| |
| |||||||
Log-Analyse und Auswertung: Windows 7: Spammailversand, dann SchädlingsfundWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
26.10.2013, 10:11
| #1 |
 |  Windows 7: Spammailversand, dann Schädlingsfund Hallo zusammen, ich habe folgendes Problem: Gestern morgen hat mein GMX-Konto einige Spammails verschickt. Sie gingen nicht an alle aus meinem Adressbuch, die Adressen fanden sich aber alle in meinem Posteingang. Ich greife auf das Konto nur per Browser zu und nutze keine Programme wie Outlook. Nach der Passwortänderung hab ich dann als erstes SUPERAntiSpyware durchlaufen lassen, was mir mitteilte, dass es zwei Dateien namens trojan.agent/gen-dundun und eine Datei namens trojan.agent/gen-reputation gefunden hat. Nach dem Entdecken dieses Boards hatte ich nach dem Defogger noch FRST und GMER benutzt. Ob zwischen den beiden Sachen ein Zusammenhang besteht, weiß ich nicht, zumindest ist seit gestern kein Spam mehr verschickt worden. Dass der Laptop in letzter Zeit nennenswert langsamer geworden wäre, ist mir nicht aufgefallen. Wie so viele bin leider auch ich völlig ohne Ahnung und weiß nicht, was jetzt zu tun ist. Wenn mir jemand helfen könnte, wäre ich sehr dankbar! Superantispyware Log: Code:
ATTFilter SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com
Generated 10/25/2013 at 08:24 PM
Application Version : 5.6.1040
Core Rules Database Version : 10854
Trace Rules Database Version: 8666
Scan type : Complete Scan
Total Scan Time : 07:36:33
Operating System Information
Windows 7 Professional 64-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Limited User
Memory items scanned : 637
Memory threats detected : 0
Registry items scanned : 74355
Registry threats detected : 0
File items scanned : 357645
File threats detected : 321
Adware.Tracking Cookie
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@247realmedia[1].txt [ /247realmedia ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@2o7[2].txt [ /2o7 ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@a.revenuemax[1].txt [ /a.revenuemax ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@accounts.google[1].txt [ /accounts.google ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@ad.ad-srv[1].txt [ /ad.ad-srv ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@ad.adserver01[1].txt [ /ad.adserver01 ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@ad.adserver01[3].txt [ /ad.adserver01 ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@ad.dyntracker[2].txt [ /ad.dyntracker ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@ad.dyntracker[3].txt [ /ad.dyntracker ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@ad.yieldmanager[1].txt [ /ad.yieldmanager ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@ad.yieldmanager[3].txt [ /ad.yieldmanager ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@ad.zanox[2].txt [ /ad.zanox ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@ad1.adfarm1.adition[2].txt [ /ad1.adfarm1.adition ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@ad1.adfarm1.adition[3].txt [ /ad1.adfarm1.adition ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@ad2.adfarm1.adition[2].txt [ /ad2.adfarm1.adition ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@ad3.adfarm1.adition[1].txt [ /ad3.adfarm1.adition ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@ad3.adfarm1.adition[2].txt [ /ad3.adfarm1.adition ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@ad4.adfarm1.adition[1].txt [ /ad4.adfarm1.adition ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@adfarm1.adition[1].txt [ /adfarm1.adition ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@adfarm1.adition[2].txt [ /adfarm1.adition ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@adformdsp[1].txt [ /adformdsp ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@adform[1].txt [ /adform ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@ads.creative-serving[1].txt [ /ads.creative-serving ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@ads.escinteractive[1].txt [ /ads.escinteractive ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@adtech[2].txt [ /adtech ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@adx.chip[2].txt [ /adx.chip ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@adxpose[1].txt [ /adxpose ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@apmebf[1].txt [ /apmebf ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@atwola[1].txt [ /atwola ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@atwola[2].txt [ /atwola ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@c.atdmt[2].txt [ /c.atdmt ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@casalemedia[1].txt [ /casalemedia ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@collective-media[1].txt [ /collective-media ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@content.yieldmanager[2].txt [ /content.yieldmanager ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@content.yieldmanager[3].txt [ /content.yieldmanager ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@doubleclick[2].txt [ /doubleclick ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@eas.apm.emediate[2].txt [ /eas.apm.emediate ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@eyewonder[1].txt [ /eyewonder ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@fastclick[1].txt [ /fastclick ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@fastclick[2].txt [ /fastclick ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@fastclick[3].txt [ /fastclick ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@googleads.g.doubleclick[1].txt [ /googleads.g.doubleclick ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@im.banner.t-online[2].txt [ /im.banner.t-online ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@imrworldwide[2].txt [ /imrworldwide ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@in.getclicky[1].txt [ /in.getclicky ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@insightexpressai[1].txt [ /insightexpressai ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@insightexpressai[2].txt [ /insightexpressai ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@invitemedia[2].txt [ /invitemedia ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@media.stage-entertainment[1].txt [ /media.stage-entertainment ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@media6degrees[1].txt [ /media6degrees ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@mediaplex[1].txt [ /mediaplex ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@mediaplex[3].txt [ /mediaplex ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@mediaplex[4].txt [ /mediaplex ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@pro-market[2].txt [ /pro-market ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@questionmarket[1].txt [ /questionmarket ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@questionmarket[3].txt [ /questionmarket ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@revsci[2].txt [ /revsci ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@ru4[2].txt [ /ru4 ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@server.adformdsp[1].txt [ /server.adformdsp ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@server.adform[2].txt [ /server.adform ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@serving-sys[1].txt [ /serving-sys ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@sevenoneintermedia.112.2o7[1].txt [ /sevenoneintermedia.112.2o7 ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@smartadserver[1].txt [ /smartadserver ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@specificclick[1].txt [ /specificclick ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@stat.dealtime[1].txt [ /stat.dealtime ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@statse.webtrendslive[1].txt [ /statse.webtrendslive ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@studivz.adfarm1.adition[2].txt [ /studivz.adfarm1.adition ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@track.adform[2].txt [ /track.adform ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@tracking.mindshare[1].txt [ /tracking.mindshare ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@tracking.quisma[2].txt [ /tracking.quisma ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@tradedoubler[1].txt [ /tradedoubler ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@traffictrack[1].txt [ /traffictrack ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@unitymedia[2].txt [ /unitymedia ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@webmasterplan[1].txt [ /webmasterplan ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@webmasterplan[2].txt [ /webmasterplan ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@www.etracker[1].txt [ /www.etracker ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@www.googleadservices[1].txt [ /www.googleadservices ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@www.mediamarkt[1].txt [ /www.mediamarkt ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@www.windowsmedia[2].txt [ /www.windowsmedia ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@www.zanox-affiliate[2].txt [ /www.zanox-affiliate ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@zanox-affiliate[1].txt [ /zanox-affiliate ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@zanox[2].txt [ /zanox ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@de.sitestat[3].txt [ /de.sitestat.com ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@de.sitestat[2].txt [ /de.sitestat.com ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@de.sitestat[1].txt [ /de.sitestat.com ]
C:\USERS\SCHRöDER\AppData\Roaming\Microsoft\Windows\Cookies\Low\schröder@ad2.adfarm1.adition[1].txt [ Cookie:schröder@ad2.adfarm1.adition.com/ ]
C:\USERS\SCHRöDER\AppData\Roaming\Microsoft\Windows\Cookies\Low\schröder@ad.yieldmanager[2].txt [ Cookie:schröder@ad.yieldmanager.com/ ]
C:\USERS\SCHRöDER\AppData\Roaming\Microsoft\Windows\Cookies\Low\schröder@interclick[1].txt [ Cookie:schröder@interclick.com/ ]
C:\USERS\SCHRöDER\AppData\Roaming\Microsoft\Windows\Cookies\Low\schröder@atdmt[1].txt [ Cookie:schröder@atdmt.com/ ]
C:\USERS\SCHRöDER\AppData\Roaming\Microsoft\Windows\Cookies\Low\schröder@statse.webtrendslive[2].txt [ Cookie:schröder@statse.webtrendslive.com/ ]
C:\USERS\SCHRöDER\AppData\Roaming\Microsoft\Windows\Cookies\Low\schröder@adfarm1.adition[1].txt [ Cookie:schröder@adfarm1.adition.com/ ]
C:\USERS\SCHRöDER\Cookies\schröder@imrworldwide[2].txt [ Cookie:schröder@imrworldwide.com/cgi-bin ]
C:\USERS\SCHRöDER\Cookies\schröder@mediaplex[4].txt [ Cookie:schröder@mediaplex.com/ ]
C:\USERS\SCHRöDER\Cookies\schröder@stat.dealtime[1].txt [ Cookie:schröder@stat.dealtime.com/ ]
C:\USERS\SCHRöDER\Cookies\schröder@adtech[2].txt [ Cookie:schröder@adtech.de/ ]
C:\USERS\SCHRöDER\Cookies\schröder@in.getclicky[1].txt [ Cookie:schröder@in.getclicky.com/ ]
C:\USERS\SCHRöDER\Cookies\schröder@server.adformdsp[1].txt [ Cookie:schröder@server.adformdsp.net/ ]
C:\USERS\SCHRöDER\Cookies\schröder@ad.adserver01[3].txt [ Cookie:schröder@ad.adserver01.de/ ]
C:\USERS\SCHRöDER\Cookies\schröder@www.zanox-affiliate[2].txt [ Cookie:schröder@www.zanox-affiliate.de/ ]
C:\USERS\SCHRöDER\Cookies\schröder@casalemedia[1].txt [ Cookie:schröder@casalemedia.com/ ]
C:\USERS\SCHRöDER\Cookies\schröder@tradedoubler[1].txt [ Cookie:schröder@tradedoubler.com/ ]
C:\USERS\SCHRöDER\Cookies\schröder@adx.chip[2].txt [ Cookie:schröder@adx.chip.de/ ]
C:\USERS\SCHRöDER\Cookies\schröder@smartadserver[1].txt [ Cookie:schröder@smartadserver.com/ ]
C:\USERS\SCHRöDER\Cookies\schröder@content.yieldmanager[3].txt [ Cookie:schröder@content.yieldmanager.com/ak/ ]
C:\USERS\SCHRöDER\Cookies\schröder@ad2.adfarm1.adition[2].txt [ Cookie:schröder@ad2.adfarm1.adition.com/ ]
C:\USERS\SCHRöDER\Cookies\schröder@www.windowsmedia[2].txt [ Cookie:schröder@www.windowsmedia.com/ ]
C:\USERS\SCHRöDER\Cookies\schröder@collective-media[1].txt [ Cookie:schröder@collective-media.net/ ]
C:\USERS\SCHRöDER\Cookies\schröder@adxpose[1].txt [ Cookie:schröder@adxpose.com/ ]
C:\USERS\SCHRöDER\Cookies\schröder@ad.yieldmanager[3].txt [ Cookie:schröder@ad.yieldmanager.com/ ]
C:\USERS\SCHRöDER\Cookies\schröder@apmebf[1].txt [ Cookie:schröder@apmebf.com/ ]
C:\USERS\SCHRöDER\Cookies\schröder@traffictrack[1].txt [ Cookie:schröder@traffictrack.de/ ]
C:\USERS\SCHRöDER\Cookies\schröder@eyewonder[1].txt [ Cookie:schröder@eyewonder.com/ ]
C:\USERS\SCHRöDER\Cookies\schröder@de.sitestat[3].txt [ Cookie:schröder@de.sitestat.com/ndr/ardsport/ ]
C:\USERS\SCHRöDER\Cookies\schröder@doubleclick[2].txt [ Cookie:schröder@doubleclick.net/ ]
C:\USERS\SCHRöDER\Cookies\schröder@im.banner.t-online[2].txt [ Cookie:schröder@im.banner.t-online.de/ ]
C:\USERS\SCHRöDER\Cookies\schröder@ad3.adfarm1.adition[1].txt [ Cookie:schröder@ad3.adfarm1.adition.com/ ]
C:\USERS\SCHRöDER\Cookies\schröder@2o7[2].txt [ Cookie:schröder@2o7.net/ ]
C:\USERS\SCHRöDER\Cookies\schröder@webmasterplan[1].txt [ Cookie:schröder@webmasterplan.com/ ]
C:\USERS\SCHRöDER\Cookies\schröder@statse.webtrendslive[1].txt [ Cookie:schröder@statse.webtrendslive.com/ ]
C:\USERS\SCHRöDER\Cookies\schröder@revsci[2].txt [ Cookie:schröder@revsci.net/ ]
C:\USERS\SCHRöDER\Cookies\schröder@ad.dyntracker[3].txt [ Cookie:schröder@ad.dyntracker.de/ ]
C:\USERS\SCHRöDER\Cookies\schröder@questionmarket[3].txt [ Cookie:schröder@questionmarket.com/ ]
C:\USERS\SCHRöDER\Cookies\schröder@adform[1].txt [ Cookie:schröder@adform.net/ ]
C:\USERS\SCHRöDER\Cookies\schröder@adfarm1.adition[1].txt [ Cookie:schröder@adfarm1.adition.com/ ]
C:\USERS\SCHRöDER\Cookies\schröder@server.adform[2].txt [ Cookie:schröder@server.adform.net/ ]
C:\USERS\SCHRöDER\Cookies\schröder@track.adform[2].txt [ Cookie:schröder@track.adform.net/ ]
C:\USERS\SCHRöDER\Cookies\schröder@pro-market[2].txt [ Cookie:schröder@pro-market.net/ ]
C:\USERS\SCHRöDER\Cookies\schröder@www.etracker[1].txt [ Cookie:schröder@www.etracker.de/ ]
C:\USERS\SCHRöDER\Cookies\schröder@studivz.adfarm1.adition[2].txt [ Cookie:schröder@studivz.adfarm1.adition.com/ ]
C:\USERS\SCHRöDER\Cookies\schröder@a.revenuemax[1].txt [ Cookie:schröder@a.revenuemax.de/ ]
C:\USERS\SCHRöDER\Cookies\schröder@media6degrees[1].txt [ Cookie:schröder@media6degrees.com/ ]
C:\USERS\SCHRöDER\Cookies\schröder@eas.apm.emediate[2].txt [ Cookie:schröder@eas.apm.emediate.eu/ ]
C:\USERS\SCHRöDER\Cookies\schröder@invitemedia[2].txt [ Cookie:schröder@invitemedia.com/ ]
C:\USERS\SCHRöDER\Cookies\schröder@tracking.quisma[2].txt [ Cookie:schröder@tracking.quisma.com/ ]
C:\USERS\SCHRöDER\Cookies\schröder@atwola[2].txt [ Cookie:schröder@atwola.com/ ]
C:\USERS\SCHRöDER\Cookies\schröder@247realmedia[1].txt [ Cookie:schröder@247realmedia.com/ ]
C:\USERS\SCHRöDER\Cookies\schröder@ru4[2].txt [ Cookie:schröder@ru4.com/ ]
C:\USERS\SCHRöDER\Cookies\schröder@sevenoneintermedia.112.2o7[1].txt [ Cookie:schröder@sevenoneintermedia.112.2o7.net/ ]
C:\USERS\SCHRöDER\Cookies\schröder@adformdsp[1].txt [ Cookie:schröder@adformdsp.net/ ]
C:\USERS\SCHRöDER\Cookies\schröder@tracking.mindshare[1].txt [ Cookie:schröder@tracking.mindshare.de/ ]
