Trojaner-Board
Seite 2 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   getwindowinfo öfnet sich permanent von alleine (https://www.trojaner-board.de/157219-getwindowinfo-oefnet-permanent-alleine.html)

lawand 06.08.2014 10:49
ok sind ja fasst 1000 gigabites und die Backups . Er ist schon bei 86 % und hat schon 126 infizierte dateien gefunden

er hat auch schon mehr als 173000 dateien gecheckt . Sehr gründliches Programm anscheienend :)

Warlord711 06.08.2014 11:01
Ja, bei der Menge kann das dauern.

lawand 06.08.2014 19:31
was solch ich machen ? mein Internet Explorer öffnet sich nun mehrfach und spamt meinen Pc voll ?
Außerdem läuft der Pc schon zwei Tage , hat 87 % durch (174000 Dateien ) und hat 140 infizierte Dateien gefunden .

P.S. ich habe meinen Pc schon 3 Jahre und das Programm ist die ganzen Backups durchgegangen und ist nun beim Backup vom Juni dieses Jahres

Warlord711 06.08.2014 19:34
Deine Entscheidung.

Du kannst ESET abbrechen und wir arbeiten anhand des vorhandenen Logs weiter, oder du lässt es durchlaufen.

Wenn da nur noch Backups sind, sollte das nicht so problematisch sein.
ICh kann dir die Entscheidung nicht abnehmen, ich "berate" nur ;-P

