:\Windows\System32\MRT
2013-12-14 09:17 - 2010-04-11 12:54 - 90708896 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-12-14 08:17 - 2012-07-01 11:38 - 00003824 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-12-14 08:17 - 2012-05-13 06:33 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-12-14 08:17 - 2011-05-15 07:05 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-12-14 08:13 - 2010-04-11 13:12 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-12-14 08:13 - 2010-04-11 13:12 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-12-14 08:05 - 2013-10-20 07:25 - 00000000 ____D C:\Users\Wolfgang\Documents\Calibre-Bibliothek
2013-12-14 07:49 - 2012-12-22 11:54 - 00000000 ____D C:\Users\Wolfgang\Documents\Outlook-Dateien
2013-12-13 11:09 - 2010-04-11 13:12 - 00004108 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-12-13 11:09 - 2010-04-11 13:12 - 00003856 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-12-01 16:16 - 2011-08-07 16:04 - 00000000 ____D C:\Freigabe
2013-11-26 20:33 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-11-26 12:54 - 2013-12-14 09:22 - 23183360 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-11-26 11:19 - 2013-12-14 09:22 - 02724864 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-11-26 11:18 - 2013-12-14 09:22 - 00004096 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollectorres.dll
2013-11-26 11:11 - 2013-12-14 09:22 - 17112576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-26 10:48 - 2013-12-14 09:22 - 00066048 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-11-26 10:46 - 2013-12-14 09:22 - 00048640 _____ (Microsoft Corporation) C:\Windows\System32\ieetwproxystub.dll
2013-11-26 10:41 - 2013-12-14 09:22 - 02764288 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-11-26 10:29 - 2013-12-14 09:22 - 00053760 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-11-26 10:27 - 2013-12-14 09:22 - 00033792 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-11-26 10:23 - 2013-12-14 09:22 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-11-26 10:21 - 2013-12-14 09:22 - 00574976 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-11-26 10:18 - 2013-12-14 09:22 - 00139264 _____ (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-11-26 10:18 - 2013-12-14 09:22 - 00111616 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollector.exe
2013-11-26 10:16 - 2013-12-14 09:22 - 00708608 _____ (Microsoft Corporation) C:\Windows\System32\jscript9diag.dll
2013-11-26 09:57 - 2013-12-14 09:22 - 00218624 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-11-26 09:38 - 2013-12-14 09:22 - 02166784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-26 09:38 - 2013-12-14 09:22 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-11-26 09:35 - 2013-12-14 09:22 - 05769216 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-11-26 09:32 - 2013-12-14 09:22 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-11-26 09:28 - 2013-12-14 09:22 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2013-11-26 09:16 - 2013-12-14 09:22 - 04243968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-26 09:02 - 2013-12-14 09:22 - 01995264 _____ (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-11-26 08:48 - 2013-12-14 09:22 - 12996608 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-11-26 08:32 - 2013-12-14 09:22 - 01928192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-11-26 08:26 - 2013-12-14 09:22 - 11221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-26 08:07 - 2013-12-14 09:22 - 02334208 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-11-26 07:40 - 2013-12-14 09:22 - 01395200 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-11-26 07:34 - 2013-12-14 09:22 - 00817664 _____ (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2013-11-26 07:34 - 2013-12-14 09:22 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-11-26 07:33 - 2013-12-14 09:22 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-26 07:27 - 2013-12-14 09:22 - 01157632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-11-25 19:55 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-11-25 19:47 - 2013-11-25 19:47 - 01228800 _____ (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00942592 _____ (Microsoft Corporation) C:\Windows\System32\jsIntl.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00940032 _____ (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2013-11-25 19:47 - 2013-11-25 19:47 - 00774144 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00626176 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-11-25 19:47 - 2013-11-25 19:47 - 00616104 _____ (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat
2013-11-25 19:47 - 2013-11-25 19:47 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00548352 _____ (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00453120 _____ (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00413696 _____ (Microsoft Corporation) C:\Windows\System32\html.iec
2013-11-25 19:47 - 2013-11-25 19:47 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-11-25 19:47 - 2013-11-25 19:47 - 00296960 _____ (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00263376 _____ (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00247808 _____ (Microsoft Corporation) C:\Windows\System32\msls31.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00243200 _____ (Microsoft Corporation) C:\Windows\System32\webcheck.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00235520 _____ (Microsoft Corporation) C:\Windows\System32\url.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00235008 _____ (Microsoft Corporation) C:\Windows\System32\elshyph.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00195584 _____ (Microsoft Corporation) C:\Windows\System32\msrating.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00167424 _____ (Microsoft Corporation) C:\Windows\System32\iexpress.exe
2013-11-25 19:47 - 2013-11-25 19:47 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-11-25 19:47 - 2013-11-25 19:47 - 00147968 _____ (Microsoft Corporation) C:\Windows\System32\occache.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00143872 _____ (Microsoft Corporation) C:\Windows\System32\wextract.exe
2013-11-25 19:47 - 2013-11-25 19:47 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-11-25 19:47 - 2013-11-25 19:47 - 00135680 _____ (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00131072 _____ (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-11-25 19:47 - 2013-11-25 19:47 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00105984 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00101376 _____ (Microsoft Corporation) C:\Windows\System32\inseng.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00090112 _____ (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe
2013-11-25 19:47 - 2013-11-25 19:47 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00086016 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-11-25 19:47 - 2013-11-25 19:47 - 00084992 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00083968 _____ (Microsoft Corporation) C:\Windows\System32\MshtmlDac.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00081408 _____ (Microsoft Corporation) C:\Windows\System32\icardie.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00077312 _____ (Microsoft Corporation) C:\Windows\System32\tdc.ocx
2013-11-25 19:47 - 2013-11-25 19:47 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-11-25 19:47 - 2013-11-25 19:47 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-11-25 19:47 - 2013-11-25 19:47 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-11-25 19:47 - 2013-11-25 19:47 - 00062464 _____ (Microsoft Corporation) C:\Windows\System32\pngfilt.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00052224 _____ (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00048640 _____ (Microsoft Corporation) C:\Windows\System32\mshtmler.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00048128 _____ (Microsoft Corporation) C:\Windows\System32\imgutil.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00040448 _____ (Microsoft Corporation) C:\Windows\System32\JavaScriptCollectionAgent.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00030208 _____ (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-11-25 19:47 - 2013-11-25 19:47 - 00013824 _____ (Microsoft Corporation) C:\Windows\System32\mshta.exe
2013-11-25 19:47 - 2013-11-25 19:47 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-11-25 19:47 - 2013-11-25 19:47 - 00013312 _____ (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2013-11-25 19:47 - 2013-11-25 19:47 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-11-25 19:12 - 2013-03-30 07:02 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avkmgr.sys
2013-11-24 14:41 - 2010-04-25 07:56 - 00000528 _____ C:\Users\Wolfgang\Desktop\nxfmg9Qh.txt
2013-11-23 19:26 - 2013-12-12 19:28 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-11-23 18:47 - 2013-12-12 19:28 - 00465920 _____ (Microsoft Corporation) C:\Windows\System32\WMPhoto.dll

