Windows 7: Trojaner mit Sperrschirm - BKA Trojaner

Ohtarwen · 28.09.2013, 08:05

Rechner: Windows 7 Professional, Service Pack 1, 64 Bit
Virenschutz: Microsoft Security Essentials

Problem: Beim Versuch eine Webseite zu öffnen (weiß leider nicht mehr welche) meldete sich Security Essentials. Es wurden 2 Elemente in Quarantäne gestellt: 2x Sirefef.P
Bald darauf kam der Sperrbildschirm mit BP Fischer drauf - der BKA Trojaner. Ich habe den Rechner sofort abgeschaltet, beim anschließenden Neustart ohne Internetzugang blieb der Bildschirm grau (auch im abgesicherten Modus). Im Task-Maneger habe ich eine X8vX73B.exe gestoppt und mir dann den Explorer anzeigen lassen.
Meine nächste Aktion war, das LAN-Kabel wieder anzustecken und mich am Trojaner-Board zu registrieren, weil ich nichts falsch machen möchte. Momentan läuft Malwarebytes.

Ich hoffe, dass ihr mir helfen könnt und danke schon jetzt dafür!

schrauber · 28.09.2013, 08:24

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Ohtarwen · 28.09.2013, 09:19

Vielen Dank für deine Hilfe!
Nachdem FRST zu laufen begonnen hat, kam der Sperrbildschirm. Beenden des Prozesses X8usw (siehe oben) brachte nichts. Daher habe ich eine Systemwiederherstellung gemacht. Ich hoffe, es geht jetzt.

Hier frst.txt

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-09-2013 02
Ran by Huebner (administrator) on ZA-HUEBNER on 28-09-2013 09:34:17
Running from C:\Users\Huebner.STADTGEMEINDE\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(devolo AG) C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(BUFFALO INC.) C:\Program Files (x86)\BUFFALO\NASNAVI\nassvc.exe
(Nitro PDF Software) C:\Program Files\Common Files\Nitro\Pro\8.0\NitroPDFDriverService8x64.exe
(Nalpeiron Ltd.) C:\windows\SysWOW64\NLSSRV32.EXE
(Oki Data Corporation) C:\Program Files\Okidata\Common\Extend3\portmgrsrv.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(TOSHIBA Corporation) C:\windows\system32\ThpSrv.exe
(TOSHIBA Corporation) C:\windows\system32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TecoService.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Vodafone) C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\Power Saver\TPwrMain.exe
(Intel Corporation) C:\windows\system32\igfxsrvc.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\SmoothView\SmoothView.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\FlashCards\TCrdMain.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\TECO\Teco.exe
(TOSHIBA Corporation) C:\Windows\System32\ThpSrv.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\ReelTime\TosReelTimeMonitor.exe
(Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe
(Microsoft Corporation) C:\Program Files\Zune\ZuneLauncher.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(TOSHIBA Corporation) C:\Program Files (x86)\TOSHIBA\TNROTATE\TNROTATE.exe
() C:\Program Files (x86)\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe
(Vodafone) C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe
(Intel Corporation) C:\windows\system32\igfxext.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe
(Microsoft Corporation) c:\Program Files\Microsoft Security Client\NisSrv.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
(Microsoft Corporation) C:\windows\regedit.exe
(Microsoft Corporation) c:\Program Files\Microsoft Security Client\MpCmdRun.exe
(Microsoft Corporation) C:\Users\Huebner.STADTGEMEINDE\AppData\Local\NDU68xWMvH8\XvX8X73B.exe
(Microsoft Corporation) C:\windows\SysWOW64\svchost.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [] - [x]
HKLM\...\Run: [HotKeysCmds] - C:\windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [TPwrMain] - C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [505696 2009-11-05] (TOSHIBA Corporation)
HKLM\...\Run: [HSON] - C:\Program Files\TOSHIBA\TBS\HSON.exe [52600 2009-03-09] (TOSHIBA Corporation)
HKLM\...\Run: [SmoothView] - C:\Program Files\Toshiba\SmoothView\SmoothView.exe [570680 2009-08-13] (TOSHIBA Corporation)
HKLM\...\Run: [00TCrdMain] - C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [913720 2010-03-25] (TOSHIBA Corporation)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8305664 2009-10-30] (Realtek Semiconductor)
HKLM\...\Run: [Teco] - C:\Program Files\TOSHIBA\TECO\Teco.exe [1483776 2010-02-25] (TOSHIBA Corporation)
HKLM\...\Run: [TosSENotify] - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [709976 2009-11-05] (TOSHIBA Corporation)
HKLM\...\Run: [ThpSrv] - C:\windows\system32\thpsrv /logon
HKLM\...\Run: [TosWaitSrv] - C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [705368 2010-02-05] (TOSHIBA Corporation)
HKLM\...\Run: [TosReelTimeMonitor] - C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe [35672 2010-03-03] (TOSHIBA Corporation)
HKLM\...\Run: [TosVolRegulator] - C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation)
HKLM\...\Run: [Toshiba TEMPRO] - C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe [1050072 2010-05-11] (Toshiba Europe GmbH)
HKLM\...\Run: [MSC] - c:\Program Files\Microsoft Security Client\msseces.exe [1356240 2013-06-20] (Microsoft Corporation)
HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware ] - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation)
Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
HKCU\...\Run: [EPSON B1100 Series] - C:\windows\system32\spool\DRIVERS\x64\3\E_IATIFEE.EXE /FU "C:\windows\TEMP\E_S94A2.tmp" /EF "HKCU"
HKCU\...\Run: [XvX8X73B.exe] - C:\Users\Huebner.STADTGEMEINDE\AppData\Local\NDU68xWMvH8\XvX8X73B.exe [90448 2013-09-27] (Microsoft Corporation)
HKCU\...\Winlogon: [Shell] cmd.exe [345088 2010-11-20] (Microsoft Corporation) <==== ATTENTION 
HKCU\...\Command Processor: "C:\Users\Huebner.STADTGEMEINDE\AppData\Local\NDU68xWMvH8\XvX8X73B.exe" <======= ATTENTION
MountPoints2: E - E:\AutoRun.exe
MountPoints2: F - F:\AutoRun.exe
MountPoints2: {051ecc45-248b-11e1-aa05-0023183b6791} - E:\AutoRun.exe
MountPoints2: {13c24403-15af-11e1-ae4a-0023183b6791} - E:\AutoRun.exe
MountPoints2: {13c24406-15af-11e1-ae4a-0023183b6791} - E:\AutoRun.exe
MountPoints2: {3ffbe561-5704-11e1-911f-0023183b6791} - E:\AutoRun.exe
MountPoints2: {41de7be3-a70d-11e0-a48d-0023183b6791} - E:\AutoRun.exe
MountPoints2: {4919b63d-6a4b-11e0-9c8f-0023183b6791} - E:\AutoRun.exe
MountPoints2: {5161c698-560c-11e1-8d94-0023183b6791} - E:\AutoRun.exe
MountPoints2: {671d1ca2-c278-11e0-a916-0023183b6791} - E:\AutoRun.exe
MountPoints2: {671d1ca7-c278-11e0-a916-0023183b6791} - E:\AutoRun.exe
MountPoints2: {79ec6722-90f8-11e0-b6d4-0023183b6791} - E:\AutoRun.exe
MountPoints2: {79ec6725-90f8-11e0-b6d4-0023183b6791} - E:\AutoRun.exe
MountPoints2: {7d36bda3-ac77-11e0-b614-0023183b6791} - E:\AutoRun.exe
MountPoints2: {8b50b4cd-9c91-11e0-9cbe-806e6f6e6963} - E:\AutoRun.exe
MountPoints2: {8db90df8-6a69-11e0-bab2-0023183b6791} - E:\AutoRun.exe
MountPoints2: {9dd465e7-2007-11e1-a8db-0023183b6791} - E:\AutoRun.exe
MountPoints2: {9dd465e9-2007-11e1-a8db-0023183b6791} - E:\AutoRun.exe
MountPoints2: {a3ef63a2-86cc-11e0-ad35-0023183b6791} - E:\AutoRun.exe
MountPoints2: {a3ef63a4-86cc-11e0-ad35-0023183b6791} - E:\AutoRun.exe
MountPoints2: {ad155827-74b3-11e0-ba94-0023183b6791} - E:\AutoRun.exe
MountPoints2: {ad15582a-74b3-11e0-ba94-0023183b6791} - E:\AutoRun.exe
MountPoints2: {ba3de2a5-77fb-11e1-ae55-0023183b6791} - E:\AutoRun.exe
MountPoints2: {c79bc7e5-6ff6-11e0-980a-0023183b6791} - E:\AutoRun.exe
MountPoints2: {c79bc7e7-6ff6-11e0-980a-0023183b6791} - E:\AutoRun.exe
MountPoints2: {f95de9ac-a211-11e0-aa57-0023183b6791} - E:\AutoRun.exe
HKLM-x32\...\Run: [TNRotate] - C:\Program Files (x86)\TOSHIBA\TNRotate\TNRotate.exe [607616 2010-02-22] (TOSHIBA Corporation)
HKLM-x32\...\Run: [TWebCamera] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe [2454840 2009-12-09] (TOSHIBA CORPORATION.)
HKLM-x32\...\Run: [Corel Photo Downloader] - C:\Program Files (x86)\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe [532808 2008-08-08] (Corel, Inc.)
HKLM-x32\...\Run: [Corel File Shell Monitor] - C:\Program Files (x86)\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe [16712 2008-08-08] ()
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [HPUsageTracking] - C:\Program Files (x86)\HP\HP UT\bin\hppusg.exe [30264 2009-10-06] (Hewlett-Packard Company)
HKLM-x32\...\Run: [MobileBroadband] - C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe [408576 2011-04-19] (Vodafone)
HKLM-x32\...\Run: [BCSSync] - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [DivXMediaServer] - C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2013-08-21] (DivX, LLC)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [ControlCenter4] - C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [143360 2012-09-06] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsMon00] - C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [3076096 2012-06-06] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [DivXUpdate] - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1861968 2013-08-29] ()
HKU\Administrator\...\Run: [TOSHIBA Online Product Information] - C:\Program Files (x86)\TOSHIBA\Toshiba Online Product Information\topi.exe [6203296 2009-08-12] (TOSHIBA)
HKU\Default\...\Run: [TOSHIBA Online Product Information] - C:\Program Files (x86)\TOSHIBA\Toshiba Online Product Information\topi.exe [6203296 2009-08-12] (TOSHIBA)
HKU\Default User\...\Run: [TOSHIBA Online Product Information] - C:\Program Files (x86)\TOSHIBA\Toshiba Online Product Information\topi.exe [6203296 2009-08-12] (TOSHIBA)
Startup: C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)

==================== Internet (Whitelisted) ====================

ProxyServer: 20.20.20.9:8080
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - DefaultScope {20640D01-6C2B-4098-AAC8-BB36A96B844D} URL = https://duckduckgo.com/?q={searchTerms}
SearchScopes: HKCU - {1D514625-819F-4B2B-A8F2-95279A4E2990} URL = 
SearchScopes: HKCU - {20640D01-6C2B-4098-AAC8-BB36A96B844D} URL = https://duckduckgo.com/?q={searchTerms}
SearchScopes: HKCU - {6A0FBD7D-314D-4BB4-96EF-300AD3359631} URL = hxxp://www.benefind.de/web.php?q={searchTerms}
SearchScopes: HKCU - {86613AFE-F9AE-4A42-93E7-34954A120C99} URL = https://startpage.com/do/search?query={searchTerms}&cat=web&pl=ie&language=deutsch
SearchScopes: HKCU - {9FEDAB7D-F6B4-4B91-8AC9-ED60CC96AC0D} URL = 
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)
Toolbar: HKLM-x32 - SimilarWeb - {74198672-5F7D-4FE9-A611-4AC1D5A66A15} - C:\Program Files (x86)\SimilarWeb\SimilarWeb.dll (SimilarGroup)
DPF: HKLM {02BCC737-B171-4746-94C9-0D8A0B2C0089} hxxp://office.microsoft.com/_layouts/ClientBin/ieawsdc64.cab
DPF: HKLM {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab
DPF: HKLM-x32 {02BCC737-B171-4746-94C9-0D8A0B2C0089} hxxp://office.microsoft.com/sites/production/ieawsdc32.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} -  No File
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\Mozilla\Firefox\Profiles\pilvdcyr.default
FF user.js: detected! => C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\Mozilla\Firefox\Profiles\pilvdcyr.default\user.js
FF NewTab: about:blank
FF SelectedSearchEngine: Web Search
FF Homepage: about:home
FF NetworkProxy: "ftp", "20.20.20.9"
FF NetworkProxy: "ftp_port", 8080
FF NetworkProxy: "http", "20.20.20.9"
FF NetworkProxy: "http_port", 8080
FF NetworkProxy: "no_proxies_on", "hollabrunn.noe.gv.at,hollabrunn.gv.at,localhost,127.0.0.1"
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "socks", "20.20.20.9"
FF NetworkProxy: "socks_port", 8080
FF NetworkProxy: "ssl", "20.20.20.9"
FF NetworkProxy: "ssl_port", 8080
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @java.com/DTPlugin,version=10.11.2 - C:\windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.11.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.2 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.0.6 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf - C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf - C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=1.6.0_39 - C:\windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nitropdf.com/NitroPDF - C:\Program Files (x86)\Nitro\Pro 8\npnitromozilla.dll (Nitro PDF)
FF Plugin-x32: @videolan.org/vlc,version=2.0.7 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\Mozilla\Firefox\Profiles\pilvdcyr.default\Extensions\staged
FF Extension: iMacros for Firefox - C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\Mozilla\Firefox\Profiles\pilvdcyr.default\Extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}
FF Extension: No Name - C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\Mozilla\Firefox\Profiles\pilvdcyr.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
FF Extension: No Name - C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\Mozilla\Firefox\Profiles\pilvdcyr.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0039-ABCDEFFEDCBA}
FF HKLM\...\Firefox\Extensions: [{C1CA7765-44E4-452e-9D00-A04F3D434281}] - 
FF HKLM-x32\...\Firefox\Extensions: [{C1CA7765-44E4-452e-9D00-A04F3D434281}] - C:\Program Files\TOSHIBA\TFPU\FirefoxAddin

==================== Services (Whitelisted) =================

R2 DevoloNetworkService; C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe [3526136 2013-08-27] (devolo AG)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2013-06-20] (Microsoft Corporation)
R2 NasPmService; C:\Program Files (x86)\BUFFALO\NASNAVI\nassvc.exe [251256 2010-10-28] (BUFFALO INC.)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366600 2013-06-20] (Microsoft Corporation)
R2 NitroDriverReadSpool8; C:\Program Files\Common Files\Nitro\Pro\8.0\NitroPDFDriverService8x64.exe [230408 2013-06-17] (Nitro PDF Software)
R2 OpLclSrv; C:\Program Files\Okidata\Common\Extend3\portmgrsrv.exe [169984 2010-08-10] (Oki Data Corporation)
S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [118520 2013-03-01] (Riverbed Technology, Inc.)
S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [124368 2010-05-11] (Toshiba Europe GmbH)

==================== Drivers (Whitelisted) ====================

R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [247216 2013-06-18] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [139616 2013-06-18] (Microsoft Corporation)
R2 NPF; C:\Windows\System32\drivers\npf.sys [36600 2013-03-01] (Riverbed Technology, Inc.)
R2 NPF_devolo; C:\Windows\sysWOW64\drivers\npf_devolo.sys [34048 2013-08-27] (CACE Technologies)
S3 ApfiltrService; system32\DRIVERS\Apfiltr.sys [x]
U5 ewusbnet; C:\Windows\System32\Drivers\ewusbnet.sys [243200 2009-10-21] (Huawei Technologies Co., Ltd.)
S3 massfilter; system32\drivers\massfilter.sys [x]
S3 SANDRA; \??\C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2013.SP1\WNt500x64\Sandra.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-28 09:34 - 2013-09-28 09:34 - 00256512 _____ C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\R85L2AwV
2013-09-28 09:34 - 2013-09-28 09:34 - 00256512 _____ C:\ProgramData\1IojVvnInx
2013-09-28 09:34 - 2013-09-28 09:34 - 00000000 ___DC C:\FRST
2013-09-28 09:33 - 2013-09-28 09:33 - 01953880 _____ (Farbar) C:\Users\Huebner.STADTGEMEINDE\Desktop\FRST64.exe
2013-09-28 08:36 - 2013-09-28 08:36 - 00001080 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-27 11:40 - 2013-09-27 11:40 - 00256512 _____ C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\TzpWZpne
2013-09-27 11:40 - 2013-09-27 11:40 - 00256512 _____ C:\ProgramData\w1eiwzGD
2013-09-26 13:08 - 2013-08-27 11:49 - 00221184 _____ (CACE Technologies) C:\windows\SysWOW64\devolopcap.dll
2013-09-26 13:08 - 2013-08-27 11:49 - 00081920 _____ (CACE Technologies) C:\windows\SysWOW64\devolopacket.dll
2013-09-26 13:08 - 2013-08-27 11:49 - 00034048 _____ (CACE Technologies) C:\windows\SysWOW64\Drivers\npf_devolo.sys
2013-09-25 14:25 - 2011-07-22 13:16 - 00000044 _____ C:\windows\system32\opnetext.ver
2013-09-25 14:25 - 2011-04-22 09:56 - 00003838 _____ C:\windows\system32\opnedef.str
2013-09-25 14:25 - 2011-04-08 14:21 - 00120320 _____ (Oki Data Corporation) C:\windows\system32\opnetext.dll
2013-09-25 14:25 - 2007-02-05 00:15 - 00005832 _____ C:\windows\system32\license.txt
2013-09-25 14:25 - 2005-03-14 09:05 - 00010359 _____ C:\windows\SysWOW64\opnetext.hlp
2013-09-25 14:25 - 2005-03-14 09:05 - 00010359 _____ C:\windows\system32\OPNETEXT.HLP
2013-09-25 14:25 - 2005-03-09 14:11 - 00000141 _____ C:\windows\SysWOW64\opnetext.cnt
2013-09-25 14:25 - 2005-03-09 14:11 - 00000141 _____ C:\windows\system32\opnetext.cnt
2013-09-25 14:25 - 2002-06-27 00:00 - 00000000 _____ C:\windows\SysWOW64\opnetext.gid
2013-09-25 14:25 - 2002-06-27 00:00 - 00000000 _____ C:\windows\system32\OPNETEXT.GID
2013-09-25 07:56 - 2013-09-25 07:56 - 00000000 ____D C:\Users\Huebner.STADTGEMEINDE\Desktop\Vorzugsstimmen
2013-09-24 11:31 - 2013-09-26 10:33 - 00000000 ____D C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\Nitro PDF
2013-09-24 11:17 - 2013-09-24 11:36 - 00000000 ____D C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\Nitro
2013-09-24 11:17 - 2013-09-24 11:17 - 00000000 ____D C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\FileOpen
2013-09-24 11:17 - 2013-09-24 11:17 - 00000000 ____D C:\ProgramData\FileOpen
2013-09-24 11:16 - 2013-09-24 11:16 - 00000000 ____D C:\ProgramData\Nitro
2013-09-24 11:16 - 2013-09-24 11:16 - 00000000 ____D C:\Program Files\Common Files\Nitro
2013-09-24 11:16 - 2013-09-24 11:16 - 00000000 ____D C:\Program Files (x86)\Nitro
2013-09-24 11:16 - 2013-06-17 22:00 - 00029704 _____ (Nitro PDF Software) C:\windows\system32\nitrolocalmon2.dll
2013-09-24 11:16 - 2013-06-17 22:00 - 00017928 _____ (Nitro PDF Software) C:\windows\system32\nitrolocalui2.dll
2013-09-24 11:14 - 2013-09-24 11:14 - 00000000 ____D C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\Downloaded Installations
2013-09-23 15:23 - 2013-09-23 15:23 - 00000087 _____ C:\windows\NetwkCfg.txt
2013-09-18 11:47 - 2013-09-18 11:47 - 00003118 _____ C:\windows\System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe
2013-09-18 11:47 - 2013-09-18 11:47 - 00003092 _____ C:\windows\System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe
2013-09-18 11:47 - 2013-09-18 11:47 - 00003090 _____ C:\windows\System32\Tasks\Microsoft_Hardware_Launch_itype_exe
2013-09-18 11:47 - 2013-09-18 11:47 - 00000000 ____H C:\windows\system32\Drivers\Msft_Kernel_point64_01011.Wdf
2013-09-18 11:47 - 2013-09-18 11:47 - 00000000 ____H C:\windows\system32\Drivers\Msft_Kernel_NuidFltr_01011.Wdf
2013-09-18 11:43 - 2013-09-18 11:43 - 00000000 ____H C:\windows\system32\Drivers\Msft_Kernel_dc3d_01011.Wdf
2013-09-16 07:56 - 2013-02-17 01:40 - 00028672 _____ (Microsoft Corporation) C:\windows\system32\IEUDINIT.EXE
2013-09-16 07:52 - 2013-09-16 07:52 - 19246592 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 15404544 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 14332928 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 13761024 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 03959296 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 02876928 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2013-09-16 07:52 - 2013-09-16 07:52 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2013-09-16 07:52 - 2013-09-16 07:52 - 02647040 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 02241024 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 02048000 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 01509376 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2013-09-16 07:52 - 2013-09-16 07:52 - 01441280 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2013-09-16 07:52 - 2013-09-16 07:52 - 01400416 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dat
2013-09-16 07:52 - 2013-09-16 07:52 - 01400416 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dat
2013-09-16 07:52 - 2013-09-16 07:52 - 01365504 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 01141248 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 01054720 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00905728 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00762368 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00719360 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00629248 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00599552 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00523264 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00452096 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00441856 _____ (Microsoft Corporation) C:\windows\system32\html.iec
2013-09-16 07:52 - 2013-09-16 07:52 - 00391168 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00361984 _____ (Microsoft Corporation) C:\windows\SysWOW64\html.iec
2013-09-16 07:52 - 2013-09-16 07:52 - 00357888 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00281600 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00270848 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00247296 _____ (Microsoft Corporation) C:\windows\system32\webcheck.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00242200 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00235008 _____ (Microsoft Corporation) C:\windows\system32\url.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00232960 _____ (Microsoft Corporation) C:\windows\SysWOW64\url.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00226816 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00226304 _____ (Microsoft Corporation) C:\windows\system32\elshyph.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00216064 _____ (Microsoft Corporation) C:\windows\system32\msls31.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00204800 _____ (Microsoft Corporation) C:\windows\SysWOW64\webcheck.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00197120 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00185344 _____ (Microsoft Corporation) C:\windows\SysWOW64\elshyph.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00173568 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00167424 _____ (Microsoft Corporation) C:\windows\system32\iexpress.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00163840 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00158720 _____ (Microsoft Corporation) C:\windows\SysWOW64\msls31.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00150528 _____ (Microsoft Corporation) C:\windows\SysWOW64\iexpress.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00149504 _____ (Microsoft Corporation) C:\windows\system32\occache.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00144896 _____ (Microsoft Corporation) C:\windows\system32\wextract.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00138752 _____ (Microsoft Corporation) C:\windows\SysWOW64\wextract.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00137216 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00136192 _____ (Microsoft Corporation) C:\windows\system32\iepeers.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00135680 _____ (Microsoft Corporation) C:\windows\system32\IEAdvpack.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00125440 _____ (Microsoft Corporation) C:\windows\SysWOW64\occache.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00117248 _____ (Microsoft Corporation) C:\windows\SysWOW64\iepeers.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00110592 _____ (Microsoft Corporation) C:\windows\SysWOW64\IEAdvpack.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00102912 _____ (Microsoft Corporation) C:\windows\system32\inseng.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00097280 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\SetIEInstalledDate.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00089600 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00082432 _____ (Microsoft Corporation) C:\windows\SysWOW64\inseng.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00081408 _____ (Microsoft Corporation) C:\windows\system32\icardie.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00079872 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00077312 _____ (Microsoft Corporation) C:\windows\system32\tdc.ocx
2013-09-16 07:52 - 2013-09-16 07:52 - 00073728 _____ (Microsoft Corporation) C:\windows\SysWOW64\SetIEInstalledDate.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00069120 _____ (Microsoft Corporation) C:\windows\SysWOW64\icardie.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00062976 _____ (Microsoft Corporation) C:\windows\system32\pngfilt.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\tdc.ocx
2013-09-16 07:52 - 2013-09-16 07:52 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00057344 _____ (Microsoft Corporation) C:\windows\SysWOW64\pngfilt.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00052224 _____ (Microsoft Corporation) C:\windows\system32\msfeedsbs.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00051200 _____ (Microsoft Corporation) C:\windows\system32\imgutil.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00048640 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmler.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\mshtmler.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00041984 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeedsbs.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00039424 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00038400 _____ (Microsoft Corporation) C:\windows\SysWOW64\imgutil.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00027648 _____ (Microsoft Corporation) C:\windows\system32\licmgr10.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00023040 _____ (Microsoft Corporation) C:\windows\SysWOW64\licmgr10.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00013824 _____ (Microsoft Corporation) C:\windows\system32\mshta.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00012800 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshta.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00012800 _____ (Microsoft Corporation) C:\windows\system32\msfeedssync.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00011776 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeedssync.exe
2013-09-16 07:47 - 2013-09-16 07:56 - 00010999 _____ C:\windows\IE10_main.log
2013-09-11 15:51 - 2009-11-27 14:29 - 00013056 _____ C:\windows\SysWOW64\CNC1749D.TBL
2013-09-11 15:51 - 2009-11-27 14:29 - 00013056 _____ C:\windows\system32\CNC1749D.TBL
2013-09-11 13:58 - 2010-08-25 05:00 - 00361472 _____ (CANON INC.) C:\windows\system32\CNMLMAE.DLL
2013-09-10 13:32 - 2013-09-10 13:53 - 00000181 _____ C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\Opusbext.dat
2013-09-10 13:28 - 2011-07-04 19:42 - 00024064 _____ (Oki Data Corporation) C:\windows\system32\OPPFLM64.DLL