C:\USERS\SCHRöDER\Cookies\schröder@de.sitestat[2].txt [ Cookie:schröder@de.sitestat.com/ndr/ ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\Low\schröder@microsoftinternetexplorer.112.2o7[1].txt [ /microsoftinternetexplorer.112.2o7.net ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\Low\schröder@fastclick[1].txt [ /fastclick.net ]
a.banner.t-online.de [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
cdnx.tribalfusion.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
content.oddcast.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
core.insightexpressai.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
core.saymedia.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
delivery.ibanner.de [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
fr-himedia.cdn.videoplaza.tv [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
ia.media-imdb.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
ictv-dread-ec.indieclicktv.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
media-vimg-net.vimg.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
media.bwfamily.tv [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
media.movieweb.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
media.mtvnservices.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
media.nbcdfw.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
media.rachaelrayshow.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
media.scanscout.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
media.spinmediavideo.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
media.stage-entertainment.de [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
media3.onsugar.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
msnbcmedia.msn.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
objects.tremormedia.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
s0.2mdn.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
secure-eu.imrworldwide.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
secure-nz.imrworldwide.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
secure-uk.imrworldwide.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
secure-us.imrworldwide.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
static.mediaworks.co.nz [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
swrmediathek.de [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
video.imedia.ro [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
www.ardmediathek.de [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
www.femalefirst.co.uk [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
www.ultimedia.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
.legolas-media.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.legolas-media.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.112.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.112.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.112.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
de.sitestat.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.rambler.ru [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.tracker.vinsight.de [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.imrworldwide.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.imrworldwide.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
in.getclicky.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.getclicky.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.static.getclicky.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.statcounter.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.invitemedia.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
ad.yieldmanager.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
ad.yieldmanager.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.tns-counter.ru [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
www.etracker.de [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
www.etracker.de [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
ad.yieldmanager.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.122.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.ru4.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
de.sitestat.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.doubleclick.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
de.sitestat.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.invitemedia.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
www.etracker.de [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
track.adform.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
pulse-analytics-beacon.reutersmedia.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.countingdownto.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.beiersdorf.122.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.dmtracker.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
de.sitestat.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.ardmediathek.de [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.ikea.122.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
stats.sumodesign.co.uk [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.mediacet.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.oms.122.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
demandmedia.trc.taboola.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
demandmedia.trc.taboola.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
demandmedia.trc.taboola.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
demandmedia.trc.taboola.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.mmstat.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.cnzz.mmstat.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.moviepilot.de [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.moviepilot.de [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.tripod.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.tripod.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.tripod.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.tripod.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
www.etracker.de [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.superstats.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.yadro.ru [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.openstat.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.yadro.ru [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.histats.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.histats.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.atdmt.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.c.atdmt.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.c.atdmt.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
fr.sitestat.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
fr.sitestat.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
www.etracker.de [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.adtech.de [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.estat.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.ipcmedia.122.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
ad.yieldmanager.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.hearstdigital.122.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
www.etracker.de [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.webmasterplan.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.cbsdigitalmedia.112.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
ad.zanox.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
de.sitestat.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.olympiaverlag.122.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.chicagosuntimes.122.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.flagcounter.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
app.videostat.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
app.videostat.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.hearstmagazines.112.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
app.videostat.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.videostat.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
www.etracker.de [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.oracle.112.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
moviepilot.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
moviepilot.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
moviepilot.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.moviepilot.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.moviepilot.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.moviepilot.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.moviepilot.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.deutschepostag.112.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.trinitymirror.112.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.invitemedia.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.invitemedia.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.xiti.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.xiti.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.statcounter.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
www.etracker.de [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.timeinc.122.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.warnerbros.112.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
statse.webtrendslive.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.vinsight.de [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
accounts.google.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
Trojan.Agent/Gen-Reputation
C:\USERS\SCHRöDER\APPDATA\LOCAL\ADOBE\ACROBAT\10.0\CACHE\RDLANG_DIGSIG.DEU
Trojan.Agent/Gen-DunDun
C:\WINDOWS.OLD\WINDOWS\INF\UNREGMP2.EXE
C:\WINDOWS.OLD\WINDOWS\SYSTEM32\DLLCACHE\UNREGMP2.EXE
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-10-2013
Ran by Schröder (administrator) on SCHRÖDER-PC on 26-10-2013 09:31:59
Running from C:\Users\Schröder\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(AuthenTec, Inc.) C:\Program Files\Fingerprint Sensor\ATService.exe
(McAfee, Inc.) C:\Program Files (x86)\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe
(Hewlett-Packard) C:\Windows\system32\Hpservice.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
(Andrea Electronics Corporation) C:\Windows\system32\AEADISRV.EXE
(LSI Corporation) C:\Program Files\LSI SoftModem\agr64svc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corporation) C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\VPNClient\cvpnd.exe
(Juniper Networks) C:\Program Files (x86)\Juniper Networks\Common Files\dsNcService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(HP) C:\Program Files\HP\HP LaserJet M1210 MFP Series\ReceiveFaxUtility.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(HP) C:\Windows\system32\HPSIsvc.exe
(Nitro PDF Software) C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe
() C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe
() C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Bioscrypt Inc.) C:\Program Files (x86)\Hewlett-Packard\IAM\Bin\AsGHost.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANOTIF.EXE
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE
(SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
(Analog Devices, Inc.) C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\pthosttr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [SoundMAX] - C:\Program Files (x86)\Analog Devices\SoundMAX\soundmax.exe [3866624 2009-05-18] (Analog Devices, Inc.)
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [IAAnotif] - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-08-25] (Intel Corporation)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1815848 2009-07-30] (Synaptics Incorporated)
HKLM\...\Run: [BCSSync] - C:\Program Files\Microsoft Office\Office14\BCSSync.exe [112512 2010-03-13] (Microsoft Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKCU\...\Run: [OfficeSyncProcess] - C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE [911040 2013-04-22] (Microsoft Corporation)
HKCU\...\Run: [SUPERAntiSpyware] - C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [6588144 2013-10-02] (SUPERAntiSpyware)
MountPoints2: {74b92733-b07d-11df-8ea5-806e6f6e6963} - E:\SWSETUP\APPINSTL\setup.exe
MountPoints2: {9360f5de-1ef6-11e3-9ac3-002713c2bfbb} - F:\SISetup.exe
HKLM-x32\...\Run: [SoundMAXPnP] - C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe [1314816 2009-05-18] (Analog Devices, Inc.)
HKLM-x32\...\Run: [PTHOSTTR] - C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE [354360 2009-07-30] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [CognizanceTS] - C:\PROGRA~3\HEWLET~1\IAM\Bin\ASTSVCC.dll [24848 2009-07-23] (Bioscrypt Inc.)
HKLM-x32\...\Run: [NPSStartup] - [x]
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2011-05-10] (Hewlett-Packard)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [681032 2013-10-01] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [162856 2013-03-20] (Geek Software GmbH)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [TkBellExe] - c:\program files (x86)\real\realplayer\Update\realsched.exe [295512 2013-09-02] (RealNetworks, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
AppInit_DLLs: C:\PROGRA~3\HEWLET~1\IAM\bin\APSHOO~1.DLL [382224 2009-07-23] (Bioscrypt Inc.)
AppInit_DLLs-x32: C:\PROGRA~3\HEWLET~1\IAM\bin\APSHook.dll [89872 2009-07-23] (Bioscrypt Inc.)
Lsa: [Notification Packages] scecli ASCredProv64
Startup: C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
BHO: Credential Manager for HP ProtectTools - {0EA99306-BC87-4930-9E1D-1D1EA32A7E4E} - C:\Program Files (x86)\Hewlett-Packard\IAM\Bin\ItIEAddIn64.dll (Bioscrypt Inc.)
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Credential Manager for HP ProtectTools - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files (x86)\Hewlett-Packard\IAM\Bin\ItIEAddIn.dll (Bioscrypt Inc.)
DPF: HKLM {AA570693-00E2-4907-B6F1-60A1199B030C} https://juniper.net/dana-cached/sc/JuniperSetupClient64.cab
DPF: HKLM-x32 {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://juniper.net/dana-cached/sc/JuniperSetupClient.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Schröder\AppData\Roaming\Mozilla\Firefox\Profiles\g0g0n6qj.default
FF DefaultSearchEngine: MyVideo Suche
FF SelectedSearchEngine: MyVideo Suche
FF Homepage: hxxp://www.gmx.net/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~3\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~3\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3503.0728 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nitropdf.com/NitroPDF - C:\Program Files (x86)\Nitro\Reader 3\npnitromozilla.dll (Nitro PDF)
FF Plugin-x32: @real.com/nppl3260;version=16.0.3.51 - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=16.0.3.51 - c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @phonostar.de/phonostar - C:\Program Files (x86)\phonostar-Player\npphonostarDetectNP.dll No File
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101721.dll (Amazon.com, Inc.)
