Ständige Werbeeinblenung / öffnende Fenster trotz div. Versuche Hiho
Ich habe hier einen Rechner, bei dem ständigh IE Fenster offnen. Pro selbst geöffnetem Fenster kann man von mindesten 2 weiteren Fenstern ausgehen, die automatisch öffnen. Oft öffnet sich der IE auch selbstständig.
Zudem wird ständig bannerwerbung angezeigt.
Zudem war bei Avira Pro der eMail Shutz und eMailschutz deaktiviert und ließ sich ohne neuinstallation nicht starten. (Scan von Avira hat auch nichts gefunden)
Versucht habe ich bereits_:
- JRT
- ADcleaner
- Maleware
--- alle 3 haben hier und da diverse Sachen gefunden, jedoch scheinbar nicht das richtige
- msconfig einen komisch klimngenden Dienst und ein Program deaktiviert
- manuell habe ich gelöscht diesen Quatsch wie MyBackup, System speedup und den blablub defender, sowie dieses komische Smileyprogramm
- Weiterhin einen komplettscan mit Kaspersky rescue disk (nach allem anderen, hat nichts mehr gefunden)
- ipconfig /flushdns
- geschaut, ob irgendwelche ominösen Plugins im IE sind
Wo liegt der wurm begraben? Danke
FRST: Zitat:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 17-04-2014
Ran by Planbau (administrator) on PLANBAU-PC on 17-04-2014 11:26:39
Running from C:\Users\Planbau\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1V2HRFHJ
Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(CANON INC) C:\Program Files\Canon\imagePROGRAFStatusMonitor\cnwisam.exe
(CANON INC.) C:\Windows\system32\Cnwiolss.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
(Google Inc.) C:\Program Files\Google\Update\1.3.23.9\GoogleCrashHandler.exe
(Canon Inc.) C:\Program Files\Canon\CAL\CALMAIN.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(CANON INC.) C:\Program Files\Canon\imagePROGRAFStatusMonitor\cnwida.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\ipoint.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliType Pro\itype.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Nero AG) C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
() C:\Program Files\Rainlendar2\Rainlendar2.exe
() C:\Users\Planbau\AppData\Local\Genesis\Genesis.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Nero AG) C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
(Nero AG) C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\system32\Macromed\Flash\FlashUtil32_12_0_0_77_ActiveX.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avmailc7.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\ProgramData\Avira\AntiVir Desktop\TEMP\SELFUPDATE\avrestart.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7625248 2009-07-20] (Realtek Semiconductor)
HKLM\...\Run: [NeroFilterCheck] => C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [153136 2007-03-01] (Nero AG)
HKLM\...\Run: [CnwiDeviceAgent] => C:\Program Files\Canon\imagePROGRAFStatusMonitor\cnwida.exe [64272 2009-06-10] (CANON INC.)
HKLM\...\Run: [IntelliPoint] => c:\Program Files\Microsoft IntelliPoint\ipoint.exe [1808784 2011-04-13] (Microsoft Corporation)
HKLM\...\Run: [itype] => c:\Program Files\Microsoft IntelliType Pro\itype.exe [1313640 2011-08-10] (Microsoft Corporation)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-11-28] (Apple Inc.)
HKLM\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [34672 2008-06-12] (Adobe Systems Incorporated)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [689744 2014-04-17] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-1617460887-3421491500-4191475435-1000\...\Run: [IncrediMail] => C:\Program Files\IncrediMail\bin\IncMail.exe [367016 2014-04-16] (IncrediMail, Ltd.)
HKU\S-1-5-21-1617460887-3421491500-4191475435-1000\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] => C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [152872 2007-06-27] (Nero AG)
HKU\S-1-5-21-1617460887-3421491500-4191475435-1000\...\Run: [Rainlendar2] => C:\Program Files\Rainlendar2\Rainlendar2.exe [2433024 2011-08-12] ()
HKU\S-1-5-21-1617460887-3421491500-4191475435-1000\...\Run: [genesis] => c:\users\planbau\appdata\local\genesis\genesis.exe [2695168 2014-04-16] ()
HKU\S-1-5-21-1617460887-3421491500-4191475435-1000\...\Run: [GoogleChromeAutoLaunch_2096916594441DEEDAD8CDE6C6BE8D19] => C:\Program Files\Google\Chrome\Application\chrome.exe [841032 2014-04-02] (Google Inc.)
HKU\S-1-5-21-1617460887-3421491500-4191475435-1000\...\MountPoints2: {39bef90e-b9a8-11e0-8e5d-001966e3f129} - D:\LaunchU3.exe -a
HKU\S-1-5-21-1617460887-3421491500-4191475435-1000\...\MountPoints2: {72acd608-d783-11e0-b3f6-001966e3f129} - D:\setup.exe
IFEO\DatamngrCoordinator.exe: [Debugger] tasklist.exe
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:Tabs
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x007E0B99276CCA01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
SearchScopes: HKLM - DefaultScope value is missing.
BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} hxxp://office.microsoft.com/_layouts/ClientBin/ieawsdc32.cab
DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-31-0.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.192.241
FireFox:
========
FF ProfilePath: C:\Users\Planbau\AppData\Roaming\Mozilla\Firefox\Profiles\cm2d8afy.default
FF Homepage: hxxp://www.yahoo.de/
FF NetworkProxy: "type", 0
FF SelectedSearchEngine: StartWeb
FF Homepage: user_pref("browser.startup.homepage", "");
FF SelectedSearchEngine: user_pref("browser.search.selectedEngine", "");
FF DefaultSearchEngine: user_pref("browser.search.defaultenginename", "");
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
Chrome:
=======
CHR HomePage:
CHR RestoreOnStartup: "sync_promo": {
"show_on_first_run_allowed"
CHR StartupUrls: "hxxp://www.google.com/"
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\34.0.1847.116\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\34.0.1847.116\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\34.0.1847.116\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll No File
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (iTunes Application Detector) - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_6_602_180.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll No File
CHR Extension: (YouTube) - C:\Users\Planbau\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-11-13]
CHR Extension: (Google-Suche) - C:\Users\Planbau\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-11-13]
CHR Extension: (Google Wallet) - C:\Users\Planbau\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]
CHR Extension: (Google Mail) - C:\Users\Planbau\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-11-13]
========================== Services (Whitelisted) =================
R2 AntiVirMailService; C:\Program Files\Avira\AntiVir Desktop\avmailc7.exe [910416 2014-04-17] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440400 2014-04-17] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440400 2014-04-17] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe [1017424 2014-04-17] (Avira Operations GmbH & Co. KG)
R2 Canon imagePROGRAF Status Monitor; C:\Program Files\Canon\imagePROGRAFStatusMonitor\cnwisam.exe [688912 2009-06-10] (CANON INC)
R2 CCALib8; C:\Program Files\Canon\CAL\CALMAIN.exe [96341 2005-09-30] (Canon Inc.)
R2 iPFDeviceAgentService; C:\Windows\system32\Cnwiolss.exe [161280 2008-12-08] (CANON INC.)
==================== Drivers (Whitelisted) ====================
S3 akshasp; C:\Windows\System32\DRIVERS\akshasp.sys [238208 2009-03-13] (Aladdin Knowledge Systems Ltd.)
S3 aksusb; C:\Windows\System32\DRIVERS\aksusb.sys [16384 2009-06-22] (Aladdin Knowledge Systems Ltd.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2014-04-17] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135648 2014-04-17] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-31] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [69240 2014-04-17] (Avira Operations GmbH & Co. KG)
R2 Hardlock; C:\Windows\system32\drivers\hardlock.sys [588800 2010-09-27] (SafeNet Inc.)
S1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-10-31] (Avira GmbH)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-04-17 11:43 - 2014-04-17 12:51 - 00000000 ____D () C:\Kaspersky Rescue Disk 10.0
2014-04-17 11:26 - 2014-04-17 11:26 - 00000000 ____D () C:\FRST
2014-04-17 11:21 - 2014-04-17 11:21 - 00000000 ____D () C:\Users\Planbau\AppData\Roaming\Avira
2014-04-17 11:20 - 2014-04-17 11:23 - 00135648 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-04-17 11:20 - 2014-04-17 11:23 - 00090400 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-04-17 11:20 - 2014-04-17 11:23 - 00069240 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-04-17 11:20 - 2014-04-17 11:20 - 00001982 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-04-17 11:20 - 2014-04-17 11:20 - 00000000 ____D () C:\Program Files\Avira
2014-04-17 11:20 - 2013-10-31 19:25 - 00113024 _____ (Avira GmbH) C:\Windows\system32\Drivers\avfwot.sys
2014-04-17 11:20 - 2013-10-31 19:25 - 00092448 _____ (Avira GmbH) C:\Windows\system32\Drivers\avfwim.sys
2014-04-17 11:20 - 2013-10-31 19:25 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2014-04-17 11:20 - 2013-10-31 19:25 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
2014-04-17 11:08 - 2014-04-17 11:08 - 00000000 ____D () C:\Users\Public\Neuer Ordner
2014-04-17 10:52 - 2014-04-17 11:15 - 00000909 _____ () C:\Windows\setupact.log
2014-04-17 10:52 - 2014-04-17 11:14 - 00002492 _____ () C:\Windows\PFRO.log
2014-04-17 10:52 - 2014-04-17 10:52 - 00000000 _____ () C:\Windows\setuperr.log