==================== One Month Modified Files and Folders =======

2013-09-28 09:34 - 2013-09-28 09:34 - 00256512 _____ C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\R85L2AwV
2013-09-28 09:34 - 2013-09-28 09:34 - 00256512 _____ C:\ProgramData\1IojVvnInx
2013-09-28 09:34 - 2013-09-28 09:34 - 00000000 ___DC C:\FRST
2013-09-28 09:33 - 2013-09-28 09:33 - 01953880 _____ (Farbar) C:\Users\Huebner.STADTGEMEINDE\Desktop\FRST64.exe
2013-09-28 09:33 - 2010-10-19 15:30 - 01061309 _____ C:\windows\WindowsUpdate.log
2013-09-28 09:26 - 2009-07-14 19:58 - 00705468 _____ C:\windows\system32\perfh007.dat
2013-09-28 09:26 - 2009-07-14 19:58 - 00151930 _____ C:\windows\system32\perfc007.dat
2013-09-28 09:26 - 2009-07-14 07:13 - 01635776 _____ C:\windows\system32\PerfStringBackup.INI
2013-09-28 09:24 - 2013-07-09 13:11 - 00011632 _____ C:\windows\setupact.log
2013-09-28 08:55 - 2009-07-14 06:45 - 00022208 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-28 08:55 - 2009-07-14 06:45 - 00022208 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-28 08:50 - 2009-07-14 05:20 - 00000000 ____D C:\windows\tracing
2013-09-28 08:45 - 2012-03-30 07:50 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2013-09-28 08:36 - 2013-09-28 08:36 - 00001080 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-28 08:36 - 2013-03-18 14:28 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-28 08:24 - 2011-11-23 09:34 - 00065536 _____ C:\windows\system32\Ikeext.etl
2013-09-28 08:24 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-09-27 11:45 - 2009-07-14 06:45 - 00499184 _____ C:\windows\system32\FNTCACHE.DAT
2013-09-27 11:40 - 2013-09-27 11:40 - 00256512 _____ C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\TzpWZpne
2013-09-27 11:40 - 2013-09-27 11:40 - 00256512 _____ C:\ProgramData\w1eiwzGD
2013-09-27 10:40 - 2011-04-06 15:08 - 00000152 _____ C:\windows\system32\config\netlogon.ftl
2013-09-27 10:10 - 2011-04-08 09:38 - 00003958 _____ C:\windows\System32\Tasks\User_Feed_Synchronization-{2A3B3BEC-1FC4-4161-B63B-A0492BDDC68F}
2013-09-27 09:26 - 2009-07-14 05:20 - 00000000 ____D C:\windows\IME
2013-09-26 13:09 - 2013-08-21 08:12 - 00000000 ____D C:\Program Files (x86)\devolo
2013-09-26 10:33 - 2013-09-24 11:31 - 00000000 ____D C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\Nitro PDF
2013-09-25 14:25 - 2010-07-07 04:08 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-09-25 14:23 - 2013-07-25 10:47 - 00000000 ____D C:\Program Files\Okidata
2013-09-25 07:56 - 2013-09-25 07:56 - 00000000 ____D C:\Users\Huebner.STADTGEMEINDE\Desktop\Vorzugsstimmen
2013-09-24 14:45 - 2011-04-12 15:44 - 00000000 ____D C:\Users\Huebner.STADTGEMEINDE\Desktop\pastebin
2013-09-24 11:36 - 2013-09-24 11:17 - 00000000 ____D C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\Nitro
2013-09-24 11:17 - 2013-09-24 11:17 - 00000000 ____D C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\FileOpen
2013-09-24 11:17 - 2013-09-24 11:17 - 00000000 ____D C:\ProgramData\FileOpen
2013-09-24 11:16 - 2013-09-24 11:16 - 00000000 ____D C:\ProgramData\Nitro
2013-09-24 11:16 - 2013-09-24 11:16 - 00000000 ____D C:\Program Files\Common Files\Nitro
2013-09-24 11:16 - 2013-09-24 11:16 - 00000000 ____D C:\Program Files (x86)\Nitro
2013-09-24 11:14 - 2013-09-24 11:14 - 00000000 ____D C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\Downloaded Installations
2013-09-24 10:32 - 2009-07-14 05:20 - 00000000 ____D C:\windows\system32\NDF
2013-09-23 15:23 - 2013-09-23 15:23 - 00000087 _____ C:\windows\NetwkCfg.txt
2013-09-20 11:56 - 2013-03-03 11:41 - 00000336 _____ C:\windows\BRCALIB.INI
2013-09-20 11:45 - 2012-03-30 07:50 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2013-09-20 11:45 - 2012-03-30 07:50 - 00003822 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2013-09-20 11:45 - 2011-05-18 07:51 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-18 11:47 - 2013-09-18 11:47 - 00003118 _____ C:\windows\System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe
2013-09-18 11:47 - 2013-09-18 11:47 - 00003092 _____ C:\windows\System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe
2013-09-18 11:47 - 2013-09-18 11:47 - 00003090 _____ C:\windows\System32\Tasks\Microsoft_Hardware_Launch_itype_exe
2013-09-18 11:47 - 2013-09-18 11:47 - 00000000 ____H C:\windows\system32\Drivers\Msft_Kernel_point64_01011.Wdf
2013-09-18 11:47 - 2013-09-18 11:47 - 00000000 ____H C:\windows\system32\Drivers\Msft_Kernel_NuidFltr_01011.Wdf
2013-09-18 11:43 - 2013-09-18 11:43 - 00000000 ____H C:\windows\system32\Drivers\Msft_Kernel_dc3d_01011.Wdf
2013-09-17 16:04 - 2013-07-25 10:53 - 00000000 ____D C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\Okidata
2013-09-17 15:42 - 2013-02-14 10:11 - 00000000 ____D C:\ProgramData\Okidata
2013-09-17 10:29 - 2009-07-14 05:20 - 00000000 ____D C:\windows\rescache
2013-09-17 08:02 - 2012-10-24 11:11 - 00000000 ____D C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\vlc
2013-09-17 07:16 - 2011-04-06 15:11 - 00001420 _____ C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-09-17 07:15 - 2010-07-07 13:34 - 00000000 ____D C:\windows\Panther
2013-09-16 17:08 - 2009-07-14 05:20 - 00000000 ____D C:\windows\PolicyDefinitions
2013-09-16 07:56 - 2013-09-16 07:47 - 00010999 _____ C:\windows\IE10_main.log
2013-09-16 07:52 - 2013-09-16 07:52 - 19246592 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 15404544 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 14332928 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 13761024 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 03959296 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 02876928 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2013-09-16 07:52 - 2013-09-16 07:52 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2013-09-16 07:52 - 2013-09-16 07:52 - 02647040 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 02241024 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 02048000 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 01509376 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2013-09-16 07:52 - 2013-09-16 07:52 - 01441280 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2013-09-16 07:52 - 2013-09-16 07:52 - 01400416 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dat
2013-09-16 07:52 - 2013-09-16 07:52 - 01400416 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dat
2013-09-16 07:52 - 2013-09-16 07:52 - 01365504 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 01141248 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 01054720 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00905728 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00762368 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00719360 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00629248 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00599552 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00523264 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00452096 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00441856 _____ (Microsoft Corporation) C:\windows\system32\html.iec
2013-09-16 07:52 - 2013-09-16 07:52 - 00391168 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00361984 _____ (Microsoft Corporation) C:\windows\SysWOW64\html.iec
2013-09-16 07:52 - 2013-09-16 07:52 - 00357888 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00281600 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00270848 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00247296 _____ (Microsoft Corporation) C:\windows\system32\webcheck.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00242200 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00235008 _____ (Microsoft Corporation) C:\windows\system32\url.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00232960 _____ (Microsoft Corporation) C:\windows\SysWOW64\url.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00226816 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00226304 _____ (Microsoft Corporation) C:\windows\system32\elshyph.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00216064 _____ (Microsoft Corporation) C:\windows\system32\msls31.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00204800 _____ (Microsoft Corporation) C:\windows\SysWOW64\webcheck.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00197120 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00185344 _____ (Microsoft Corporation) C:\windows\SysWOW64\elshyph.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00173568 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00167424 _____ (Microsoft Corporation) C:\windows\system32\iexpress.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00163840 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00158720 _____ (Microsoft Corporation) C:\windows\SysWOW64\msls31.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00150528 _____ (Microsoft Corporation) C:\windows\SysWOW64\iexpress.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00149504 _____ (Microsoft Corporation) C:\windows\system32\occache.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00144896 _____ (Microsoft Corporation) C:\windows\system32\wextract.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00138752 _____ (Microsoft Corporation) C:\windows\SysWOW64\wextract.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00137216 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00136192 _____ (Microsoft Corporation) C:\windows\system32\iepeers.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00135680 _____ (Microsoft Corporation) C:\windows\system32\IEAdvpack.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00125440 _____ (Microsoft Corporation) C:\windows\SysWOW64\occache.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00117248 _____ (Microsoft Corporation) C:\windows\SysWOW64\iepeers.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00110592 _____ (Microsoft Corporation) C:\windows\SysWOW64\IEAdvpack.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00102912 _____ (Microsoft Corporation) C:\windows\system32\inseng.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00097280 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\SetIEInstalledDate.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00089600 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00082432 _____ (Microsoft Corporation) C:\windows\SysWOW64\inseng.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00081408 _____ (Microsoft Corporation) C:\windows\system32\icardie.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00079872 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00077312 _____ (Microsoft Corporation) C:\windows\system32\tdc.ocx
2013-09-16 07:52 - 2013-09-16 07:52 - 00073728 _____ (Microsoft Corporation) C:\windows\SysWOW64\SetIEInstalledDate.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00069120 _____ (Microsoft Corporation) C:\windows\SysWOW64\icardie.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00062976 _____ (Microsoft Corporation) C:\windows\system32\pngfilt.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\tdc.ocx
2013-09-16 07:52 - 2013-09-16 07:52 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00057344 _____ (Microsoft Corporation) C:\windows\SysWOW64\pngfilt.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00052224 _____ (Microsoft Corporation) C:\windows\system32\msfeedsbs.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00051200 _____ (Microsoft Corporation) C:\windows\system32\imgutil.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00048640 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmler.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\mshtmler.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00041984 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeedsbs.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00039424 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00038400 _____ (Microsoft Corporation) C:\windows\SysWOW64\imgutil.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00027648 _____ (Microsoft Corporation) C:\windows\system32\licmgr10.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00023040 _____ (Microsoft Corporation) C:\windows\SysWOW64\licmgr10.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00013824 _____ (Microsoft Corporation) C:\windows\system32\mshta.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00012800 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshta.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00012800 _____ (Microsoft Corporation) C:\windows\system32\msfeedssync.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00011776 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeedssync.exe
2013-09-16 07:42 - 2013-04-15 11:24 - 00000000 ____D C:\ProgramData\DivX
2013-09-16 07:41 - 2013-04-15 11:25 - 00000000 ____D C:\Program Files (x86)\DivX
2013-09-12 14:09 - 2011-04-12 16:52 - 00000952 ___SH C:\ProgramData\KGyGaAvL.sys
2013-09-12 14:09 - 2011-04-12 11:09 - 00000000 ____D C:\Users\Huebner.STADTGEMEINDE\Documents\My PSP Files
2013-09-11 14:03 - 2013-02-21 16:57 - 00000000 ____D C:\ProgramData\CanonIJPLM
2013-09-10 14:54 - 2013-04-15 11:41 - 00000000 ____D C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\DivX
2013-09-10 14:27 - 2013-07-09 13:11 - 00009048 _____ C:\windows\PFRO.log
2013-09-10 13:53 - 2013-09-10 13:32 - 00000181 _____ C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\Opusbext.dat
2013-09-10 13:29 - 2009-07-14 05:20 - 00000000 ____D C:\windows\Web

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-23 10:58

==================== End Of Log ============================

--- --- ---

und hier additions.txt

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27-09-2013 02
Ran by Huebner at 2013-09-28 09:36:19
Running from C:\Users\Huebner.STADTGEMEINDE\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Microsoft Security Essentials (Enabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Microsoft Security Essentials (Enabled - Up to date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}

==================== Installed Programs ======================

64 Bit HP CIO Components Installer (Version: 7.2.4)
Adobe AIR (x32 Version: 1.5.3.9130)
Adobe Flash Player 11 ActiveX (x32 Version: 11.8.800.175)
Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.168)
Adobe Reader XI (11.0.04) - Deutsch (x32 Version: 11.0.04)
Applet (HKCU)
Atheros Driver Installation Program (x32 Version: 5.0)
Bluetooth Stack for Windows by Toshiba (Version: v7.10.01(T))
Brother MFL-Pro Suite DCP-9055CDN (x32 Version: 1.1.5.0)
BUFFALO LinkStation(LX-WXL) Setup Guide (x32)
BUFFALO NAS Navigator2 (x32)
Bullzip PDF Printer 7.2.0.1304 (Version: 7.2.0.1304)
Canon MP160 Benutzerregistrierung (x32)
CCleaner (Version: 4.03)
Corel Paint Shop Pro Photo X2 (x32 Version: 12.50.0001)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32)
devolo dLAN Cockpit (x32 Version: 4.1.3.0)
DivX-Setup (x32 Version: 2.6.1.84)
EPSON B1100 Series Printer Uninstall
Foxit Reader (x32 Version: 6.0.6.722)
Free YouTube to MP3 Converter version 3.12.1.320 (x32 Version: 3.12.1.320)
GPL Ghostscript Lite 8.70 (x32)
HP Deskjet 3520 series - Grundlegende Software für das Gerät (Version: 28.0.1315.0)
HP Deskjet 3520 series Setup Guide (x32 Version: 27.0.0)
HP LaserJet P2050 Series 6.0 (Version: 6.0)
HP LaserJet Professional CP1520 Series (x32)
hppFonts (x32 Version: 001.001.00061)
hppQFolderP2050 (x32 Version: 1.00.0000)
hppusgP2050 (x32 Version: 1.1.0.1)
ImagXpress (x32 Version: 7.0.74.0)
Intel(R) Graphics Media Accelerator Driver (x32 Version: 8.15.10.2082)
Intel(R) Management Engine Components (x32 Version: 6.0.0.1179)
Intel(R) Network Connections Drivers (Version: 14.8)
Intel(R) Rapid Storage Technology (x32 Version: 9.5.7.1002)
Java 7 Update 11 (64-bit) (Version: 7.0.110)
Java SE Development Kit 7 Update 11 (64-bit) (Version: 1.7.0.110)
Java(TM) 6 Update 39 (x32 Version: 6.0.390)
Junk Mail filter update (x32 Version: 14.0.8089.726)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319)
Microsoft Access 2010 (x32 Version: 14.0.7015.1000)
Microsoft Antimalware Service DE-DE Language Pack (Version: 3.0.8402.2)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Choice Guard (x32 Version: 2.0.48.0)
Microsoft Office Access 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Access Runtime (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003)
Microsoft Office Home and Business 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000)
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Professional Edition 2003 (x32 Version: 11.0.8173.0)
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Single Image 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Security Client (Version: 4.3.0215.0)
Microsoft Security Client DE-DE Language Pack (Version: 2.1.1116.0)
Microsoft Security Essentials (Version: 4.3.215.0)
Microsoft Silverlight (x32 Version: 4.1.10329.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Mobile Connect (x32 Version: 1.00.0000)
Mozilla Firefox 23.0.1 (x86 de) (x32 Version: 23.0.1)
Mozilla Maintenance Service (x32 Version: 23.0.1)
MSVC80_x64_v2 (Version: 1.0.3.0)
MSVC80_x86_v2 (x32 Version: 1.0.3.0)
MSVC90_x64 (Version: 1.0.1.2)
MSVC90_x86 (x32 Version: 1.0.1.2)
MSVCRT (x32 Version: 14.0.1468.721)
MSXML 4.0 SP3 Parser (KB973685) (x32 Version: 4.30.2107.0)
neroxml (x32 Version: 1.0.0)
NirSoft ProduKey (x32)
Nitro Pro 8 (Version: 8.5.5.2)
OKI Color Swatch-Dienstprogramm (x32 Version: 2.1.11)
OKI Configuration Tool (x32 Version: 1.3.1)
OKI Device Setting (x32 Version: 1.4.4)
OKI MB4x1/ES41x1/MPS42x Scanner (x32 Version: 1.1.1.0)
OKI MC5(3)x2/ES5(3)4x2 Scanner (x32 Version: 1.0.0.2)
OKI Network Extension (x32 Version: 1.00.000)
OKI Network Setting (x32 Version: 1.0.1)
OpenEdge 10.1C Shared Network Installation (x32 Version: 10.1C)
PC Connectivity Solution (x32 Version: 11.4.19.0)
PDF reDirect (remove only) (x32 Version: v2.5.0)
Photo Service - powered by myphotobook (x32 Version: 1.0.7)
Photo Service - powered by myphotobook (x32 Version: 1.0.7-279)
PlayReady PC Runtime amd64 (Version: 1.3.0)
RarZilla Free Unrar (x32 Version: 2.90)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.5971)
Recuva (Version: 1.42)
RICOH R5U230 Media Driver ver.2.08.03.03 (x32 Version: 2.08.03.03)
ScannerDriver (Version: 1.0.0.2)
ScannerDriver (Version: 1.1.1.0)
Scribus 1.4.2 (x32 Version: 1.4.2)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32)
SES Driver (Version: 1.0.0)
SimilarWeb (x32 Version: 0.0.0.1)
TeamViewer 8 (x32 Version: 8.0.16642)
TOSHIBA 180 Degrees Rotation Utility (x32 Version: 1.3.0)
Toshiba Assist (x32 Version: 3.00.10)
TOSHIBA ConfigFree (x32 Version: 8.0.28)
TOSHIBA Disc Creator (Version: 2.1.0.2 for x64)
TOSHIBA DVD PLAYER (x32 Version: 3.01.2.12-A)
TOSHIBA eco Utility (Version: 1.2.7.64)
TOSHIBA eco Utility (x32 Version: 1.2.7.64)
TOSHIBA HDD Protection (Version: 2.2.0.3)
TOSHIBA HDD/SSD Alert (Version: 3.1.64.4)
TOSHIBA HDD/SSD Alert (x32 Version: 3.1.64.4)
Toshiba Manuals (x32 Version: 10.02)
Toshiba Online Product Information (x32 Version: 2.08.0001)
TOSHIBA PC Health Monitor (Version: 1.5.6.64)
TOSHIBA Recovery Media Creator (Version: 2.1.0.4 x64)
TOSHIBA Recovery Media Creator Reminder (x32 Version: 1.00.0019)
TOSHIBA ReelTime (Version: 1.6.06.64)
TOSHIBA ReelTime (x32 Version: 1.6.06.64)
TOSHIBA Service Station (x32 Version: 2.1.40)
TOSHIBA Sicherheits-Assistent (x32 Version: 2.0.8)
Toshiba TEMPRO (x32 Version: 3.33)
TOSHIBA Value Added Package (Version: 1.3.5.64)
TOSHIBA Value Added Package (x32 Version: 1.3.5.64)
TOSHIBA Web Camera Application (x32 Version: 1.1.2.8)
TX Text Control 14.0 (x32 Version: 14.0)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2836939) (x32 Version: 1)
Update for Microsoft Office 2010 (KB2494150) (x32)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0)
VLC media player 2.0.6 (Version: 2.0.6)
VLC media player 2.0.7 (x32 Version: 2.0.7)
Vodafone Mobile Broadband (x32 Version: 10.2.103.31248)
WebReg (x32 Version: 100.0.170.000)
Winamp (x32 Version: 5.623 )
Winamp Erkennungs-Plug-in (HKCU Version: 1.0.0.1)
Windows Driver Package - Western Digital Technologies (WDC_SAM) WDC_SAM  (01/19/2011 1.0.0009.0) (Version: 01/19/2011 1.0.0009.0)
Windows Live Call (x32 Version: 14.0.8064.0206)
Windows Live Communications Platform (x32 Version: 14.0.8064.206)
Windows Live Essentials (x32 Version: 14.0.8089.0726)
Windows Live Essentials (x32 Version: 14.0.8089.726)
Windows Live Fotogalerie (x32 Version: 14.0.8081.709)
Windows Live ID Sign-in Assistant (Version: 6.500.3165.0)
Windows Live Mail (x32 Version: 14.0.8089.0726)
Windows Live Messenger (x32 Version: 14.0.8089.0726)
Windows Live Movie Maker (x32 Version: 14.0.8091.0730)
Windows Live Sync (x32 Version: 14.0.8089.726)
Windows Live Writer (x32 Version: 14.0.8089.0726)
Windows Live-Uploadtool (x32 Version: 14.0.8014.1029)
Windows Mobile Device Updater Component (Version: 04.08.2345.00)
Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0) (Version: 08/22/2008 7.0.0.0)
WinPcap 4.1.3 (x32 Version: 4.1.0.2980)
Wireshark 1.8.6 (64-bit) (x32 Version: 1.8.6)
Zune (Version: 04.08.2345.00)
Zune Language Pack (CHS) (Version: 04.08.2345.00)
Zune Language Pack (CHT) (Version: 04.08.2345.00)
Zune Language Pack (CSY) (Version: 04.08.2345.00)
Zune Language Pack (DAN) (Version: 04.08.2345.00)
Zune Language Pack (DEU) (Version: 04.08.2345.00)
Zune Language Pack (ELL) (Version: 04.08.2345.00)
Zune Language Pack (ESP) (Version: 04.08.2345.00)
Zune Language Pack (FIN) (Version: 04.08.2345.00)
Zune Language Pack (FRA) (Version: 04.08.2345.00)
Zune Language Pack (HUN) (Version: 04.08.2345.00)
Zune Language Pack (IND) (Version: 04.08.2345.00)
Zune Language Pack (ITA) (Version: 04.08.2345.00)
Zune Language Pack (JPN) (Version: 04.08.2345.00)
Zune Language Pack (KOR) (Version: 04.08.2345.00)
Zune Language Pack (MSL) (Version: 04.08.2345.00)
Zune Language Pack (NLD) (Version: 04.08.2345.00)
Zune Language Pack (NOR) (Version: 04.08.2345.00)
Zune Language Pack (PLK) (Version: 04.08.2345.00)
Zune Language Pack (PTB) (Version: 04.08.2345.00)
Zune Language Pack (PTG) (Version: 04.08.2345.00)
Zune Language Pack (RUS) (Version: 04.08.2345.00)
Zune Language Pack (SVE) (Version: 04.08.2345.00)