FF SearchPlugin: C:\Users\Schröder\AppData\Roaming\Mozilla\Firefox\Profiles\g0g0n6qj.default\searchplugins\amazon-search-suggestions.xml
FF SearchPlugin: C:\Users\Schröder\AppData\Roaming\Mozilla\Firefox\Profiles\g0g0n6qj.default\searchplugins\myvideo-suche-.xml
FF SearchPlugin: C:\Users\Schröder\AppData\Roaming\Mozilla\Firefox\Profiles\g0g0n6qj.default\searchplugins\ponseu--englisch--deutsch.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: personas - C:\Users\Schröder\AppData\Roaming\Mozilla\Firefox\Profiles\g0g0n6qj.default\Extensions\personas@christopher.beard.xpi
FF Extension: Adblock Plus - C:\Users\Schröder\AppData\Roaming\Mozilla\Firefox\Profiles\g0g0n6qj.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF HKLM-x32\...\Firefox\Extensions: [{DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
==================== Services (Whitelisted) =================
R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [143120 2013-05-23] (SUPERAntiSpyware.com)
R2 AEADIFilters; C:\Windows\system32\AEADISRV.EXE [111616 2008-07-15] (Andrea Electronics Corporation)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440392 2013-10-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440392 2013-10-01] (Avira Operations GmbH & Co. KG)
R2 ASBroker; C:\Program Files (x86)\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll [192784 2009-07-23] (Bioscrypt Inc.)
R2 ASChannel; C:\Program Files (x86)\Hewlett-Packard\IAM\Bin\AsChnl.dll [150288 2009-07-23] (Bioscrypt Inc.)
R2 BcmSqlStartupSvc; C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe [34216 2010-03-25] (Microsoft Corporation)
R2 CVPND; C:\Program Files (x86)\Cisco\VPNClient\cvpnd.exe [1529856 2011-03-04] (Cisco Systems, Inc.)
S3 HP ProtectTools Service; C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe [45056 2009-07-30] (Hewlett-Packard Development Company, L.P)
R2 HpFkCryptService; C:\Program Files (x86)\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [256544 2009-07-29] (McAfee, Inc.)
R2 HPM1210RcvFaxSrvc; C:\Program Files\HP\HP LaserJet M1210 MFP Series\ReceiveFaxUtility.exe [361888 2012-07-25] (HP)
S3 MSSQL$MSSMLBIZ; C:\Program Files (x86)\Microsoft SQL Server\MSSQL10.MSSMLBIZ\MSSQL\Binn\sqlservr.exe [43010392 2009-03-30] (Microsoft Corporation)
R2 NitroReaderDriverReadSpool3; C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe [230416 2012-12-17] (Nitro PDF Software)
R2 Radio.fx; C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe [3673944 2011-11-18] ()
R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-08-14] ()
S4 SQLAgent$MSSMLBIZ; C:\Program Files (x86)\Microsoft SQL Server\MSSQL10.MSSMLBIZ\MSSQL\Binn\SQLAGENT.EXE [366936 2009-03-30] (Microsoft Corporation)
R2 yksvc; C:\Windows\System32\yk62x64.dll [382976 2009-07-20] (Marvell)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105856 2013-10-01] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132600 2013-10-01] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-01] (Avira Operations GmbH & Co. KG)
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
S3 HP1210FAX; C:\Windows\System32\Drivers\HPM1210FAX.sys [16896 2012-11-08] ()
S3 mvusbews; C:\Windows\System32\Drivers\mvusbews.sys [20480 2012-12-24] (Marvell Semiconductor, Inc.)
R1 RsvLock; C:\Windows\System32\Drivers\RsvLock.sys [14880 2009-07-29] (SafeBoot International)
R0 SafeBoot; C:\Windows\System32\Drivers\SafeBoot.sys [55840 2009-07-29] ()
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R0 SbAlg; C:\Windows\System32\Drivers\SbAlg.sys [60160 2007-07-16] (SafeBoot N.V.)
R0 SbFsLock; C:\Windows\System32\Drivers\SbFsLock.sys [15392 2009-07-29] (SafeBoot International)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1805104 2009-07-02] ()
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-10-26 09:31 - 2013-10-26 09:31 - 01956086 _____ (Farbar) C:\Users\Schröder\Desktop\FRST64.exe
2013-10-25 20:48 - 2013-10-25 20:48 - 00377856 _____ C:\Users\Schröder\Desktop\gmer_2.1.19163.exe
2013-10-25 20:43 - 2013-10-25 20:43 - 00000000 ____D C:\FRST
2013-10-25 20:41 - 2013-10-25 20:41 - 00000478 _____ C:\Users\Schröder\Desktop\defogger_disable.log
2013-10-25 20:41 - 2013-10-25 20:41 - 00000000 _____ C:\Users\Schröder\defogger_reenable
2013-10-25 20:40 - 2013-10-25 20:40 - 00050477 _____ C:\Users\Schröder\Desktop\Defogger.exe
2013-10-25 20:27 - 2013-10-25 20:27 - 00035820 _____ C:\Users\Schröder\Desktop\SUPERAntiSpyware Scan Log - 10-25-2013 - 20-24-59.log
2013-10-25 20:02 - 2013-10-25 20:02 - 00701332 _____ C:\Users\Schröder\Desktop\Unterstützungsantrag Lehrpreis.jpeg
2013-10-25 12:44 - 2013-10-25 12:44 - 00000000 ____D C:\Users\Schröder\AppData\Roaming\SUPERAntiSpyware.com
2013-10-25 12:43 - 2013-10-25 12:45 - 00000000 ____D C:\Program Files\SUPERAntiSpyware
2013-10-25 12:43 - 2013-10-25 12:43 - 00001808 _____ C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
2013-10-25 12:43 - 2013-10-25 12:43 - 00000000 ____D C:\ProgramData\SUPERAntiSpyware.com
2013-10-25 12:40 - 2013-10-25 12:42 - 27853504 _____ (SUPERAntiSpyware) C:\Users\Schröder\Desktop\SUPERAntiSpyware.exe
2013-10-19 00:05 - 2013-10-19 00:05 - 00000000 ____D C:\Program Files\Common Files\Deterministic Networks
2013-10-19 00:05 - 2013-10-19 00:05 - 00000000 ____D C:\Program Files (x86)\Cisco Systems
2013-10-19 00:05 - 2013-10-19 00:05 - 00000000 ____D C:\Program Files (x86)\Cisco
2013-10-19 00:04 - 2013-10-19 00:07 - 00001593 _____ C:\Windows\VPNInstall.MIF
2013-10-19 00:03 - 2013-10-19 00:03 - 05333322 _____ C:\Users\Schröder\Downloads\rzinst-Cisco-VPNClient-5.0.07.0440x64.exe
2013-10-19 00:03 - 2013-10-19 00:03 - 00000594 _____ C:\Windows\RRZE.LOG
2013-10-19 00:03 - 2013-10-19 00:03 - 00000000 ____D C:\Windows\RRZE
2013-10-18 12:33 - 2013-10-18 12:33 - 00915368 _____ (Oracle Corporation) C:\Users\Schröder\Downloads\jre-7u45-windows-i586-iftw.exe
2013-10-18 12:31 - 2013-10-18 12:31 - 00000000 ____D C:\ProgramData\Oracle
2013-10-18 12:30 - 2013-10-18 12:30 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-10-18 12:30 - 2013-10-18 12:30 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-10-18 12:30 - 2013-10-18 12:30 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-10-18 12:30 - 2013-10-18 12:30 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-10-11 16:59 - 2013-10-11 17:03 - 00000000 ____D C:\Users\Schröder\Desktop\Erlangen
2013-10-10 22:57 - 2013-09-14 03:10 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-10-10 22:57 - 2013-09-08 04:30 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-10-10 22:57 - 2013-09-08 04:27 - 00327168 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2013-10-10 22:57 - 2013-09-08 04:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswsock.dll
2013-10-10 22:57 - 2013-08-29 04:17 - 05549504 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-10-10 22:57 - 2013-08-29 04:16 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-10-10 22:57 - 2013-08-29 04:16 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2013-10-10 22:57 - 2013-08-29 04:16 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-10-10 22:57 - 2013-08-29 04:13 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2013-10-10 22:57 - 2013-08-29 03:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-10-10 22:57 - 2013-08-29 03:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-10-10 22:57 - 2013-08-29 03:50 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-10-10 22:57 - 2013-08-29 03:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2013-10-10 22:57 - 2013-08-29 03:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-10-10 22:57 - 2013-08-29 03:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2013-10-10 22:57 - 2013-08-29 02:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-10-10 22:57 - 2013-08-29 02:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-10-10 22:57 - 2013-08-29 02:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-10-10 22:57 - 2013-08-29 02:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-10-10 22:57 - 2013-08-28 03:21 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-10-10 22:57 - 2013-08-28 03:12 - 00461312 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll
2013-10-10 22:57 - 2013-08-01 14:09 - 00983488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-10-10 22:57 - 2013-07-20 12:33 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-10 22:57 - 2013-07-20 12:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2013-10-10 22:57 - 2013-07-12 12:41 - 00185344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys
2013-10-10 22:57 - 2013-07-12 12:41 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
2013-10-10 22:57 - 2013-07-04 14:57 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2013-10-10 22:57 - 2013-07-04 14:50 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2013-10-10 22:57 - 2013-07-04 14:50 - 00102400 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2013-10-10 22:57 - 2013-07-04 13:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll
2013-10-10 22:57 - 2013-07-04 13:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll
2013-10-10 22:57 - 2013-07-04 13:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2013-10-10 22:57 - 2013-07-04 12:11 - 00140800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2013-10-10 22:57 - 2013-07-03 06:40 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys
2013-10-10 22:57 - 2013-07-03 06:05 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2013-10-10 22:57 - 2013-07-03 06:05 - 00032896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2013-10-10 22:57 - 2013-06-26 00:55 - 00785624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2013-10-10 22:57 - 2013-06-06 07:50 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2013-10-10 22:57 - 2013-06-06 07:49 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2013-10-10 22:57 - 2013-06-06 07:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2013-10-10 22:57 - 2013-06-06 07:47 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2013-10-10 22:57 - 2013-06-06 06:57 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2013-10-10 22:57 - 2013-06-06 06:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2013-10-10 22:57 - 2013-06-06 06:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2013-10-10 22:57 - 2013-06-06 05:30 - 00368128 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-10-10 22:57 - 2013-06-06 05:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2013-10-10 22:57 - 2013-06-06 05:01 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2013-09-30 21:33 - 2013-09-30 21:33 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-26 20:42 - 2013-09-26 20:42 - 98009570 _____ C:\Windows\SysWOW64\璅ḼM
2013-09-26 14:42 - 2013-09-26 14:42 - 97961477 _____ C:\Windows\SysWOW64\灷檪Ḽ¡
==================== One Month Modified Files and Folders =======
2013-10-26 09:31 - 2013-10-26 09:31 - 01956086 _____ (Farbar) C:\Users\Schröder\Desktop\FRST64.exe
2013-10-26 09:30 - 2009-07-14 06:45 - 00009712 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-26 09:30 - 2009-07-14 06:45 - 00009712 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-26 09:27 - 2010-08-25 21:23 - 01625918 _____ C:\Windows\WindowsUpdate.log
2013-10-26 09:23 - 2013-09-22 12:58 - 00003374 _____ C:\Windows\System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-1242068612-3420065025-570463520-1000
2013-10-26 09:23 - 2013-09-22 12:58 - 00003246 _____ C:\Windows\System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-1242068612-3420065025-570463520-1000
2013-10-26 09:21 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-26 09:21 - 2009-07-14 06:51 - 00213219 _____ C:\Windows\setupact.log
2013-10-25 20:48 - 2013-10-25 20:48 - 00377856 _____ C:\Users\Schröder\Desktop\gmer_2.1.19163.exe
2013-10-25 20:43 - 2013-10-25 20:43 - 00000000 ____D C:\FRST