lawand 07.08.2014 12:12
ich lass es sicherheitshalber weiter durchlaufen

Eset log :
Code:
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=180c40ccfea9434e9cd32d25def84af4
# engine=19497
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-08-07 09:46:31
# local_time=2014-08-07 11:46:31 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 100 240229 151903965 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 260404 159035982 0 0
# scanned=174574
# found=155
# cleaned=0
# scan_time=55615
sh=B4E639E42DC1AB9A1736D2F1AF91AF264F3BE379 ft=1 fh=597692f37efa691d vn="Variante von Win32/Amonetize.Z evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Program Files\Update Software\Bundle.exe"
sh=29AA66D388F57CE53E92B10D6FA6861F1E5142E6 ft=1 fh=6a8583720d151220 vn="Win32/Tivmonk.B Trojaner" ac=I fn="C:\FRST\Quarantine\C\Program Files\Update Software\winclient32.exe"
sh=41DE8CB24CF5AC8C9CB0A33B244E0EF3A8ABD138 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Conduit.AA evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\Lawand\AppData\Local\CRE\iokhogohoamdhejdbenjbjkhjmjlggab.crx"
sh=4B553651EF610C0614F8393D6C25ABA0A8F09ECA ft=1 fh=92ef1bb072edf568 vn="Variante von Win32/Bundled.Toolbar.Ask.D potenziell unsichere Anwendung" ac=I fn="C:\Program Files\Avira\AntiVir Desktop\offercast_avirav7_.exe"
sh=2BDDE03A0D73949A23EB84A1BEAED7A04B8AA935 ft=1 fh=5d3d22017cb0a45c vn="Variante von Win32/HackTool.Crack.BL potenziell unsichere Anwendung" ac=I fn="C:\Program Files\Journey of a Roach\steam_api.dll"
sh=DDB631D84A26EEACF0A706CEC14EEDE54200040E ft=0 fh=0000000000000000 vn="Win32/HackTool.Steam.E Trojaner" ac=I fn="C:\Users\Gullanar\AppData\Local\Google\Chrome\User Data\Default\File System\002\p\00\00000001"
sh=B4354902ADAD00B3214063BC7897B00EA6B53057 ft=0 fh=0000000000000000 vn="Win32/BrowserCompanion.G evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Gullanar\AppData\Local\Google\Chrome\User Data\Temp\scoped_dir_1871\blabbers-ch.crx"
sh=857B8A7174CCB09A37D37C7D1AA257AC3B4496BB ft=0 fh=0000000000000000 vn="Win32/BrowserCompanion.G evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Gullanar\AppData\Local\Google\Chrome\User Data\Temp\scoped_dir_1871\CRX_INSTALL\witmain.js"
sh=34F2250D95985E2EEEE0F3CA484EFBBC1B592F74 ft=0 fh=0000000000000000 vn="Win32/DealPly.E evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Gullanar\AppData\Local\Google\Chrome\User Data\Temp\scoped_dir_30074\DealPly.crx"
sh=444329E675A61AB752AAC433DFEC3DAAA0A26C6A ft=0 fh=0000000000000000 vn="Win32/DealPly.E evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Gullanar\AppData\Local\Google\Chrome\User Data\Temp\scoped_dir_30074\CRX_INSTALL\background.html"
sh=B506B2465FD10608020D30ED9047B5E11DE63FA0 ft=1 fh=10102a51b62618f2 vn="Win32/Bundled.Toolbar.Ask.E potenziell unsichere Anwendung" ac=I fn="C:\Users\Gullanar\Documents\APNSetup.exe"
sh=B506B2465FD10608020D30ED9047B5E11DE63FA0 ft=1 fh=10102a51b62618f2 vn="Win32/Bundled.Toolbar.Ask.E potenziell unsichere Anwendung" ac=I fn="C:\Users\Gullanar\Documents\APNSetup1.exe"
sh=E49A7CA3ACE893C7EF95973AF9F72F149F5AB945 ft=1 fh=72b44411b5e44a7c vn="Variante von Win32/AdWare.iBryte.AG Anwendung" ac=I fn="C:\Users\Gullanar\Downloads\Java_Updater_Setup (1).exe"
sh=95ADC7925C2BB20FACE637E7031972F8E208FA33 ft=0 fh=0000000000000000 vn="Variante von Win32/SweetIM.L evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Lawand\AppData\Local\Google\Chrome\User Data\Default\External Extensions\{EEE6C373-6118-11DC-9C72-001320C79847}\SweetFB.crx"
sh=8A9E8854C4C7A60A17F0A939E044795D5AC5529E ft=1 fh=3bdee6dfd70dc07b vn="Win32/Somoto.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Lawand\AppData\Local\Google\Chrome\User Data\Default\File System\005\t\00\00000000"
sh=B506B2465FD10608020D30ED9047B5E11DE63FA0 ft=1 fh=10102a51b62618f2 vn="Win32/Bundled.Toolbar.Ask.E potenziell unsichere Anwendung" ac=I fn="C:\Users\Lawand\Documents\APNSetup1.exe"
sh=89D0338DA997AF65AC582A0478756604A8626B5F ft=1 fh=6cc545e6cae82e67 vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\assembly\GAC\Microsoft.VisualStudio.OLE.Interop\7.1.40304.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.OLE.Interop.dll"
sh=0B232E06BC5E12D421289FDBAAC3E17EEC539271 ft=1 fh=e15e07abb92dc3fd vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\assembly\GAC_MSIL\Interop.SHDocVw\1.1.0.0__84542ff99aed6a4d\Interop.SHDocVw.dll"
sh=C70872D7B4F48D529A179C0FA54AB65FB1B982F4 ft=1 fh=f2e2b15faf5e28f3 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Windows\Installer\MSI2BA8.tmp"
sh=C70872D7B4F48D529A179C0FA54AB65FB1B982F4 ft=1 fh=f2e2b15faf5e28f3 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Windows\Installer\MSI5F74.tmp"
sh=3F7F25A0628A731849E70F5C6A37B48F3CF431D0 ft=1 fh=6ca57a02b1c441c3 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Windows\Installer\MSIA89A.tmp"
sh=C70872D7B4F48D529A179C0FA54AB65FB1B982F4 ft=1 fh=f2e2b15faf5e28f3 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Windows\Installer\MSICF6F.tmp"
sh=C70872D7B4F48D529A179C0FA54AB65FB1B982F4 ft=1 fh=f2e2b15faf5e28f3 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Windows\Installer\MSIFA1E.tmp"
sh=71435DDB11E00D0243380C4902324853FE4ECE8F ft=1 fh=12b0cd2dde452d65 vn="Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ApnIC[1].0"
sh=567F7670AC05037B3D666088C2B25036098F2AA7 ft=0 fh=0000000000000000 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AskToolbarInstaller-AVIRA-V7[1].7z"
sh=5A66C171963EC6CD5840A912571F2E0FEB40D43E ft=0 fh=0000000000000000 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AskToolbarInstaller-AVIRA-V7[2].7z"
sh=40E49124AD0B55A25F947333CA88E9D0BC30A7E3 ft=1 fh=e26ad988592b2af9 vn="Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1MUZTY8N\ApnIC[1].0"
sh=05F4A82A22EB44EFE5163151FB4F56919DC05398 ft=1 fh=eca75680ea9b0d36 vn="Variante von Win32/AdWare.iBryte.AH Anwendung" ac=I fn="D:\Java_Updater_Setup.exe"
sh=D98C4B33D5BDB6B9614E3B9231776941E69B8469 ft=0 fh=0000000000000000 vn="MSIL/Solimba.H evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2012-12-17 165707\Backup Files 2012-12-17 165707\Backup files 1.zip"
sh=51BB1DF70982114859CA1358FD7DB32A4F3DDA9E ft=0 fh=0000000000000000 vn="Win32/BrowserCompanion.G evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2012-12-17 165707\Backup Files 2012-12-17 165707\Backup files 2.zip"
sh=E140AC0661DD589D85E8089710DF20A54E0D6978 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2012-12-17 165707\Backup Files 2012-12-17 165707\Backup files 6.zip"
sh=2A8A1C58DDD8711EDCB381F95CB6465F124E144A ft=0 fh=0000000000000000 vn="Win32/Toolbar.Linkury evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2012-12-17 165707\Backup Files 2012-12-17 165707\Backup files 7.zip"
sh=405995DBDEA10710EA444AA2D49199B828D8BB34 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2012-12-17 165707\Backup Files 2013-01-17 101409\Backup files 4.zip"
sh=B0BD5A18D49C77862589E0B3641C4C70AA407E3A ft=0 fh=0000000000000000 vn="Win32/Toolbar.Linkury evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2012-12-17 165707\Backup Files 2013-01-17 101409\Backup files 5.zip"
sh=04F8BB94C13925938F700CA1A933DC8726C7D287 ft=0 fh=0000000000000000 vn="MSIL/Solimba.H evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2013-01-30 195752\Backup Files 2013-01-30 195752\Backup files 1.zip"
sh=343B5FAD44535FDE529DF4D451DE3A434BFAE2DE ft=0 fh=0000000000000000 vn="Win32/Toolbar.Linkury evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2013-01-30 195752\Backup Files 2013-01-30 195752\Backup files 10.zip"
sh=1D20201CDB6DB471B9F686B5F0E07CFBB79D5D90 ft=0 fh=0000000000000000 vn="Win32/BrowserCompanion.G evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2013-01-30 195752\Backup Files 2013-01-30 195752\Backup files 2.zip"
sh=0AEEFC3DC0C38C87CB68B5EAA50ED653CF869646 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2013-01-30 195752\Backup Files 2013-01-30 195752\Backup files 8.zip"
sh=5E2584620A82AFD48B047117FB037BCC17FC9DC3 ft=0 fh=0000000000000000 vn="MSIL/Solimba.H evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2013-02-17 204134\Backup Files 2013-02-17 204134\Backup files 1.zip"
sh=C56BA112651B95EE05A3ACC4286913EEBDF0F65B ft=0 fh=0000000000000000 vn="Win32/BrowserCompanion.G evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2013-02-17 204134\Backup Files 2013-02-17 204134\Backup files 2.zip"
sh=27E0E4CAF91DF7024E5A9797268B8FC738641690 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2013-02-17 204134\Backup Files 2013-02-25 071229\Backup files 3.zip"
sh=BA1996F398BFE3E34E3031F91C0C0C3EA6F4A65E ft=0 fh=0000000000000000 vn="Win32/Toolbar.Linkury evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2013-02-17 204134\Backup Files 2013-02-25 071229\Backup files 4.zip"
sh=4F48B02749282D9C2E851A957C804BAE7AB1A97C ft=0 fh=0000000000000000 vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2013-02-17 204134\Backup Files 2013-03-14 100607\Backup files 1.zip"
sh=C66FB3A4EF69CF5A7DD7412342F9168034E5F4C5 ft=0 fh=0000000000000000 vn="Win32/Adware.1ClickDownload.W Anwendung" ac=I fn="D:\PC\Backup Set 2013-02-17 204134\Backup Files 2013-04-05 124934\Backup files 1.zip"
sh=D5C26BDA07707863E7934FC61B99D14CFA7D8D6F ft=0 fh=0000000000000000 vn="MSIL/Solimba.H evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2013-04-15 115901\Backup Files 2013-04-15 115901\Backup files 1.zip"
sh=B3905B1758FBEA289357C9C895875B7FD9C48567 ft=0 fh=0000000000000000 vn="Win32/BrowserCompanion.G evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2013-04-15 115901\Backup Files 2013-04-15 115901\Backup files 2.zip"
sh=AFC57A65347C8DB204EA73EEB972A4CDE0AB4E12 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2013-04-15 115901\Backup Files 2013-04-15 115901\Backup files 6.zip"
sh=42B43DB0C3D6205F6352638434BDCBDA3AFECE9F ft=0 fh=0000000000000000 vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2013-04-15 115901\Backup Files 2013-04-15 115901\Backup files 7.zip"
sh=6B0029C206EB40DE78BDDD881373C99986BF60D6 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2013-04-15 115901\Backup Files 2013-05-05 212534\Backup files 1.zip"
sh=F15419792CC8A1BDFC5B95A9E3D6EA066221E53A ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2013-04-15 115901\Backup Files 2013-05-28 150051\Backup files 4.zip"
sh=79BFB7012886C8135E8A960F06E0CA264B8ED945 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2013-04-15 115901\Backup Files 2013-05-28 150051\Backup files 5.zip"
sh=EDE8396F2D5F3B0369BE60DF24465C38FDCF99DD ft=0 fh=0000000000000000 vn="MSIL/Solimba.H evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2013-06-03 093133\Backup Files 2013-06-03 093133\Backup files 1.zip"
sh=336C45F0D15195C2C64881F1D806394FCEDD83D8 ft=0 fh=0000000000000000 vn="Win32/BrowserCompanion.G evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2013-06-03 093133\Backup Files 2013-06-03 093133\Backup files 2.zip"