==================== Restore Points  =========================

05-08-2013 10:00:03 Windows-Sicherung
08-08-2013 08:16:06 Windows Update
12-08-2013 05:42:46 Windows Update
12-08-2013 10:00:03 Windows-Sicherung
14-08-2013 09:00:19 Windows Update
19-08-2013 05:23:01 Windows Update
19-08-2013 10:00:03 Windows-Sicherung
22-08-2013 08:19:01 Windows Update
22-08-2013 12:43:38 Installiert Brother Software Suite
04-09-2013 06:44:46 Windows-Sicherung
09-09-2013 05:45:41 Windows Update
09-09-2013 10:00:11 Windows-Sicherung
10-09-2013 12:23:08 Installiert ScannerDriver
10-09-2013 12:45:14 Installiert ScannerDriver
13-09-2013 05:42:22 Windows Update
16-09-2013 05:48:22 Windows Update
16-09-2013 05:48:51 Windows Modules Installer
16-09-2013 05:50:10 Windows Modules Installer
16-09-2013 10:00:03 Windows-Sicherung
17-09-2013 13:36:17 Installiert ActKey
17-09-2013 14:04:03 Entfernt ActKey
18-09-2013 09:45:44 DCInstallRestorePoint
23-09-2013 05:29:19 Windows Update
23-09-2013 10:00:02 Windows-Sicherung
24-09-2013 09:15:24 Nitro Pro 8 wird installiert
25-09-2013 12:21:44 Installiert ScannerDriver
25-09-2013 12:22:50 Installiert Color Swatch Utility
25-09-2013 12:24:02 Konfiguriert ScannerDriver
25-09-2013 12:25:14 Installiert OKI Network Extension
25-09-2013 12:26:08 Installiert Color Swatch Utility
26-09-2013 11:16:08 Windows Update

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____N C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {0091A139-3FB5-406B-ACB7-437864756CAC} - System32\Tasks\User_Feed_Synchronization-{2A3B3BEC-1FC4-4161-B63B-A0492BDDC68F} => C:\windows\system32\msfeedssync.exe [2013-09-16] (Microsoft Corporation)
Task: {00E0B394-E47E-4CA3-9E94-285DB6EA6287} - System32\Tasks\0 => Iexplore.exe 
Task: {0EFBADA3-1E02-4602-A775-4AFE32A2D0B4} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe
Task: {11C72E30-1150-46A8-96E7-749E9D1E5751} - System32\Tasks\Microsoft\Windows\Windows Activation Technologies\ValidationTask => C:\Windows\system32\Wat\WatAdminSvc.exe [2011-04-20] (Microsoft Corporation)
Task: {2AFABEA8-4B75-436C-80DA-34F04498471D} - System32\Tasks\Huebner Local Autobackup => C:\Program Files (x86)\Nero\Nero BackItUp &amp; Burn\Nero BackItUp\NBCore.exe
Task: {2B689807-4D14-44D9-BBE7-F76BF898CAD2} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1676436058-1265901383-628622809-1329 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe
Task: {36EECBED-7FFB-41FE-8A9F-317FC68E3D4D} - System32\Tasks\{A634BD6A-5406-4E01-A996-52C1712CF733} => E:\AutoRun.exe
Task: {4BAAD33E-A786-4529-9AB3-55725D74EEF1} - System32\Tasks\{DC61BF3E-0921-4D1E-8544-7060BFF09A1E} => E:\AutoRun.exe
Task: {4D686959-ACF6-4405-AA01-00EF0C1FA2A5} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-06-19] (Piriform Ltd)
Task: {65F2DB13-CC7A-4426-932A-2F576105422D} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
Task: {6A05B33A-5BC8-47D0-BA5D-E24B6497015F} - System32\Tasks\{1EF0D3A4-9A21-4DC0-9ED6-32EA6C556258} => E:\AutoRun.exe
Task: {783718AF-1FBC-4046-8F1E-BFB9861C8454} - System32\Tasks\{3DCBAF4B-49A7-4D1C-AD82-F31294AD8D42} => E:\AutoRun.exe
Task: {7C8B0501-0611-41FE-A2EC-4C584F8B2187} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {81E301E1-B973-48A5-B547-809C445A0281} - System32\Tasks\2157 => C:\temp\launchie.vbsC:\temp\launchie.vbs //B
Task: {891156EF-E8A1-4D80-92FD-938D500B8164} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-09-20] (Adobe Systems Incorporated)
Task: {95B7D184-0ED1-4442-B411-34E7A8D527A9} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
Task: {9F00D6CB-7709-4360-87D2-AF096A954035} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1676436058-1265901383-628622809-1329 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe
Task: {AC234B68-F7BC-4B79-8292-FDE73A78AA83} - System32\Tasks\ConfigFree Startup Programs => C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe [2010-02-22] (TOSHIBA CORPORATION)
Task: {AD50F691-D5B6-4222-AFD0-55790FF58658} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-05-11] (Adobe Systems Incorporated)
Task: {CB072CE2-D1AA-461D-82A8-0681059E665E} - System32\Tasks\{83D1B20C-0716-43E7-9549-A1E4C924A3A3} => E:\AutoRun.exe
Task: {D9FC4D44-38FC-42D5-97D7-C0DFC3F3EC77} - System32\Tasks\{78E76B38-A761-45F9-B402-615F8DE68E82} => \\TSRA\Standamt\WinStA\UPDATE.EXE
Task: {FAB26A7A-F878-4677-88D9-EE84BBC5BEB9} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2010-03-03 14:15 - 2010-03-03 14:15 - 08762680 _____ () C:\Program Files\Toshiba\FlashCards\BlackPng.dll
2009-11-03 13:26 - 2009-11-03 13:26 - 00053560 _____ () C:\Program Files\TOSHIBA\FlashCards\Hotkey\FnZ.dll
2010-03-03 14:15 - 2010-03-03 14:15 - 00019256 _____ () C:\Program Files\TOSHIBA\FlashCards\Hotkey\FnF10.dll
2010-03-03 14:15 - 2010-03-03 14:15 - 00019256 _____ () C:\Program Files\TOSHIBA\FlashCards\Hotkey\FnF11.dll
2010-07-07 04:08 - 2009-06-22 14:40 - 00022328 _____ () C:\Program Files\TOSHIBA\Toshiba Assist\NotifyX.dll
2009-03-12 20:08 - 2009-03-12 20:08 - 00048640 _____ () C:\Program Files (x86)\Toshiba\PCDiag\NotifyPCD.dll
2009-07-25 16:38 - 2009-07-25 16:38 - 00017800 _____ () C:\Program Files\TOSHIBA\TOSHIBA Disc Creator\NotifyTDC.dll
2010-02-25 17:19 - 2010-02-25 17:19 - 00578936 _____ () C:\Program Files\Toshiba\TECO\TecoPower.dll
2009-11-05 09:18 - 2009-11-05 09:18 - 00079192 _____ () C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosIPCWraper.dll
2011-04-19 17:12 - 2011-04-19 17:12 - 00308736 _____ () C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\Vodafone.View.Taskbar.dll
2009-07-13 23:03 - 2009-07-14 03:15 - 00364544 _____ () C:\Windows\SysWOW64\msjetoledb40.dll
2013-08-22 14:44 - 2009-02-27 16:38 - 00139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll
2013-08-29 02:25 - 2013-08-29 02:25 - 00100688 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll
2013-08-19 15:17 - 2013-08-19 15:17 - 03551640 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\Windows:nlsPreferences

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"

==================== Faulty Device Manager Devices =============

Name: Atheros AR9280 Wireless Network Adapter
Description: Atheros AR9280 Wireless Network Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Atheros Communications Inc.
Service: athr
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (09/28/2013 09:32:24 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: iexplore.exe, Version: 10.0.9200.16686, Zeitstempel: 0x52058d43
Name des fehlerhaften Moduls: ieapfltr.dll, Version: 10.0.9200.16521, Zeitstempel: 0x512077a4
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000001a129
ID des fehlerhaften Prozesses: 0x5c0
Startzeit der fehlerhaften Anwendung: 0xiexplore.exe0
Pfad der fehlerhaften Anwendung: iexplore.exe1
Pfad des fehlerhaften Moduls: iexplore.exe2
Berichtskennung: iexplore.exe3

Error: (09/28/2013 08:48:06 AM) (Source: Application Hang) (User: )
Description: Programm iexplore.exe, Version 10.0.9200.16686 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: dfc

Startzeit: 01cebc169b8b6d73

Endzeit: 10

Anwendungspfad: C:\Program Files\Internet Explorer\iexplore.exe

Berichts-ID: e270da7e-2809-11e3-8d63-0023183b6791

Error: (09/28/2013 08:13:44 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: svchost.exe, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bc100
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00006dc0
ID des fehlerhaften Prozesses: 0xed4
Startzeit der fehlerhaften Anwendung: 0xsvchost.exe0
Pfad der fehlerhaften Anwendung: svchost.exe1
Pfad des fehlerhaften Moduls: svchost.exe2
Berichtskennung: svchost.exe3

Error: (09/27/2013 07:36:41 AM) (Source: Application Hang) (User: )
Description: Programm IEXPLORE.EXE, Version 10.0.9200.16686 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: ac8

Startzeit: 01cebb42ef7471cf

Endzeit: 31

Anwendungspfad: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Berichts-ID:

Error: (09/26/2013 01:05:45 PM) (Source: VmbService) (User: )
Description: GetClient

Error: (09/24/2013 06:53:03 PM) (Source: VmbService) (User: )
Description: GetClient

Error: (09/23/2013 00:23:51 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile  WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.

Error: (09/23/2013 00:22:38 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.

Error: (09/20/2013 11:53:47 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: WINWORD.EXE, Version: 14.0.7015.1000, Zeitstempel: 0x51cca7cc
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0e9dfa9c
ID des fehlerhaften Prozesses: 0x1310
Startzeit der fehlerhaften Anwendung: 0xWINWORD.EXE0
Pfad der fehlerhaften Anwendung: WINWORD.EXE1
Pfad des fehlerhaften Moduls: WINWORD.EXE2
Berichtskennung: WINWORD.EXE3

Error: (09/19/2013 10:33:50 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile  WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.


System errors:
=============
Error: (09/28/2013 08:27:16 AM) (Source: TermService) (User: )
Description: Der Terminalserver kann den Dienstprinzipalnamen "TERMSRV", der für die Serverauthentifizierung verwendet werden soll, nicht registrieren. Der folgende Fehler ist aufgetreten: Die angegebene Domäne ist nicht vorhanden, oder es konnte keine Verbindung hergestellt werden.
.

Error: (09/28/2013 08:24:44 AM) (Source: Microsoft-Windows-GroupPolicy) (User: STADTGEMEINDE)
Description: Bei der Verarbeitung der Gruppenrichtlinie ist aufgrund fehlender Netzwerkkonnektivität mit einem Domänencontroller ein Fehler aufgetreten. Dies kann eine vorübergehende Bedingung sein. Es wird eine Erfolgsmeldung generiert, wenn die Verbindung des Computers mit dem Domänencontroller wiederhergestellt wurde und wenn die Gruppenrichtlinie erfolgreich verarbeitet wurde. Falls für mehrere Stunden keine Erfolgsmeldung angezeigt wird, wenden Sie sich an den Administrator.

Error: (09/28/2013 08:24:40 AM) (Source: Microsoft-Windows-GroupPolicy) (User: NT-AUTORITÄT)
Description: Bei der Verarbeitung der Gruppenrichtlinie ist aufgrund fehlender Netzwerkkonnektivität mit einem Domänencontroller ein Fehler aufgetreten. Dies kann eine vorübergehende Bedingung sein. Es wird eine Erfolgsmeldung generiert, wenn die Verbindung des Computers mit dem Domänencontroller wiederhergestellt wurde und wenn die Gruppenrichtlinie erfolgreich verarbeitet wurde. Falls für mehrere Stunden keine Erfolgsmeldung angezeigt wird, wenden Sie sich an den Administrator.

Error: (09/28/2013 08:24:36 AM) (Source: NETLOGON) (User: )
Description: Der Computer konnte eine sichere Sitzung mit einem
Domänencontroller in der Domäne STADTGEMEINDE aufgrund der folgenden
Ursache nicht einrichten: 
%%1311

Dies kann zu Authentifizierungsproblemen führen. Stellen
Sie sicher, dass der Computer mit dem Netzwerk verbunden ist.
Wenden Sie sich an den Domänenadministrator, wenn das Problem
weiterhin besteht.



ZUSÄTZLICHE INFORMATIONEN

Wenn dieser Computer ein Domänencontroller der bestimmten
Domäne ist, wird eine sichere Sitzung zum primären
Domänencontrolleremulator in der bestimmten Domäne eingerichtet.
Andernfalls richtet dieser Computer eine sichere Sitzung zu
einem beliebigen Domänencontroller in der bestimmten Domäne ein.

Error: (09/28/2013 08:23:39 AM) (Source: Microsoft Antimalware) (User: )
Description: Beim Aktualisieren der Signaturen wurde von %NT-AUTORITÄT60 ein Fehler festgestellt.

	Neue Signaturversion: 

	Vorherige Signaturversion: 1.159.771.0

	Aktualisierungsquelle: %NT-AUTORITÄT59

	Aktualisierungsphase: 4.3.0215.00

	Quellpfad: 4.3.0215.01

	Signaturtyp: %NT-AUTORITÄT602

	Aktualisierungstyp: %NT-AUTORITÄT604

	Benutzer: NT-AUTORITÄT\SYSTEM

	Aktuelle Modulversion: %NT-AUTORITÄT605

	Vorherige Modulversion: %NT-AUTORITÄT606

	Fehlercode: %NT-AUTORITÄT607

	Fehlerbeschreibung: %NT-AUTORITÄT608

Error: (09/28/2013 08:23:39 AM) (Source: Microsoft Antimalware) (User: )
Description: Beim Aktualisieren der Signaturen wurde von %NT-AUTORITÄT60 ein Fehler festgestellt.

	Neue Signaturversion: 

	Vorherige Signaturversion: 1.159.771.0

	Aktualisierungsquelle: %NT-AUTORITÄT59

	Aktualisierungsphase: 4.3.0215.00

	Quellpfad: 4.3.0215.01

	Signaturtyp: %NT-AUTORITÄT602

	Aktualisierungstyp: %NT-AUTORITÄT604

	Benutzer: NT-AUTORITÄT\SYSTEM

	Aktuelle Modulversion: %NT-AUTORITÄT605

	Vorherige Modulversion: %NT-AUTORITÄT606

	Fehlercode: %NT-AUTORITÄT607

	Fehlerbeschreibung: %NT-AUTORITÄT608

Error: (09/28/2013 08:15:48 AM) (Source: TermService) (User: )
Description: Der Terminalserver kann den Dienstprinzipalnamen "TERMSRV", der für die Serverauthentifizierung verwendet werden soll, nicht registrieren. Der folgende Fehler ist aufgetreten: Die angegebene Domäne ist nicht vorhanden, oder es konnte keine Verbindung hergestellt werden.
.

Error: (09/28/2013 08:13:25 AM) (Source: Microsoft-Windows-GroupPolicy) (User: STADTGEMEINDE)
Description: Bei der Verarbeitung der Gruppenrichtlinie ist aufgrund fehlender Netzwerkkonnektivität mit einem Domänencontroller ein Fehler aufgetreten. Dies kann eine vorübergehende Bedingung sein. Es wird eine Erfolgsmeldung generiert, wenn die Verbindung des Computers mit dem Domänencontroller wiederhergestellt wurde und wenn die Gruppenrichtlinie erfolgreich verarbeitet wurde. Falls für mehrere Stunden keine Erfolgsmeldung angezeigt wird, wenden Sie sich an den Administrator.

Error: (09/28/2013 08:13:07 AM) (Source: Microsoft-Windows-GroupPolicy) (User: NT-AUTORITÄT)
Description: Fehler bei der Verarbeitung der Gruppenrichtlinie. Der Computername konnte nicht aufgelöst werden. Dies kann mindestens eine der folgenden Ursachen haben: 
a) Fehler bei der Namensauflösung mit dem aktuellen Domänencontroller. 
b) Active Directory-Replikationswartezeit (ein auf einem anderen Domänencontroller erstelltes Konto hat nicht auf dem aktuellen Domänencontroller repliziert).

Error: (09/28/2013 08:13:04 AM) (Source: NETLOGON) (User: )
Description: Der Computer konnte eine sichere Sitzung mit einem
Domänencontroller in der Domäne STADTGEMEINDE aufgrund der folgenden
Ursache nicht einrichten: 
%%1311

Dies kann zu Authentifizierungsproblemen führen. Stellen
Sie sicher, dass der Computer mit dem Netzwerk verbunden ist.
Wenden Sie sich an den Domänenadministrator, wenn das Problem
weiterhin besteht.