2013-10-25 20:41 - 2013-10-25 20:41 - 00000478 _____ C:\Users\Schröder\Desktop\defogger_disable.log
2013-10-25 20:41 - 2013-10-25 20:41 - 00000000 _____ C:\Users\Schröder\defogger_reenable
2013-10-25 20:41 - 2010-08-25 21:31 - 00000000 ____D C:\Users\Schröder
2013-10-25 20:40 - 2013-10-25 20:40 - 00050477 _____ C:\Users\Schröder\Desktop\Defogger.exe
2013-10-25 20:35 - 2009-08-30 07:25 - 00724550 _____ C:\Windows\system32\perfh007.dat
2013-10-25 20:35 - 2009-08-30 07:25 - 00157018 _____ C:\Windows\system32\perfc007.dat
2013-10-25 20:35 - 2009-07-14 07:13 - 01695360 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-25 20:27 - 2013-10-25 20:27 - 00035820 _____ C:\Users\Schröder\Desktop\SUPERAntiSpyware Scan Log - 10-25-2013 - 20-24-59.log
2013-10-25 20:02 - 2013-10-25 20:02 - 00701332 _____ C:\Users\Schröder\Desktop\Unterstützungsantrag Lehrpreis.jpeg
2013-10-25 12:45 - 2013-10-25 12:43 - 00000000 ____D C:\Program Files\SUPERAntiSpyware
2013-10-25 12:44 - 2013-10-25 12:44 - 00000000 ____D C:\Users\Schröder\AppData\Roaming\SUPERAntiSpyware.com
2013-10-25 12:43 - 2013-10-25 12:43 - 00001808 _____ C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
2013-10-25 12:43 - 2013-10-25 12:43 - 00000000 ____D C:\ProgramData\SUPERAntiSpyware.com
2013-10-25 12:42 - 2013-10-25 12:40 - 27853504 _____ (SUPERAntiSpyware) C:\Users\Schröder\Desktop\SUPERAntiSpyware.exe
2013-10-24 23:53 - 2010-08-31 15:48 - 00000000 ____D C:\Users\Schröder\Desktop\Uni
2013-10-22 19:42 - 2013-09-02 10:35 - 00003352 _____ C:\Windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1242068612-3420065025-570463520-1000
2013-10-22 19:42 - 2013-09-02 10:35 - 00003224 _____ C:\Windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1242068612-3420065025-570463520-1000
2013-10-21 00:56 - 2012-01-29 13:48 - 00016976 _____ C:\Users\Schröder\Meine Konzerte.xlsx
2013-10-21 00:29 - 2010-09-07 21:10 - 00000000 ____D C:\Users\Schröder\AppData\Roaming\Skype
2013-10-19 00:07 - 2013-10-19 00:04 - 00001593 _____ C:\Windows\VPNInstall.MIF
2013-10-19 00:05 - 2013-10-19 00:05 - 00000000 ____D C:\Program Files\Common Files\Deterministic Networks
2013-10-19 00:05 - 2013-10-19 00:05 - 00000000 ____D C:\Program Files (x86)\Cisco Systems
2013-10-19 00:05 - 2013-10-19 00:05 - 00000000 ____D C:\Program Files (x86)\Cisco
2013-10-19 00:03 - 2013-10-19 00:03 - 05333322 _____ C:\Users\Schröder\Downloads\rzinst-Cisco-VPNClient-5.0.07.0440x64.exe
2013-10-19 00:03 - 2013-10-19 00:03 - 00000594 _____ C:\Windows\RRZE.LOG
2013-10-19 00:03 - 2013-10-19 00:03 - 00000000 ____D C:\Windows\RRZE
2013-10-18 12:33 - 2013-10-18 12:33 - 00915368 _____ (Oracle Corporation) C:\Users\Schröder\Downloads\jre-7u45-windows-i586-iftw.exe
2013-10-18 12:31 - 2013-10-18 12:31 - 00000000 ____D C:\ProgramData\Oracle
2013-10-18 12:30 - 2013-10-18 12:30 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-10-18 12:30 - 2013-10-18 12:30 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-10-18 12:30 - 2013-10-18 12:30 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-10-18 12:30 - 2013-10-18 12:30 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-10-13 21:20 - 2012-04-06 09:48 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-10-13 21:20 - 2011-05-28 20:52 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-10-12 10:23 - 2013-05-26 17:14 - 00000000 ____D C:\Users\Schröder\Desktop\Einzelzeug
2013-10-11 17:03 - 2013-10-11 16:59 - 00000000 ____D C:\Users\Schröder\Desktop\Erlangen
2013-10-11 17:02 - 2013-06-05 23:35 - 00000000 ____D C:\Users\Schröder\Desktop\Anderes
2013-10-11 08:08 - 2009-07-14 06:45 - 00418464 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-11 00:02 - 2010-10-15 19:21 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-10-10 23:55 - 2013-08-14 22:29 - 00000000 ____D C:\Windows\system32\MRT
2013-10-10 23:52 - 2010-08-30 13:57 - 80541720 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-10-09 21:27 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2013-10-01 10:20 - 2013-05-02 11:06 - 00083160 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-10-01 10:20 - 2013-03-30 18:01 - 00132600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-10-01 10:20 - 2013-03-30 18:01 - 00105856 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-10-01 10:20 - 2013-03-30 18:01 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-10-01 10:16 - 2012-04-24 20:16 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-09-30 21:34 - 2010-08-27 19:30 - 00000000 ____D C:\Users\Schröder\AppData\Local\Mozilla
2013-09-30 21:33 - 2013-09-30 21:33 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-26 20:42 - 2013-09-26 20:42 - 98009570 _____ C:\Windows\SysWOW64\璅ḼM
2013-09-26 20:04 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-09-26 14:42 - 2013-09-26 14:42 - 97961477 _____ C:\Windows\SysWOW64\灷檪Ḽ¡
Some content of TEMP:
====================
C:\Users\Schröder\AppData\Local\Temp\avgnt.exe
C:\Users\Schröder\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\Schröder\AppData\Local\Temp\JuniperSetupClientInstaller.exe
C:\Users\Schröder\AppData\Local\Temp\neoNCSetup64.exe
C:\Users\Schröder\AppData\Local\Temp\siinst.exe
C:\Users\Schröder\AppData\Local\Temp\strings.dll
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-10-21 14:00
==================== End Of Log ============================
Addition Logfile: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 26-10-2013
Ran by Schröder at 2013-10-26 09:33:13
Running from C:\Users\Schröder\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
64 Bit HP CIO Components Installer (Version: 7.2.8)
Adobe Flash Player 10 ActiveX (x32 Version: 10.1.53.64)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.117)
Adobe Reader X (10.1.8) - Deutsch (x32 Version: 10.1.8)
Amazon MP3-Downloader 1.0.17 (x32 Version: 1.0.17)
Apple Application Support (x32 Version: 2.3.4)
Apple Software Update (x32 Version: 2.1.3.127)
AuthenTec Fingerprint System (Version: 8.0.202.0)
Avira Free Antivirus (x32 Version: 14.0.0.383)
B109n-z (x32 Version: 130.0.396.000)
Bombermaaan 1.4 (x32)
Bonjour (Version: 3.0.0.10)
BufferChm (x32 Version: 130.0.331.000)
Business Contact Manager for Microsoft Outlook 2010 (Version: 4.0.11308.0)
Business Contact Manager für Microsoft Outlook 2010 (Version: 4.0.11308.0)
CDBurnerXP (Version: 4.3.8.2631)
CDBurnerXP (x32 Version: 4.4.0.2838)
Cisco Systems VPN Client 5.0.07.0440 (Version: 5.0.7)
Credential Manager for HP ProtectTools (x32 Version: 4.1.5.1483)
D3DX10 (x32 Version: 15.4.2368.0902)
Definition Update for Microsoft Office 2010 (KB982726) 64-Bit Edition
Destinations (x32 Version: 130.0.0.0)
DeviceDiscovery (x32 Version: 130.0.372.000)
DoulosSIL 4.106 (x32)
Drive Encryption for HP ProtectTools (Version: 4.0.24)
Dropbox (HKCU Version: 2.0.22)
Fotogalerie (x32 Version: 16.4.3503.0728)
Free FLV Converter V 7.1.0 (x32 Version: 7.1.0.0)
GPBaseService2 (x32 Version: 130.0.371.000)
Hewlett-Packard ACLM.NET v1.1.1.0 (x32 Version: 1.00.0000)
HP 3D DriveGuard (Version: 4.0.3.1)
HP Customer Participation Program 13.0 (Version: 13.0)
HP ePrint (x32 Version: 10.0.13228.1563)
HP ESU for Microsoft Windows 7 (x32 Version: 1.0.3.1)
HP Imaging Device Functions 13.0 (Version: 13.0)
HP JavaCard for HP ProtectTools (x32 Version: 04.10.9.0013)
HP LaserJet Professional M1130-M1210 MFP Series
HP LaserJet Professional M1210 MFP Series Fax Installer (Version: 1.3.0)
HP Photosmart Wireless B109n-z All-In-One Driver Software 13.0 Rel .6
HP Postscript Converter (Version: 4.5.12202)
HP Print Projects 1.0 (Version: 1.0)
HP Product Detection (x32 Version: 11.14.0001)
HP ProtectTools Security Manager (x32 Version: 04.10.9.0013)
HP ProtectTools Security Manager Suite (x32 Version: 04.10.9.0013)
HP Smart Web Printing 4.5 (Version: 4.5)
HP Solution Center 13.0 (Version: 13.0)
HP Support Assistant (x32 Version: 6.0.5.4)
HP Unified IO (Version: 2.0.0.479)
HP Unified IO (x32 Version: 2.0.0.479)
HP Update (x32 Version: 5.005.000.001)
HP Webcam Driver (x32 Version: 5.8.50008.0)
HPDiagnosticAlert (x32 Version: 1.00.0000)
HPPhotoGadget (x32 Version: 130.0.282.000)
hpPrintProjects (x32 Version: 130.0.303.000)
HPProductAssistant (x32 Version: 130.0.371.000)
HPSSupply (x32 Version: 130.0.371.000)
hpWLPGInstaller (x32 Version: 130.0.303.000)
Intel(R) Graphics Media Accelerator Driver
Intel® Matrix Storage Manager
Java 7 Update 45 (x32 Version: 7.0.450)
Java Auto Updater (x32 Version: 2.1.9.8)
Juniper Networks Network Connect 7.0.0 (x32 Version: 7.0.0.17289)
Juniper Networks Network Connect 7.2.0 (x32 Version: 7.2.0.21697)
Juniper Networks Network Connect 7.3.0 (x32 Version: 7.3.0.26561)
Juniper Networks, Inc. Setup Client (HKCU Version: 7.3.7.38707)
Juniper Networks, Inc. Setup Client 64-bit Activex Control (Version: 2.1.1.1)
Juniper Networks, Inc. Setup Client Activex Control (x32 Version: 2.1.1.1)
LSI HDA Modem (Version: 2.1.94)
MarketResearch (x32 Version: 130.0.374.000)
Marvell Miniport Driver (x32 Version: 10.70.5.3)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Chart Controls for Microsoft .NET Framework 3.5 (KB2500170) (x32 Version: 3.5.30730.0)
Microsoft Chart Controls for Microsoft .NET Framework 3.5 Language Pack - deu (x32 Version: 3.5.0.0)
Microsoft Office 2010 Service Pack 1 (SP1)
Microsoft Office Access MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Excel MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Groove MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Groove MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office InfoPath MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office InfoPath MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Office 32-bit Components 2010 (Version: 14.0.6029.1000)
Microsoft Office OneNote MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Outlook MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office PowerPoint MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Professional Plus 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (English) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (French) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (Italian) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proofing (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Publisher MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Shared 32-bit MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Shared MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Word MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft SQL Server 2008 (x32)
Microsoft SQL Server 2008 Browser (x32 Version: 10.1.2531.0)
Microsoft SQL Server 2008 Common Files (x32 Version: 10.0.1600.22)
Microsoft SQL Server 2008 Common Files (x32 Version: 10.1.2531.0)
Microsoft SQL Server 2008 Database Engine Services (x32 Version: 10.1.2531.0)
Microsoft SQL Server 2008 Database Engine Shared (x32 Version: 10.1.2531.0)
Microsoft SQL Server 2008 Native Client (Version: 10.1.2531.0)
Microsoft SQL Server 2008 RsFx Driver (x32 Version: 10.1.2531.0)
Microsoft SQL Server VSS Writer (Version: 10.1.2531.0)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 (Version: 8.0.51011)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (x32 Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft® Office Language Pack 2010 – Deutsch (Business Contact Manager für Microsoft Outlook 2010) (Version: 4.0.11308.0)
Miranda IM 0.9.9 (x32)
Movie Maker (x32 Version: 16.4.3503.0728)
Mozilla Firefox 24.0 (x86 de) (x32 Version: 24.0)
Mozilla Maintenance Service (x32 Version: 24.0)
MP4 To MP3 Converter V3.0 (x32)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT110 (x32 Version: 16.4.1108.0727)
MSVCRT110_amd64 (Version: 16.4.1108.0727)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
Network64 (Version: 130.0.572.000)
Network64 (Version: 140.0.221.000)
Nitro Reader 3 (Version: 3.0.10.7)