sh=720E9D3ADF5841083A36D0A43554A7A3A0F07838 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2013-06-03 093133\Backup Files 2013-06-03 093133\Backup files 6.zip"
sh=84500ED75492BF35E11100299376C0A18FD1F936 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2013-06-03 093133\Backup Files 2013-06-03 093133\Backup files 7.zip"
sh=50A5C8CE18B2B45170EF6C2332567B39EE031743 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2013-06-03 093133\Backup Files 2013-06-16 210749\Backup files 4.zip"
sh=C61B27A080C2DAAB93E1AC1365F26B28F07C4C64 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2013-06-03 093133\Backup Files 2013-06-16 210749\Backup files 5.zip"
sh=E9FA266D0EA12B0D9F103D1FE65257E9C79C99B1 ft=0 fh=0000000000000000 vn="MSIL/Solimba.H evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2013-06-23 190002\Backup Files 2013-06-23 190002\Backup files 1.zip"
sh=395E5269CF026C8DC2B64DE7BEC05B539CE98DCC ft=0 fh=0000000000000000 vn="Win32/BrowserCompanion.G evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2013-06-23 190002\Backup Files 2013-06-23 190002\Backup files 2.zip"
sh=0349FAD9A0246B9A8EE6D2C152402F4BBD04F35B ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2013-06-23 190002\Backup Files 2013-06-23 190002\Backup files 6.zip"
sh=653B958A0DCE65871F66B1A30F07983CC7ADB19F ft=0 fh=0000000000000000 vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2013-06-23 190002\Backup Files 2013-06-23 190002\Backup files 8.zip"
sh=C875B5D11D16060961B9B42C11B3AA0F33C0AE87 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2013-06-23 190002\Backup Files 2013-09-30 190207\Backup files 10.zip"
sh=EE58F7B77BDD7020FD7CF24FA20A6349B6AD7283 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2013-06-23 190002\Backup Files 2013-09-30 190207\Backup files 11.zip"
sh=E1B8ECD65417A3E7D28A7D82175C3CFF9813E2E8 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2013-06-23 190002\Backup Files 2013-09-30 190207\Backup files 13.zip"
sh=FFA51BB719B00D707242A59CC57C9A687526ED09 ft=0 fh=0000000000000000 vn="Win32/BrowserCompanion.G evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2013-06-23 190002\Backup Files 2013-09-30 190207\Backup files 2.zip"
sh=360657F3D6D8BC9DA2F42B1C4A728B27A2FBD4B8 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2013-10-06 190009\Backup Files 2013-10-06 190009\Backup files 10.zip"
sh=C13F274F8EE70234C6211264965119659C72D1C9 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2013-10-06 190009\Backup Files 2013-10-06 190009\Backup files 11.zip"
sh=38C458E03DE0404E2EFD54E2988661FF725C4BA5 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2013-10-06 190009\Backup Files 2013-10-06 190009\Backup files 13.zip"
sh=D86790D3C18EAADCC403E6859C9997E3557ECE4F ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="D:\PC\Backup Set 2013-10-06 190009\Backup Files 2013-10-20 190003\Backup files 4.zip"
sh=BE8C2053AFFB5F8EF307E3D6BB82E67AFB3D23AD ft=0 fh=0000000000000000 vn="Variante von Win32/SweetIM.L evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2013-10-06 190009\Backup Files 2013-11-05 192510\Backup files 11.zip"
sh=10BCEBE10BC7A995AA140E5E198BF9F4EFCA4367 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2013-10-06 190009\Backup Files 2013-11-05 192510\Backup files 12.zip"
sh=0F677F840166768FA955C1A959787861AF25030F ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2013-10-06 190009\Backup Files 2013-11-05 192510\Backup files 7.zip"
sh=880091F3C5E338F5DABD0C8220C9F9FBCF3E92BF ft=0 fh=0000000000000000 vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2013-10-06 190009\Backup Files 2013-11-05 192510\Backup files 9.zip"
sh=07AECDC0FC06A8EC5419A02213DAE5C5E863CB8F ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2013-11-10 200150\Backup Files 2013-11-10 200150\Backup files 10.zip"
sh=8EA186B5EB051C709CB60CD1A11BD73F9A94BBD1 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2013-11-10 200150\Backup Files 2013-11-10 200150\Backup files 11.zip"
sh=130D03C0E3D4C9526C27877958194ACF9984D594 ft=0 fh=0000000000000000 vn="Variante von Win32/SweetIM.L evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2013-11-10 200150\Backup Files 2013-11-10 200150\Backup files 14.zip"
sh=360F1F0B0463D3775DF8CD9E69D4A20C43431924 ft=0 fh=0000000000000000 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="D:\PC\Backup Set 2013-11-10 200150\Backup Files 2013-11-17 190003\Backup files 2.zip"
sh=B1594DDB50964ABD720859A74AC3ED6E5E34CDE5 ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="D:\PC\Backup Set 2013-11-10 200150\Backup Files 2013-11-17 190003\Backup files 3.zip"
sh=D908537061A0B4F530C201E8817182E3BDF87CDF ft=0 fh=0000000000000000 vn="Variante von Win32/Bundled.Toolbar.Ask.D potenziell unsichere Anwendung" ac=I fn="D:\PC\Backup Set 2013-11-10 200150\Backup Files 2013-11-17 190003\Backup files 5.zip"
sh=839D9C3044D9E75C3A554D9DB0A23DCDF4F52E8E ft=0 fh=0000000000000000 vn="Win32/OpenCandy potenziell unsichere Anwendung" ac=I fn="D:\PC\Backup Set 2013-11-10 200150\Backup Files 2013-11-24 191452\Backup files 1.zip"
sh=66502C9C8544F7B1419D04B1E3863AC4AD1B69FF ft=0 fh=0000000000000000 vn="Variante von Win32/DealPly.R evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2013-11-10 200150\Backup Files 2013-12-02 154019\Backup files 1.zip"
sh=260808268E22F5C2D24BC80AB04C93BC3A5220B9 ft=0 fh=0000000000000000 vn="Win32/Somoto.A evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2013-11-10 200150\Backup Files 2013-12-08 190005\Backup files 1.zip"
sh=97CF3910B884ACC5433906103A1C516FF3043FE3 ft=0 fh=0000000000000000 vn="Variante von Win32/Somoto.D evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2013-11-10 200150\Backup Files 2013-12-08 190005\Backup files 2.zip"
sh=3B44A482BD9009D1EE3887C2C0A9C4BB5ACF9B81 ft=0 fh=0000000000000000 vn="Variante von Win32/Mobogenie.A evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2013-11-10 200150\Backup Files 2013-12-08 190005\Backup files 23.zip"
sh=D6D6ABF7F3E2E54D773FBCDAF28F2A538343B960 ft=0 fh=0000000000000000 vn="Win32/Somoto.A evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2013-11-10 200150\Backup Files 2013-12-08 190005\Backup files 3.zip"
sh=0BEFD5EF9D087221D6D2B7ABF1B63DEAC19C6BA3 ft=0 fh=0000000000000000 vn="Win32/Bundled.Toolbar.Ask.E potenziell unsichere Anwendung" ac=I fn="D:\PC\Backup Set 2013-12-16 080050\Backup Files 2013-12-16 080050\Backup files 4.zip"
sh=7989937764EB97A3468CB5245354B0F6992B4258 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2013-12-16 080050\Backup Files 2013-12-22 190005\Backup files 10.zip"
sh=84C5B4B0957A6FD0C5D58E30D1DA2DE59B4CF675 ft=0 fh=0000000000000000 vn="Variante von Win32/DealPly.M evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2013-12-16 080050\Backup Files 2013-12-22 190005\Backup files 11.zip"
sh=815CDD4107059E0BB0C2CAD9729313E34AD34E81 ft=0 fh=0000000000000000 vn="MSIL/DomaIQ.M evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2013-12-16 080050\Backup Files 2013-12-22 190005\Backup files 2.zip"
sh=BB1DE181BD5C970DEB695DE14AF96918BAF01483 ft=0 fh=0000000000000000 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="D:\PC\Backup Set 2013-12-16 080050\Backup Files 2013-12-29 190003\Backup files 1.zip"
sh=8320F68D5DE27C9D3306E1B165AA7C80140119DF ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="D:\PC\Backup Set 2013-12-16 080050\Backup Files 2013-12-29 190003\Backup files 3.zip"
sh=666D109AD72572F0E68C1FC84058071868456C9A ft=0 fh=0000000000000000 vn="Variante von Win32/Bundled.Toolbar.Ask.D potenziell unsichere Anwendung" ac=I fn="D:\PC\Backup Set 2013-12-16 080050\Backup Files 2013-12-29 190003\Backup files 32.zip"
sh=D90809D919733665138958D3A424A1349E3769D6 ft=0 fh=0000000000000000 vn="Variante von Win32/Mobogenie.A evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2013-12-16 080050\Backup Files 2013-12-29 190003\Backup files 57.zip"
sh=9DDB43D8F9F8F576246645F27E183F11EB018842 ft=0 fh=0000000000000000 vn="Variante von Win32/Conduit.SearchProtect.N evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2013-12-16 080050\Backup Files 2014-01-06 132147\Backup files 10.zip"
sh=77FCE0748A44A534A5377BCDC75D7A8755DE79AF ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="D:\PC\Backup Set 2013-12-16 080050\Backup Files 2014-01-06 132147\Backup files 12.zip"
sh=FD614E25773CEE8A17395CC12E0362C1F2D73522 ft=0 fh=0000000000000000 vn="Variante von Win32/Mobogenie.A evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2013-12-16 080050\Backup Files 2014-01-06 132147\Backup files 13.zip"
sh=D87371679292D7C5CDAF42FCD00FED52324B57DB ft=0 fh=0000000000000000 vn="Win32/Bundled.Toolbar.Ask.E potenziell unsichere Anwendung" ac=I fn="D:\PC\Backup Set 2013-12-16 080050\Backup Files 2014-01-06 132147\Backup files 2.zip"
sh=E9DA65D362AFDDB1236B1F3D661CF4C34EA8800A ft=0 fh=0000000000000000 vn="Variante von Win32/SoftonicDownloader.F evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2014-01-12 190004\Backup Files 2014-01-12 190004\Backup files 1.zip"
sh=25A36D0E5DD1B783C1148A7845B4E1077E13075F ft=0 fh=0000000000000000 vn="Win32/NextLive.A evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2014-01-12 190004\Backup Files 2014-01-12 190004\Backup files 10.zip"
sh=C66ACACA36ADA06251FAE62E2B1CAD01C107F142 ft=0 fh=0000000000000000 vn="Variante von Win32/Mobogenie.A evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2014-01-12 190004\Backup Files 2014-01-12 190004\Backup files 105.zip"
sh=9F995A078B1F953CF665830093E584EF9B31026A ft=0 fh=0000000000000000 vn="Variante von Win32/Conduit.SearchProtect.N evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2014-01-12 190004\Backup Files 2014-01-12 190004\Backup files 11.zip"
sh=CF806C320FE1BD9386516243D5B870296D4F4145 ft=0 fh=0000000000000000 vn="Variante von Win32/SweetIM.L evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2014-01-12 190004\Backup Files 2014-01-12 190004\Backup files 13.zip"
sh=1C6A923CA5C2E4F6935E245D4BC3A283CDABB417 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Conduit.AH evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2014-01-12 190004\Backup Files 2014-01-12 190004\Backup files 14.zip"
sh=007C78341A3B7F2BED8ADB604129C08D00328D51 ft=0 fh=0000000000000000 vn="Win32/Bundled.Toolbar.Ask.E potenziell unsichere Anwendung" ac=I fn="D:\PC\Backup Set 2014-01-12 190004\Backup Files 2014-01-12 190004\Backup files 4.zip"
sh=974C1A201A7F0AF055E514667520E0DCFDF3C0E1 ft=0 fh=0000000000000000 vn="Win32/Bundled.Toolbar.Ask.E potenziell unsichere Anwendung" ac=I fn="D:\PC\Backup Set 2014-01-12 190004\Backup Files 2014-01-19 190005\Backup files 1.zip"
sh=CEC7C7E28FB62A4F11F3E60B8D1B2E9BA5E4D11D ft=0 fh=0000000000000000 vn="Variante von Win32/SweetIM.L evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2014-01-12 190004\Backup Files 2014-01-19 190005\Backup files 12.zip"
sh=4FFC5C956293D54AC6538C8F04A64C3984F2E92F ft=0 fh=0000000000000000 vn="Win32/NextLive.A evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2014-01-12 190004\Backup Files 2014-01-19 190005\Backup files 8.zip"