ZUSÄTZLICHE INFORMATIONEN

Wenn dieser Computer ein Domänencontroller der bestimmten
Domäne ist, wird eine sichere Sitzung zum primären
Domänencontrolleremulator in der bestimmten Domäne eingerichtet.
Andernfalls richtet dieser Computer eine sichere Sitzung zu
einem beliebigen Domänencontroller in der bestimmten Domäne ein.


Microsoft Office Sessions:
=========================
Error: (09/28/2013 09:32:24 AM) (Source: Application Error)(User: )
Description: iexplore.exe10.0.9200.1668652058d43ieapfltr.dll10.0.9200.16521512077a4c0000005000000000001a1295c001cebc1cb040a2ffC:\Program Files\Internet Explorer\iexplore.exeC:\windows\System32\ieapfltr.dll1d7c777e-2810-11e3-8d63-0023183b6791

Error: (09/28/2013 08:48:06 AM) (Source: Application Hang)(User: )
Description: iexplore.exe10.0.9200.16686dfc01cebc169b8b6d7310C:\Program Files\Internet Explorer\iexplore.exee270da7e-2809-11e3-8d63-0023183b6791

Error: (09/28/2013 08:13:44 AM) (Source: Application Error)(User: )
Description: svchost.exe6.1.7600.163854a5bc100unknown0.0.0.000000000c000000500006dc0ed401cebc11dc802dc3C:\windows\SysWOW64\svchost.exeunknown209009ff-2805-11e3-83fa-0023183b6791

Error: (09/27/2013 07:36:41 AM) (Source: Application Hang)(User: )
Description: IEXPLORE.EXE10.0.9200.16686ac801cebb42ef7471cf31C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Error: (09/26/2013 01:05:45 PM) (Source: VmbService)(User: )
Description: GetClient

Error: (09/24/2013 06:53:03 PM) (Source: VmbService)(User: )
Description: GetClient

Error: (09/23/2013 00:23:51 PM) (Source: SideBySide)(User: )
Description: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1"c:\program files (x86)\windows live\photo gallery\MovieMaker.Exec:\program files (x86)\windows live\photo gallery\WLMFDS.DLL8

Error: (09/23/2013 00:22:38 PM) (Source: SideBySide)(User: )
Description: assemblyIdentityversionMAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINORC:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dllC:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll3

Error: (09/20/2013 11:53:47 AM) (Source: Application Error)(User: )
Description: WINWORD.EXE14.0.7015.100051cca7ccunknown0.0.0.000000000c00000050e9dfa9c131001ceb5e3a9850a62C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXEunknown8af05626-21da-11e3-8fd0-0023183b6791

Error: (09/19/2013 10:33:50 AM) (Source: SideBySide)(User: )
Description: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1"c:\program files (x86)\windows live\photo gallery\MovieMaker.Exec:\program files (x86)\windows live\photo gallery\WLMFDS.DLL8


==================== Memory info =========================== 

Percentage of memory in use: 59%
Total physical RAM: 3824.43 MB
Available physical RAM: 1561.81 MB
Total Pagefile: 7647.04 MB
Available Pagefile: 5260.02 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB

==================== Drives ================================

Drive c: (TI30640600A) (Fixed) (Total:288.1 GB) (Free:160.1 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 298 GB) (Disk ID: 9B3C41A1)
Partition 1: (Active) - (Size=1 GB) - (Type=27)
Partition 2: (Not Active) - (Size=288 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=9 GB) - (Type=17)

==================== End Of Log ============================

schrauber · 28.09.2013, 15:20

Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel

Link 1

WICHTIG - Speichere Combofix auf deinem Desktop

Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Ohtarwen · 28.09.2013, 16:54

Hallo Schrauber!
Die Fehlermeldung kam nicht. Hier das Log:

Code:

ATTFilter

ComboFix 13-09-26.03 - Huebner 28.09.2013  17:35:39.1.4 - x64
Microsoft Windows 7 Professional   6.1.7601.1.1252.43.1031.18.3824.1812 [GMT 2:00]
ausgeführt von:: c:\users\Huebner.STADTGEMEINDE\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}
SP: Microsoft Security Essentials *Disabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
 ADS - windows: deleted 192 bytes in 1 streams. 
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\END
c:\users\Huebner.STADTGEMEINDE\AppData\Local\assembly\tmp
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-08-28 bis 2013-09-28  ))))))))))))))))))))))))))))))
.
.
2013-09-28 15:39 . 2013-09-28 15:39	--------	d-----w-	c:\users\Huebner.STADTGEMEINDE\AppData\Local\temp
2013-09-28 15:39 . 2013-09-28 15:39	--------	d-----w-	c:\users\HUEBNE~1~STA\AppData\Local\temp
2013-09-28 15:39 . 2013-09-28 15:39	--------	d-----w-	c:\users\Default\AppData\Local\temp
2013-09-28 15:39 . 2013-09-28 15:39	--------	d-----w-	c:\users\Administrator\AppData\Local\temp
2013-09-28 12:30 . 2013-09-28 12:30	76232	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CF11E8B5-71CB-476A-AEA8-AD24080C3F10}\offreg.dll
2013-09-28 10:19 . 2013-09-05 05:32	9694160	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CF11E8B5-71CB-476A-AEA8-AD24080C3F10}\mpengine.dll
2013-09-28 08:02 . 2013-09-05 05:32	9694160	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-09-28 07:34 . 2013-09-28 07:34	--------	dc----w-	C:\FRST
2013-09-26 11:08 . 2013-08-27 09:49	81920	----a-w-	c:\windows\SysWow64\devolopacket.dll
2013-09-26 11:08 . 2013-08-27 09:49	34048	----a-w-	c:\windows\SysWow64\drivers\npf_devolo.sys
2013-09-26 11:08 . 2013-08-27 09:49	221184	----a-w-	c:\windows\SysWow64\devolopcap.dll
2013-09-25 12:25 . 2011-04-08 12:21	120320	----a-w-	c:\windows\system32\opnetext.dll
2013-09-25 12:21 . 2011-04-20 00:45	43520	----a-w-	c:\windows\system32\Spool\prtprocs\x64\OPLAPP3.DLL
2013-09-24 09:31 . 2013-09-26 08:33	--------	d-----w-	c:\users\Huebner.STADTGEMEINDE\AppData\Roaming\Nitro PDF
2013-09-24 09:17 . 2013-09-24 09:36	--------	d-----w-	c:\users\Huebner.STADTGEMEINDE\AppData\Roaming\Nitro
2013-09-24 09:17 . 2013-09-24 09:17	--------	d-----w-	c:\users\Huebner.STADTGEMEINDE\AppData\Roaming\FileOpen
2013-09-24 09:17 . 2013-09-24 09:17	--------	d-----w-	c:\programdata\FileOpen
2013-09-24 09:16 . 2013-06-17 20:00	29704	----a-w-	c:\windows\system32\nitrolocalmon2.dll
2013-09-24 09:16 . 2013-06-17 20:00	17928	----a-w-	c:\windows\system32\nitrolocalui2.dll
2013-09-24 09:16 . 2013-09-24 09:16	--------	d-----w-	c:\program files\Common Files\Nitro
2013-09-24 09:16 . 2013-09-24 09:16	--------	d-----w-	c:\programdata\Nitro
2013-09-24 09:16 . 2013-09-24 09:16	--------	d-----w-	c:\program files (x86)\Nitro
2013-09-24 09:16 . 2013-09-24 09:16	--------	d-----w-	c:\program files (x86)\Common Files\Nitro
2013-09-24 09:14 . 2013-09-24 09:14	--------	d-----w-	c:\users\Huebner.STADTGEMEINDE\AppData\Roaming\Downloaded Installations
2013-09-16 05:56 . 2013-02-16 23:40	28672	----a-w-	c:\windows\system32\IEUDINIT.EXE
2013-09-11 11:59 . 2010-08-25 03:00	87040	----a-w-	c:\windows\system32\Spool\prtprocs\x64\CNMPPAE.DLL
2013-09-11 11:59 . 2010-08-25 03:00	28672	----a-w-	c:\windows\system32\Spool\prtprocs\x64\CNMPDAE.DLL
2013-09-11 11:58 . 2010-08-25 03:00	361472	----a-w-	c:\windows\system32\CNMLMAE.DLL
2013-09-10 11:29 . 2013-06-19 08:41	41984	----a-w-	c:\windows\system32\Spool\prtprocs\x64\OKBIPP3.DLL
2013-09-10 11:29 . 2013-06-19 08:41	41984	----a-w-	c:\windows\system32\Spool\prtprocs\x64\1_OKBIPP3.DLL
2013-09-10 11:28 . 2011-07-04 17:42	24064	----a-w-	c:\windows\system32\OPPFLM64.DLL
2013-09-09 05:46 . 2013-09-09 05:46	965008	------w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{332D0E29-B05A-4489-8209-AE80C58591D1}\gapaengine.dll
2013-09-05 14:04 . 2013-09-05 14:04	209272	----a-w-	c:\program files (x86)\Mozilla Firefox\plugins\nppdf32.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-09-20 09:45 . 2012-03-30 05:50	692616	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2013-09-20 09:45 . 2011-05-18 05:51	71048	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-09-12 12:09 . 2011-04-12 14:52	952	--sha-w-	c:\programdata\KGyGaAvL.sys
2013-08-26 09:13 . 2013-08-26 09:13	354656	----a-w-	c:\windows\SysWow64\DivXControlPanelApplet.cpl
2013-08-23 08:05 . 2012-06-14 05:34	941720	------w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2013-08-14 09:03 . 2011-04-06 14:05	78161360	----a-w-	c:\windows\system32\MRT.exe
2013-08-07 22:54 . 2013-08-07 22:54	94208	----a-w-	c:\windows\SysWow64\dpl100.dll
2013-07-25 09:25 . 2013-08-14 08:00	1888768	----a-w-	c:\windows\system32\WMVDECOD.DLL
2013-07-25 08:57 . 2013-08-14 08:00	1620992	----a-w-	c:\windows\SysWow64\WMVDECOD.DLL
2013-07-19 01:58 . 2013-08-14 08:00	2048	----a-w-	c:\windows\system32\tzres.dll
2013-07-19 01:41 . 2013-08-14 08:00	2048	----a-w-	c:\windows\SysWow64\tzres.dll
2013-07-09 06:03 . 2013-08-14 08:00	5550528	----a-w-	c:\windows\system32\ntoskrnl.exe
2013-07-09 05:54 . 2013-08-14 08:00	1732032	----a-w-	c:\windows\system32\ntdll.dll
2013-07-09 05:53 . 2013-08-14 08:00	243712	----a-w-	c:\windows\system32\wow64.dll
2013-07-09 05:52 . 2013-08-14 08:00	224256	----a-w-	c:\windows\system32\wintrust.dll
2013-07-09 05:51 . 2013-08-14 08:00	1217024	----a-w-	c:\windows\system32\rpcrt4.dll
2013-07-09 05:46 . 2013-08-14 08:00	1472512	----a-w-	c:\windows\system32\crypt32.dll
2013-07-09 05:46 . 2013-08-14 08:00	184320	----a-w-	c:\windows\system32\cryptsvc.dll
2013-07-09 05:46 . 2013-08-14 08:00	139776	----a-w-	c:\windows\system32\cryptnet.dll
2013-07-09 05:03 . 2013-08-14 08:00	3913664	----a-w-	c:\windows\SysWow64\ntoskrnl.exe
2013-07-09 05:03 . 2013-08-14 08:00	3968960	----a-w-	c:\windows\SysWow64\ntkrnlpa.exe
2013-07-09 04:53 . 2013-08-14 08:00	1292192	----a-w-	c:\windows\SysWow64\ntdll.dll
2013-07-09 04:52 . 2013-08-14 08:00	663552	----a-w-	c:\windows\SysWow64\rpcrt4.dll
2013-07-09 04:52 . 2013-08-14 08:00	5120	----a-w-	c:\windows\SysWow64\wow32.dll
2013-07-09 04:52 . 2013-08-14 08:00	175104	----a-w-	c:\windows\SysWow64\wintrust.dll
2013-07-09 04:46 . 2013-08-14 08:00	1166848	----a-w-	c:\windows\SysWow64\crypt32.dll
2013-07-09 04:46 . 2013-08-14 08:00	140288	----a-w-	c:\windows\SysWow64\cryptsvc.dll
2013-07-09 04:46 . 2013-08-14 08:00	103936	----a-w-	c:\windows\SysWow64\cryptnet.dll
2013-07-09 04:45 . 2013-08-14 08:00	44032	----a-w-	c:\windows\apppatch\acwow64.dll
2013-07-09 02:49 . 2013-08-14 08:00	25600	----a-w-	c:\windows\SysWow64\setup16.exe
2013-07-09 02:49 . 2013-08-14 08:00	7680	----a-w-	c:\windows\SysWow64\instnm.exe
2013-07-09 02:49 . 2013-08-14 08:00	14336	----a-w-	c:\windows\SysWow64\ntvdm64.dll
2013-07-09 02:49 . 2013-08-14 08:00	2048	----a-w-	c:\windows\SysWow64\user.exe
2013-07-06 06:03 . 2013-08-14 08:00	1910208	----a-w-	c:\windows\system32\drivers\tcpip.sys
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}]
2013-04-05 18:30	280224	----a-w-	c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"TWebCamera"="c:\program files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" [2009-12-09 2454840]
"Corel Photo Downloader"="c:\program files (x86)\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" [2008-08-08 532808]
"Corel File Shell Monitor"="c:\program files (x86)\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe" [2008-08-08 16712]
"HPUsageTracking"="c:\program files (x86)\HP\HP UT\bin\hppusg.exe" [2009-10-06 30264]
"MobileBroadband"="c:\program files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe" [2011-04-19 408576]
"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2012-11-05 89184]
"DivXMediaServer"="c:\program files (x86)\DivX\DivX Media Server\DivXMediaServer.exe" [2013-08-21 450560]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-05-11 958576]
"ControlCenter4"="c:\program files (x86)\ControlCenter4\BrCcBoot.exe" [2012-09-06 143360]
"BrStsMon00"="c:\program files (x86)\Browny02\Brother\BrStMonW.exe" [2012-06-06 3076096]
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2013-08-29 1861968]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"TOSHIBA Online Product Information"="c:\program files (x86)\TOSHIBA\Toshiba Online Product Information\topi.exe" [2009-08-12 6203296]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux2"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 ATSwpWDF;AuthenTec TruePrint USB WDF Driver;c:\windows\system32\Drivers\ATSwpWDF.sys;c:\windows\SYSNATIVE\Drivers\ATSwpWDF.sys [x]
R3 BrYNSvc;BrYNSvc;c:\program files (x86)\Browny02\BrYNSvc.exe;c:\program files (x86)\Browny02\BrYNSvc.exe [x]
R3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys;c:\windows\SYSNATIVE\DRIVERS\dc3d.sys [x]
R3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys;c:\windows\SYSNATIVE\drivers\massfilter.sys [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 Point64;Microsoft Mouse and Keyboard Center Filter Driver;c:\windows\system32\DRIVERS\point64.sys;c:\windows\SYSNATIVE\DRIVERS\point64.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 TemproMonitoringService;Notebook Performance Tuning Service (TEMPRO);c:\program files (x86)\Toshiba TEMPRO\TemproSvc.exe;c:\program files (x86)\Toshiba TEMPRO\TemproSvc.exe [x]
R3 TMachInfo;TMachInfo;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S0 Thpdrv;TOSHIBA HDD Protection Driver;c:\windows\system32\DRIVERS\thpdrv.sys;c:\windows\SYSNATIVE\DRIVERS\thpdrv.sys [x]
S0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;c:\windows\system32\DRIVERS\Thpevm.SYS;c:\windows\SYSNATIVE\DRIVERS\Thpevm.SYS [x]
S0 tos_sps64;TOSHIBA tos_sps64 Service;c:\windows\system32\DRIVERS\tos_sps64.sys;c:\windows\SYSNATIVE\DRIVERS\tos_sps64.sys [x]
S2 cfWiMAXService;ConfigFree WiMAX Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe;c:\program files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe [x]
S2 ConfigFree Service;ConfigFree Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe;c:\program files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe [x]
S2 DevoloNetworkService;devolo Network Service;c:\program files (x86)\devolo\dlan\devolonetsvc.exe;c:\program files (x86)\devolo\dlan\devolonetsvc.exe [x]
S2 NasPmService;NAS PM Service;c:\program files (x86)\BUFFALO\NASNAVI\nassvc.exe;c:\program files (x86)\BUFFALO\NASNAVI\nassvc.exe [x]
S2 NitroDriverReadSpool8;NitroPDFDriverCreatorReadSpool8;c:\program files\Common Files\Nitro\Pro\8.0\NitroPDFDriverService8x64.exe;c:\program files\Common Files\Nitro\Pro\8.0\NitroPDFDriverService8x64.exe [x]
S2 nlsX86cc;Nalpeiron Licensing Service;c:\windows\SysWOW64\NLSSRV32.EXE;c:\windows\SysWOW64\NLSSRV32.EXE [x]
S2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys;c:\windows\SYSNATIVE\drivers\npf.sys [x]
S2 NPF_devolo;NetGroup Packet Filter Driver (devolo);c:\windows\sysWOW64\drivers\npf_devolo.sys;c:\windows\sysWOW64\drivers\npf_devolo.sys [x]
S2 OpLclSrv;OKI Local Port Manager;c:\program files\Okidata\Common\Extend3\portmgrsrv.exe;c:\program files\Okidata\Common\Extend3\portmgrsrv.exe [x]
S2 rimspci;rimspci;c:\windows\system32\DRIVERS\rimspe64.sys;c:\windows\SYSNATIVE\DRIVERS\rimspe64.sys [x]
S2 risdpcie;risdpcie;c:\windows\system32\DRIVERS\risdpe64.sys;c:\windows\SYSNATIVE\DRIVERS\risdpe64.sys [x]
S2 rixdpcie;rixdpcie;c:\windows\system32\DRIVERS\rixdpe64.sys;c:\windows\SYSNATIVE\DRIVERS\rixdpe64.sys [x]
S2 TeamViewer8;TeamViewer 8;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [x]
S2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;c:\program files\TOSHIBA\TECO\TecoService.exe;c:\program files\TOSHIBA\TECO\TecoService.exe [x]
S2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\DRIVERS\TVALZFL.sys;c:\windows\SYSNATIVE\DRIVERS\TVALZFL.sys [x]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S2 VmbService;Vodafone-Mobile-Broadband-Dienst;c:\program files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe;c:\program files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe [x]
S3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\DRIVERS\e1k62x64.sys;c:\windows\SYSNATIVE\DRIVERS\e1k62x64.sys [x]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys;c:\windows\SYSNATIVE\DRIVERS\HECIx64.sys [x]
S3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys;c:\windows\SYSNATIVE\DRIVERS\ew_jubusenum.sys [x]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys;c:\windows\SYSNATIVE\DRIVERS\Impcd.sys [x]
S3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys;c:\windows\SYSNATIVE\DRIVERS\pgeffect.sys [x]
S3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [x]
S3 TPCHSrv;TPCH Service;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe [x]
S3 vodafone_K3805-z_dc_enum;vodafone_K3805-z_dc_enum;c:\windows\system32\DRIVERS\vodafone_K3805-z_dc_enum.sys;c:\windows\SYSNATIVE\DRIVERS\vodafone_K3805-z_dc_enum.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2013-09-28 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-30 09:45]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}]
2013-04-05 18:30	339104	----a-w-	c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ThpSrv"="c:\windows\system32\thpsrv" [X]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-02-17 166424]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-02-17 391192]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-02-17 410648]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-10-30 8305664]
"TosSENotify"="c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [2009-11-05 709976]
"TosVolRegulator"="c:\program files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe" [2009-11-11 24376]
"Toshiba TEMPRO"="c:\program files (x86)\Toshiba TEMPRO\TemproTray.exe" [2010-05-11 1050072]
"Zune Launcher"="c:\program files\Zune\ZuneLauncher.exe" [2011-08-05 163552]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-06-20 1356240]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyServer = 20.20.20.9:8080
uInternet Settings,ProxyOverride = <local>
uSearchAssistant = hxxp://www.google.com
IE: {{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll
FF - ProfilePath - c:\users\Huebner.STADTGEMEINDE\AppData\Roaming\Mozilla\Firefox\Profiles\pilvdcyr.default\
FF - prefs.js: browser.search.selectedEngine - Web Search
FF - prefs.js: browser.startup.homepage - about:home
FF - prefs.js: network.proxy.ftp - 20.20.20.9
FF - prefs.js: network.proxy.ftp_port - 8080
FF - prefs.js: network.proxy.http - 20.20.20.9
FF - prefs.js: network.proxy.http_port - 8080
FF - prefs.js: network.proxy.socks - 20.20.20.9
FF - prefs.js: network.proxy.socks_port - 8080
FF - prefs.js: network.proxy.ssl - 20.20.20.9
FF - prefs.js: network.proxy.ssl_port - 8080
FF - prefs.js: network.proxy.type - 0
FF - user.js: extensions.Softonic.hpOld0 - hxxp://www.startfenster.com
FF - user.js: extensions.Softonic.tlbrSrchUrl - hxxp://search.softonic.com/MOY00006/tb_v1?SearchSource=1&cc=&q=
FF - user.js: extensions.Softonic.id - 6aa97e7f0000000000000023183b6791
FF - user.js: extensions.Softonic.appId - {7ABBFE1C-E485-44AA-8F36-353751B4124D}
FF - user.js: extensions.Softonic.instlDay - 15761
FF - user.js: extensions.Softonic.vrsn - 1.8.8.11
FF - user.js: extensions.Softonic.vrsni - 1.8.8.11
FF - user.js: extensions.Softonic_i.vrsnTs - 1.8.8.1111:52
FF - user.js: extensions.Softonic.prtnrId - softonic
FF - user.js: extensions.Softonic.prdct - Softonic
FF - user.js: extensions.Softonic.aflt - SD
FF - user.js: extensions.Softonic_i.smplGrp - none
FF - user.js: extensions.Softonic.tlbrId - BASEirobinhoodActive
FF - user.js: extensions.Softonic.instlRef - MOY00006
FF - user.js: extensions.Softonic.dfltLng - de
FF - user.js: extensions.Softonic_i.excTlbr - false
FF - user.js: extensions.Softonic.excTlbr - false
FF - user.js: extensions.Softonic.admin - false
FF - user.js: extensions.Softonic.autoRvrt - false
FF - user.js: extensions.Softonic.rvrt - true
FF - user.js: extensions.Softonic_i.hmpg - true
FF - user.js: extensions.Softonic.hmpgUrl - hxxp://search.softonic.com/MOY00006/tb_v1?SearchSource=13&cc=
FF - user.js: extensions.Softonic.dfltSrch - true
FF - user.js: extensions.Softonic.srchPrvdr - Search the web (Softonic)
FF - user.js: extensions.Softonic.kw_url - hxxp://search.softonic.com/MOY00006/tb_v1?SearchSource=2&cc=&q=
FF - user.js: extensions.Softonic_i.dnsErr - true
FF - user.js: extensions.Softonic_i.newTab - true
FF - user.js: extensions.Softonic.newTabUrl - hxxp://search.softonic.com/MOY00006/tb_v1?SearchSource=15&cc=
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKLM-Run-TNRotate - %ProgramFiles(x86)%\TOSHIBA\TNRotate\TNRotate.exe
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
HKLM-Run-TPwrMain - c:\program files (x86)\TOSHIBA\Power Saver\TPwrMain.EXE
HKLM-Run-HSON - c:\program files (x86)\TOSHIBA\TBS\HSON.exe
HKLM-Run-SmoothView - c:\program files (x86)\Toshiba\SmoothView\SmoothView.exe
HKLM-Run-00TCrdMain - c:\program files (x86)\TOSHIBA\FlashCards\TCrdMain.exe
HKLM-Run-Teco - c:\program files (x86)\TOSHIBA\TECO\Teco.exe
HKLM-Run-TosWaitSrv - c:\program files (x86)\TOSHIBA\TPHM\TosWaitSrv.exe
HKLM-Run-TosReelTimeMonitor - c:\program files (x86)\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_175_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_175_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_175_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_175_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_175.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_175.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_175.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_175.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
   00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
@SACL=
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-09-28  17:42:48
ComboFix-quarantined-files.txt  2013-09-28 15:42
.
Vor Suchlauf: 26 Verzeichnis(se), 172.030.574.592 Bytes frei
Nach Suchlauf: 31 Verzeichnis(se), 174.692.794.368 Bytes frei
.
- - End Of File - - 1144C55B88D5700BB4DF06C843637BCC

schrauber · 29.09.2013, 06:00

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Ohtarwen · 29.09.2013, 09:47