PDF24 Creator 5.4.0 (x32)
Photo Gallery (x32 Version: 16.4.3503.0728)
Pidgin (x32 Version: 2.7.4)
PS_AIO_06_B109n-z_SW_Min (x32 Version: 130.0.396.000)
QuickTime (x32 Version: 7.74.80.86)
RealDownloader (x32 Version: 1.3.3)
RealNetworks - Microsoft Visual C++ 2008 Runtime (x32 Version: 9.0)
RealNetworks - Microsoft Visual C++ 2010 Runtime (x32 Version: 10.0)
RealPlayer (x32 Version: 16.0.3)
RealUpgrade 1.1 (x32 Version: 1.1.0)
Safari (x32 Version: 5.34.57.2)
Samsung New PC Studio (x32 Version: 1.00.0000)
SAMSUNG USB Driver for Mobile Phones (Version: 1.3.650.0)
Scan (x32 Version: 13.0.0.0)
Scan To (Version: 2.0.1)
SCR3xxx Smart Card Reader (x32 Version: 8.35)
Service Pack 1 für SQL Server 2008 (KB 968369) (x32 Version: 10.1.2531.0)
Shop for HP Supplies (Version: 13.0)
Skype™ 6.6 (x32 Version: 6.6.106)
SmartWebPrinting (x32 Version: 130.0.373.000)
SolutionCenter (x32 Version: 130.0.373.000)
SoundMAX (x32 Version: 6.10.2.7255)
Sql Server Customer Experience Improvement Program (x32 Version: 10.1.2531.0)
Status (x32 Version: 130.0.373.000)
SUPERAntiSpyware (Version: 5.6.1040)
Synaptics Pointing Device Driver (Version: 13.2.6.2)
Toolbox (x32 Version: 130.0.648.000)
TrayApp (x32 Version: 130.0.376.000)
Unterstützungsdateien für Microsoft SQL Server 2008-Setup (x32 Version: 10.1.2531.0)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3)
Update for Microsoft Access 2010 (KB2553446) 64-Bit Edition
Update for Microsoft Filter Pack 2.0 (KB2810071) 64-Bit Edition
Update for Microsoft Office 2010 (KB2494150)
Update for Microsoft Office 2010 (KB2553065)
Update for Microsoft Office 2010 (KB2553181) 64-Bit Edition
Update for Microsoft Office 2010 (KB2553267) 64-Bit Edition
Update for Microsoft Office 2010 (KB2553270) 64-Bit Edition
Update for Microsoft Office 2010 (KB2553310) 64-Bit Edition
Update for Microsoft Office 2010 (KB2566458)
Update for Microsoft Office 2010 (KB2589298) 64-Bit Edition
Update for Microsoft Office 2010 (KB2589375) 64-Bit Edition
Update for Microsoft Office 2010 (KB2598242) 64-Bit Edition
Update for Microsoft Office 2010 (KB2760598) 64-Bit Edition
Update for Microsoft Office 2010 (KB2760631) 64-Bit Edition
Update for Microsoft Office 2010 (KB2767886) 64-Bit Edition
Update for Microsoft Office 2010 (KB2794737) 64-Bit Edition
Update for Microsoft Office 2010 (KB2825640) 64-Bit Edition
Update for Microsoft Office 2010 (KB2826026) 64-Bit Edition
Update for Microsoft OneNote 2010 (KB2553290) 64-Bit Edition
Update for Microsoft OneNote 2010 (KB2810072) 64-Bit Edition
Update for Microsoft Outlook 2010 (KB2687623) 64-Bit Edition
Update for Microsoft Outlook Social Connector 2010 (KB2553406) 64-Bit Edition
Update for Microsoft PowerPoint 2010 (KB2553145) 64-Bit Edition
Update for Microsoft SharePoint Workspace 2010 (KB2589371) 64-Bit Edition
Update for Microsoft Visio Viewer 2010 (KB2810066) 64-Bit Edition
Update for Microsoft Word 2010 (KB2827323) 64-Bit Edition
Visual C++ 9.0 CRT (x86) WinSXS MSM (x32 Version: 9.0)
VLC media player 1.1.5 (x32 Version: 1.1.5)
WDR RadioRecorder (x32)
WebReg (x32 Version: 130.0.132.017)
Windows Live Communications Platform (x32 Version: 16.4.3503.0728)
Windows Live Essentials (x32 Version: 16.4.3503.0728)
Windows Live ID Sign-in Assistant (Version: 7.250.4311.0)
Windows Live Installer (x32 Version: 16.4.3503.0728)
Windows Live Photo Common (x32 Version: 16.4.3503.0728)
Windows Live PIMT Platform (x32 Version: 16.4.3503.0728)
Windows Live SOXE (x32 Version: 16.4.3503.0728)
Windows Live SOXE Definitions (x32 Version: 16.4.3503.0728)
Windows Live UX Platform (x32 Version: 16.4.3503.0728)
Windows Live UX Platform Language Pack (x32 Version: 16.4.3503.0728)
Windows Media Player Firefox Plugin (x32 Version: 1.0.0.8)
WinSCP 4.3.6 (x32 Version: 4.3.6)
==================== Restore Points =========================
17-09-2013 03:12:11 Windows Update
26-09-2013 18:00:19 Geplanter Prüfpunkt
10-10-2013 21:46:29 Windows Update
18-10-2013 10:28:46 Installed Java 7 Update 45
18-10-2013 22:03:45 Installed Cisco Systems VPN Client 5.0.07.0440
25-10-2013 10:08:48 Windows Update
==================== Hosts content: ==========================
2009-07-14 04:34 - 2011-06-09 00:25 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {0103D669-25C6-4921-9C25-267D4B3D986C} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Total Care Tune-Up => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPTuneUp.exe [2011-03-22] (Hewlett-Packard Company)
Task: {14A92BFC-0CCD-4E08-B4D5-30B6CBFF3590} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-1242068612-3420065025-570463520-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {2FBA85DE-F502-4AA9-9087-8751C9C406C0} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1242068612-3420065025-570463520-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {4CFD163F-1AEC-4588-A024-5EB8F6AFA17B} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1242068612-3420065025-570463520-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {51352DD1-71A8-47B5-952B-5257ECCE9AEC} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-1242068612-3420065025-570463520-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {60A7468A-75EE-4BA5-B645-F9B22C9F09AE} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPSFMessenger\HPSFMsgr.exe [2011-06-21] (Hewlett-Packard Company)
Task: {7955A848-8CE6-4DAF-B0B5-A11E1078CE35} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-1242068612-3420065025-570463520-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {7FB01293-4705-4613-81EB-114F701C1A47} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2010-11-20] (Microsoft Corporation)
Task: {9011E21F-0118-4746-B4BD-48295DE67EBE} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {9C8D6621-F0A6-445A-8295-9D021F07E1AA} - System32\Tasks\{D48C862A-0792-4541-81B9-56A1B0286F49} => C:\Program Files (x86)\Skype\Phone\Skype.exe [2013-06-21] (Skype Technologies S.A.)
Task: {B8834A7F-E2D9-42C4-95E3-F7DC6C2187DD} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater\HPSFUpdater.exe [2011-06-14] (Hewlett-Packard)
Task: {C229A2BE-4B26-4902-9BAD-F2B0FA8DA6DC} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2011-06-21] (Hewlett-Packard Company)
Task: {CB80004F-1B39-4DFD-B8B8-558CC22C1D67} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-1242068612-3420065025-570463520-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {CFC7ABA2-77C8-4C6F-9A63-166E62FDE5B0} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {D8DFDF03-B77A-4CD1-B3B4-1F55DA2C5D4D} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2011-06-21] (Hewlett-Packard Company)
Task: {F85E4298-AC5B-4C47-ABD2-76E188535005} - System32\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-1242068612-3420065025-570463520-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\recordingmanager.exe [2013-08-14] (RealNetworks, Inc.)
==================== Loaded Modules (whitelisted) =============
2011-03-17 01:07 - 2011-03-17 01:07 - 04297568 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2013-02-26 11:10 - 2013-02-26 10:24 - 00397704 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2011-03-04 12:49 - 2011-03-04 12:49 - 00202752 _____ () C:\Program Files (x86)\Cisco\VPNClient\vpnapi.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\Users\Schröder\Desktop\Unterstützungsantrag Lehrpreis.jpeg:3or4kl4x13tuuug3Byamue2s4b
AlternateDataStreams: C:\Users\Schröder\Desktop\Unterstützungsantrag Lehrpreis.jpeg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
==================== Safe Mode (whitelisted) ===================
==================== Faulty Device Manager Devices =============
Name: Cisco Systems VPN Adapter for 64-bit Windows
Description: Cisco Systems VPN Adapter for 64-bit Windows
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: CVirtA
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: HP Photosmart Wireless B109n-z
Description: HP Photosmart Wireless B109n-z
Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
Manufacturer: Hewlett-Packard
Service: StillCam
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: Photosmart Wireless B109n-z
Description: Photosmart Wireless B109n-z
Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}
Manufacturer: HP
Service:
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: Deskjet 3000 J310 series
Description: Deskjet 3000 J310 series
Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}
Manufacturer: HP
Service:
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: Deskjet 3000 J310 series
Description: Deskjet 3000 J310 series
Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}
Manufacturer: HP
Service:
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: Deskjet 3000 J310 series
Description: Deskjet 3000 J310 series
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (10/23/2013 11:21:45 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: WebKit2WebProcess.exe, Version: 7534.57.2.4, Zeitstempel: 0x4f97642d
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18229, Zeitstempel: 0x51fb1116
Ausnahmecode: 0x80000003
Fehleroffset: 0x00013219
ID des fehlerhaften Prozesses: 0xe4c
Startzeit der fehlerhaften Anwendung: 0xWebKit2WebProcess.exe0
Pfad der fehlerhaften Anwendung: WebKit2WebProcess.exe1
Pfad des fehlerhaften Moduls: WebKit2WebProcess.exe2
Berichtskennung: WebKit2WebProcess.exe3
Error: (10/23/2013 10:44:53 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: AsGHost.exe, Version: 3.1.1.74, Zeitstempel: 0x4a680dbf
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x69007200
ID des fehlerhaften Prozesses: 0xe3c
Startzeit der fehlerhaften Anwendung: 0xAsGHost.exe0
Pfad der fehlerhaften Anwendung: AsGHost.exe1
Pfad des fehlerhaften Moduls: AsGHost.exe2
Berichtskennung: AsGHost.exe3
Error: (10/23/2013 10:44:48 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: AsGHost.exe, Version: 3.1.1.74, Zeitstempel: 0x4a680dbf
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x65007400
ID des fehlerhaften Prozesses: 0xe3c
Startzeit der fehlerhaften Anwendung: 0xAsGHost.exe0
Pfad der fehlerhaften Anwendung: AsGHost.exe1
Pfad des fehlerhaften Moduls: AsGHost.exe2
Berichtskennung: AsGHost.exe3
Error: (10/23/2013 09:30:10 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: AsGHost.exe, Version: 3.1.1.74, Zeitstempel: 0x4a680dbf
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea8e7
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0002e3be
ID des fehlerhaften Prozesses: 0xccc
Startzeit der fehlerhaften Anwendung: 0xAsGHost.exe0
Pfad der fehlerhaften Anwendung: AsGHost.exe1
Pfad des fehlerhaften Moduls: AsGHost.exe2
Berichtskennung: AsGHost.exe3
Error: (10/23/2013 09:30:03 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: AsGHost.exe, Version: 3.1.1.74, Zeitstempel: 0x4a680dbf
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea8e7
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00042685
ID des fehlerhaften Prozesses: 0xccc
Startzeit der fehlerhaften Anwendung: 0xAsGHost.exe0
Pfad der fehlerhaften Anwendung: AsGHost.exe1
Pfad des fehlerhaften Moduls: AsGHost.exe2
Berichtskennung: AsGHost.exe3
Error: (10/22/2013 10:48:01 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: AsGHost.exe, Version: 3.1.1.74, Zeitstempel: 0x4a680dbf
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0xd96fa900
ID des fehlerhaften Prozesses: 0xc48
Startzeit der fehlerhaften Anwendung: 0xAsGHost.exe0
Pfad der fehlerhaften Anwendung: AsGHost.exe1
Pfad des fehlerhaften Moduls: AsGHost.exe2
Berichtskennung: AsGHost.exe3
Error: (10/21/2013 04:13:48 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: AcroRd32.exe, Version: 10.1.8.24, Zeitstempel: 0x5225d462
Name des fehlerhaften Moduls: MakeAccessible.api, Version: 10.1.8.24, Zeitstempel: 0x5225e182
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000b69a2
ID des fehlerhaften Prozesses: 0x1104