2014-04-17 08:28 - 2014-04-17 08:28 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-04-17 08:28 - 2014-04-03 09:51 - 00073432 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-17 08:28 - 2014-04-03 09:51 - 00051416 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-17 08:26 - 2014-04-17 08:42 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamswissarmy.sys
2014-04-17 08:26 - 2014-04-17 08:28 - 00000000 ____D () C:\Users\Planbau\AppData\Roaming\Malwarebytes
2014-04-17 08:25 - 2014-04-17 08:28 - 00001030 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-04-17 08:25 - 2014-04-17 08:28 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-17 08:25 - 2014-04-17 08:28 - 00000000 ____D () C:\Program Files\Malwarebytes' Anti-Malware
2014-04-17 08:25 - 2014-04-03 09:50 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-17 08:18 - 2014-04-17 08:21 - 00000000 ____D () C:\AdwCleaner
2014-04-17 08:17 - 2014-04-17 08:18 - 01426178 _____ () C:\Users\Planbau\Downloads\adwcleaner.exe
2014-04-17 08:16 - 2014-04-17 08:16 - 00000852 _____ () C:\Users\Planbau\Desktop\JRT.txt
2014-04-16 16:16 - 2014-04-16 16:16 - 00000000 __SHD () C:\Users\Planbau\AppData\Local\EmieUserList
2014-04-16 16:16 - 2014-04-16 16:16 - 00000000 __SHD () C:\Users\Planbau\AppData\Local\EmieSiteList
2014-04-16 16:06 - 2014-03-06 11:19 - 17387008 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-16 16:06 - 2014-03-06 10:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-16 16:06 - 2014-03-06 10:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-04-16 16:06 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-04-16 16:06 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-16 16:06 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-04-16 16:06 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-16 16:06 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-16 16:06 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-16 16:06 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-16 16:06 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-16 16:06 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-04-16 16:06 - 2014-03-06 09:38 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-04-16 16:06 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-04-16 16:06 - 2014-03-06 09:28 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-04-16 16:06 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-04-16 16:06 - 2014-03-06 09:18 - 00575488 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-16 16:06 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-04-16 16:06 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-16 16:06 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-04-16 16:06 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-16 16:06 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-04-16 16:06 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-16 16:06 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-04-16 16:06 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-16 16:06 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-16 16:03 - 2014-04-16 16:03 - 00001949 _____ () C:\Users\Public\Desktop\IncrediMail.lnk
2014-04-16 15:49 - 2014-04-16 15:49 - 00000000 ____D () C:\Windows\ERUNT
2014-04-16 15:36 - 2014-04-16 15:36 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_dc3d_01009.Wdf
2014-04-16 09:42 - 2014-04-16 09:42 - 06121512 _____ (TeamViewer GmbH) C:\Users\Planbau\Desktop\TeamViewer_Setup_es.exe
2014-04-16 09:41 - 2014-04-17 11:26 - 00000000 ____D () C:\Users\Planbau\AppData\Local\Genesis
2014-04-16 09:41 - 2014-04-17 08:40 - 00000000 ____D () C:\Program Files\003
2014-04-16 09:41 - 2014-04-16 09:41 - 00002555 _____ () C:\Users\Planbau\Desktop\Continue TeamViewer.lnk
2014-04-11 12:34 - 2014-03-04 11:17 - 00868352 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-11 12:34 - 2014-02-04 04:07 - 00234432 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-11 12:34 - 2014-02-04 04:07 - 00149440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-11 12:34 - 2014-02-04 04:07 - 00027072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-11 12:34 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-11 12:34 - 2014-01-24 04:18 - 01212352 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-03-21 11:46 - 2014-03-21 11:46 - 00152848 _____ (Microsoft Corporation) C:\Windows\system32\comdlg32.ocx
==================== One Month Modified Files and Folders =======
2014-04-17 12:51 - 2014-04-17 11:43 - 00000000 ____D () C:\Kaspersky Rescue Disk 10.0
2014-04-17 11:26 - 2014-04-17 11:26 - 00000000 ____D () C:\FRST
2014-04-17 11:26 - 2014-04-16 09:41 - 00000000 ____D () C:\Users\Planbau\AppData\Local\Genesis
2014-04-17 11:23 - 2014-04-17 11:20 - 00135648 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-04-17 11:23 - 2014-04-17 11:20 - 00090400 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-04-17 11:23 - 2014-04-17 11:20 - 00069240 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-04-17 11:22 - 2012-09-24 11:05 - 01963378 _____ () C:\Windows\WindowsUpdate.log