Malwarebytes Bericht:

Code:

ATTFilter

 Malwarebytes Anti-Malware  (Test) 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.09.29.02

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16686
Huebner :: ZA-HUEBNER [Administrator]

Schutz: Deaktiviert

29.09.2013 10:09:36
mbam-log-2013-09-29 (10-09-36).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 243387
Laufzeit: 4 Minute(n), 55 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 2
C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\OpenCandy (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\OpenCandy\60F9CE6B33C64C7596D9E8C238B59F40 (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateien: 4
C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\OpenCandy\60F9CE6B33C64C7596D9E8C238B59F40\3712.ico (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\OpenCandy\60F9CE6B33C64C7596D9E8C238B59F40\EBB77268-338F-4C6A-8590-AD88FED26F4A (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\OpenCandy\60F9CE6B33C64C7596D9E8C238B59F40\Installer.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\OpenCandy\60F9CE6B33C64C7596D9E8C238B59F40\OCBrowserHelper_1.0.6.124.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

Bei adwcleaner gab es nichts zu löschen.

Code:

ATTFilter

# AdwCleaner v3.005 - Bericht erstellt am 29/09/2013 um 10:22:50
# Updated 22/09/2013 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : Huebner - ZA-HUEBNER
# Gestartet von : C:\Users\Huebner.STADTGEMEINDE\Desktop\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\RegistryHelper.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_adblock-ie_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_adblock-ie_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_cobian-backup_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_cobian-backup_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_keyfinder_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_keyfinder_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_pdf-redirect[1]_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_pdf-redirect[1]_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{544C2426-48FD-4C40-AE3B-31257FF334D0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B887CA3B-D82B-4A01-AD29-E97444D01CE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AFB904C4-C255-4540-B97E-A75A34F1FFB0}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\APN PIP
Schlüssel Gelöscht : HKCU\Software\Conduit
Schlüssel Gelöscht : HKLM\Software\PIP

***** [ Browser ] *****

-\\ Internet Explorer v10.0.9200.16686


-\\ Mozilla Firefox v23.0.1 (de)

*************************

AdwCleaner[R0].txt - [3095 octets] - [29/09/2013 10:03:30]
AdwCleaner[R1].txt - [3155 octets] - [29/09/2013 10:20:45]
AdwCleaner[S0].txt - [2968 octets] - [29/09/2013 10:22:50]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [3028 octets] ##########

JRT.txt

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.3 (09.27.2013:1)
OS: Windows 7 Professional x64
Ran by Huebner on 29.09.2013 at 10:30:39,66
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\dropdowndeals_132013-1714_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\dropdowndeals_132013-1714_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\Softonic_chr_1-8-8-11_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\Softonic_chr_1-8-8-11_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\dropdowndeals_132013-1714_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\dropdowndeals_132013-1714_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\Softonic_chr_1-8-8-11_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\Softonic_chr_1-8-8-11_RASMANCS