Startzeit der fehlerhaften Anwendung: 0xAcroRd32.exe0
Pfad der fehlerhaften Anwendung: AcroRd32.exe1
Pfad des fehlerhaften Moduls: AcroRd32.exe2
Berichtskennung: AcroRd32.exe3
Error: (10/20/2013 05:34:01 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: AcroRd32.exe, Version: 10.1.8.24, Zeitstempel: 0x5225d462
Name des fehlerhaften Moduls: MakeAccessible.api, Version: 10.1.8.24, Zeitstempel: 0x5225e182
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000b69a2
ID des fehlerhaften Prozesses: 0x1c34
Startzeit der fehlerhaften Anwendung: 0xAcroRd32.exe0
Pfad der fehlerhaften Anwendung: AcroRd32.exe1
Pfad des fehlerhaften Moduls: AcroRd32.exe2
Berichtskennung: AcroRd32.exe3
Error: (10/20/2013 03:24:14 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: AcroRd32.exe, Version: 10.1.8.24, Zeitstempel: 0x5225d462
Name des fehlerhaften Moduls: MakeAccessible.api, Version: 10.1.8.24, Zeitstempel: 0x5225e182
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000b69a2
ID des fehlerhaften Prozesses: 0x1338
Startzeit der fehlerhaften Anwendung: 0xAcroRd32.exe0
Pfad der fehlerhaften Anwendung: AcroRd32.exe1
Pfad des fehlerhaften Moduls: AcroRd32.exe2
Berichtskennung: AcroRd32.exe3
Error: (10/19/2013 06:44:26 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: AsGHost.exe, Version: 3.1.1.74, Zeitstempel: 0x4a680dbf
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea8e7
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000326f1
ID des fehlerhaften Prozesses: 0xf20
Startzeit der fehlerhaften Anwendung: 0xAsGHost.exe0
Pfad der fehlerhaften Anwendung: AsGHost.exe1
Pfad des fehlerhaften Moduls: AsGHost.exe2
Berichtskennung: AsGHost.exe3
System errors:
=============
Error: (10/26/2013 00:54:50 AM) (Source: DCOM) (User: )
Description: {7429F543-2A60-4CB7-8BC5-F27EA898FB44}
Error: (10/25/2013 08:28:16 PM) (Source: DCOM) (User: )
Description: {7429F543-2A60-4CB7-8BC5-F27EA898FB44}
Error: (10/25/2013 10:19:07 AM) (Source: DCOM) (User: )
Description: {7429F543-2A60-4CB7-8BC5-F27EA898FB44}
Error: (10/25/2013 00:47:42 AM) (Source: DCOM) (User: )
Description: {7429F543-2A60-4CB7-8BC5-F27EA898FB44}
Error: (10/24/2013 09:39:39 AM) (Source: DCOM) (User: )
Description: {7429F543-2A60-4CB7-8BC5-F27EA898FB44}
Error: (10/24/2013 00:09:52 AM) (Source: DCOM) (User: )
Description: {7429F543-2A60-4CB7-8BC5-F27EA898FB44}
Error: (10/23/2013 06:15:50 PM) (Source: iaStor) (User: )
Description: Das Gerät \Device\Ide\iaStor0 hat innerhalb der Fehlerwartezeit nicht geantwortet.
Error: (10/23/2013 11:39:47 AM) (Source: DCOM) (User: )
Description: {7429F543-2A60-4CB7-8BC5-F27EA898FB44}
Error: (10/23/2013 09:34:40 AM) (Source: DCOM) (User: )
Description: {7429F543-2A60-4CB7-8BC5-F27EA898FB44}
Error: (10/23/2013 09:13:24 AM) (Source: WMPNetworkSvc) (User: )
Description: WMPNetworkSvc0x80004005
Microsoft Office Sessions:
=========================
Error: (10/23/2013 11:21:45 AM) (Source: Application Error)(User: )
Description: WebKit2WebProcess.exe7534.57.2.44f97642dKERNELBASE.dll6.1.7601.1822951fb11168000000300013219e4c01cecfce9b45fd4dC:\Program Files (x86)\Safari\Apple Application Support\WebKit2WebProcess.exeC:\Windows\syswow64\KERNELBASE.dll888b834f-3bc4-11e3-967c-002713c2bfbb
Error: (10/23/2013 10:44:53 AM) (Source: Application Error)(User: )
Description: AsGHost.exe3.1.1.744a680dbfunknown0.0.0.000000000c000000569007200e3c01cecfc50372bcd0C:\Program Files (x86)\Hewlett-Packard\IAM\Bin\AsGHost.exeunknown624d0101-3bbf-11e3-967c-002713c2bfbb
Error: (10/23/2013 10:44:48 AM) (Source: Application Error)(User: )
Description: AsGHost.exe3.1.1.744a680dbfunknown0.0.0.000000000c000000565007400e3c01cecfc50372bcd0C:\Program Files (x86)\Hewlett-Packard\IAM\Bin\AsGHost.exeunknown5f38feb7-3bbf-11e3-967c-002713c2bfbb
Error: (10/23/2013 09:30:10 AM) (Source: Application Error)(User: )
Description: AsGHost.exe3.1.1.744a680dbfntdll.dll6.1.7601.18247521ea8e7c00000050002e3beccc01cecfbf1e303f69C:\Program Files (x86)\Hewlett-Packard\IAM\Bin\AsGHost.exeC:\Windows\SysWOW64\ntdll.dllf27e5eb1-3bb4-11e3-9392-002713c2bfbb
Error: (10/23/2013 09:30:03 AM) (Source: Application Error)(User: )
Description: AsGHost.exe3.1.1.744a680dbfntdll.dll6.1.7601.18247521ea8e7c000000500042685ccc01cecfbf1e303f69C:\Program Files (x86)\Hewlett-Packard\IAM\Bin\AsGHost.exeC:\Windows\SysWOW64\ntdll.dllee2f3fba-3bb4-11e3-9392-002713c2bfbb
Error: (10/22/2013 10:48:01 PM) (Source: Application Error)(User: )
Description: AsGHost.exe3.1.1.744a680dbfunknown0.0.0.000000000c0000005d96fa900c4801cecf351a37ef4bC:\Program Files (x86)\Hewlett-Packard\IAM\Bin\AsGHost.exeunknown3d0fe7dc-3b5b-11e3-9805-002713c2bfbb
Error: (10/21/2013 04:13:48 PM) (Source: Application Error)(User: )
Description: AcroRd32.exe10.1.8.245225d462MakeAccessible.api10.1.8.245225e182c0000005000b69a2110401cece67aa8a2180C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AcroRd32.exeC:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\MakeAccessible.api008f4629-3a5b-11e3-8d96-002713c2bfbb
Error: (10/20/2013 05:34:01 PM) (Source: Application Error)(User: )
Description: AcroRd32.exe10.1.8.245225d462MakeAccessible.api10.1.8.245225e182c0000005000b69a21c3401cecda9abd6a5d8C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AcroRd32.exeC:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\MakeAccessible.api0a81ee9f-399d-11e3-90d0-002713c2bfbb
Error: (10/20/2013 03:24:14 PM) (Source: Application Error)(User: )
Description: AcroRd32.exe10.1.8.245225d462MakeAccessible.api10.1.8.245225e182c0000005000b69a2133801cecd97a0b5eb73C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AcroRd32.exeC:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\MakeAccessible.apie949f92c-398a-11e3-90d0-002713c2bfbb
Error: (10/19/2013 06:44:26 PM) (Source: Application Error)(User: )
Description: AsGHost.exe3.1.1.744a680dbfntdll.dll6.1.7601.18247521ea8e7c0000005000326f1f2001cecce946dd0e88C:\Program Files (x86)\Hewlett-Packard\IAM\Bin\AsGHost.exeC:\Windows\SysWOW64\ntdll.dllb67e9638-38dd-11e3-9731-002713c2bfbb
==================== Memory info ===========================
Percentage of memory in use: 56%
Total physical RAM: 1976.27 MB
Available physical RAM: 850.87 MB
Total Pagefile: 3952.53 MB
Available Pagefile: 2010.99 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:230.87 GB) (Free:97.74 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (HP_TOOLS) (Fixed) (Total:2 GB) (Free:1.93 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: B0C9B0C9)
Partition 1: (Active) - (Size=231 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=2 GB) - (Type=0C)
==================== End Of Log ============================
GMER Logfile: Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-10-26 10:08:44
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 TOSHIBA_ rev.LH00 232,89GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\SCHRDE~1\AppData\Local\Temp\awddrkob.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Cisco\VPNClient\cvpnd.exe[2044] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076801465 2 bytes [80, 76]
.text C:\Program Files (x86)\Cisco\VPNClient\cvpnd.exe[2044] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000768014bb 2 bytes [80, 76]
.text ... * 2
.text C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe[2152] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 0000000076d78769 5 bytes JMP 0000000100641870
.text C:\Program Files (x86)\Hewlett-Packard\IAM\Bin\AsGHost.exe[3200] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076801465 2 bytes [80, 76]
.text C:\Program Files (x86)\Hewlett-Packard\IAM\Bin\AsGHost.exe[3200] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000768014bb 2 bytes [80, 76]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANOTIF.EXE[3520] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076801465 2 bytes [80, 76]
.text C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANOTIF.EXE[3520] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000768014bb 2 bytes [80, 76]
.text ... * 2
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe[3716] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076801465 2 bytes [80, 76]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe[3716] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000768014bb 2 bytes [80, 76]
.text ... * 2
.text C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe[4044] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076801465 2 bytes [80, 76]
.text C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe[4044] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000768014bb 2 bytes [80, 76]
.text ... * 2
.text C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\pthosttr.exe[4052] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000076801465 2 bytes [80, 76]
.text C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\pthosttr.exe[4052] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000768014bb 2 bytes [80, 76]
.text ... * 2
.text C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe[3428] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076801465 2 bytes [80, 76]
.text C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe[3428] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000768014bb 2 bytes [80, 76]
.text ... * 2
.text C:\Program Files (x86)\PDF24\pdf24.exe[4172] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076801465 2 bytes [80, 76]
.text C:\Program Files (x86)\PDF24\pdf24.exe[4172] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000768014bb 2 bytes [80, 76]
.text ... * 2
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[2932] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076801465 2 bytes [80, 76]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[2932] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000768014bb 2 bytes [80, 76]
.text ... * 2
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[4600] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076801465 2 bytes [80, 76]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[4600] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000768014bb 2 bytes [80, 76]
.text ... * 2
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[5156] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076801465 2 bytes [80, 76]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[5156] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000768014bb 2 bytes [80, 76]
.text ... * 2
---- Threads - GMER 2.1 ----
Thread C:\Windows\system32\svchost.exe [1240:1280] 000007fefacf341c
Thread C:\Windows\system32\svchost.exe [1240:1284] 000007fefacf3a2c
Thread C:\Windows\system32\svchost.exe [1240:1288] 000007fefacf3768
Thread C:\Windows\system32\svchost.exe [1240:1292] 000007fefacf5c20
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\002713c2bfbb
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\002713c2bfbb (not active ControlSet)
---- EOF - GMER 2.1 ----
|
|
26.10.2013, 11:28
| #2 | |
| /// the machine /// TB-Ausbilder    | Windows 7: Spammailversand, dann Schädlingsfund hi,
__________________Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!Downloade dir bitte Combofix vom folgenden Downloadspiegel Link 1 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
__________________ |
|
26.10.2013, 13:10
| #3 |
| | Windows 7: Spammailversand, dann Schädlingsfund Hallo schrauber,
__________________vielen Dank für die schnelle Antwort, das gewünschte Logfile kommt hier: Code:
ATTFilter ComboFix 13-10-26.01 - Schröder 26.10.2013 13:39:38.1.2 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1252.49.1031.18.1976.859 [GMT 2:00]
ausgeführt von:: c:\users\Schr÷der\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\Thumbs.db
c:\windows\Installer\{5FDC06BF-3D3D-4367-8FFB-4FAFCB61972D}\Icon09DB8A851.exe
c:\windows\IsUn0407.exe
.
c:\windows\SysWow64\drivers\ntfs.sys . . . ist infiziert!!