sh=B2F65CDFA2B8731DC42260C6039B6844A16494CE ft=0 fh=0000000000000000 vn="Variante von Win32/Mobogenie.A evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2014-01-12 190004\Backup Files 2014-01-19 190005\Backup files 98.zip"
sh=0673A143DD40861ADA4BE234B78C3B745ECEE294 ft=0 fh=0000000000000000 vn="Variante von Win32/SoftonicDownloader.F evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2014-01-27 183134\Backup Files 2014-01-27 183134\Backup files 1.zip"
sh=351C1464288B483C18C4C65CECF0D9A4CF69BCD6 ft=0 fh=0000000000000000 vn="Variante von Win32/SoftonicDownloader.F evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2014-01-27 183134\Backup Files 2014-02-02 190005\Backup files 1.zip"
sh=378ACED5D5A1BF5173068A23CA79D82308A12ED1 ft=0 fh=0000000000000000 vn="Win32/NextLive.A evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2014-01-27 183134\Backup Files 2014-02-02 190005\Backup files 10.zip"
sh=7D87B76A607AD931655AC2C55289F10496CE6892 ft=0 fh=0000000000000000 vn="Variante von Win32/Mobogenie.A evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2014-01-27 183134\Backup Files 2014-02-02 190005\Backup files 104.zip"
sh=20E901EA35A8592F81ED73A9BBFD600C6151EDAE ft=0 fh=0000000000000000 vn="Variante von Win32/SweetIM.L evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2014-01-27 183134\Backup Files 2014-02-02 190005\Backup files 13.zip"
sh=525303364D6B5048A044C6B34DB03CF9E781E05F ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Conduit.AH evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2014-01-27 183134\Backup Files 2014-02-02 190005\Backup files 14.zip"
sh=73F385854A738304BA0F367B132FEF24C30093B5 ft=0 fh=0000000000000000 vn="Variante von Win32/SoftonicDownloader.F evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2014-01-27 183134\Backup Files 2014-02-17 194835\Backup files 1.zip"
sh=F4CC5CE45076574DDF2C53B0D60661B98A4FF371 ft=0 fh=0000000000000000 vn="Variante von Win32/SoftonicDownloader.F evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2014-03-16 190001\Backup Files 2014-03-16 190001\Backup files 1.zip"
sh=FD8E40ABE009F21EAEDD83187B8C97190A05DFD4 ft=0 fh=0000000000000000 vn="Win32/NextLive.A evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2014-03-16 190001\Backup Files 2014-03-16 190001\Backup files 11.zip"
sh=E6A1F576B9436D5048087474A39A20C085E18C07 ft=0 fh=0000000000000000 vn="Variante von Win32/SweetIM.L evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2014-03-16 190001\Backup Files 2014-03-16 190001\Backup files 12.zip"
sh=7E61958E45D478BB9A5324B4AC3072740C426C27 ft=0 fh=0000000000000000 vn="Win32/DownloadAdmin.G evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2014-03-16 190001\Backup Files 2014-03-16 190001\Backup files 3.zip"
sh=CEAF202E0B0C2BE578A9364A22EF8F2C3F9004EE ft=0 fh=0000000000000000 vn="Variante von Win32/Mobogenie.A evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2014-03-16 190001\Backup Files 2014-03-16 190001\Backup files 33.zip"
sh=CDF313BF12D7B5E0FA9CE6B077D3A05F1C1817EC ft=0 fh=0000000000000000 vn="Variante von Win32/DomaIQ.AU evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2014-03-16 190001\Backup Files 2014-03-23 190002\Backup files 1.zip"
sh=03C0834702C7FA44BE51A04A6D9CC011A41B5F00 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Conduit.AH evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2014-03-16 190001\Backup Files 2014-03-30 190004\Backup files 1.zip"
sh=F577B681C7F413E667137C729CB7992C0E2FF5B9 ft=0 fh=0000000000000000 vn="Variante von Win32/DomaIQ.AU evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2014-03-16 190001\Backup Files 2014-04-27 190004\Backup files 1.zip"
sh=3799E8E443EA5F529E6CB4156EE27F7639E8A32C ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Conduit.AA evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2014-03-16 190001\Backup Files 2014-04-27 190004\Backup files 12.zip"
sh=E924C95DBDA9C1BE327C13AD48757042B3F1BF45 ft=0 fh=0000000000000000 vn="Variante von Win32/SweetIM.L evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2014-03-16 190001\Backup Files 2014-04-27 190004\Backup files 14.zip"
sh=6C706F1F8FD0A69D286E69F25A69946964564763 ft=0 fh=0000000000000000 vn="Win32/Bundled.Toolbar.Ask.E potenziell unsichere Anwendung" ac=I fn="D:\PC\Backup Set 2014-03-16 190001\Backup Files 2014-04-27 190004\Backup files 2.zip"
sh=28BBF9CBA6E228E755FA8F85E49702D962748C3D ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Conduit.AA evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2014-05-04 191124\Backup Files 2014-05-04 191124\Backup files 15.zip"
sh=BC33CE40733CFCF68711A06314E96C855519F465 ft=0 fh=0000000000000000 vn="Variante von Win32/SweetIM.L evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2014-05-04 191124\Backup Files 2014-05-04 191124\Backup files 17.zip"
sh=A1698DF6E23A3FB794462760D72D64518D23DEEB ft=0 fh=0000000000000000 vn="Win32/BrowserCompanion.G evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2014-05-04 191124\Backup Files 2014-05-04 191124\Backup files 3.zip"
sh=6E11EB0E1636272B0D60DC8D12854F7A738B47E9 ft=0 fh=0000000000000000 vn="Win32/Bundled.Toolbar.Ask.E potenziell unsichere Anwendung" ac=I fn="D:\PC\Backup Set 2014-05-04 191124\Backup Files 2014-05-04 191124\Backup files 5.zip"
sh=C107C4C9BFC920B2E343CE2790D85808065D7B2C ft=0 fh=0000000000000000 vn="Win32/BrowserCompanion.G evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2014-05-04 191124\Backup Files 2014-05-18 190009\Backup files 1.zip"
sh=C06DA3703B37DF05914D8D6A1240BB7C22008D9B ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Conduit.AA evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2014-05-04 191124\Backup Files 2014-05-18 190009\Backup files 5.zip"
sh=2B9BA1C9FCE274CC2FCAA6F25E23A278BD1F297B ft=0 fh=0000000000000000 vn="Win32/BrowserCompanion.G evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2014-05-25 190001\Backup Files 2014-05-25 190001\Backup files 1.zip"
sh=A9EBF2E244D23D025E73E4FCFA373AC7790C3019 ft=0 fh=0000000000000000 vn="Win32/Bundled.Toolbar.Ask.E potenziell unsichere Anwendung" ac=I fn="D:\PC\Backup Set 2014-05-25 190001\Backup Files 2014-05-25 190001\Backup files 2.zip"
sh=AE31E074A01B6496B4CA4B124B5AFC023BDB6A1D ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Conduit.AA evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2014-05-25 190001\Backup Files 2014-05-25 190001\Backup files 5.zip"
sh=47479351A9CCCF89879B22AF8B83D863BE8FEA94 ft=0 fh=0000000000000000 vn="Variante von Win32/SweetIM.L evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2014-05-25 190001\Backup Files 2014-05-25 190001\Backup files 6.zip"
sh=71A05C336A3A2350D24411772991165108194594 ft=0 fh=0000000000000000 vn="Win32/Bundled.Toolbar.Ask.E potenziell unsichere Anwendung" ac=I fn="D:\PC\Backup Set 2014-05-25 190001\Backup Files 2014-06-01 190002\Backup files 1.zip"
sh=F8FE21F2817DABD0DDDA167BCED38512ABDBCEC2 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Conduit.AA evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2014-05-25 190001\Backup Files 2014-06-01 190002\Backup files 4.zip"
sh=5F7005EDE58B1FF0C08FE3243B91E586D140CCFF ft=0 fh=0000000000000000 vn="Variante von Win32/SweetIM.L evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2014-05-25 190001\Backup Files 2014-06-01 190002\Backup files 5.zip"
sh=D071D51E7706C3AA69D0E14C2B70179100B07CD1 ft=0 fh=0000000000000000 vn="Win32/BrowserCompanion.G evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2014-06-09 171220\Backup Files 2014-06-09 171220\Backup files 2.zip"
sh=3DA9DEC03F331CD21A60E063660B4637D58D39E7 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Conduit.AA evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2014-06-09 171220\Backup Files 2014-06-09 171220\Backup files 6.zip"
sh=031DC5E8371FECAF56C3A8778F8B8D76913E0092 ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="D:\PC\Backup Set 2014-06-09 171220\Backup Files 2014-06-27 184315\Backup files 1.zip"
sh=D08A2BF51CE338EB851EC91047052F38ECA2D476 ft=0 fh=0000000000000000 vn="Variante von Win32/AdWare.iBryte.AG Anwendung" ac=I fn="D:\PC\Backup Set 2014-07-21 114444\Backup Files 2014-07-21 114444\Backup files 1.zip"
sh=F58E3F35526415A4B1E09924F629B0887ED3D89E ft=0 fh=0000000000000000 vn="Win32/BrowserCompanion.G evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2014-07-21 114444\Backup Files 2014-07-21 114444\Backup files 2.zip"
sh=A4EA88D13D92A70160B480CD8B6AC8E081C11D4D ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Conduit.AA evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2014-07-21 114444\Backup Files 2014-07-21 114444\Backup files 6.zip"
sh=1826845BF2F6590C5F287C41427A23472F8C7016 ft=0 fh=0000000000000000 vn="Variante von Win32/SweetIM.L evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2014-07-21 114444\Backup Files 2014-07-21 114444\Backup files 7.zip"
sh=B9D81D9D9AEFEEFA4028719EA97A07B95546A283 ft=0 fh=0000000000000000 vn="Win32/BrowserCompanion.G evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2014-07-21 114444\Backup Files 2014-07-27 190009\Backup files 2.zip"
sh=691DE4AA442C55BEC9166B5B6CFFF98E40461D9C ft=0 fh=0000000000000000 vn="Win32/Bundled.Toolbar.Ask.E potenziell unsichere Anwendung" ac=I fn="D:\PC\Backup Set 2014-07-21 114444\Backup Files 2014-07-27 190009\Backup files 3.zip"
sh=207F20B0FCEA9E8729693C6004CA931322DD2CFD ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Conduit.AA evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2014-07-21 114444\Backup Files 2014-07-27 190009\Backup files 6.zip"
sh=939E7074078BD99857624EF7B12967A73B7D0ED7 ft=0 fh=0000000000000000 vn="Variante von Win32/SweetIM.L evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2014-07-21 114444\Backup Files 2014-07-27 190009\Backup files 7.zip"
sh=616ECD7E3E9F7F1E826BB489057D44F6FEF96495 ft=0 fh=0000000000000000 vn="Variante von Win32/AdWare.iBryte.AG Anwendung" ac=I fn="D:\PC\Backup Set 2014-08-03 190016\Backup Files 2014-08-03 190016\Backup files 1.zip"
sh=FD14BABF442E96A32D832742F42FA3EDA4D72E77 ft=0 fh=0000000000000000 vn="Win32/BrowserCompanion.G evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2014-08-03 190016\Backup Files 2014-08-03 190016\Backup files 3.zip"
sh=BB8F83F17E0354D8BCA1512C723FD3D359D82D4D ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Conduit.AA evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2014-08-03 190016\Backup Files 2014-08-03 190016\Backup files 7.zip"
sh=4A4DC4386384C07BEACACA8FBEBDF42FCC53C3EB ft=0 fh=0000000000000000 vn="Variante von Win32/SweetIM.L evtl. unerwünschte Anwendung" ac=I fn="D:\PC\Backup Set 2014-08-03 190016\Backup Files 2014-08-03 190016\Backup files 9.zip"
sh=0000000000000000000000000000000000000000 ft=- fh=0000000000000000 vn="Variante von Win32/Tivmonk.B Trojaner" ac=I fn="${Memory}"
FRST :

Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version:2-08-2014
Ran by Lawand at 2014-08-04 20:11:59 Run:2
Running from C:\Users\Lawand\Desktop
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
C:\Program Files\Update Software
*****************

C:\Program Files\Update Software => Moved successfully.

==== End of Fixlog ====

Warlord711 07.08.2014 12:42
Code:
sh=2BDDE03A0D73949A23EB84A1BEAED7A04B8AA935 ft=1 fh=5d3d22017cb0a45c vn="Variante von Win32/HackTool.Crack.BL potenziell unsichere Anwendung" ac=I fn="C:\Program Files\Journey of a Roach\steam_api.dll"
sh=DDB631D84A26EEACF0A706CEC14EEDE54200040E ft=0 fh=0000000000000000 vn="Win32/HackTool.Steam.E Trojaner" ac=I fn="C:\Users\Gullanar\AppData\Local\Google\Chrome\User Data\Default\File System\002\p\00\00000001"
Gecrackte Steam Spiele ?

:nono:

Das gibt Gelbe Karte !:schrei:

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
"C:\Users\Gullanar\Documents\APNSetup1.exe"
"C:\Users\Gullanar\Documents\APNSetup.exe"
"C:\Program Files\Journey of a Roach\steam_api.dll"
"C:\Users\Gullanar\AppData\Local\Google\Chrome\User Data\Default\File System\002\p\00\00000001"
"C:\Users\Gullanar\Downloads\Java_Updater_Setup (1).exe"
"C:\Users\Lawand\AppData\Local\Google\Chrome\User Data\Default\External Extensions\{EEE6C373-6118-11DC-9C72-001320C79847}\SweetFB.crx"
"C:\Users\Lawand\AppData\Local\Google\Chrome\User Data\Default\File System\005\t\00\00000000"
"C:\Users\Lawand\Documents\APNSetup1.exe"
"C:\Windows\Installer\MSI2BA8.tmp"
"C:\Windows\Installer\MSI5F74.tmp"
"C:\Windows\Installer\MSIA89A.tmp"
"C:\Windows\Installer\MSICF6F.tmp"
"C:\Windows\Installer\MSIFA1E.tmp"
"D:\Java_Updater_Setup.exe"

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.



Die Sachen in den Backup Zips kann ich so nicht löschen, ohne die komplette .zip zu löschen.

Mach noch bitte ein frisches FRST, ein Trojaner war noch aktiv.

Starte noch einmal FRST.
  • Ändere keine der Voreinstellungen und drücke auf Scan.
  • Wenn der Scan abgeschlossen ist, werden ein neues Logfile FRST.txt erstellt und auf dem Desktop gespeichert.
  • Poste den Inhalt dieses Logfiles bitte hier in deinen Thread.

lawand 07.08.2014 14:48
ist das richtig ?

muss mein sohn gewesen sein , tut mir leid

also die BAckups sind mir nicht so wichtig würde ich auch löschen , nur ich weiß nicht wie ?

FRST.txt :



FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:2-08-2014
Ran by Lawand (administrator) on PC on 07-08-2014 15:06:57
Running from C:\Users\Lawand\Desktop
Platform: Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbam.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
() C:\Program Files\Update Software\winclient32.exe
(OpenLimit SignCubes AG) C:\Program Files\AusweisApp\siqBootLoader.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKU\S-1-5-21-2722409785-1221214759-2200874239-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [msnmsgr] => ~"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
HKU\S-1-5-21-2722409785-1221214759-2200874239-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {3653c29e-9903-11e1-92d6-4487fcac1ab0} - F:\LaunchU3.exe -a
HKU\S-1-5-21-2722409785-1221214759-2200874239-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {8cdfb19c-5ebf-11e1-b13e-806e6f6e6963} - E:\install.EXE id= ver=1.0.0.0
HKU\S-1-5-21-2722409785-1221214759-2200874239-1003\...\Run: [Akamai NetSession Interface] => "C:\Users\Lawand\AppData\Local\Akamai\netsession_win.exe"
HKU\S-1-5-21-2722409785-1221214759-2200874239-1003\...\Run: [AusweisApp] => C:\Program Files\AusweisApp\siqBootLoader.exe [2518656 2014-01-24] (OpenLimit SignCubes AG)
HKU\S-1-5-21-2722409785-1221214759-2200874239-1003\...\MountPoints2: F - F:\LaunchU3.exe -a
ShellIconOverlayIdentifiers:  SkyDrivePro1 (ErrorConflict) -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers:  SkyDrivePro2 (SyncInProgress) -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers:  SkyDrivePro3 (InSync) -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: AusweisApp 1.12.0.0 -> {C9EE92B7-EDD5-4ad9-8029-2EC6818E653A} -> C:\Program Files\AusweisApp\siqeCardClientIE32.ols (OpenLimit SignCubes AG)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU - No Name - {4432605F-C2EE-4A1E-B2DF-5DC1F1D263B9} -  No File
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Winsock: Catalog5 05 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 80.69.100.110 80.69.100.102

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_44.dll ()
FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw_1166636.dll (Adobe Systems, Inc.)
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~4\Office14\NPAUTHZ.DLL No File
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~4\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Lawand\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npMeetingJoinPluginOC.dll (Microsoft Corporation)

Chrome:
=======
CHR HomePage: https://www.google.de/
CHR StartupUrls: "hxxp://www.google.com/"
CHR Extension: (XJZ Survey Remover) - C:\Users\Lawand\AppData\Local\Google\Chrome\User Data\Default\Extensions\cphljojhgmnabimjemakjleocdheengh [2014-01-04]
CHR Extension: (Facebook Theme) - C:\Users\Lawand\AppData\Local\Google\Chrome\User Data\Default\Extensions\ecafhogdjnebmoaebdkdcifnebfbkpoe [2014-03-16]
CHR Extension: (Google Wallet) - C:\Users\Lawand\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-02]
CHR HKLM\...\Chrome\Extension: [iokhogohoamdhejdbenjbjkhjmjlggab] - C:\Users\Lawand\AppData\Local\CRE\iokhogohoamdhejdbenjbjkhjmjlggab.crx [2013-09-02]
CHR HKLM\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]
CHR HKCU\...\Chrome\Extension: [iokhogohoamdhejdbenjbjkhjmjlggab] - C:\Users\Lawand\AppData\Local\CRE\iokhogohoamdhejdbenjbjkhjmjlggab.crx [2014-07-14]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-08-07] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-07] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1021008 2014-08-07] (Avira Operations GmbH & Co. KG)
R2 c2cautoupdatesvc; C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [97648 2014-07-04] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-06-04] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-14] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-08-05] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-05-12] (Malwarebytes Corporation)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-10-06] (Avira GmbH)
S3 zghsmdm; C:\Windows\System32\DRIVERS\zghsmdm.sys [106752 2011-01-13] (ZTE Incorporated)