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\dvdvideosoftiehelpers"
Successfully deleted: [Folder] "C:\Users\Huebner.STADTGEMEINDE\appdata\locallow\softonic"



~~~ FireFox

Successfully deleted: [File] C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\mozilla\firefox\profiles\pilvdcyr.default\user.js
Successfully deleted the following from C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\mozilla\firefox\profiles\pilvdcyr.default\prefs.js

user_pref("browser.search.selectedEngine", "Web Search");
user_pref("extensions.Softonic.admin", false);
user_pref("extensions.Softonic.aflt", "SD");
user_pref("extensions.Softonic.appId", "{7ABBFE1C-E485-44AA-8F36-353751B4124D}");
user_pref("extensions.Softonic.autoRvrt", "false");
user_pref("extensions.Softonic.dfltLng", "de");
user_pref("extensions.Softonic.dfltSrch", true);
user_pref("extensions.Softonic.excTlbr", false);
user_pref("extensions.Softonic.hmpgUrl", "hxxp://search.softonic.com/MOY00006/tb_v1?SearchSource=13&cc=");
user_pref("extensions.Softonic.hpOld0", "hxxp://www.startfenster.com");
user_pref("extensions.Softonic.id", "6aa97e7f0000000000000023183b6791");
user_pref("extensions.Softonic.instlDay", "15761");
user_pref("extensions.Softonic.instlRef", "MOY00006");
user_pref("extensions.Softonic.kw_url", "hxxp://search.softonic.com/MOY00006/tb_v1?SearchSource=2&cc=&q=");
user_pref("extensions.Softonic.newTabUrl", "hxxp://search.softonic.com/MOY00006/tb_v1?SearchSource=15&cc=");
user_pref("extensions.Softonic.prdct", "Softonic");
user_pref("extensions.Softonic.prtnrId", "softonic");
user_pref("extensions.Softonic.rvrt", "true");
user_pref("extensions.Softonic.srchPrvdr", "Search the web (Softonic)");
user_pref("extensions.Softonic.tlbrId", "BASEirobinhoodActive");
user_pref("extensions.Softonic.tlbrSrchUrl", "hxxp://search.softonic.com/MOY00006/tb_v1?SearchSource=1&cc=&q=");
user_pref("extensions.Softonic.vrsn", "1.8.8.11");
user_pref("extensions.Softonic.vrsni", "1.8.8.11");
user_pref("extensions.Softonic_i.dnsErr", true);
user_pref("extensions.Softonic_i.excTlbr", false);
user_pref("extensions.Softonic_i.hmpg", true);
user_pref("extensions.Softonic_i.newTab", true);
user_pref("extensions.Softonic_i.smplGrp", "none");
user_pref("extensions.Softonic_i.vrsnTs", "1.8.8.1111:52:44");
user_pref("extensions.helperbar.SmartbarDisabled", false);
user_pref("extensions.helperbar.SmartbarStateMinimaized", false);
Emptied folder: C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\mozilla\firefox\profiles\pilvdcyr.default\minidumps [58 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 29.09.2013 at 10:36:39,03
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST.txt

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-09-2013 02
Ran by Huebner (administrator) on ZA-HUEBNER on 29-09-2013 10:42:52
Running from C:\Users\Huebner.STADTGEMEINDE\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(BUFFALO INC.) C:\Program Files (x86)\BUFFALO\NASNAVI\nassvc.exe
(Nitro PDF Software) C:\Program Files\Common Files\Nitro\Pro\8.0\NitroPDFDriverService8x64.exe
(Nalpeiron Ltd.) C:\windows\SysWOW64\NLSSRV32.EXE
(Oki Data Corporation) C:\Program Files\Okidata\Common\Extend3\portmgrsrv.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(TOSHIBA Corporation) C:\windows\system32\ThpSrv.exe
(TOSHIBA Corporation) C:\windows\system32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TecoService.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Vodafone) C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) c:\Program Files\Microsoft Security Client\NisSrv.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\Power Saver\TPwrMain.exe
(Intel Corporation) C:\windows\system32\igfxsrvc.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\SmoothView\SmoothView.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\FlashCards\TCrdMain.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\TECO\Teco.exe
(TOSHIBA Corporation) C:\Windows\System32\ThpSrv.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\ReelTime\TosReelTimeMonitor.exe
(Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe
(Microsoft Corporation) C:\Program Files\Zune\ZuneLauncher.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
() C:\Program Files (x86)\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe
(Vodafone) C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
(Intel Corporation) C:\windows\system32\igfxext.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe
(Microsoft Corporation) C:\windows\System32\MsSpellCheckingFacility.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\windows\splwow64.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [HotKeysCmds] - C:\windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [TPwrMain] - C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [505696 2009-11-05] (TOSHIBA Corporation)
HKLM\...\Run: [HSON] - C:\Program Files\TOSHIBA\TBS\HSON.exe [52600 2009-03-09] (TOSHIBA Corporation)
HKLM\...\Run: [SmoothView] - C:\Program Files\Toshiba\SmoothView\SmoothView.exe [570680 2009-08-13] (TOSHIBA Corporation)
HKLM\...\Run: [00TCrdMain] - C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [913720 2010-03-25] (TOSHIBA Corporation)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8305664 2009-10-30] (Realtek Semiconductor)
HKLM\...\Run: [Teco] - C:\Program Files\TOSHIBA\TECO\Teco.exe [1483776 2010-02-25] (TOSHIBA Corporation)
HKLM\...\Run: [TosSENotify] - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [709976 2009-11-05] (TOSHIBA Corporation)
HKLM\...\Run: [ThpSrv] - C:\windows\system32\thpsrv /logon
HKLM\...\Run: [TosWaitSrv] - C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [705368 2010-02-05] (TOSHIBA Corporation)
HKLM\...\Run: [TosReelTimeMonitor] - C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe [35672 2010-03-03] (TOSHIBA Corporation)
HKLM\...\Run: [TosVolRegulator] - C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation)
HKLM\...\Run: [Toshiba TEMPRO] - C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe [1050072 2010-05-11] (Toshiba Europe GmbH)
HKLM\...\Run: [Zune Launcher] - C:\Program Files\Zune\ZuneLauncher.exe [163552 2011-08-05] (Microsoft Corporation)
HKLM\...\Run: [MSC] - c:\Program Files\Microsoft Security Client\msseces.exe [1356240 2013-06-20] (Microsoft Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM-x32\...\Run: [TWebCamera] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe [2454840 2009-12-09] (TOSHIBA CORPORATION.)
HKLM-x32\...\Run: [Corel Photo Downloader] - C:\Program Files (x86)\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe [532808 2008-08-08] (Corel, Inc.)
HKLM-x32\...\Run: [Corel File Shell Monitor] - C:\Program Files (x86)\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe [16712 2008-08-08] ()
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [HPUsageTracking] - C:\Program Files (x86)\HP\HP UT\bin\hppusg.exe [30264 2009-10-06] (Hewlett-Packard Company)
HKLM-x32\...\Run: [MobileBroadband] - C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe [408576 2011-04-19] (Vodafone)
HKLM-x32\...\Run: [BCSSync] - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [DivXMediaServer] - C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2013-08-21] (DivX, LLC)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [ControlCenter4] - C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [143360 2012-09-06] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsMon00] - C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [3076096 2012-06-06] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [DivXUpdate] - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1861968 2013-08-29] ()
HKU\Administrator\...\Run: [TOSHIBA Online Product Information] - C:\Program Files (x86)\TOSHIBA\Toshiba Online Product Information\topi.exe [6203296 2009-08-12] (TOSHIBA)
HKU\Default\...\Run: [TOSHIBA Online Product Information] - C:\Program Files (x86)\TOSHIBA\Toshiba Online Product Information\topi.exe [6203296 2009-08-12] (TOSHIBA)
HKU\Default User\...\Run: [TOSHIBA Online Product Information] - C:\Program Files (x86)\TOSHIBA\Toshiba Online Product Information\topi.exe [6203296 2009-08-12] (TOSHIBA)
Startup: C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)

==================== Internet (Whitelisted) ====================

ProxyServer: 20.20.20.9:8080
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - DefaultScope {20640D01-6C2B-4098-AAC8-BB36A96B844D} URL = https://duckduckgo.com/?q={searchTerms}
SearchScopes: HKCU - {1D514625-819F-4B2B-A8F2-95279A4E2990} URL = 
SearchScopes: HKCU - {20640D01-6C2B-4098-AAC8-BB36A96B844D} URL = https://duckduckgo.com/?q={searchTerms}
SearchScopes: HKCU - {6A0FBD7D-314D-4BB4-96EF-300AD3359631} URL = hxxp://www.benefind.de/web.php?q={searchTerms}
SearchScopes: HKCU - {86613AFE-F9AE-4A42-93E7-34954A120C99} URL = https://startpage.com/do/search?query={searchTerms}&cat=web&pl=ie&language=deutsch
SearchScopes: HKCU - {9FEDAB7D-F6B4-4B91-8AC9-ED60CC96AC0D} URL = 
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM-x32 - SimilarWeb - {74198672-5F7D-4FE9-A611-4AC1D5A66A15} - C:\Program Files (x86)\SimilarWeb\SimilarWeb.dll (SimilarGroup)
DPF: HKLM {02BCC737-B171-4746-94C9-0D8A0B2C0089} hxxp://office.microsoft.com/_layouts/ClientBin/ieawsdc64.cab
DPF: HKLM {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab
DPF: HKLM-x32 {02BCC737-B171-4746-94C9-0D8A0B2C0089} hxxp://office.microsoft.com/sites/production/ieawsdc32.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} -  No File
Tcpip\Parameters: [DhcpNameServer] 20.20.20.2

FireFox:
========
FF ProfilePath: C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\Mozilla\Firefox\Profiles\pilvdcyr.default
FF NewTab: about:blank
FF Homepage: about:home
FF NetworkProxy: "ftp", "20.20.20.9"
FF NetworkProxy: "ftp_port", 8080
FF NetworkProxy: "http", "20.20.20.9"
FF NetworkProxy: "http_port", 8080
FF NetworkProxy: "no_proxies_on", "hollabrunn.noe.gv.at,hollabrunn.gv.at,localhost,127.0.0.1"
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "socks", "20.20.20.9"
FF NetworkProxy: "socks_port", 8080
FF NetworkProxy: "ssl", "20.20.20.9"
FF NetworkProxy: "ssl_port", 8080
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @java.com/DTPlugin,version=10.11.2 - C:\windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.11.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.2 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.0.6 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf - C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll No File
FF Plugin-x32: @java.com/DTPlugin,version=1.6.0_39 - C:\windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nitropdf.com/NitroPDF - C:\Program Files (x86)\Nitro\Pro 8\npnitromozilla.dll (Nitro PDF)
FF Plugin-x32: @videolan.org/vlc,version=2.0.7 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: iMacros for Firefox - C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\Mozilla\Firefox\Profiles\pilvdcyr.default\Extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}
FF Extension: No Name - C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\Mozilla\Firefox\Profiles\pilvdcyr.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
FF Extension: No Name - C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\Mozilla\Firefox\Profiles\pilvdcyr.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0039-ABCDEFFEDCBA}
FF HKLM\...\Firefox\Extensions: [{C1CA7765-44E4-452e-9D00-A04F3D434281}] - 
FF HKLM-x32\...\Firefox\Extensions: [{C1CA7765-44E4-452e-9D00-A04F3D434281}] - C:\Program Files\TOSHIBA\TFPU\FirefoxAddin

==================== Services (Whitelisted) =================

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2013-06-20] (Microsoft Corporation)
R2 NasPmService; C:\Program Files (x86)\BUFFALO\NASNAVI\nassvc.exe [251256 2010-10-28] (BUFFALO INC.)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366600 2013-06-20] (Microsoft Corporation)
R2 NitroDriverReadSpool8; C:\Program Files\Common Files\Nitro\Pro\8.0\NitroPDFDriverService8x64.exe [230408 2013-06-17] (Nitro PDF Software)
R2 OpLclSrv; C:\Program Files\Okidata\Common\Extend3\portmgrsrv.exe [169984 2010-08-10] (Oki Data Corporation)
S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [118520 2013-03-01] (Riverbed Technology, Inc.)
S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [124368 2010-05-11] (Toshiba Europe GmbH)

==================== Drivers (Whitelisted) ====================

R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [247216 2013-06-18] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [139616 2013-06-18] (Microsoft Corporation)
R2 NPF; C:\Windows\System32\drivers\npf.sys [36600 2013-03-01] (Riverbed Technology, Inc.)
S3 ApfiltrService; system32\DRIVERS\Apfiltr.sys [x]
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
U5 ewusbnet; C:\Windows\System32\Drivers\ewusbnet.sys [243200 2009-10-21] (Huawei Technologies Co., Ltd.)
S3 massfilter; system32\drivers\massfilter.sys [x]
S3 SANDRA; \??\C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2013.SP1\WNt500x64\Sandra.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-29 10:42 - 2013-09-29 10:42 - 00001533 _____ C:\Users\Huebner.STADTGEMEINDE\Desktop\Niederschrift Gemeindewahlbehörde.pdf.lnk
2013-09-29 10:38 - 2013-09-29 10:40 - 01953880 _____ (Farbar) C:\Users\Huebner.STADTGEMEINDE\Desktop\FRST64.exe
2013-09-29 10:36 - 2013-09-29 10:36 - 00004306 _____ C:\Users\Huebner.STADTGEMEINDE\Desktop\JRT.txt
2013-09-29 10:30 - 2013-09-29 10:30 - 00000000 ____D C:\windows\ERUNT
2013-09-29 10:29 - 2013-09-29 10:29 - 01030305 _____ (Thisisu) C:\Users\Huebner.STADTGEMEINDE\Desktop\JRT.exe
2013-09-29 10:22 - 2013-09-29 10:22 - 00003155 _____ C:\Users\Huebner.STADTGEMEINDE\Desktop\AdwCleaner[R1].txt
2013-09-29 10:10 - 2013-09-29 10:10 - 00001086 _____ C:\Users\Huebner.STADTGEMEINDE\Desktop\Nationalratswahl 2013.lnk
2013-09-29 10:07 - 2013-09-29 10:07 - 00001080 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-29 10:07 - 2013-09-29 10:07 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-29 10:07 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2013-09-29 10:03 - 2013-09-29 10:22 - 00000000 ___DC C:\AdwCleaner
2013-09-29 10:02 - 2013-09-29 10:02 - 01042066 _____ C:\Users\Huebner.STADTGEMEINDE\Desktop\adwcleaner.exe
2013-09-29 05:42 - 2013-09-29 10:23 - 00000224 _____ C:\windows\setupact.log
2013-09-29 05:42 - 2013-09-29 10:18 - 00002502 _____ C:\windows\PFRO.log
2013-09-29 05:42 - 2013-09-29 05:42 - 00000000 _____ C:\windows\setuperr.log
2013-09-28 17:42 - 2013-09-28 17:42 - 00028367 ____C C:\Users\Huebner.STADTGEMEINDE\Desktop\ComboFix.txt
2013-09-28 17:34 - 2013-09-28 17:42 - 00000000 ___DC C:\Qoobox
2013-09-28 17:34 - 2013-09-28 17:40 - 00000000 ____D C:\windows\erdnt
2013-09-28 17:34 - 2011-06-26 08:45 - 00256000 _____ C:\windows\PEV.exe
2013-09-28 17:34 - 2010-11-07 19:20 - 00208896 _____ C:\windows\MBR.exe
2013-09-28 17:34 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2013-09-28 17:34 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2013-09-28 17:34 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2013-09-28 17:34 - 2000-08-31 02:00 - 00098816 _____ C:\windows\sed.exe
2013-09-28 17:34 - 2000-08-31 02:00 - 00080412 _____ C:\windows\grep.exe
2013-09-28 17:34 - 2000-08-31 02:00 - 00068096 _____ C:\windows\zip.exe
2013-09-28 17:22 - 2013-09-28 17:22 - 05129766 ____R (Swearware) C:\Users\Huebner.STADTGEMEINDE\Desktop\ComboFix.exe
2013-09-28 09:52 - 2013-09-28 09:52 - 00256512 _____ C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\guyGmVw9IE
2013-09-28 09:52 - 2013-09-28 09:52 - 00256512 _____ C:\ProgramData\Wo5fsnevCOe
2013-09-28 09:40 - 2013-09-28 09:40 - 00256512 _____ C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\imdiSsWI
2013-09-28 09:40 - 2013-09-28 09:40 - 00256512 _____ C:\ProgramData\rqp8Nof89Gn
2013-09-28 09:36 - 2013-09-28 09:37 - 00033749 _____ C:\Users\Huebner.STADTGEMEINDE\Desktop\Addition.txt
2013-09-28 09:34 - 2013-09-28 09:34 - 00256512 _____ C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\R85L2AwV
2013-09-28 09:34 - 2013-09-28 09:34 - 00256512 _____ C:\ProgramData\1IojVvnInx
2013-09-28 09:34 - 2013-09-28 09:34 - 00000000 ___DC C:\FRST
2013-09-27 11:40 - 2013-09-27 11:40 - 00256512 _____ C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\TzpWZpne
2013-09-27 11:40 - 2013-09-27 11:40 - 00256512 _____ C:\ProgramData\w1eiwzGD
2013-09-25 14:25 - 2011-07-22 13:16 - 00000044 _____ C:\windows\system32\opnetext.ver
2013-09-25 14:25 - 2011-04-22 09:56 - 00003838 _____ C:\windows\system32\opnedef.str
2013-09-25 14:25 - 2011-04-08 14:21 - 00120320 _____ (Oki Data Corporation) C:\windows\system32\opnetext.dll
2013-09-25 14:25 - 2007-02-05 00:15 - 00005832 _____ C:\windows\system32\license.txt
2013-09-25 14:25 - 2005-03-14 09:05 - 00010359 _____ C:\windows\SysWOW64\opnetext.hlp
2013-09-25 14:25 - 2005-03-14 09:05 - 00010359 _____ C:\windows\system32\OPNETEXT.HLP
2013-09-25 14:25 - 2005-03-09 14:11 - 00000141 _____ C:\windows\SysWOW64\opnetext.cnt
2013-09-25 14:25 - 2005-03-09 14:11 - 00000141 _____ C:\windows\system32\opnetext.cnt
2013-09-25 14:25 - 2002-06-27 00:00 - 00000000 _____ C:\windows\SysWOW64\opnetext.gid
2013-09-25 14:25 - 2002-06-27 00:00 - 00000000 _____ C:\windows\system32\OPNETEXT.GID
2013-09-24 11:31 - 2013-09-26 10:33 - 00000000 ____D C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\Nitro PDF
2013-09-24 11:17 - 2013-09-24 11:36 - 00000000 ____D C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\Nitro
2013-09-24 11:17 - 2013-09-24 11:17 - 00000000 ____D C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\FileOpen
2013-09-24 11:17 - 2013-09-24 11:17 - 00000000 ____D C:\ProgramData\FileOpen
2013-09-24 11:16 - 2013-09-24 11:16 - 00000000 ____D C:\ProgramData\Nitro
2013-09-24 11:16 - 2013-09-24 11:16 - 00000000 ____D C:\Program Files\Common Files\Nitro
2013-09-24 11:16 - 2013-09-24 11:16 - 00000000 ____D C:\Program Files (x86)\Nitro
2013-09-24 11:16 - 2013-06-17 22:00 - 00029704 _____ (Nitro PDF Software) C:\windows\system32\nitrolocalmon2.dll
2013-09-24 11:16 - 2013-06-17 22:00 - 00017928 _____ (Nitro PDF Software) C:\windows\system32\nitrolocalui2.dll
2013-09-24 11:14 - 2013-09-24 11:14 - 00000000 ____D C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\Downloaded Installations
2013-09-23 15:23 - 2013-09-23 15:23 - 00000087 _____ C:\windows\NetwkCfg.txt
2013-09-18 11:47 - 2013-09-18 11:47 - 00003118 _____ C:\windows\System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe
2013-09-18 11:47 - 2013-09-18 11:47 - 00003092 _____ C:\windows\System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe
2013-09-18 11:47 - 2013-09-18 11:47 - 00003090 _____ C:\windows\System32\Tasks\Microsoft_Hardware_Launch_itype_exe
2013-09-18 11:47 - 2013-09-18 11:47 - 00000000 ____H C:\windows\system32\Drivers\Msft_Kernel_point64_01011.Wdf
2013-09-18 11:47 - 2013-09-18 11:47 - 00000000 ____H C:\windows\system32\Drivers\Msft_Kernel_NuidFltr_01011.Wdf
2013-09-18 11:43 - 2013-09-18 11:43 - 00000000 ____H C:\windows\system32\Drivers\Msft_Kernel_dc3d_01011.Wdf
2013-09-16 07:56 - 2013-02-17 01:40 - 00028672 _____ (Microsoft Corporation) C:\windows\system32\IEUDINIT.EXE
2013-09-16 07:52 - 2013-09-16 07:52 - 19246592 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 15404544 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 14332928 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 13761024 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 03959296 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 02876928 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2013-09-16 07:52 - 2013-09-16 07:52 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2013-09-16 07:52 - 2013-09-16 07:52 - 02647040 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 02241024 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 02048000 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 01509376 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2013-09-16 07:52 - 2013-09-16 07:52 - 01441280 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2013-09-16 07:52 - 2013-09-16 07:52 - 01400416 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dat
2013-09-16 07:52 - 2013-09-16 07:52 - 01400416 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dat
2013-09-16 07:52 - 2013-09-16 07:52 - 01365504 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 01141248 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 01054720 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00905728 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00762368 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00719360 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00629248 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00599552 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00523264 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00452096 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00441856 _____ (Microsoft Corporation) C:\windows\system32\html.iec
2013-09-16 07:52 - 2013-09-16 07:52 - 00391168 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00361984 _____ (Microsoft Corporation) C:\windows\SysWOW64\html.iec
2013-09-16 07:52 - 2013-09-16 07:52 - 00357888 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00281600 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00270848 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00247296 _____ (Microsoft Corporation) C:\windows\system32\webcheck.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00242200 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00235008 _____ (Microsoft Corporation) C:\windows\system32\url.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00232960 _____ (Microsoft Corporation) C:\windows\SysWOW64\url.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00226816 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00226304 _____ (Microsoft Corporation) C:\windows\system32\elshyph.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00216064 _____ (Microsoft Corporation) C:\windows\system32\msls31.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00204800 _____ (Microsoft Corporation) C:\windows\SysWOW64\webcheck.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00197120 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00185344 _____ (Microsoft Corporation) C:\windows\SysWOW64\elshyph.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00173568 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00167424 _____ (Microsoft Corporation) C:\windows\system32\iexpress.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00163840 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00158720 _____ (Microsoft Corporation) C:\windows\SysWOW64\msls31.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00150528 _____ (Microsoft Corporation) C:\windows\SysWOW64\iexpress.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00149504 _____ (Microsoft Corporation) C:\windows\system32\occache.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00144896 _____ (Microsoft Corporation) C:\windows\system32\wextract.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00138752 _____ (Microsoft Corporation) C:\windows\SysWOW64\wextract.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00137216 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00136192 _____ (Microsoft Corporation) C:\windows\system32\iepeers.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00135680 _____ (Microsoft Corporation) C:\windows\system32\IEAdvpack.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00125440 _____ (Microsoft Corporation) C:\windows\SysWOW64\occache.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00117248 _____ (Microsoft Corporation) C:\windows\SysWOW64\iepeers.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00110592 _____ (Microsoft Corporation) C:\windows\SysWOW64\IEAdvpack.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00102912 _____ (Microsoft Corporation) C:\windows\system32\inseng.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00097280 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\SetIEInstalledDate.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00089600 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00082432 _____ (Microsoft Corporation) C:\windows\SysWOW64\inseng.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00081408 _____ (Microsoft Corporation) C:\windows\system32\icardie.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00079872 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00077312 _____ (Microsoft Corporation) C:\windows\system32\tdc.ocx
2013-09-16 07:52 - 2013-09-16 07:52 - 00073728 _____ (Microsoft Corporation) C:\windows\SysWOW64\SetIEInstalledDate.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00069120 _____ (Microsoft Corporation) C:\windows\SysWOW64\icardie.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00062976 _____ (Microsoft Corporation) C:\windows\system32\pngfilt.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\tdc.ocx
2013-09-16 07:52 - 2013-09-16 07:52 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00057344 _____ (Microsoft Corporation) C:\windows\SysWOW64\pngfilt.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00052224 _____ (Microsoft Corporation) C:\windows\system32\msfeedsbs.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00051200 _____ (Microsoft Corporation) C:\windows\system32\imgutil.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00048640 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmler.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\mshtmler.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00041984 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeedsbs.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00039424 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00038400 _____ (Microsoft Corporation) C:\windows\SysWOW64\imgutil.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00027648 _____ (Microsoft Corporation) C:\windows\system32\licmgr10.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00023040 _____ (Microsoft Corporation) C:\windows\SysWOW64\licmgr10.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00013824 _____ (Microsoft Corporation) C:\windows\system32\mshta.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00012800 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshta.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00012800 _____ (Microsoft Corporation) C:\windows\system32\msfeedssync.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00011776 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeedssync.exe
2013-09-11 15:51 - 2009-11-27 14:29 - 00013056 _____ C:\windows\SysWOW64\CNC1749D.TBL
2013-09-11 15:51 - 2009-11-27 14:29 - 00013056 _____ C:\windows\system32\CNC1749D.TBL
2013-09-11 13:58 - 2010-08-25 05:00 - 00361472 _____ (CANON INC.) C:\windows\system32\CNMLMAE.DLL
2013-09-10 13:32 - 2013-09-10 13:53 - 00000181 _____ C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\Opusbext.dat
2013-09-10 13:28 - 2011-07-04 19:42 - 00024064 _____ (Oki Data Corporation) C:\windows\system32\OPPFLM64.DLL

==================== One Month Modified Files and Folders =======

2013-09-29 10:42 - 2013-09-29 10:42 - 00001533 _____ C:\Users\Huebner.STADTGEMEINDE\Desktop\Niederschrift Gemeindewahlbehörde.pdf.lnk
2013-09-29 10:40 - 2013-09-29 10:38 - 01953880 _____ (Farbar) C:\Users\Huebner.STADTGEMEINDE\Desktop\FRST64.exe
2013-09-29 10:36 - 2013-09-29 10:36 - 00004306 _____ C:\Users\Huebner.STADTGEMEINDE\Desktop\JRT.txt
2013-09-29 10:34 - 2010-10-19 15:30 - 01101548 _____ C:\windows\WindowsUpdate.log
2013-09-29 10:31 - 2009-07-14 06:45 - 00022208 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-29 10:31 - 2009-07-14 06:45 - 00022208 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-29 10:30 - 2013-09-29 10:30 - 00000000 ____D C:\windows\ERUNT
2013-09-29 10:29 - 2013-09-29 10:29 - 01030305 _____ (Thisisu) C:\Users\Huebner.STADTGEMEINDE\Desktop\JRT.exe
2013-09-29 10:23 - 2013-09-29 05:42 - 00000224 _____ C:\windows\setupact.log
2013-09-29 10:23 - 2011-11-23 09:34 - 00065536 _____ C:\windows\system32\Ikeext.etl
2013-09-29 10:23 - 2011-04-06 15:08 - 00000152 _____ C:\windows\system32\config\netlogon.ftl
2013-09-29 10:23 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-09-29 10:22 - 2013-09-29 10:22 - 00003155 _____ C:\Users\Huebner.STADTGEMEINDE\Desktop\AdwCleaner[R1].txt
2013-09-29 10:22 - 2013-09-29 10:03 - 00000000 ___DC C:\AdwCleaner
2013-09-29 10:19 - 2009-07-14 05:20 - 00000000 ____D C:\windows\tracing
2013-09-29 10:18 - 2013-09-29 05:42 - 00002502 _____ C:\windows\PFRO.log
2013-09-29 10:10 - 2013-09-29 10:10 - 00001086 _____ C:\Users\Huebner.STADTGEMEINDE\Desktop\Nationalratswahl 2013.lnk
2013-09-29 10:07 - 2013-09-29 10:07 - 00001080 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-29 10:07 - 2013-09-29 10:07 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-29 10:07 - 2011-04-12 15:44 - 00000000 ____D C:\Users\Huebner.STADTGEMEINDE\Desktop\pastebin
2013-09-29 10:02 - 2013-09-29 10:02 - 01042066 _____ C:\Users\Huebner.STADTGEMEINDE\Desktop\adwcleaner.exe
2013-09-29 10:00 - 2009-07-14 05:20 - 00000000 ____D C:\windows\system32\NDF
2013-09-29 09:45 - 2012-03-30 07:50 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2013-09-29 05:42 - 2013-09-29 05:42 - 00000000 _____ C:\windows\setuperr.log
2013-09-28 20:14 - 2010-07-07 13:34 - 00000000 ____D C:\windows\Panther
2013-09-28 17:42 - 2013-09-28 17:42 - 00028367 ____C C:\Users\Huebner.STADTGEMEINDE\Desktop\ComboFix.txt
2013-09-28 17:42 - 2013-09-28 17:34 - 00000000 ___DC C:\Qoobox
2013-09-28 17:40 - 2013-09-28 17:34 - 00000000 ____D C:\windows\erdnt
2013-09-28 17:40 - 2009-07-14 04:34 - 00000215 ____C C:\windows\system.ini
2013-09-28 17:22 - 2013-09-28 17:22 - 05129766 ____R (Swearware) C:\Users\Huebner.STADTGEMEINDE\Desktop\ComboFix.exe
2013-09-28 10:06 - 2011-04-06 15:11 - 00000000 ____D C:\Users\Huebner.STADTGEMEINDE
2013-09-28 10:01 - 2011-04-06 15:25 - 00000000 ____D C:\Users\Administrator
2013-09-28 10:00 - 2009-07-14 20:18 - 00000000 ___RD C:\Users\Public\Recorded TV
2013-09-28 10:00 - 2009-07-14 05:20 - 00000000 ____D C:\windows\registration
2013-09-28 09:52 - 2013-09-28 09:52 - 00256512 _____ C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\guyGmVw9IE
2013-09-28 09:52 - 2013-09-28 09:52 - 00256512 _____ C:\ProgramData\Wo5fsnevCOe
2013-09-28 09:40 - 2013-09-28 09:40 - 00256512 _____ C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\imdiSsWI
2013-09-28 09:40 - 2013-09-28 09:40 - 00256512 _____ C:\ProgramData\rqp8Nof89Gn
2013-09-28 09:37 - 2013-09-28 09:36 - 00033749 _____ C:\Users\Huebner.STADTGEMEINDE\Desktop\Addition.txt
2013-09-28 09:34 - 2013-09-28 09:34 - 00256512 _____ C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\R85L2AwV
2013-09-28 09:34 - 2013-09-28 09:34 - 00256512 _____ C:\ProgramData\1IojVvnInx
2013-09-28 09:34 - 2013-09-28 09:34 - 00000000 ___DC C:\FRST
2013-09-27 11:40 - 2013-09-27 11:40 - 00256512 _____ C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\TzpWZpne
2013-09-27 11:40 - 2013-09-27 11:40 - 00256512 _____ C:\ProgramData\w1eiwzGD
2013-09-26 10:33 - 2013-09-24 11:31 - 00000000 ____D C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\Nitro PDF
2013-09-26 07:33 - 2011-04-08 09:38 - 00003958 _____ C:\windows\System32\Tasks\User_Feed_Synchronization-{2A3B3BEC-1FC4-4161-B63B-A0492BDDC68F}
2013-09-25 14:25 - 2010-07-07 04:08 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-09-25 14:23 - 2013-07-25 10:47 - 00000000 ____D C:\Program Files\Okidata
2013-09-24 13:13 - 2009-07-14 19:58 - 00705468 _____ C:\windows\system32\perfh007.dat
2013-09-24 13:13 - 2009-07-14 19:58 - 00151930 _____ C:\windows\system32\perfc007.dat
2013-09-24 13:13 - 2009-07-14 07:13 - 01635776 _____ C:\windows\system32\PerfStringBackup.INI
2013-09-24 11:36 - 2013-09-24 11:17 - 00000000 ____D C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\Nitro
2013-09-24 11:17 - 2013-09-24 11:17 - 00000000 ____D C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\FileOpen
2013-09-24 11:17 - 2013-09-24 11:17 - 00000000 ____D C:\ProgramData\FileOpen
2013-09-24 11:16 - 2013-09-24 11:16 - 00000000 ____D C:\ProgramData\Nitro
2013-09-24 11:16 - 2013-09-24 11:16 - 00000000 ____D C:\Program Files\Common Files\Nitro
2013-09-24 11:16 - 2013-09-24 11:16 - 00000000 ____D C:\Program Files (x86)\Nitro
2013-09-24 11:14 - 2013-09-24 11:14 - 00000000 ____D C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\Downloaded Installations
2013-09-23 15:23 - 2013-09-23 15:23 - 00000087 _____ C:\windows\NetwkCfg.txt
2013-09-20 11:56 - 2013-03-03 11:41 - 00000336 _____ C:\windows\BRCALIB.INI
2013-09-20 11:45 - 2012-03-30 07:50 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2013-09-20 11:45 - 2012-03-30 07:50 - 00003822 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2013-09-20 11:45 - 2011-05-18 07:51 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-19 07:33 - 2009-07-14 06:45 - 00499160 _____ C:\windows\system32\FNTCACHE.DAT
2013-09-18 11:47 - 2013-09-18 11:47 - 00003118 _____ C:\windows\System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe
2013-09-18 11:47 - 2013-09-18 11:47 - 00003092 _____ C:\windows\System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe
2013-09-18 11:47 - 2013-09-18 11:47 - 00003090 _____ C:\windows\System32\Tasks\Microsoft_Hardware_Launch_itype_exe
2013-09-18 11:47 - 2013-09-18 11:47 - 00000000 ____H C:\windows\system32\Drivers\Msft_Kernel_point64_01011.Wdf
2013-09-18 11:47 - 2013-09-18 11:47 - 00000000 ____H C:\windows\system32\Drivers\Msft_Kernel_NuidFltr_01011.Wdf
2013-09-18 11:43 - 2013-09-18 11:43 - 00000000 ____H C:\windows\system32\Drivers\Msft_Kernel_dc3d_01011.Wdf
2013-09-17 16:04 - 2013-07-25 10:53 - 00000000 ____D C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\Okidata
2013-09-17 15:42 - 2013-02-14 10:11 - 00000000 ____D C:\ProgramData\Okidata
2013-09-17 10:29 - 2009-07-14 05:20 - 00000000 ____D C:\windows\rescache
2013-09-17 08:02 - 2012-10-24 11:11 - 00000000 ____D C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\vlc
2013-09-17 07:16 - 2011-04-06 15:11 - 00001420 _____ C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-09-16 17:08 - 2009-07-14 05:20 - 00000000 ____D C:\windows\PolicyDefinitions
2013-09-16 07:52 - 2013-09-16 07:52 - 19246592 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 15404544 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 14332928 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 13761024 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 03959296 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 02876928 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2013-09-16 07:52 - 2013-09-16 07:52 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2013-09-16 07:52 - 2013-09-16 07:52 - 02647040 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 02241024 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 02048000 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 01509376 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2013-09-16 07:52 - 2013-09-16 07:52 - 01441280 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2013-09-16 07:52 - 2013-09-16 07:52 - 01400416 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dat
2013-09-16 07:52 - 2013-09-16 07:52 - 01400416 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dat
2013-09-16 07:52 - 2013-09-16 07:52 - 01365504 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 01141248 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 01054720 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00905728 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00762368 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00719360 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00629248 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00599552 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00523264 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00452096 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00441856 _____ (Microsoft Corporation) C:\windows\system32\html.iec
2013-09-16 07:52 - 2013-09-16 07:52 - 00391168 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00361984 _____ (Microsoft Corporation) C:\windows\SysWOW64\html.iec
2013-09-16 07:52 - 2013-09-16 07:52 - 00357888 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00281600 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00270848 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00247296 _____ (Microsoft Corporation) C:\windows\system32\webcheck.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00242200 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00235008 _____ (Microsoft Corporation) C:\windows\system32\url.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00232960 _____ (Microsoft Corporation) C:\windows\SysWOW64\url.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00226816 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00226304 _____ (Microsoft Corporation) C:\windows\system32\elshyph.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00216064 _____ (Microsoft Corporation) C:\windows\system32\msls31.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00204800 _____ (Microsoft Corporation) C:\windows\SysWOW64\webcheck.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00197120 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00185344 _____ (Microsoft Corporation) C:\windows\SysWOW64\elshyph.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00173568 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00167424 _____ (Microsoft Corporation) C:\windows\system32\iexpress.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00163840 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00158720 _____ (Microsoft Corporation) C:\windows\SysWOW64\msls31.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00150528 _____ (Microsoft Corporation) C:\windows\SysWOW64\iexpress.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00149504 _____ (Microsoft Corporation) C:\windows\system32\occache.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00144896 _____ (Microsoft Corporation) C:\windows\system32\wextract.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00138752 _____ (Microsoft Corporation) C:\windows\SysWOW64\wextract.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00137216 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00136192 _____ (Microsoft Corporation) C:\windows\system32\iepeers.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00135680 _____ (Microsoft Corporation) C:\windows\system32\IEAdvpack.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00125440 _____ (Microsoft Corporation) C:\windows\SysWOW64\occache.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00117248 _____ (Microsoft Corporation) C:\windows\SysWOW64\iepeers.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00110592 _____ (Microsoft Corporation) C:\windows\SysWOW64\IEAdvpack.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00102912 _____ (Microsoft Corporation) C:\windows\system32\inseng.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00097280 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\SetIEInstalledDate.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00089600 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00082432 _____ (Microsoft Corporation) C:\windows\SysWOW64\inseng.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00081408 _____ (Microsoft Corporation) C:\windows\system32\icardie.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00079872 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00077312 _____ (Microsoft Corporation) C:\windows\system32\tdc.ocx
2013-09-16 07:52 - 2013-09-16 07:52 - 00073728 _____ (Microsoft Corporation) C:\windows\SysWOW64\SetIEInstalledDate.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00069120 _____ (Microsoft Corporation) C:\windows\SysWOW64\icardie.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00062976 _____ (Microsoft Corporation) C:\windows\system32\pngfilt.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\tdc.ocx
2013-09-16 07:52 - 2013-09-16 07:52 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00057344 _____ (Microsoft Corporation) C:\windows\SysWOW64\pngfilt.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00052224 _____ (Microsoft Corporation) C:\windows\system32\msfeedsbs.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00051200 _____ (Microsoft Corporation) C:\windows\system32\imgutil.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00048640 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmler.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\mshtmler.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00041984 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeedsbs.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00039424 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00038400 _____ (Microsoft Corporation) C:\windows\SysWOW64\imgutil.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00027648 _____ (Microsoft Corporation) C:\windows\system32\licmgr10.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00023040 _____ (Microsoft Corporation) C:\windows\SysWOW64\licmgr10.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00013824 _____ (Microsoft Corporation) C:\windows\system32\mshta.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00012800 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshta.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00012800 _____ (Microsoft Corporation) C:\windows\system32\msfeedssync.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00011776 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeedssync.exe
2013-09-16 07:42 - 2013-04-15 11:24 - 00000000 ____D C:\ProgramData\DivX
2013-09-16 07:41 - 2013-04-15 11:25 - 00000000 ____D C:\Program Files (x86)\DivX
2013-09-12 14:09 - 2011-04-12 16:52 - 00000952 ___SH C:\ProgramData\KGyGaAvL.sys
2013-09-12 14:09 - 2011-04-12 11:09 - 00000000 ____D C:\Users\Huebner.STADTGEMEINDE\Documents\My PSP Files
2013-09-11 14:03 - 2013-02-21 16:57 - 00000000 ____D C:\ProgramData\CanonIJPLM
2013-09-10 14:54 - 2013-04-15 11:41 - 00000000 ____D C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\DivX
2013-09-10 13:53 - 2013-09-10 13:32 - 00000181 _____ C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\Opusbext.dat
2013-09-10 13:29 - 2009-07-14 05:20 - 00000000 ____D C:\windows\Web

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-23 10:58

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

Ich wünsche dir einen schönen Sonntag! :-)

schrauber · 29.09.2013, 18:01

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

Ohtarwen · 30.09.2013, 14:11

Das ESET-Ding läuft ewig lang und produziert nur so ein kurzes Log?

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=300cdda3f2e7934db5dcdf3d639a57b1
# engine=15299
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-09-29 05:38:07
# local_time=2013-09-29 07:38:07 (+0100, Mitteleuropäische Sommerzeit)
# country="Austria"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776574 100 94 7021898 132106137 0 0
# scanned=29401
# found=0
# cleaned=0
# scan_time=402
ESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
Can not open internetCan not open internetESETSmartInstaller@High as downloader log:
Can not open internet# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=300cdda3f2e7934db5dcdf3d639a57b1
# engine=15302
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-09-30 08:10:39
# local_time=2013-09-30 10:10:39 (+0100, Mitteleuropäische Sommerzeit)
# country="Austria"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776574 100 94 7074250 132158489 0 0
# scanned=218452
# found=0
# cleaned=0
# scan_time=6265

SecurityCheck checkup.txt

Code:

ATTFilter

 Results of screen317's Security Check version 0.99.73  
 Windows 7 Service Pack 1 x64 (UAC is enabled)  
 Internet Explorer 10  
``````````````Antivirus/Firewall Check:`````````````` 
Microsoft Security Essentials   
  (On Access scanning disabled!) 
 Error obtaining update status for antivirus!  
`````````Anti-malware/Other Utilities Check:````````` 
 Malwarebytes Anti-Malware Version 1.75.0.1300  
 Java(TM) 6 Update 39  
 Java 7 Update 40  
 Java version out of Date! 
 Adobe Flash Player 11.8.800.168  
 Adobe Reader XI  
 Mozilla Firefox (23.0.1) 
````````Process Check: objlist.exe by Laurent````````  
 Microsoft Security Essentials MSMpEng.exe 
 Microsoft Security Essentials msseces.exe 
 Malwarebytes' Anti-Malware mbamscheduler.exe   
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````