2014-04-17 11:22 - 2009-07-14 06:34 - 00018656 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-17 11:22 - 2009-07-14 06:34 - 00018656 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-17 11:21 - 2014-04-17 11:21 - 00000000 ____D () C:\Users\Planbau\AppData\Roaming\Avira
2014-04-17 11:20 - 2014-04-17 11:20 - 00001982 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-04-17 11:20 - 2014-04-17 11:20 - 00000000 ____D () C:\Program Files\Avira
2014-04-17 11:20 - 2011-06-06 13:48 - 00000000 ____D () C:\ProgramData\Avira
2014-04-17 11:19 - 2009-09-30 08:19 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-17 11:15 - 2014-04-17 10:52 - 00000909 _____ () C:\Windows\setupact.log
2014-04-17 11:15 - 2012-06-21 07:59 - 00000000 ____D () C:\Users\Planbau\.rainlendar2
2014-04-17 11:15 - 2012-01-12 11:30 - 00001096 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-17 11:15 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-17 11:14 - 2014-04-17 10:52 - 00002492 _____ () C:\Windows\PFRO.log
2014-04-17 11:10 - 2012-04-05 08:13 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-17 11:08 - 2014-04-17 11:08 - 00000000 ____D () C:\Users\Public\Neuer Ordner
2014-04-17 11:08 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public
2014-04-17 11:06 - 2012-01-12 11:30 - 00001100 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-17 10:52 - 2014-04-17 10:52 - 00000000 _____ () C:\Windows\setuperr.log
2014-04-17 09:25 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-04-17 08:42 - 2014-04-17 08:26 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamswissarmy.sys
2014-04-17 08:40 - 2014-04-16 09:41 - 00000000 ____D () C:\Program Files\003
2014-04-17 08:40 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Branding
2014-04-17 08:28 - 2014-04-17 08:28 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-04-17 08:28 - 2014-04-17 08:26 - 00000000 ____D () C:\Users\Planbau\AppData\Roaming\Malwarebytes
2014-04-17 08:28 - 2014-04-17 08:25 - 00001030 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-04-17 08:28 - 2014-04-17 08:25 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-17 08:28 - 2014-04-17 08:25 - 00000000 ____D () C:\Program Files\Malwarebytes' Anti-Malware
2014-04-17 08:21 - 2014-04-17 08:18 - 00000000 ____D () C:\AdwCleaner
2014-04-17 08:18 - 2014-04-17 08:17 - 01426178 _____ () C:\Users\Planbau\Downloads\adwcleaner.exe
2014-04-17 08:16 - 2014-04-17 08:16 - 00000852 _____ () C:\Users\Planbau\Desktop\JRT.txt
2014-04-16 16:16 - 2014-04-16 16:16 - 00000000 __SHD () C:\Users\Planbau\AppData\Local\EmieUserList
2014-04-16 16:16 - 2014-04-16 16:16 - 00000000 __SHD () C:\Users\Planbau\AppData\Local\EmieSiteList
2014-04-16 16:08 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-04-16 16:03 - 2014-04-16 16:03 - 00001949 _____ () C:\Users\Public\Desktop\IncrediMail.lnk
2014-04-16 15:49 - 2014-04-16 15:49 - 00000000 ____D () C:\Windows\ERUNT
2014-04-16 15:36 - 2014-04-16 15:36 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_dc3d_01009.Wdf
2014-04-16 12:09 - 2009-11-23 13:33 - 00117696 _____ () C:\Users\Planbau\AppData\Local\GDIPFONTCACHEV1.DAT
2014-04-16 12:09 - 2009-07-14 06:33 - 00434992 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-04-16 09:45 - 2009-11-24 10:20 - 00000000 ____D () C:\Users\Planbau\AppData\Roaming\TeamViewer
2014-04-16 09:45 - 2009-11-24 10:19 - 00000000 ____D () C:\Program Files\TeamViewer
2014-04-16 09:42 - 2014-04-16 09:42 - 06121512 _____ (TeamViewer GmbH) C:\Users\Planbau\Desktop\TeamViewer_Setup_es.exe
2014-04-16 09:41 - 2014-04-16 09:41 - 00002555 _____ () C:\Users\Planbau\Desktop\Continue TeamViewer.lnk
2014-04-15 13:10 - 2012-11-13 08:59 - 00002087 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-04-11 16:43 - 2013-08-15 17:02 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-11 16:43 - 2009-11-06 12:29 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-04-11 16:41 - 2009-12-18 11:52 - 88028728 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-04-03 09:51 - 2014-04-17 08:28 - 00073432 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-03 09:51 - 2014-04-17 08:28 - 00051416 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-03 09:50 - 2014-04-17 08:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-03-21 11:46 - 2014-03-21 11:46 - 00152848 _____ (Microsoft Corporation) C:\Windows\system32\comdlg32.ocx
Some content of TEMP:
====================
C:\Users\Planbau\AppData\Local\Temp\avgnt.exe
C:\Users\Planbau\AppData\Local\Temp\Quarantine.exe
C:\Users\Planbau\AppData\Local\Temp\SpOrder.dll
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-04-09 10:40
==================== End Of Log ============================
| |