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-09-26 bis 2013-10-26 ))))))))))))))))))))))))))))))
.
.
2013-10-26 11:56 . 2013-10-26 11:56 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-10-25 18:43 . 2013-10-25 18:43 -------- d-----w- C:\FRST
2013-10-25 10:44 . 2013-10-25 10:44 -------- d-----w- c:\users\Schröder\AppData\Roaming\SUPERAntiSpyware.com
2013-10-25 10:43 . 2013-10-25 10:45 -------- d-----w- c:\program files\SUPERAntiSpyware
2013-10-25 10:43 . 2013-10-25 10:43 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2013-10-25 10:09 . 2013-10-15 23:20 10280728 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{96E1B3DC-1A0B-4C76-861C-074612FE8E31}\mpengine.dll
2013-10-18 22:05 . 2013-10-18 22:05 -------- d-----w- c:\program files\Common Files\Deterministic Networks
2013-10-18 22:05 . 2013-10-18 22:05 -------- d-----w- c:\program files (x86)\Cisco Systems
2013-10-18 22:05 . 2013-10-18 22:05 -------- d-----w- c:\program files (x86)\Cisco
2013-10-18 22:03 . 2013-10-18 22:03 -------- d-----w- c:\windows\RRZE
2013-10-18 10:31 . 2013-10-18 10:31 -------- d-----w- c:\programdata\Oracle
2013-10-18 10:31 . 2013-10-18 10:31 -------- d-----w- c:\program files (x86)\Common Files\Java
2013-10-18 10:30 . 2013-10-18 10:30 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-10-13 19:20 . 2012-04-06 07:48 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-10-13 19:20 . 2011-05-28 18:52 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-10-10 21:52 . 2010-08-30 11:57 80541720 ----a-w- c:\windows\system32\MRT.exe
2013-10-01 08:20 . 2013-05-02 09:06 83160 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2013-10-01 08:20 . 2013-03-30 16:01 28600 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2013-10-01 08:20 . 2013-03-30 16:01 132600 ----a-w- c:\windows\system32\drivers\avipbb.sys
2013-10-01 08:20 . 2013-03-30 16:01 105856 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2013-09-03 12:35 . 2010-08-27 18:02 278800 ------w- c:\windows\system32\MpSigStub.exe
2013-09-02 08:32 . 2013-09-02 08:32 348160 ----a-w- c:\windows\SysWow64\msvcr71.dll
2013-09-02 08:32 . 2013-09-02 08:32 499712 ----a-w- c:\windows\SysWow64\msvcp71.dll
2013-08-29 01:48 . 2013-10-10 20:57 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2013-08-09 15:44 . 2013-09-16 17:08 226816 ----a-w- c:\windows\system32\hpbprtmonui.dll
2013-08-09 15:43 . 2013-09-16 17:08 424960 ----a-w- c:\windows\system32\hpbrprtmon.dll
2013-08-09 15:42 . 2013-09-16 17:08 404992 ----a-w- c:\windows\system32\hpbprtmon.dll
2013-08-05 02:25 . 2013-09-15 06:46 155584 ----a-w- c:\windows\system32\drivers\ataport.sys
2013-08-02 08:08 . 2011-06-08 18:23 594024 ----a-w- c:\windows\system32\dsNcSmartCardProv.dll
2013-08-02 08:08 . 2011-06-08 18:23 423528 ----a-w- c:\windows\system32\dsNcCredProv.dll
2013-08-02 08:08 . 2013-08-02 08:08 357992 ----a-w- c:\windows\SysWow64\dsGinaLoaderX64.dll
2013-08-02 07:37 . 2013-08-02 07:37 36816 ----a-w- c:\windows\system32\drivers\dsNcAdpt.sys
2013-08-02 02:14 . 2013-09-15 06:45 215040 ----a-w- c:\windows\system32\winsrv.dll
2013-08-02 02:13 . 2013-09-15 06:46 424448 ----a-w- c:\windows\system32\KernelBase.dll
2013-08-02 02:13 . 2013-09-15 06:46 1161216 ----a-w- c:\windows\system32\kernel32.dll
2013-08-02 02:12 . 2013-09-15 06:45 43520 ----a-w- c:\windows\system32\csrsrv.dll
2013-08-02 02:12 . 2013-09-15 06:45 6144 ---ha-w- c:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-08-02 02:12 . 2013-09-15 06:45 4608 ---ha-w- c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-08-02 02:12 . 2013-09-15 06:45 4096 ---ha-w- c:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-08-02 02:12 . 2013-09-15 06:45 4096 ---ha-w- c:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-08-02 02:12 . 2013-09-15 06:45 3072 ---ha-w- c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-08-02 02:12 . 2013-09-15 06:45 3072 ---ha-w- c:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-08-02 02:12 . 2013-09-15 06:45 3072 ---ha-w- c:\windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-08-02 02:12 . 2013-09-15 06:45 6656 ----a-w- c:\windows\system32\apisetschema.dll
2013-08-02 02:12 . 2013-09-15 06:45 3584 ---ha-w- c:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-08-02 02:12 . 2013-09-15 06:45 3584 ---ha-w- c:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-08-02 02:12 . 2013-09-15 06:45 3584 ---ha-w- c:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-08-02 02:12 . 2013-09-15 06:45 3072 ---ha-w- c:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-08-02 02:12 . 2013-09-15 06:45 4608 ---ha-w- c:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-08-02 02:12 . 2013-09-15 06:45 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-08-02 02:12 . 2013-09-15 06:45 3584 ---ha-w- c:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-08-02 02:12 . 2013-09-15 06:45 3584 ---ha-w- c:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-08-02 02:12 . 2013-09-15 06:45 3584 ---ha-w- c:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-08-02 02:12 . 2013-09-15 06:45 3584 ---ha-w- c:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-08-02 02:12 . 2013-09-15 06:45 3072 ---ha-w- c:\windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-08-02 02:12 . 2013-09-15 06:45 3072 ---ha-w- c:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-08-02 02:12 . 2013-09-15 06:45 3072 ---ha-w- c:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-08-02 02:12 . 2013-09-15 06:45 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-08-02 02:12 . 2013-09-15 06:45 5120 ---ha-w- c:\windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-08-02 02:12 . 2013-09-15 06:45 3072 ---ha-w- c:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-08-02 02:12 . 2013-09-15 06:45 3072 ---ha-w- c:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-08-02 02:12 . 2013-09-15 06:45 3072 ---ha-w- c:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-08-02 02:12 . 2013-09-15 06:45 3072 ---ha-w- c:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-08-02 02:12 . 2013-09-15 06:45 3072 ---ha-w- c:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-08-02 02:12 . 2013-09-15 06:45 3072 ---ha-w- c:\windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-08-02 01:50 . 2013-09-15 06:46 274944 ----a-w- c:\windows\SysWow64\KernelBase.dll
2013-08-02 01:48 . 2013-09-15 06:45 5120 ---ha-w- c:\windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
2013-08-02 01:48 . 2013-09-15 06:45 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-08-02 01:48 . 2013-09-15 06:45 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
2013-08-02 01:48 . 2013-09-15 06:45 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-08-02 01:48 . 2013-09-15 06:45 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
2013-08-02 01:48 . 2013-09-15 06:45 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-08-02 01:48 . 2013-09-15 06:45 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
2013-08-02 01:48 . 2013-09-15 06:45 4608 ---ha-w- c:\windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
2013-08-02 01:48 . 2013-09-15 06:45 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
2013-08-02 01:48 . 2013-09-15 06:45 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
2013-08-02 01:48 . 2013-09-15 06:45 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-08-02 01:48 . 2013-09-15 06:45 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
2013-08-02 01:48 . 2013-09-15 06:45 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-08-02 01:48 . 2013-09-15 06:45 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
2013-08-02 01:48 . 2013-09-15 06:45 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
2013-08-02 01:48 . 2013-09-15 06:45 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
2013-08-02 01:48 . 2013-09-15 06:45 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
2013-08-02 01:48 . 2013-09-15 06:45 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
2013-08-02 01:48 . 2013-09-15 06:45 6656 ----a-w- c:\windows\SysWow64\apisetschema.dll
2013-08-02 01:48 . 2013-09-15 06:45 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
2013-08-02 01:48 . 2013-09-15 06:45 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-08-02 01:48 . 2013-09-15 06:45 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
2013-08-02 01:48 . 2013-09-15 06:45 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
2013-08-02 01:48 . 2013-09-15 06:45 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
2013-08-02 01:48 . 2013-09-15 06:45 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
2013-08-02 01:09 . 2013-09-15 06:45 338432 ----a-w- c:\windows\system32\conhost.exe
2013-08-02 00:59 . 2013-09-15 06:45 112640 ----a-w- c:\windows\system32\smss.exe
2013-08-02 00:43 . 2013-09-15 06:45 6144 ---ha-w- c:\windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
2013-08-02 00:43 . 2013-09-15 06:45 4608 ---ha-w- c:\windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
2013-08-02 00:43 . 2013-09-15 06:45 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
2013-08-02 00:43 . 2013-09-15 06:45 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AutorunsDisabled\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 130736 ----a-w- c:\users\Schröder\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AutorunsDisabled\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 130736 ----a-w- c:\users\Schröder\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AutorunsDisabled\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 130736 ----a-w- c:\users\Schröder\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"OfficeSyncProcess"="c:\program files\Microsoft Office\Office14\MSOSYNC.EXE" [2013-04-22 911040]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2013-10-02 6588144]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files (x86)\Analog Devices\Core\smax4pnp.exe" [2009-05-18 1314816]
"PTHOSTTR"="c:\program files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE" [2009-07-30 354360]
"CognizanceTS"="c:\progra~3\HEWLET~1\IAM\Bin\ASTSVCC.dll" [2009-07-23 24848]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
"HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2011-05-10 49208]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-10-01 681032]
"PDFPrint"="c:\program files (x86)\PDF24\pdf24.exe" [2013-03-20 162856]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888]
"TkBellExe"="c:\program files (x86)\real\realplayer\Update\realsched.exe" [2013-09-02 295512]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
.