Und ein knackfrisches FRST log

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-09-2013 02
Ran by Huebner (administrator) on ZA-HUEBNER on 30-09-2013 15:03:18
Running from C:\Users\Huebner.STADTGEMEINDE\Desktop\Trojanerjagd
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(BUFFALO INC.) C:\Program Files (x86)\BUFFALO\NASNAVI\nassvc.exe
(Nitro PDF Software) C:\Program Files\Common Files\Nitro\Pro\8.0\NitroPDFDriverService8x64.exe
(Nalpeiron Ltd.) C:\windows\SysWOW64\NLSSRV32.EXE
(Oki Data Corporation) C:\Program Files\Okidata\Common\Extend3\portmgrsrv.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(TOSHIBA Corporation) C:\windows\system32\ThpSrv.exe
(TOSHIBA Corporation) C:\windows\system32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TecoService.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Vodafone) C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\Power Saver\TPwrMain.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\SmoothView\SmoothView.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\FlashCards\TCrdMain.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\TECO\Teco.exe
(TOSHIBA Corporation) C:\Windows\System32\ThpSrv.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\ReelTime\TosReelTimeMonitor.exe
(Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe
(Microsoft Corporation) C:\Program Files\Zune\ZuneLauncher.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Intel Corporation) C:\windows\system32\igfxsrvc.exe
() C:\Program Files (x86)\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe
(Vodafone) C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe
(Intel Corporation) C:\windows\system32\igfxext.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Microsoft Corporation) C:\windows\splwow64.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [HotKeysCmds] - C:\windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [TPwrMain] - C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [505696 2009-11-05] (TOSHIBA Corporation)
HKLM\...\Run: [HSON] - C:\Program Files\TOSHIBA\TBS\HSON.exe [52600 2009-03-09] (TOSHIBA Corporation)
HKLM\...\Run: [SmoothView] - C:\Program Files\Toshiba\SmoothView\SmoothView.exe [570680 2009-08-13] (TOSHIBA Corporation)
HKLM\...\Run: [00TCrdMain] - C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [913720 2010-03-25] (TOSHIBA Corporation)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8305664 2009-10-30] (Realtek Semiconductor)
HKLM\...\Run: [Teco] - C:\Program Files\TOSHIBA\TECO\Teco.exe [1483776 2010-02-25] (TOSHIBA Corporation)
HKLM\...\Run: [TosSENotify] - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [709976 2009-11-05] (TOSHIBA Corporation)
HKLM\...\Run: [ThpSrv] - C:\windows\system32\thpsrv /logon
HKLM\...\Run: [TosWaitSrv] - C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [705368 2010-02-05] (TOSHIBA Corporation)
HKLM\...\Run: [TosReelTimeMonitor] - C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe [35672 2010-03-03] (TOSHIBA Corporation)
HKLM\...\Run: [TosVolRegulator] - C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation)
HKLM\...\Run: [Toshiba TEMPRO] - C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe [1050072 2010-05-11] (Toshiba Europe GmbH)
HKLM\...\Run: [Zune Launcher] - C:\Program Files\Zune\ZuneLauncher.exe [163552 2011-08-05] (Microsoft Corporation)
HKLM\...\Run: [MSC] - c:\Program Files\Microsoft Security Client\msseces.exe [1356240 2013-06-20] (Microsoft Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM-x32\...\Run: [TWebCamera] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe [2454840 2009-12-09] (TOSHIBA CORPORATION.)
HKLM-x32\...\Run: [Corel Photo Downloader] - C:\Program Files (x86)\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe [532808 2008-08-08] (Corel, Inc.)
HKLM-x32\...\Run: [Corel File Shell Monitor] - C:\Program Files (x86)\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe [16712 2008-08-08] ()
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [HPUsageTracking] - "C:\Program Files (x86)\HP\HP UT\bin\hppusg.exe" "C:\Program Files (x86)\HP\HP UT\"
HKLM-x32\...\Run: [MobileBroadband] - C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe [408576 2011-04-19] (Vodafone)
HKLM-x32\...\Run: [BCSSync] - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [DivXMediaServer] - C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2013-08-21] (DivX, LLC)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [ControlCenter4] - C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [143360 2012-09-06] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsMon00] - C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [3076096 2012-06-06] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [DivXUpdate] - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1861968 2013-08-29] ()
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKU\Administrator\...\Run: [TOSHIBA Online Product Information] - C:\Program Files (x86)\TOSHIBA\Toshiba Online Product Information\topi.exe [6203296 2009-08-12] (TOSHIBA)
HKU\Default\...\Run: [TOSHIBA Online Product Information] - C:\Program Files (x86)\TOSHIBA\Toshiba Online Product Information\topi.exe [6203296 2009-08-12] (TOSHIBA)
HKU\Default User\...\Run: [TOSHIBA Online Product Information] - C:\Program Files (x86)\TOSHIBA\Toshiba Online Product Information\topi.exe [6203296 2009-08-12] (TOSHIBA)
Startup: C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)

==================== Internet (Whitelisted) ====================

ProxyServer: 20.20.20.9:8080
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - DefaultScope {20640D01-6C2B-4098-AAC8-BB36A96B844D} URL = https://duckduckgo.com/?q={searchTerms}
SearchScopes: HKCU - {1D514625-819F-4B2B-A8F2-95279A4E2990} URL = 
SearchScopes: HKCU - {20640D01-6C2B-4098-AAC8-BB36A96B844D} URL = https://duckduckgo.com/?q={searchTerms}
SearchScopes: HKCU - {6A0FBD7D-314D-4BB4-96EF-300AD3359631} URL = hxxp://www.benefind.de/web.php?q={searchTerms}
SearchScopes: HKCU - {86613AFE-F9AE-4A42-93E7-34954A120C99} URL = https://startpage.com/do/search?query={searchTerms}&cat=web&pl=ie&language=deutsch
SearchScopes: HKCU - {9FEDAB7D-F6B4-4B91-8AC9-ED60CC96AC0D} URL = 
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - SimilarWeb - {74198672-5F7D-4FE9-A611-4AC1D5A66A15} - C:\Program Files (x86)\SimilarWeb\SimilarWeb.dll (SimilarGroup)
DPF: HKLM {02BCC737-B171-4746-94C9-0D8A0B2C0089} hxxp://office.microsoft.com/_layouts/ClientBin/ieawsdc64.cab
DPF: HKLM {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab
DPF: HKLM-x32 {02BCC737-B171-4746-94C9-0D8A0B2C0089} hxxp://office.microsoft.com/sites/production/ieawsdc32.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} -  No File
Tcpip\Parameters: [DhcpNameServer] 20.20.20.2

FireFox:
========
FF ProfilePath: C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\Mozilla\Firefox\Profiles\pilvdcyr.default
FF NewTab: about:blank
FF Homepage: about:home
FF NetworkProxy: "ftp", "20.20.20.9"
FF NetworkProxy: "ftp_port", 8080
FF NetworkProxy: "http", "20.20.20.9"
FF NetworkProxy: "http_port", 8080
FF NetworkProxy: "no_proxies_on", "hollabrunn.noe.gv.at,hollabrunn.gv.at,localhost,127.0.0.1"
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "socks", "20.20.20.9"
FF NetworkProxy: "socks_port", 8080
FF NetworkProxy: "ssl", "20.20.20.9"
FF NetworkProxy: "ssl_port", 8080
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @java.com/DTPlugin,version=10.11.2 - C:\windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.11.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.2 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.0.6 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf - C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll No File
FF Plugin-x32: @java.com/DTPlugin,version=10.40.2 - C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.40.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nitropdf.com/NitroPDF - C:\Program Files (x86)\Nitro\Pro 8\npnitromozilla.dll (Nitro PDF)
FF Plugin-x32: @videolan.org/vlc,version=2.0.7 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: iMacros for Firefox - C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\Mozilla\Firefox\Profiles\pilvdcyr.default\Extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}
FF Extension: No Name - C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\Mozilla\Firefox\Profiles\pilvdcyr.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
FF Extension: No Name - C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\Mozilla\Firefox\Profiles\pilvdcyr.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0039-ABCDEFFEDCBA}
FF HKLM\...\Firefox\Extensions: [{C1CA7765-44E4-452e-9D00-A04F3D434281}] - 
FF HKLM-x32\...\Firefox\Extensions: [{C1CA7765-44E4-452e-9D00-A04F3D434281}] - C:\Program Files\TOSHIBA\TFPU\FirefoxAddin

==================== Services (Whitelisted) =================

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2013-06-20] (Microsoft Corporation)
R2 NasPmService; C:\Program Files (x86)\BUFFALO\NASNAVI\nassvc.exe [251256 2010-10-28] (BUFFALO INC.)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366600 2013-06-20] (Microsoft Corporation)
R2 NitroDriverReadSpool8; C:\Program Files\Common Files\Nitro\Pro\8.0\NitroPDFDriverService8x64.exe [230408 2013-06-17] (Nitro PDF Software)
R2 OpLclSrv; C:\Program Files\Okidata\Common\Extend3\portmgrsrv.exe [169984 2010-08-10] (Oki Data Corporation)
S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [118520 2013-03-01] (Riverbed Technology, Inc.)
S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [124368 2010-05-11] (Toshiba Europe GmbH)

==================== Drivers (Whitelisted) ====================

R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [247216 2013-06-18] (Microsoft Corporation)
S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [139616 2013-06-18] (Microsoft Corporation)
R2 NPF; C:\Windows\System32\drivers\npf.sys [36600 2013-03-01] (Riverbed Technology, Inc.)
S3 ApfiltrService; system32\DRIVERS\Apfiltr.sys [x]
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
U5 ewusbnet; C:\Windows\System32\Drivers\ewusbnet.sys [243200 2009-10-21] (Huawei Technologies Co., Ltd.)
S3 massfilter; system32\drivers\massfilter.sys [x]
S3 SANDRA; \??\C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2013.SP1\WNt500x64\Sandra.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-30 15:02 - 2013-09-30 15:02 - 00001038 _____ C:\Users\Huebner.STADTGEMEINDE\Desktop\checkup.txt
2013-09-30 08:23 - 2013-09-30 08:23 - 02347384 _____ (ESET) C:\Users\Huebner.STADTGEMEINDE\Desktop\esetsmartinstaller_enu.exe
2013-09-29 19:33 - 2013-09-29 19:33 - 00891144 _____ C:\Users\Huebner.STADTGEMEINDE\Desktop\SecurityCheck.exe
2013-09-29 11:19 - 2013-09-29 11:18 - 00264616 _____ (Oracle Corporation) C:\windows\SysWOW64\javaws.exe
2013-09-29 11:18 - 2013-09-29 11:18 - 00175016 _____ (Oracle Corporation) C:\windows\SysWOW64\javaw.exe
2013-09-29 11:18 - 2013-09-29 11:18 - 00175016 _____ (Oracle Corporation) C:\windows\SysWOW64\java.exe
2013-09-29 11:18 - 2013-09-29 11:18 - 00096168 _____ (Oracle Corporation) C:\windows\SysWOW64\WindowsAccessBridge-32.dll
2013-09-29 11:17 - 2013-09-29 11:17 - 00000000 ____D C:\windows\Sun
2013-09-29 10:50 - 2013-09-30 15:03 - 00000000 ____D C:\Users\Huebner.STADTGEMEINDE\Desktop\Trojanerjagd
2013-09-29 10:30 - 2013-09-29 10:30 - 00000000 ____D C:\windows\ERUNT
2013-09-29 10:07 - 2013-09-29 10:07 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-29 10:07 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2013-09-29 10:03 - 2013-09-29 10:22 - 00000000 ___DC C:\AdwCleaner
2013-09-29 05:42 - 2013-09-30 14:37 - 00002224 _____ C:\windows\setupact.log
2013-09-29 05:42 - 2013-09-30 11:07 - 00003542 _____ C:\windows\PFRO.log
2013-09-29 05:42 - 2013-09-29 05:42 - 00000000 _____ C:\windows\setuperr.log
2013-09-28 17:34 - 2013-09-28 17:42 - 00000000 ___DC C:\Qoobox
2013-09-28 17:34 - 2013-09-28 17:40 - 00000000 ____D C:\windows\erdnt
2013-09-28 17:34 - 2011-06-26 08:45 - 00256000 _____ C:\windows\PEV.exe
2013-09-28 17:34 - 2010-11-07 19:20 - 00208896 _____ C:\windows\MBR.exe
2013-09-28 17:34 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2013-09-28 17:34 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2013-09-28 17:34 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2013-09-28 17:34 - 2000-08-31 02:00 - 00098816 _____ C:\windows\sed.exe
2013-09-28 17:34 - 2000-08-31 02:00 - 00080412 _____ C:\windows\grep.exe
2013-09-28 17:34 - 2000-08-31 02:00 - 00068096 _____ C:\windows\zip.exe
2013-09-28 09:52 - 2013-09-28 09:52 - 00256512 _____ C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\guyGmVw9IE
2013-09-28 09:52 - 2013-09-28 09:52 - 00256512 _____ C:\ProgramData\Wo5fsnevCOe
2013-09-28 09:40 - 2013-09-28 09:40 - 00256512 _____ C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\imdiSsWI
2013-09-28 09:40 - 2013-09-28 09:40 - 00256512 _____ C:\ProgramData\rqp8Nof89Gn
2013-09-28 09:34 - 2013-09-28 09:34 - 00256512 _____ C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\R85L2AwV
2013-09-28 09:34 - 2013-09-28 09:34 - 00256512 _____ C:\ProgramData\1IojVvnInx
2013-09-28 09:34 - 2013-09-28 09:34 - 00000000 ___DC C:\FRST
2013-09-27 11:40 - 2013-09-27 11:40 - 00256512 _____ C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\TzpWZpne
2013-09-27 11:40 - 2013-09-27 11:40 - 00256512 _____ C:\ProgramData\w1eiwzGD
2013-09-25 14:25 - 2011-07-22 13:16 - 00000044 _____ C:\windows\system32\opnetext.ver
2013-09-25 14:25 - 2011-04-22 09:56 - 00003838 _____ C:\windows\system32\opnedef.str
2013-09-25 14:25 - 2011-04-08 14:21 - 00120320 _____ (Oki Data Corporation) C:\windows\system32\opnetext.dll
2013-09-25 14:25 - 2007-02-05 00:15 - 00005832 _____ C:\windows\system32\license.txt
2013-09-25 14:25 - 2005-03-14 09:05 - 00010359 _____ C:\windows\SysWOW64\opnetext.hlp
2013-09-25 14:25 - 2005-03-14 09:05 - 00010359 _____ C:\windows\system32\OPNETEXT.HLP
2013-09-25 14:25 - 2005-03-09 14:11 - 00000141 _____ C:\windows\SysWOW64\opnetext.cnt
2013-09-25 14:25 - 2005-03-09 14:11 - 00000141 _____ C:\windows\system32\opnetext.cnt
2013-09-25 14:25 - 2002-06-27 00:00 - 00000000 _____ C:\windows\SysWOW64\opnetext.gid
2013-09-25 14:25 - 2002-06-27 00:00 - 00000000 _____ C:\windows\system32\OPNETEXT.GID
2013-09-24 11:31 - 2013-09-30 07:45 - 00000000 ____D C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\Nitro PDF
2013-09-24 11:17 - 2013-09-24 11:36 - 00000000 ____D C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\Nitro
2013-09-24 11:17 - 2013-09-24 11:17 - 00000000 ____D C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\FileOpen
2013-09-24 11:17 - 2013-09-24 11:17 - 00000000 ____D C:\ProgramData\FileOpen
2013-09-24 11:16 - 2013-09-24 11:16 - 00000000 ____D C:\ProgramData\Nitro
2013-09-24 11:16 - 2013-09-24 11:16 - 00000000 ____D C:\Program Files\Common Files\Nitro
2013-09-24 11:16 - 2013-09-24 11:16 - 00000000 ____D C:\Program Files (x86)\Nitro
2013-09-24 11:16 - 2013-06-17 22:00 - 00029704 _____ (Nitro PDF Software) C:\windows\system32\nitrolocalmon2.dll
2013-09-24 11:16 - 2013-06-17 22:00 - 00017928 _____ (Nitro PDF Software) C:\windows\system32\nitrolocalui2.dll
2013-09-24 11:14 - 2013-09-24 11:14 - 00000000 ____D C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\Downloaded Installations
2013-09-23 15:23 - 2013-09-23 15:23 - 00000087 _____ C:\windows\NetwkCfg.txt
2013-09-18 11:47 - 2013-09-18 11:47 - 00003118 _____ C:\windows\System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe
2013-09-18 11:47 - 2013-09-18 11:47 - 00003092 _____ C:\windows\System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe
2013-09-18 11:47 - 2013-09-18 11:47 - 00003090 _____ C:\windows\System32\Tasks\Microsoft_Hardware_Launch_itype_exe
2013-09-18 11:47 - 2013-09-18 11:47 - 00000000 ____H C:\windows\system32\Drivers\Msft_Kernel_point64_01011.Wdf
2013-09-18 11:47 - 2013-09-18 11:47 - 00000000 ____H C:\windows\system32\Drivers\Msft_Kernel_NuidFltr_01011.Wdf
2013-09-18 11:43 - 2013-09-18 11:43 - 00000000 ____H C:\windows\system32\Drivers\Msft_Kernel_dc3d_01011.Wdf
2013-09-16 07:56 - 2013-02-17 01:40 - 00028672 _____ (Microsoft Corporation) C:\windows\system32\IEUDINIT.EXE
2013-09-16 07:52 - 2013-09-16 07:52 - 19246592 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 15404544 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 14332928 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 13761024 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 03959296 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 02876928 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2013-09-16 07:52 - 2013-09-16 07:52 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2013-09-16 07:52 - 2013-09-16 07:52 - 02647040 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 02241024 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 02048000 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 01509376 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2013-09-16 07:52 - 2013-09-16 07:52 - 01441280 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2013-09-16 07:52 - 2013-09-16 07:52 - 01400416 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dat
2013-09-16 07:52 - 2013-09-16 07:52 - 01400416 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dat
2013-09-16 07:52 - 2013-09-16 07:52 - 01365504 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 01141248 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 01054720 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00905728 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00762368 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00719360 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00629248 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00599552 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00523264 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00452096 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00441856 _____ (Microsoft Corporation) C:\windows\system32\html.iec
2013-09-16 07:52 - 2013-09-16 07:52 - 00391168 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00361984 _____ (Microsoft Corporation) C:\windows\SysWOW64\html.iec
2013-09-16 07:52 - 2013-09-16 07:52 - 00357888 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00281600 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00270848 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00247296 _____ (Microsoft Corporation) C:\windows\system32\webcheck.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00242200 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00235008 _____ (Microsoft Corporation) C:\windows\system32\url.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00232960 _____ (Microsoft Corporation) C:\windows\SysWOW64\url.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00226816 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00226304 _____ (Microsoft Corporation) C:\windows\system32\elshyph.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00216064 _____ (Microsoft Corporation) C:\windows\system32\msls31.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00204800 _____ (Microsoft Corporation) C:\windows\SysWOW64\webcheck.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00197120 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00185344 _____ (Microsoft Corporation) C:\windows\SysWOW64\elshyph.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00173568 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00167424 _____ (Microsoft Corporation) C:\windows\system32\iexpress.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00163840 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00158720 _____ (Microsoft Corporation) C:\windows\SysWOW64\msls31.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00150528 _____ (Microsoft Corporation) C:\windows\SysWOW64\iexpress.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00149504 _____ (Microsoft Corporation) C:\windows\system32\occache.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00144896 _____ (Microsoft Corporation) C:\windows\system32\wextract.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00138752 _____ (Microsoft Corporation) C:\windows\SysWOW64\wextract.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00137216 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00136192 _____ (Microsoft Corporation) C:\windows\system32\iepeers.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00135680 _____ (Microsoft Corporation) C:\windows\system32\IEAdvpack.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00125440 _____ (Microsoft Corporation) C:\windows\SysWOW64\occache.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00117248 _____ (Microsoft Corporation) C:\windows\SysWOW64\iepeers.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00110592 _____ (Microsoft Corporation) C:\windows\SysWOW64\IEAdvpack.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00102912 _____ (Microsoft Corporation) C:\windows\system32\inseng.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00097280 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\SetIEInstalledDate.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00089600 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00082432 _____ (Microsoft Corporation) C:\windows\SysWOW64\inseng.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00081408 _____ (Microsoft Corporation) C:\windows\system32\icardie.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00079872 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00077312 _____ (Microsoft Corporation) C:\windows\system32\tdc.ocx
2013-09-16 07:52 - 2013-09-16 07:52 - 00073728 _____ (Microsoft Corporation) C:\windows\SysWOW64\SetIEInstalledDate.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00069120 _____ (Microsoft Corporation) C:\windows\SysWOW64\icardie.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00062976 _____ (Microsoft Corporation) C:\windows\system32\pngfilt.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\tdc.ocx
2013-09-16 07:52 - 2013-09-16 07:52 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00057344 _____ (Microsoft Corporation) C:\windows\SysWOW64\pngfilt.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00052224 _____ (Microsoft Corporation) C:\windows\system32\msfeedsbs.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00051200 _____ (Microsoft Corporation) C:\windows\system32\imgutil.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00048640 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmler.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\mshtmler.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00041984 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeedsbs.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00039424 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00038400 _____ (Microsoft Corporation) C:\windows\SysWOW64\imgutil.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00027648 _____ (Microsoft Corporation) C:\windows\system32\licmgr10.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00023040 _____ (Microsoft Corporation) C:\windows\SysWOW64\licmgr10.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00013824 _____ (Microsoft Corporation) C:\windows\system32\mshta.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00012800 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshta.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00012800 _____ (Microsoft Corporation) C:\windows\system32\msfeedssync.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00011776 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeedssync.exe
2013-09-11 15:51 - 2009-11-27 14:29 - 00013056 _____ C:\windows\SysWOW64\CNC1749D.TBL
2013-09-11 15:51 - 2009-11-27 14:29 - 00013056 _____ C:\windows\system32\CNC1749D.TBL
2013-09-11 13:58 - 2010-08-25 05:00 - 00361472 _____ (CANON INC.) C:\windows\system32\CNMLMAE.DLL
2013-09-10 13:32 - 2013-09-10 13:53 - 00000181 _____ C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\Opusbext.dat
2013-09-10 13:28 - 2011-07-04 19:42 - 00024064 _____ (Oki Data Corporation) C:\windows\system32\OPPFLM64.DLL