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-04 21:47 - 2014-08-04 20:16 - 02347384 _____ (ESET) C:\Users\Lawand\Desktop\esetsmartinstaller_deu.exe
2014-08-04 16:59 - 2014-08-04 16:59 - 00001544 _____ () C:\Users\Lawand\Desktop\mbam.txt
2014-08-04 16:34 - 2014-08-04 16:34 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Lawand\Desktop\mbam-setup-2.0.2.1012.exe
2014-08-04 16:34 - 2014-08-04 16:34 - 00001064 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-08-04 16:34 - 2014-08-04 16:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-08-04 16:34 - 2014-08-04 16:34 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-08-04 16:34 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-08-04 16:34 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-08-04 16:34 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-08-04 16:31 - 2014-08-04 16:31 - 00035756 _____ () C:\Users\Lawand\Desktop\JRT.txt
2014-08-04 16:28 - 2014-08-04 16:28 - 01016261 _____ (Thisisu) C:\Users\Lawand\Desktop\JRT.exe
2014-08-04 16:28 - 2014-08-04 16:28 - 00000000 ____D () C:\Windows\ERUNT
2014-08-04 16:27 - 2014-08-04 16:27 - 00001101 _____ () C:\Users\Lawand\Desktop\AdwCleaner[S2].txt
2014-08-04 13:31 - 2014-08-04 13:32 - 00042161 _____ () C:\Users\Lawand\Desktop\Addition.txt
2014-08-04 13:30 - 2014-08-07 15:07 - 00000000 ____D () C:\FRST
2014-08-04 13:30 - 2014-08-07 15:06 - 00012586 _____ () C:\Users\Lawand\Desktop\FRST.txt
2014-08-04 13:30 - 2014-08-04 13:30 - 01084928 _____ (Farbar) C:\Users\Lawand\Desktop\FRST.exe
2014-08-04 12:28 - 2014-08-04 12:28 - 00688992 ____R (Swearware) C:\Users\Lawand\Desktop\dds.exe
2014-08-04 12:22 - 2014-08-04 15:54 - 00000616 _____ () C:\Windows\PFRO.log
2014-08-04 12:18 - 2014-08-04 12:16 - 01361309 _____ () C:\Users\Lawand\Desktop\adwcleaner_3.302.exe
2014-08-04 12:16 - 2014-08-04 15:53 - 00000000 ____D () C:\AdwCleaner
2014-08-03 17:52 - 2014-08-03 17:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-08-02 16:21 - 2014-08-06 11:02 - 00000896 _____ () C:\Windows\setupact.log
2014-08-02 16:21 - 2014-08-02 16:21 - 00000000 _____ () C:\Windows\setuperr.log
2014-08-02 11:01 - 2014-05-14 18:23 - 01973728 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-08-02 11:01 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-08-02 11:01 - 2014-05-14 18:23 - 00054240 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-08-02 11:01 - 2014-05-14 18:23 - 00045536 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-08-02 11:01 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-08-02 11:01 - 2014-05-14 18:17 - 02425856 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-08-02 11:01 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-08-02 11:01 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-08-02 11:01 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-07-23 15:53 - 2014-07-23 15:53 - 00000000 ____D () C:\Users\Lawand\AppData\Roaming\Unity
2014-07-23 15:47 - 2014-07-23 15:47 - 00000226 _____ () C:\Users\Lawand\BullseyeCoverageError.txt
2014-07-21 15:05 - 2014-07-21 15:05 - 00007605 _____ () C:\Users\Lawand\AppData\Local\Resmon.ResmonCfg
2014-07-09 17:10 - 2014-07-09 17:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Goat Simulator
2014-07-09 15:44 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-07-09 15:44 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-09 15:44 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-09 15:44 - 2014-06-19 01:56 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-09 15:44 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-09 15:44 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-09 15:44 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-09 15:44 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-09 15:44 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-09 15:44 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-09 15:44 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-09 15:44 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-09 15:44 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-09 15:44 - 2014-06-19 01:23 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-09 15:44 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-09 15:44 - 2014-06-19 01:16 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-09 15:44 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-09 15:44 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-09 15:44 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-09 15:44 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-09 15:44 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-09 15:44 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-09 15:44 - 2014-06-19 00:52 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-09 15:44 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-09 15:44 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-09 15:44 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-09 15:44 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-09 15:44 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-09 15:44 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-09 15:44 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-09 15:44 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-07-09 15:44 - 2014-06-18 02:52 - 02350080 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-09 15:44 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-09 15:44 - 2014-05-30 08:36 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-09 15:43 - 2014-06-30 03:40 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-07-09 15:43 - 2014-06-30 03:36 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-07-09 15:43 - 2014-06-05 16:26 - 01059840 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-07-09 15:43 - 2014-05-30 09:52 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-07-09 15:43 - 2014-05-30 09:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-07-09 15:43 - 2014-05-30 09:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-07-09 15:43 - 2014-05-30 09:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-07-09 15:43 - 2014-05-30 09:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-07-09 15:43 - 2014-05-30 09:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-07-09 15:43 - 2014-05-30 09:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-07 15:07 - 2014-08-04 13:30 - 00012586 _____ () C:\Users\Lawand\Desktop\FRST.txt
2014-08-07 15:07 - 2014-08-04 13:30 - 00000000 ____D () C:\FRST
2014-08-07 15:06 - 2013-11-19 17:02 - 00000000 ____D () C:\Program Files\Journey of a Roach
2014-08-07 15:02 - 2014-02-27 13:14 - 02269184 _____ () C:\Users\Lawand\AppData\Local\ChromeHitoryDB
2014-08-07 15:01 - 2014-05-16 17:08 - 00000000 ____D () C:\Users\Lawand\AppData\Roaming\Skype
2014-08-07 14:53 - 2012-11-22 19:16 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-08-07 14:16 - 2014-04-11 16:30 - 00000000 ____D () C:\Users\Lawand\AppData\Roaming\.minecraft
2014-08-07 10:30 - 2014-05-17 11:04 - 01472252 _____ () C:\Windows\WindowsUpdate.log
2014-08-06 20:53 - 2012-11-22 19:16 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-08-06 11:02 - 2014-08-02 16:21 - 00000896 _____ () C:\Windows\setupact.log
2014-08-05 08:04 - 2014-04-27 13:35 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-04 20:16 - 2014-08-04 21:47 - 02347384 _____ (ESET) C:\Users\Lawand\Desktop\esetsmartinstaller_deu.exe
2014-08-04 20:15 - 2009-07-14 06:34 - 00014592 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-04 20:15 - 2009-07-14 06:34 - 00014592 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-04 20:09 - 2014-06-15 13:49 - 00000000 ____D () C:\Users\Lawand\.ausweisapp
2014-08-04 20:07 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-04 16:59 - 2014-08-04 16:59 - 00001544 _____ () C:\Users\Lawand\Desktop\mbam.txt
2014-08-04 16:34 - 2014-08-04 16:34 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Lawand\Desktop\mbam-setup-2.0.2.1012.exe
2014-08-04 16:34 - 2014-08-04 16:34 - 00001064 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-08-04 16:34 - 2014-08-04 16:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-08-04 16:34 - 2014-08-04 16:34 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-08-04 16:31 - 2014-08-04 16:31 - 00035756 _____ () C:\Users\Lawand\Desktop\JRT.txt
2014-08-04 16:28 - 2014-08-04 16:28 - 01016261 _____ (Thisisu) C:\Users\Lawand\Desktop\JRT.exe
2014-08-04 16:28 - 2014-08-04 16:28 - 00000000 ____D () C:\Windows\ERUNT
2014-08-04 16:27 - 2014-08-04 16:27 - 00001101 _____ () C:\Users\Lawand\Desktop\AdwCleaner[S2].txt
2014-08-04 15:54 - 2014-08-04 12:22 - 00000616 _____ () C:\Windows\PFRO.log
2014-08-04 15:53 - 2014-08-04 12:16 - 00000000 ____D () C:\AdwCleaner
2014-08-04 15:30 - 2014-06-12 18:15 - 00000000 ____D () C:\Users\Lawand\AppData\Roaming\TS3Client
2014-08-04 13:32 - 2014-08-04 13:31 - 00042161 _____ () C:\Users\Lawand\Desktop\Addition.txt
2014-08-04 13:30 - 2014-08-04 13:30 - 01084928 _____ (Farbar) C:\Users\Lawand\Desktop\FRST.exe
2014-08-04 12:28 - 2014-08-04 12:28 - 00688992 ____R (Swearware) C:\Users\Lawand\Desktop\dds.exe
2014-08-04 12:24 - 2012-03-09 18:57 - 00000000 ____D () C:\Users\Lawand\AppData\Local\Adobe
2014-08-04 12:22 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-08-04 12:20 - 2014-05-18 12:35 - 00000000 ____D () C:\Users\Lawand\Downloads\Mama
2014-08-04 12:16 - 2014-08-04 12:18 - 01361309 _____ () C:\Users\Lawand\Desktop\adwcleaner_3.302.exe
2014-08-03 17:52 - 2014-08-03 17:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-08-03 17:52 - 2014-06-16 18:05 - 00000000 ____D () C:\Program Files\WinRAR
2014-08-03 17:52 - 2014-05-29 17:12 - 00000000 ____D () C:\Users\Lawand\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-08-02 16:22 - 2013-02-16 12:42 - 00434688 ___SH () C:\Users\Lawand\Desktop\Thumbs.db
2014-08-02 16:21 - 2014-08-02 16:21 - 00000000 _____ () C:\Windows\setuperr.log
2014-07-29 08:48 - 2012-12-05 19:43 - 00214016 ___SH () C:\Users\Lawand\Thumbs.db
2014-07-25 12:16 - 2012-02-26 16:27 - 00000000 ___RD () C:\Program Files\Skype
2014-07-25 12:15 - 2012-03-02 18:03 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-07-24 19:45 - 2012-03-03 11:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-07-23 15:53 - 2014-07-23 15:53 - 00000000 ____D () C:\Users\Lawand\AppData\Roaming\Unity
2014-07-23 15:47 - 2014-07-23 15:47 - 00000226 _____ () C:\Users\Lawand\BullseyeCoverageError.txt
2014-07-23 15:47 - 2012-02-24 12:01 - 00000000 ____D () C:\Users\Lawand
2014-07-23 15:07 - 2009-07-14 06:53 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-07-21 15:05 - 2014-07-21 15:05 - 00007605 _____ () C:\Users\Lawand\AppData\Local\Resmon.ResmonCfg
2014-07-12 20:14 - 2013-12-11 20:42 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2014-07-12 20:14 - 2012-09-19 17:45 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-07-11 11:49 - 2012-02-24 10:21 - 00000000 ____D () C:\Users\Gullanar
2014-07-10 12:44 - 2012-08-31 15:55 - 00386560 ___SH () C:\Users\Gullanar\Thumbs.db
2014-07-10 12:17 - 2013-10-08 20:00 - 00035848 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-07-10 12:12 - 2009-07-14 06:33 - 04012240 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-10 12:10 - 2014-05-07 21:58 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-07-10 12:10 - 2009-07-14 10:56 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-09 19:16 - 2013-08-31 19:46 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-09 19:14 - 2012-03-03 11:32 - 93585272 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-07-09 17:12 - 2012-12-19 21:55 - 00000000 ____D () C:\Users\Lawand\Documents\My Games
2014-07-09 17:10 - 2014-07-09 17:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Goat Simulator

Some content of TEMP:
====================
C:\Users\Gullanar\AppData\Local\Temp\avgnt.exe
C:\Users\Lawand\AppData\Local\Temp\avgnt.exe
C:\Users\Lawand\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-07-30 14:53

==================== End Of Log ============================
--- --- ---

--- --- ---

--- --- ---


Fixlog.txt :

Code:
C:\Windows\Installer\MSI5F74.tmp => Moved successfully.
C:\Windows\Installer\MSIA89A.tmp => Moved successfully.
C:\Windows\Installer\MSICF6F.tmp => Moved successfully.
C:\Windows\Installer\MSIFA1E.tmp => Moved successfully.
D:\Java_Updater_Setup.exe => Moved successfully.

==== End of Fixlog ====
hallo ?

Warlord711 07.08.2014 14:54
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
() C:\Program Files\Update Software\winclient32.exe

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.