Files to move or delete:
====================
C:\ProgramData\0zj2q3fr.reg


Some content of TEMP:
====================
C:\Users\Wolfgang\AppData\Local\Temp\avgnt.exe
C:\Users\Wolfgang\AppData\Local\Temp\~tmf9043366444806648529.dll


==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

Restore point made on: 2013-12-14 09:16:14

==================== Memory info ===========================

Percentage of memory in use: 28%
Total physical RAM: 1976.93 MB
Available physical RAM: 1414.64 MB
Total Pagefile: 1976.93 MB
Available Pagefile: 1409.73 MB
Total Virtual: 8192 MB
Available Virtual: 8191.87 MB

==================== Drives ================================

Drive c: (Acer) (Fixed) (Total:220.79 GB) (Free:89.69 GB) NTFS
Drive e: (PQSERVICE) (Fixed) (Total:12 GB) (Free:0.99 GB) NTFS
Drive f: (GRMCULXFRER_DE_DVD) (CDROM) (Total:3.04 GB) (Free:0 GB) UDF
Drive g: (HITMANPRO) (Removable) (Total:1.86 GB) (Free:1.85 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (SYSTEM RESERVED) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: 2C2FF16E)
Partition 1: (Not Active) - (Size=12 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=221 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 2 GB) (Disk ID: 51575880)
Partition 1: (Active) - (Size=2 GB) - (Type=0B)


LastRegBack: 2013-11-20 11:09

==================== End Of Log ============================
--- --- ---

schrauber 23.12.2013 08:51
Drücke bitte die + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
Startup: C:\Users\Wolfgang\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0zj2q3fr.lnk
ShortcutTarget: 0zj2q3fr.lnk -> C:\PROGRA~3\\rf3q2jz0.jss (hxxp://tortoisesvn.net)
S2 Winmgmt; C:\PROGRA~3\\0zj2q3fr.zvv [61540 2013-12-22] (Microsoft Corporation)
2013-12-22 07:51 - 2013-12-22 07:51 - 00000291 _____ C:\ProgramData\0zj2q3fr.reg
2013-12-22 07:50 - 2013-12-22 13:20 - 95025368 ____T C:\ProgramData\0zj2q3fr.fee
2013-12-22 07:50 - 2013-12-22 13:20 - 00000000 _____ C:\ProgramData\0zj2q3fr.odd
2013-12-22 07:50 - 2013-12-22 07:50 - 00230912 _____ (hxxp://tortoisesvn.net) C:\ProgramData\rf3q2jz0.jss
2013-12-22 07:50 - 2013-12-22 07:50 - 00061540 ____T (Microsoft Corporation) C:\ProgramData\0zj2q3fr.zvv
Speichere diese bitte als Fixlist.txt auf deinem USB Stick.
  • Starte deinen Rechner erneut in die Reparaturoptionen
  • Starte nun die FRST.exe erneut und klicke den Entfernen Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.



Rechner normal starten.


Alle Zeitangaben in WEZ +1. Es ist jetzt 15:52 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131