==================== One Month Modified Files and Folders =======

2013-09-30 15:03 - 2013-09-29 10:50 - 00000000 ____D C:\Users\Huebner.STADTGEMEINDE\Desktop\Trojanerjagd
2013-09-30 15:02 - 2013-09-30 15:02 - 00001038 _____ C:\Users\Huebner.STADTGEMEINDE\Desktop\checkup.txt
2013-09-30 14:59 - 2011-04-06 15:08 - 00000152 _____ C:\windows\system32\config\netlogon.ftl
2013-09-30 14:58 - 2010-10-19 15:30 - 01220690 _____ C:\windows\WindowsUpdate.log
2013-09-30 14:45 - 2012-03-30 07:50 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2013-09-30 14:45 - 2009-07-14 06:45 - 00022208 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-30 14:45 - 2009-07-14 06:45 - 00022208 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-30 14:37 - 2013-09-29 05:42 - 00002224 _____ C:\windows\setupact.log
2013-09-30 14:37 - 2011-11-23 09:34 - 00065536 _____ C:\windows\system32\Ikeext.etl
2013-09-30 14:37 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-09-30 14:37 - 2009-07-14 05:20 - 00000000 ____D C:\windows\tracing
2013-09-30 12:01 - 2009-07-14 19:58 - 00705468 _____ C:\windows\system32\perfh007.dat
2013-09-30 12:01 - 2009-07-14 19:58 - 00151930 _____ C:\windows\system32\perfc007.dat
2013-09-30 12:01 - 2009-07-14 07:13 - 01635776 _____ C:\windows\system32\PerfStringBackup.INI
2013-09-30 11:07 - 2013-09-29 05:42 - 00003542 _____ C:\windows\PFRO.log
2013-09-30 09:46 - 2011-04-12 10:31 - 00000000 ____D C:\Treiber
2013-09-30 09:43 - 2012-01-12 09:43 - 00000000 ____D C:\ProgramData\EPSON
2013-09-30 09:09 - 2013-07-10 13:58 - 00000000 ___DC C:\Spiele_Mutti
2013-09-30 08:23 - 2013-09-30 08:23 - 02347384 _____ (ESET) C:\Users\Huebner.STADTGEMEINDE\Desktop\esetsmartinstaller_enu.exe
2013-09-30 08:08 - 2011-04-08 09:38 - 00003958 _____ C:\windows\System32\Tasks\User_Feed_Synchronization-{2A3B3BEC-1FC4-4161-B63B-A0492BDDC68F}
2013-09-30 07:45 - 2013-09-24 11:31 - 00000000 ____D C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\Nitro PDF
2013-09-29 19:33 - 2013-09-29 19:33 - 00891144 _____ C:\Users\Huebner.STADTGEMEINDE\Desktop\SecurityCheck.exe
2013-09-29 12:34 - 2009-07-14 05:20 - 00000000 ____D C:\windows\system32\NDF
2013-09-29 11:18 - 2013-09-29 11:19 - 00264616 _____ (Oracle Corporation) C:\windows\SysWOW64\javaws.exe
2013-09-29 11:18 - 2013-09-29 11:18 - 00175016 _____ (Oracle Corporation) C:\windows\SysWOW64\javaw.exe
2013-09-29 11:18 - 2013-09-29 11:18 - 00175016 _____ (Oracle Corporation) C:\windows\SysWOW64\java.exe
2013-09-29 11:18 - 2013-09-29 11:18 - 00096168 _____ (Oracle Corporation) C:\windows\SysWOW64\WindowsAccessBridge-32.dll
2013-09-29 11:18 - 2012-07-03 18:04 - 00868264 _____ (Oracle Corporation) C:\windows\SysWOW64\npdeployJava1.dll
2013-09-29 11:18 - 2012-07-03 18:04 - 00000000 ____D C:\Program Files (x86)\Java
2013-09-29 11:18 - 2012-03-09 12:26 - 00790440 _____ (Oracle Corporation) C:\windows\SysWOW64\deployJava1.dll
2013-09-29 11:17 - 2013-09-29 11:17 - 00000000 ____D C:\windows\Sun
2013-09-29 10:30 - 2013-09-29 10:30 - 00000000 ____D C:\windows\ERUNT
2013-09-29 10:22 - 2013-09-29 10:03 - 00000000 ___DC C:\AdwCleaner
2013-09-29 10:07 - 2013-09-29 10:07 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-29 10:07 - 2011-04-12 15:44 - 00000000 ____D C:\Users\Huebner.STADTGEMEINDE\Desktop\pastebin
2013-09-29 05:42 - 2013-09-29 05:42 - 00000000 _____ C:\windows\setuperr.log
2013-09-28 20:14 - 2010-07-07 13:34 - 00000000 ____D C:\windows\Panther
2013-09-28 17:42 - 2013-09-28 17:34 - 00000000 ___DC C:\Qoobox
2013-09-28 17:40 - 2013-09-28 17:34 - 00000000 ____D C:\windows\erdnt
2013-09-28 17:40 - 2009-07-14 04:34 - 00000215 ____C C:\windows\system.ini
2013-09-28 10:06 - 2011-04-06 15:11 - 00000000 ____D C:\Users\Huebner.STADTGEMEINDE
2013-09-28 10:01 - 2011-04-06 15:25 - 00000000 ____D C:\Users\Administrator
2013-09-28 10:00 - 2009-07-14 20:18 - 00000000 ___RD C:\Users\Public\Recorded TV
2013-09-28 10:00 - 2009-07-14 05:20 - 00000000 ____D C:\windows\registration
2013-09-28 09:52 - 2013-09-28 09:52 - 00256512 _____ C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\guyGmVw9IE
2013-09-28 09:52 - 2013-09-28 09:52 - 00256512 _____ C:\ProgramData\Wo5fsnevCOe
2013-09-28 09:40 - 2013-09-28 09:40 - 00256512 _____ C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\imdiSsWI
2013-09-28 09:40 - 2013-09-28 09:40 - 00256512 _____ C:\ProgramData\rqp8Nof89Gn
2013-09-28 09:34 - 2013-09-28 09:34 - 00256512 _____ C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\R85L2AwV
2013-09-28 09:34 - 2013-09-28 09:34 - 00256512 _____ C:\ProgramData\1IojVvnInx
2013-09-28 09:34 - 2013-09-28 09:34 - 00000000 ___DC C:\FRST
2013-09-27 11:40 - 2013-09-27 11:40 - 00256512 _____ C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\TzpWZpne
2013-09-27 11:40 - 2013-09-27 11:40 - 00256512 _____ C:\ProgramData\w1eiwzGD
2013-09-25 14:25 - 2010-07-07 04:08 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-09-25 14:23 - 2013-07-25 10:47 - 00000000 ____D C:\Program Files\Okidata
2013-09-24 11:36 - 2013-09-24 11:17 - 00000000 ____D C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\Nitro
2013-09-24 11:17 - 2013-09-24 11:17 - 00000000 ____D C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\FileOpen
2013-09-24 11:17 - 2013-09-24 11:17 - 00000000 ____D C:\ProgramData\FileOpen
2013-09-24 11:16 - 2013-09-24 11:16 - 00000000 ____D C:\ProgramData\Nitro
2013-09-24 11:16 - 2013-09-24 11:16 - 00000000 ____D C:\Program Files\Common Files\Nitro
2013-09-24 11:16 - 2013-09-24 11:16 - 00000000 ____D C:\Program Files (x86)\Nitro
2013-09-24 11:14 - 2013-09-24 11:14 - 00000000 ____D C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\Downloaded Installations
2013-09-23 15:23 - 2013-09-23 15:23 - 00000087 _____ C:\windows\NetwkCfg.txt
2013-09-20 11:56 - 2013-03-03 11:41 - 00000336 _____ C:\windows\BRCALIB.INI
2013-09-20 11:45 - 2012-03-30 07:50 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2013-09-20 11:45 - 2012-03-30 07:50 - 00003822 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2013-09-20 11:45 - 2011-05-18 07:51 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-19 07:33 - 2009-07-14 06:45 - 00499160 _____ C:\windows\system32\FNTCACHE.DAT
2013-09-18 11:47 - 2013-09-18 11:47 - 00003118 _____ C:\windows\System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe
2013-09-18 11:47 - 2013-09-18 11:47 - 00003092 _____ C:\windows\System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe
2013-09-18 11:47 - 2013-09-18 11:47 - 00003090 _____ C:\windows\System32\Tasks\Microsoft_Hardware_Launch_itype_exe
2013-09-18 11:47 - 2013-09-18 11:47 - 00000000 ____H C:\windows\system32\Drivers\Msft_Kernel_point64_01011.Wdf
2013-09-18 11:47 - 2013-09-18 11:47 - 00000000 ____H C:\windows\system32\Drivers\Msft_Kernel_NuidFltr_01011.Wdf
2013-09-18 11:43 - 2013-09-18 11:43 - 00000000 ____H C:\windows\system32\Drivers\Msft_Kernel_dc3d_01011.Wdf
2013-09-17 16:04 - 2013-07-25 10:53 - 00000000 ____D C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\Okidata
2013-09-17 15:42 - 2013-02-14 10:11 - 00000000 ____D C:\ProgramData\Okidata
2013-09-17 10:29 - 2009-07-14 05:20 - 00000000 ____D C:\windows\rescache
2013-09-17 08:02 - 2012-10-24 11:11 - 00000000 ____D C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\vlc
2013-09-17 07:16 - 2011-04-06 15:11 - 00001420 _____ C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-09-16 17:08 - 2009-07-14 05:20 - 00000000 ____D C:\windows\PolicyDefinitions
2013-09-16 07:52 - 2013-09-16 07:52 - 19246592 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 15404544 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 14332928 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 13761024 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 03959296 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 02876928 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2013-09-16 07:52 - 2013-09-16 07:52 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2013-09-16 07:52 - 2013-09-16 07:52 - 02647040 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 02241024 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 02048000 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 01509376 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2013-09-16 07:52 - 2013-09-16 07:52 - 01441280 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2013-09-16 07:52 - 2013-09-16 07:52 - 01400416 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dat
2013-09-16 07:52 - 2013-09-16 07:52 - 01400416 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dat
2013-09-16 07:52 - 2013-09-16 07:52 - 01365504 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 01141248 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 01054720 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00905728 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00762368 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00719360 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00629248 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00599552 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00523264 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00452096 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00441856 _____ (Microsoft Corporation) C:\windows\system32\html.iec
2013-09-16 07:52 - 2013-09-16 07:52 - 00391168 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00361984 _____ (Microsoft Corporation) C:\windows\SysWOW64\html.iec
2013-09-16 07:52 - 2013-09-16 07:52 - 00357888 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00281600 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00270848 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00247296 _____ (Microsoft Corporation) C:\windows\system32\webcheck.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00242200 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00235008 _____ (Microsoft Corporation) C:\windows\system32\url.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00232960 _____ (Microsoft Corporation) C:\windows\SysWOW64\url.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00226816 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00226304 _____ (Microsoft Corporation) C:\windows\system32\elshyph.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00216064 _____ (Microsoft Corporation) C:\windows\system32\msls31.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00204800 _____ (Microsoft Corporation) C:\windows\SysWOW64\webcheck.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00197120 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00185344 _____ (Microsoft Corporation) C:\windows\SysWOW64\elshyph.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00173568 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00167424 _____ (Microsoft Corporation) C:\windows\system32\iexpress.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00163840 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00158720 _____ (Microsoft Corporation) C:\windows\SysWOW64\msls31.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00150528 _____ (Microsoft Corporation) C:\windows\SysWOW64\iexpress.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00149504 _____ (Microsoft Corporation) C:\windows\system32\occache.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00144896 _____ (Microsoft Corporation) C:\windows\system32\wextract.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00138752 _____ (Microsoft Corporation) C:\windows\SysWOW64\wextract.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00137216 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00136192 _____ (Microsoft Corporation) C:\windows\system32\iepeers.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00135680 _____ (Microsoft Corporation) C:\windows\system32\IEAdvpack.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00125440 _____ (Microsoft Corporation) C:\windows\SysWOW64\occache.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00117248 _____ (Microsoft Corporation) C:\windows\SysWOW64\iepeers.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00110592 _____ (Microsoft Corporation) C:\windows\SysWOW64\IEAdvpack.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00102912 _____ (Microsoft Corporation) C:\windows\system32\inseng.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00097280 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\SetIEInstalledDate.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00089600 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00082432 _____ (Microsoft Corporation) C:\windows\SysWOW64\inseng.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00081408 _____ (Microsoft Corporation) C:\windows\system32\icardie.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00079872 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00077312 _____ (Microsoft Corporation) C:\windows\system32\tdc.ocx
2013-09-16 07:52 - 2013-09-16 07:52 - 00073728 _____ (Microsoft Corporation) C:\windows\SysWOW64\SetIEInstalledDate.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00069120 _____ (Microsoft Corporation) C:\windows\SysWOW64\icardie.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00062976 _____ (Microsoft Corporation) C:\windows\system32\pngfilt.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\tdc.ocx
2013-09-16 07:52 - 2013-09-16 07:52 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00057344 _____ (Microsoft Corporation) C:\windows\SysWOW64\pngfilt.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00052224 _____ (Microsoft Corporation) C:\windows\system32\msfeedsbs.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00051200 _____ (Microsoft Corporation) C:\windows\system32\imgutil.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00048640 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmler.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\mshtmler.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00041984 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeedsbs.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00039424 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00038400 _____ (Microsoft Corporation) C:\windows\SysWOW64\imgutil.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00027648 _____ (Microsoft Corporation) C:\windows\system32\licmgr10.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00023040 _____ (Microsoft Corporation) C:\windows\SysWOW64\licmgr10.dll
2013-09-16 07:52 - 2013-09-16 07:52 - 00013824 _____ (Microsoft Corporation) C:\windows\system32\mshta.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00012800 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshta.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00012800 _____ (Microsoft Corporation) C:\windows\system32\msfeedssync.exe
2013-09-16 07:52 - 2013-09-16 07:52 - 00011776 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeedssync.exe
2013-09-16 07:42 - 2013-04-15 11:24 - 00000000 ____D C:\ProgramData\DivX
2013-09-16 07:41 - 2013-04-15 11:25 - 00000000 ____D C:\Program Files (x86)\DivX
2013-09-12 14:09 - 2011-04-12 16:52 - 00000952 ___SH C:\ProgramData\KGyGaAvL.sys
2013-09-12 14:09 - 2011-04-12 11:09 - 00000000 ____D C:\Users\Huebner.STADTGEMEINDE\Documents\My PSP Files
2013-09-11 14:03 - 2013-02-21 16:57 - 00000000 ____D C:\ProgramData\CanonIJPLM
2013-09-10 14:54 - 2013-04-15 11:41 - 00000000 ____D C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\DivX
2013-09-10 13:53 - 2013-09-10 13:32 - 00000181 _____ C:\Users\Huebner.STADTGEMEINDE\AppData\Roaming\Opusbext.dat
2013-09-10 13:29 - 2009-07-14 05:20 - 00000000 ____D C:\windows\Web

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-23 10:58

==================== End Of Log ============================

--- --- ---

Nein, ich habe seit Sonntag Mittag keinen Piep mehr von ihm gehört.

schrauber · 30.09.2013, 19:41

Java updaten

Fertig

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Ohtarwen · 01.10.2013, 13:12

Java.com verkündet "Herzlichen Glückwunsch. Sie haben die empfohlene Java-Version installiert (Version 7 Update 40)."
Combofix hat sich selbst zerstört.
Delfix hat alles bereinigt.
Der Trojaner ist pfutsch.

Alles leiwand!

Aaaaaaaber: Die Spiele sind weg!

(Solitär, Spider Solitär, ...)
Fehlt mir eh nicht, ich mach nur Spaß. Sonst kann ich keine Folgeschäden feststellen. Alles OK!

Vielen herzlichen Dank für deine Hilfe und die Tipps!
Ich weiß, dass ich selbst schuld an der Misere war. Ich habe nach einem seltsamen Dateinamen gesucht und auch gefunden (leider). Schon während ich auf den Link geklickt habe, dachte ich, das könnte ein Fehler sein...

Nochmals dankeschön!
Und, ich werde den Spende-Button nicht übersehen.

Liebe Grüße,
Ohtarwen.

schrauber · 01.10.2013, 19:08

Gern Geschehen

01.10.2013, 19:08	#12
schrauber /// the machine /// TB-Ausbilder	Windows 7: Trojaner mit Sperrschirm - BKA Trojaner Gern Geschehen __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Windows 7: Trojaner mit Sperrschirm - BKA Trojaner

Plagegeister aller Art und deren Bekämpfung: Windows 7: Trojaner mit Sperrschirm - BKA Trojaner