Mach dann mal einen Neustart und dann nochmal ein FRST Log, bitte.

lawand 07.08.2014 15:23
FRST.txt :


FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:2-08-2014
Ran by Lawand (administrator) on PC on 07-08-2014 16:10:05
Running from C:\Users\Lawand\Desktop
Platform: Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbam.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(OpenLimit SignCubes AG) C:\Program Files\AusweisApp\siqBootLoader.exe
(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office15\MSOSYNC.EXE
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKU\S-1-5-21-2722409785-1221214759-2200874239-1003\...\Run: [Akamai NetSession Interface] => "C:\Users\Lawand\AppData\Local\Akamai\netsession_win.exe"
HKU\S-1-5-21-2722409785-1221214759-2200874239-1003\...\Run: [AusweisApp] => C:\Program Files\AusweisApp\siqBootLoader.exe [2518656 2014-01-24] (OpenLimit SignCubes AG)
HKU\S-1-5-21-2722409785-1221214759-2200874239-1003\...\MountPoints2: F - F:\LaunchU3.exe -a
ShellIconOverlayIdentifiers:  SkyDrivePro1 (ErrorConflict) -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers:  SkyDrivePro2 (SyncInProgress) -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers:  SkyDrivePro3 (InSync) -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: AusweisApp 1.12.0.0 -> {C9EE92B7-EDD5-4ad9-8029-2EC6818E653A} -> C:\Program Files\AusweisApp\siqeCardClientIE32.ols (OpenLimit SignCubes AG)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU - No Name - {4432605F-C2EE-4A1E-B2DF-5DC1F1D263B9} -  No File
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Winsock: Catalog5 05 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 80.69.100.110 80.69.100.102

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_44.dll ()
FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw_1166636.dll (Adobe Systems, Inc.)
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~4\Office14\NPAUTHZ.DLL No File
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~4\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Lawand\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npMeetingJoinPluginOC.dll (Microsoft Corporation)

Chrome:
=======
CHR HomePage: https://www.google.de/
CHR StartupUrls: "hxxp://www.google.com/"
CHR Extension: (XJZ Survey Remover) - C:\Users\Lawand\AppData\Local\Google\Chrome\User Data\Default\Extensions\cphljojhgmnabimjemakjleocdheengh [2014-01-04]
CHR Extension: (Facebook Theme) - C:\Users\Lawand\AppData\Local\Google\Chrome\User Data\Default\Extensions\ecafhogdjnebmoaebdkdcifnebfbkpoe [2014-03-16]
CHR Extension: (Google Wallet) - C:\Users\Lawand\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-02]
CHR HKLM\...\Chrome\Extension: [iokhogohoamdhejdbenjbjkhjmjlggab] - C:\Users\Lawand\AppData\Local\CRE\iokhogohoamdhejdbenjbjkhjmjlggab.crx [2013-09-02]
CHR HKLM\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]
CHR HKCU\...\Chrome\Extension: [iokhogohoamdhejdbenjbjkhjmjlggab] - C:\Users\Lawand\AppData\Local\CRE\iokhogohoamdhejdbenjbjkhjmjlggab.crx [2014-07-14]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-08-07] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-07] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1021008 2014-08-07] (Avira Operations GmbH & Co. KG)
R2 c2cautoupdatesvc; C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [97648 2014-07-04] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-06-04] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-14] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-08-07] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-05-12] (Malwarebytes Corporation)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-10-06] (Avira GmbH)
S3 zghsmdm; C:\Windows\System32\DRIVERS\zghsmdm.sys [106752 2011-01-13] (ZTE Incorporated)

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-04 21:47 - 2014-08-04 20:16 - 02347384 _____ (ESET) C:\Users\Lawand\Desktop\esetsmartinstaller_deu.exe
2014-08-04 16:59 - 2014-08-04 16:59 - 00001544 _____ () C:\Users\Lawand\Desktop\mbam.txt
2014-08-04 16:34 - 2014-08-04 16:34 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Lawand\Desktop\mbam-setup-2.0.2.1012.exe
2014-08-04 16:34 - 2014-08-04 16:34 - 00001064 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-08-04 16:34 - 2014-08-04 16:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-08-04 16:34 - 2014-08-04 16:34 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-08-04 16:34 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-08-04 16:34 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-08-04 16:34 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-08-04 16:31 - 2014-08-04 16:31 - 00035756 _____ () C:\Users\Lawand\Desktop\JRT.txt
2014-08-04 16:28 - 2014-08-04 16:28 - 01016261 _____ (Thisisu) C:\Users\Lawand\Desktop\JRT.exe
2014-08-04 16:28 - 2014-08-04 16:28 - 00000000 ____D () C:\Windows\ERUNT
2014-08-04 16:27 - 2014-08-04 16:27 - 00001101 _____ () C:\Users\Lawand\Desktop\AdwCleaner[S2].txt
2014-08-04 13:31 - 2014-08-04 13:32 - 00042161 _____ () C:\Users\Lawand\Desktop\Addition.txt
2014-08-04 13:30 - 2014-08-07 16:10 - 00012004 _____ () C:\Users\Lawand\Desktop\FRST.txt
2014-08-04 13:30 - 2014-08-07 16:10 - 00000000 ____D () C:\FRST
2014-08-04 13:30 - 2014-08-04 13:30 - 01084928 _____ (Farbar) C:\Users\Lawand\Desktop\FRST.exe
2014-08-04 12:28 - 2014-08-04 12:28 - 00688992 ____R (Swearware) C:\Users\Lawand\Desktop\dds.exe
2014-08-04 12:22 - 2014-08-07 16:05 - 00002180 _____ () C:\Windows\PFRO.log
2014-08-04 12:18 - 2014-08-04 12:16 - 01361309 _____ () C:\Users\Lawand\Desktop\adwcleaner_3.302.exe
2014-08-04 12:16 - 2014-08-04 15:53 - 00000000 ____D () C:\AdwCleaner
2014-08-03 17:52 - 2014-08-03 17:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-08-02 16:21 - 2014-08-07 16:05 - 00001008 _____ () C:\Windows\setupact.log
2014-08-02 16:21 - 2014-08-02 16:21 - 00000000 _____ () C:\Windows\setuperr.log
2014-08-02 11:01 - 2014-05-14 18:23 - 01973728 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-08-02 11:01 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-08-02 11:01 - 2014-05-14 18:23 - 00054240 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-08-02 11:01 - 2014-05-14 18:23 - 00045536 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-08-02 11:01 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-08-02 11:01 - 2014-05-14 18:17 - 02425856 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-08-02 11:01 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-08-02 11:01 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-08-02 11:01 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-07-23 15:53 - 2014-07-23 15:53 - 00000000 ____D () C:\Users\Lawand\AppData\Roaming\Unity
2014-07-23 15:47 - 2014-07-23 15:47 - 00000226 _____ () C:\Users\Lawand\BullseyeCoverageError.txt
2014-07-21 15:05 - 2014-07-21 15:05 - 00007605 _____ () C:\Users\Lawand\AppData\Local\Resmon.ResmonCfg
2014-07-09 17:10 - 2014-07-09 17:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Goat Simulator
2014-07-09 15:44 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-07-09 15:44 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-09 15:44 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-09 15:44 - 2014-06-19 01:56 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-09 15:44 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-09 15:44 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-09 15:44 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-09 15:44 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-09 15:44 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-09 15:44 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-09 15:44 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-09 15:44 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-09 15:44 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-09 15:44 - 2014-06-19 01:23 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-09 15:44 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-09 15:44 - 2014-06-19 01:16 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-09 15:44 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-09 15:44 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-09 15:44 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-09 15:44 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-09 15:44 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-09 15:44 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-09 15:44 - 2014-06-19 00:52 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-09 15:44 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-09 15:44 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-09 15:44 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-09 15:44 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-09 15:44 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-09 15:44 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-09 15:44 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-09 15:44 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-07-09 15:44 - 2014-06-18 02:52 - 02350080 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-09 15:44 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-09 15:44 - 2014-05-30 08:36 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-09 15:43 - 2014-06-30 03:40 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-07-09 15:43 - 2014-06-30 03:36 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-07-09 15:43 - 2014-06-05 16:26 - 01059840 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-07-09 15:43 - 2014-05-30 09:52 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-07-09 15:43 - 2014-05-30 09:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-07-09 15:43 - 2014-05-30 09:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-07-09 15:43 - 2014-05-30 09:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-07-09 15:43 - 2014-05-30 09:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-07-09 15:43 - 2014-05-30 09:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-07-09 15:43 - 2014-05-30 09:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-07 16:10 - 2014-08-04 13:30 - 00012004 _____ () C:\Users\Lawand\Desktop\FRST.txt
2014-08-07 16:10 - 2014-08-04 13:30 - 00000000 ____D () C:\FRST
2014-08-07 16:08 - 2014-04-27 13:35 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-07 16:07 - 2014-06-15 13:49 - 00000000 ____D () C:\Users\Lawand\.ausweisapp
2014-08-07 16:07 - 2012-03-09 18:57 - 00000000 ____D () C:\Users\Lawand\AppData\Local\Adobe
2014-08-07 16:06 - 2012-11-22 19:16 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-08-07 16:05 - 2014-08-04 12:22 - 00002180 _____ () C:\Windows\PFRO.log
2014-08-07 16:05 - 2014-08-02 16:21 - 00001008 _____ () C:\Windows\setupact.log
2014-08-07 16:05 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-07 16:02 - 2014-05-17 11:04 - 01481802 _____ () C:\Windows\WindowsUpdate.log
2014-08-07 15:53 - 2012-11-22 19:16 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-08-07 15:09 - 2014-02-27 13:14 - 02269184 _____ () C:\Users\Lawand\AppData\Local\ChromeHitoryDB
2014-08-07 15:06 - 2013-11-19 17:02 - 00000000 ____D () C:\Program Files\Journey of a Roach
2014-08-07 15:01 - 2014-05-16 17:08 - 00000000 ____D () C:\Users\Lawand\AppData\Roaming\Skype
2014-08-07 14:16 - 2014-04-11 16:30 - 00000000 ____D () C:\Users\Lawand\AppData\Roaming\.minecraft
2014-08-04 20:16 - 2014-08-04 21:47 - 02347384 _____ (ESET) C:\Users\Lawand\Desktop\esetsmartinstaller_deu.exe
2014-08-04 20:15 - 2009-07-14 06:34 - 00014592 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-04 20:15 - 2009-07-14 06:34 - 00014592 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-04 16:59 - 2014-08-04 16:59 - 00001544 _____ () C:\Users\Lawand\Desktop\mbam.txt
2014-08-04 16:34 - 2014-08-04 16:34 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Lawand\Desktop\mbam-setup-2.0.2.1012.exe
2014-08-04 16:34 - 2014-08-04 16:34 - 00001064 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-08-04 16:34 - 2014-08-04 16:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-08-04 16:34 - 2014-08-04 16:34 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-08-04 16:31 - 2014-08-04 16:31 - 00035756 _____ () C:\Users\Lawand\Desktop\JRT.txt
2014-08-04 16:28 - 2014-08-04 16:28 - 01016261 _____ (Thisisu) C:\Users\Lawand\Desktop\JRT.exe
2014-08-04 16:28 - 2014-08-04 16:28 - 00000000 ____D () C:\Windows\ERUNT
2014-08-04 16:27 - 2014-08-04 16:27 - 00001101 _____ () C:\Users\Lawand\Desktop\AdwCleaner[S2].txt
2014-08-04 15:53 - 2014-08-04 12:16 - 00000000 ____D () C:\AdwCleaner
2014-08-04 15:30 - 2014-06-12 18:15 - 00000000 ____D () C:\Users\Lawand\AppData\Roaming\TS3Client
2014-08-04 13:32 - 2014-08-04 13:31 - 00042161 _____ () C:\Users\Lawand\Desktop\Addition.txt
2014-08-04 13:30 - 2014-08-04 13:30 - 01084928 _____ (Farbar) C:\Users\Lawand\Desktop\FRST.exe
2014-08-04 12:28 - 2014-08-04 12:28 - 00688992 ____R (Swearware) C:\Users\Lawand\Desktop\dds.exe
2014-08-04 12:22 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-08-04 12:20 - 2014-05-18 12:35 - 00000000 ____D () C:\Users\Lawand\Downloads\Mama
2014-08-04 12:16 - 2014-08-04 12:18 - 01361309 _____ () C:\Users\Lawand\Desktop\adwcleaner_3.302.exe
2014-08-03 17:52 - 2014-08-03 17:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-08-03 17:52 - 2014-06-16 18:05 - 00000000 ____D () C:\Program Files\WinRAR
2014-08-03 17:52 - 2014-05-29 17:12 - 00000000 ____D () C:\Users\Lawand\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-08-02 16:22 - 2013-02-16 12:42 - 00434688 ___SH () C:\Users\Lawand\Desktop\Thumbs.db
2014-08-02 16:21 - 2014-08-02 16:21 - 00000000 _____ () C:\Windows\setuperr.log
2014-07-29 08:48 - 2012-12-05 19:43 - 00214016 ___SH () C:\Users\Lawand\Thumbs.db
2014-07-25 12:16 - 2012-02-26 16:27 - 00000000 ___RD () C:\Program Files\Skype
2014-07-25 12:15 - 2012-03-02 18:03 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-07-24 19:45 - 2012-03-03 11:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-07-23 15:53 - 2014-07-23 15:53 - 00000000 ____D () C:\Users\Lawand\AppData\Roaming\Unity
2014-07-23 15:47 - 2014-07-23 15:47 - 00000226 _____ () C:\Users\Lawand\BullseyeCoverageError.txt
2014-07-23 15:47 - 2012-02-24 12:01 - 00000000 ____D () C:\Users\Lawand
2014-07-23 15:07 - 2009-07-14 06:53 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-07-21 15:05 - 2014-07-21 15:05 - 00007605 _____ () C:\Users\Lawand\AppData\Local\Resmon.ResmonCfg
2014-07-12 20:14 - 2013-12-11 20:42 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2014-07-12 20:14 - 2012-09-19 17:45 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-07-11 11:49 - 2012-02-24 10:21 - 00000000 ____D () C:\Users\Gullanar
2014-07-10 12:44 - 2012-08-31 15:55 - 00386560 ___SH () C:\Users\Gullanar\Thumbs.db
2014-07-10 12:17 - 2013-10-08 20:00 - 00035848 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-07-10 12:12 - 2009-07-14 06:33 - 04012240 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-10 12:10 - 2014-05-07 21:58 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-07-10 12:10 - 2009-07-14 10:56 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-09 19:16 - 2013-08-31 19:46 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-09 19:14 - 2012-03-03 11:32 - 93585272 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-07-09 17:12 - 2012-12-19 21:55 - 00000000 ____D () C:\Users\Lawand\Documents\My Games
2014-07-09 17:10 - 2014-07-09 17:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Goat Simulator

Some content of TEMP:
====================
C:\Users\Gullanar\AppData\Local\Temp\avgnt.exe
C:\Users\Lawand\AppData\Local\Temp\avgnt.exe
C:\Users\Lawand\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-07-30 14:53

==================== End Of Log ============================
--- --- ---

--- --- ---




Fixlog.txt :

Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version:2-08-2014
Ran by Lawand at 2014-08-07 16:01:46 Run:4
Running from C:\Users\Lawand\Desktop
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
() C:\Program Files\Update Software\winclient32.exe
*****************

[3048] C:\Program Files\Update Software\winclient32.exe => Process closed successfully.

==== End of Fixlog ====
könnten sie mir noch helfen die Backups zu löschen ?

Warlord711 07.08.2014 15:34
Geht es jetzt darum nur die einzelnen gemeldeten .zip zu löschen oder sämtliche Backups ?

lawand 07.08.2014 15:40
ist egal , ich kann auch alle Backups löschen

Warlord711 07.08.2014 15:44
Zitat:
Zitat von lawand (Beitrag 1341293)
ist egal , ich kann auch alle Backups löschen
Ok und wo genau brauchst du da meine Hilfe ?

Ich hab gesehen, das die Backups unter D:\PC\ liegen und vom Namen her immer gleich aufgebaut sind, z.b. Backup Set 2013-10-06 190009.

Du musst doch nur im Windows Explorer die entsprechenden Ordner markieren und löschen.

lawand 07.08.2014 15:48
ok danke für ihre hilfe . noch eine letzte frage : kann ich die ganzen removal tools jetzt löschen ?

Warlord711 07.08.2014 15:50
Zitat:
Zitat von lawand (Beitrag 1341296)
ok danke für ihre hilfe . noch eine letzte frage : kann ich die ganzen removal tools jetzt löschen ?
Dazu kommen wir jetzt ;)

Die Reihenfolge ist hier entscheidend.
  1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
  2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
    • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
    • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
    • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
  3. Downloade Dir bitte auf jeden Fall DelFix Download DelFix auf deinen Desktop:
    • Schließe alle offenen Programme.
    • Starte die delfix.exe mit einem Doppelklick.
    • Setze vor jede Funktion ein Häkchen.
    • Klicke auf Start.
    • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
    • Starte deinen Rechner abschließend neu.
  4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.



Abschließend habe ich noch ein paar Tipps zur Absicherung deines Systems.


Ich kann gar nicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
  • Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
  • Windows Updates
    • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
    • Windows Vista / 7 / 8 : Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
  • Gehe sicher das die automatischen Updates aktiviert sind.
  • Software Updates
    Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
    Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.


Anti-Viren-Programm und zusätzlicher Schutz
  • Gehe sicher, dass du immer nur eine Anti-Viren Software installiert hast und dass diese auch up to date ist!
  • MalwareBytes Anti Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
    Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion bietet zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.
  • AdwCleaner
    Dieses Tool erkennt eine Vielzahl von Werbeprogrammen (Adware) und unerwümschten Programmen (PUPs).
    Starte das Tool einmal die Woche und lass es laufen. Sollte eine neue Version verfügbar sein, so wird dies angezeigt und du kannst dir die neueste Version direkt auf den Desktop downloaden.
  • SpywareBlaster
    Eine kurze Einführung findest du Hier
  • WOT (Web of trust)
    Dieses AddOn warnt dich, bevor Du eine als schädlich gemeldete Seite besuchst.


Alternative Browser
Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Mozilla Firefox
  • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
  • NoScript
    Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt, wenn Du es bestätigst.
  • AdblockPlus
    Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
    Es spart außerdem Downloadkapazität.


Performance
  • Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
  • Halte dich fern von Registry Cleanern.
    Diese Schaden deinem System mehr als dass sie helfen. Hier ein englischer Link:
    Miekemoes Blogspot ( MVP )


Was du vermeiden solltest:
  • Klicke nicht auf alles, nur weil es dich dazu auffordert und schön bunt ist.
  • Verwende keine P2P oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Öffne keine Anhänge von dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie z.B. deinFoto.jpg.exe.
  • Lade keine Software von Softonic oder Chip herunter, da diese Installer oft mit Adware oder unerünschter Software versehen sind!



Nun bleibt mir nur noch dir viel Spaß beim sicheren Surfen zu wünschen... ... und vielleicht möchtest du ja das Trojaner-Board unterstützen?

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so dass ich dieses Thema aus meinen Abos löschen kann.


Alle Zeitangaben in WEZ +1. Es ist jetzt 11:23 Uhr.
Seite 2 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131