c:\users\Schröder\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files\Microsoft Office\Office14\ONENOTEM.EXE /tsr [2013-6-25 246472]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2009-5-21 275768]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"AppInit_DLLs"=c:\progra~3\HEWLET~1\IAM\Bin\APSHook.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 HP ProtectTools Service;HP ProtectTools Service;c:\program files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe;c:\program files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe [x]
R3 HP1210FAX;HP1210MFP FAX;c:\windows\system32\Drivers\HPM1210FAX.sys;c:\windows\SYSNATIVE\Drivers\HPM1210FAX.sys [x]
R3 mvusbews;USB EWS Device;c:\windows\system32\Drivers\mvusbews.sys;c:\windows\SYSNATIVE\Drivers\mvusbews.sys [x]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [x]
R3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\DRIVERS\ss_bbus.sys;c:\windows\SYSNATIVE\DRIVERS\ss_bbus.sys [x]
R3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\DRIVERS\ss_bmdfl.sys;c:\windows\SYSNATIVE\DRIVERS\ss_bmdfl.sys [x]
R3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\DRIVERS\ss_bmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ss_bmdm.sys [x]
R3 TFsExDisk;TFsExDisk;c:\windows\System32\Drivers\TFsExDisk.sys;c:\windows\SYSNATIVE\Drivers\TFsExDisk.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R4 MSSQLServerADHelper100;SQL Server Hilfsdienst für Active Directory;c:\program files (x86)\Microsoft SQL Server\100\Shared\SQLADHLP.EXE;c:\program files (x86)\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [x]
R4 SQLAgent$MSSMLBIZ;SQL Server-Agent (MSSMLBIZ);c:\program files (x86)\Microsoft SQL Server\MSSQL10.MSSMLBIZ\MSSQL\Binn\SQLAGENT.EXE;c:\program files (x86)\Microsoft SQL Server\MSSQL10.MSSMLBIZ\MSSQL\Binn\SQLAGENT.EXE [x]
S0 SafeBoot;SafeBoot; [x]
S0 SbAlg;SbAlg; [x]
S0 SbFsLock;SbFsLock; [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S1 RsvLock;RsvLock; [x]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [x]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [x]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 ASBroker;Logon Session Broker;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
S2 ASChannel;Lokaler Verbindungskanal;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
S2 ATService;AuthenTec Fingerprint Service;c:\program files\Fingerprint Sensor\ATService.exe;c:\program files\Fingerprint Sensor\ATService.exe [x]
S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [x]
S2 HpFkCryptService;Drive Encryption Service;c:\program files (x86)\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe;c:\program files (x86)\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [x]
S2 HPM1210RcvFaxSrvc;HP LaserJet Professional M1210 MFP Series Receive Fax Service;c:\program files\HP\HP LaserJet M1210 MFP Series\ReceiveFaxUtility.exe;c:\program files\HP\HP LaserJet M1210 MFP Series\ReceiveFaxUtility.exe [x]
S2 HPSIService;HP SI Service;c:\windows\system32\HPSIsvc.exe;c:\windows\SYSNATIVE\HPSIsvc.exe [x]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe;c:\windows\SYSNATIVE\Hpservice.exe [x]
S2 NitroReaderDriverReadSpool3;NitroPDFReaderDriverCreatorReadSpool3;c:\program files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe;c:\program files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe [x]
S2 Radio.fx;Radio.fx Server;c:\program files (x86)\Tobit Radio.fx\Server\rfx-server.exe;c:\program files (x86)\Tobit Radio.fx\Server\rfx-server.exe [x]
S2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe;c:\program files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [x]
S2 yksvc;Marvell Yukon Service;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
S3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys;c:\windows\SYSNATIVE\drivers\IntcHdmi.sys [x]
S3 NETw5s64;Intel(R) Wireless WiFi Link Adaptertreiber für Windows 7 64-Bit;c:\windows\system32\DRIVERS\NETw5s64.sys;c:\windows\SYSNATIVE\DRIVERS\NETw5s64.sys [x]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
Cognizance REG_MULTI_SZ ASBroker
Bioscrypt REG_MULTI_SZ ASChannel
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AutorunsDisabled\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 164016 ----a-w- c:\users\Schröder\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AutorunsDisabled\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 164016 ----a-w- c:\users\Schröder\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AutorunsDisabled\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 164016 ----a-w- c:\users\Schröder\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AutorunsDisabled\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 164016 ----a-w- c:\users\Schröder\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-08-02 165912]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-08-02 387608]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-08-02 365592]
"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-08-25 186904]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 112512]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\progra~3\HEWLET~1\IAM\Bin\APSHook64.dll
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
IE: An OneNote s&enden - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\Schröder\AppData\Roaming\Mozilla\Firefox\Profiles\g0g0n6qj.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.gmx.net/
FF - ExtSQL: 2013-09-02 10:34; {DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}; c:\programdata\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF - ExtSQL: !HIDDEN! 2010-08-30 19:16; smartwebprinting@hp.com; c:\program files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKLM-Run-NPSStartup - (no file)
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\vpngui.exe.lnk - c:\windows\Installer\{5FDC06BF-3D3D-4367-8FFB-4FAFCB61972D}\Icon09DB8A851.exe -user_logon
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-{CA43FE4F-9FF2-4AD7-88F0-CC3BAC17B226} - c:\program files (x86)\InstallShield Installation Information\{CA43FE4F-9FF2-4AD7-88F0-CC3BAC17B226}\setup.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Cisco\VPNClient\cvpnd.exe
c:\program files (x86)\Juniper Networks\Common Files\dsNcService.exe
c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\program files (x86)\Hewlett-Packard\IAM\Bin\AsGHost.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2013-10-26 14:07:18 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2013-10-26 12:07
.
Vor Suchlauf: 19 Verzeichnis(se), 114.323.558.400 Bytes frei
Nach Suchlauf: 27 Verzeichnis(se), 115.549.446.144 Bytes frei
.
- - End Of File - - EBA82B1988E8A00796DD5B24B497F66D
A36C5E4F47E84449FF07ED3517B43A31
|
|
26.10.2013, 18:22
| #4 |
| /// the machine /// TB-Ausbilder | Windows 7: Spammailversand, dann Schädlingsfund Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
26.10.2013, 19:36
| #5 |
| | Windows 7: Spammailversand, dann Schädlingsfund Vielen Dank wieder für die Antwort, hier nun die Logs. Nun bin ich mal gespannt, ob es gut oder schlecht ist, dass Anti-Malware nichts gefunden hat. Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.10.26.06 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 8.0.7601.17514 Schröder :: SCHRÖDER-PC [Administrator] 26.10.2013 19:53:33 mbam-log-2013-10-26 (19-53-33).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 212326 Laufzeit: 8 Minute(n), 12 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Code:
ATTFilter # AdwCleaner v3.010 - Bericht erstellt am 26/10/2013 um 20:05:51
# Updated 20/10/2013 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : Schröder - SCHRÖDER-PC
# Gestartet von : C:\Users\Schröder\Desktop\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\Uniblue\DriverScanner
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\driverscanner
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\driverscanner_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\driverscanner_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_free-flv-converter_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_free-flv-converter_RASMANCS
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Schlüssel Gelöscht : HKCU\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\StartSearch
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKLM\Software\Conduit
***** [ Browser ] *****
-\\ Internet Explorer v0.0.0.0
-\\ Mozilla Firefox v24.0 (de)
[ Datei : C:\Users\Schröder\AppData\Roaming\Mozilla\Firefox\Profiles\g0g0n6qj.default\prefs.js ]
*************************
AdwCleaner[R0].txt - [2197 octets] - [26/10/2013 20:04:59]
AdwCleaner[S0].txt - [1853 octets] - [26/10/2013 20:05:51]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1913 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.7 (10.15.2013:3)
OS: Windows 7 Professional x64
Ran by Schr”der on 26.10.2013 at 20:12:56,12
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL
~~~ Registry Keys
~~~ Files
~~~ Folders
~~~ FireFox
Emptied folder: C:\Users\Schr”der\AppData\Roaming\mozilla\firefox\profiles\g0g0n6qj.default\minidumps [1019 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 26.10.2013 at 20:21:33,57
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-10-2013
Ran by Schröder (administrator) on SCHRÖDER-PC on 26-10-2013 20:23:24
Running from C:\Users\Schröder\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(AuthenTec, Inc.) C:\Program Files\Fingerprint Sensor\ATService.exe
(McAfee, Inc.) C:\Program Files (x86)\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe
(Hewlett-Packard) C:\Windows\system32\Hpservice.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
(Andrea Electronics Corporation) C:\Windows\system32\AEADISRV.EXE
(LSI Corporation) C:\Program Files\LSI SoftModem\agr64svc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corporation) C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\VPNClient\cvpnd.exe
(Juniper Networks) C:\Program Files (x86)\Juniper Networks\Common Files\dsNcService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(HP) C:\Program Files\HP\HP LaserJet M1210 MFP Series\ReceiveFaxUtility.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(HP) C:\Windows\system32\HPSIsvc.exe
(Nitro PDF Software) C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe
() C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe
() C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Bioscrypt Inc.) C:\Program Files (x86)\Hewlett-Packard\IAM\Bin\AsGHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANOTIF.EXE
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Analog Devices, Inc.) C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\pthosttr.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [IAAnotif] - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-08-25] (Intel Corporation)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1815848 2009-07-30] (Synaptics Incorporated)
HKLM\...\Run: [BCSSync] - C:\Program Files\Microsoft Office\Office14\BCSSync.exe [112512 2010-03-13] (Microsoft Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKCU\...\Run: [OfficeSyncProcess] - C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE [911040 2013-04-22] (Microsoft Corporation)
HKCU\...\Run: [SUPERAntiSpyware] - C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [6588144 2013-10-02] (SUPERAntiSpyware)
HKLM-x32\...\Run: [SoundMAXPnP] - C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe [1314816 2009-05-18] (Analog Devices, Inc.)
HKLM-x32\...\Run: [PTHOSTTR] - C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE [354360 2009-07-30] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [CognizanceTS] - C:\PROGRA~3\HEWLET~1\IAM\Bin\ASTSVCC.dll [24848 2009-07-23] (Bioscrypt Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2011-05-10] (Hewlett-Packard)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [681032 2013-10-01] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [162856 2013-03-20] (Geek Software GmbH)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [TkBellExe] - c:\program files (x86)\real\realplayer\Update\realsched.exe [295512 2013-09-02] (RealNetworks, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
AppInit_DLLs: C:\PROGRA~3\HEWLET~1\IAM\Bin\APSHook64.dll C:\PROGRA~3\HEWLET~1\IAM\bin\APSHOO~1.DLL [382224 2009-07-23] (Bioscrypt Inc.)
AppInit_DLLs-x32: C:\PROGRA~3\HEWLET~1\IAM\Bin\APSHook.dll [89872 2009-07-23] (Bioscrypt Inc.)
Startup: C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Credential Manager for HP ProtectTools - {0EA99306-BC87-4930-9E1D-1D1EA32A7E4E} - C:\Program Files (x86)\Hewlett-Packard\IAM\Bin\ItIEAddIn64.dll (Bioscrypt Inc.)
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Credential Manager for HP ProtectTools - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files (x86)\Hewlett-Packard\IAM\Bin\ItIEAddIn.dll (Bioscrypt Inc.)
DPF: HKLM {AA570693-00E2-4907-B6F1-60A1199B030C} https://juniper.net/dana-cached/sc/JuniperSetupClient64.cab
DPF: HKLM-x32 {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://juniper.net/dana-cached/sc/JuniperSetupClient.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Schröder\AppData\Roaming\Mozilla\Firefox\Profiles\g0g0n6qj.default
FF Homepage: hxxp://www.gmx.net/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~3\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~3\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3503.0728 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nitropdf.com/NitroPDF - C:\Program Files (x86)\Nitro\Reader 3\npnitromozilla.dll (Nitro PDF)
FF Plugin-x32: @real.com/nppl3260;version=16.0.3.51 - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=16.0.3.51 - c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @phonostar.de/phonostar - C:\Program Files (x86)\phonostar-Player\npphonostarDetectNP.dll No File
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101721.dll (Amazon.com, Inc.)
FF SearchPlugin: C:\Users\Schröder\AppData\Roaming\Mozilla\Firefox\Profiles\g0g0n6qj.default\searchplugins\amazon-search-suggestions.xml
FF SearchPlugin: C:\Users\Schröder\AppData\Roaming\Mozilla\Firefox\Profiles\g0g0n6qj.default\searchplugins\myvideo-suche-.xml
FF SearchPlugin: C:\Users\Schröder\AppData\Roaming\Mozilla\Firefox\Profiles\g0g0n6qj.default\searchplugins\ponseu--englisch--deutsch.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: personas - C:\Users\Schröder\AppData\Roaming\Mozilla\Firefox\Profiles\g0g0n6qj.default\Extensions\personas@christopher.beard.xpi
FF Extension: Adblock Plus - C:\Users\Schröder\AppData\Roaming\Mozilla\Firefox\Profiles\g0g0n6qj.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF HKLM-x32\...\Firefox\Extensions: [{DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
==================== Services (Whitelisted) =================
R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [143120 2013-05-23] (SUPERAntiSpyware.com)
R2 AEADIFilters; C:\Windows\system32\AEADISRV.EXE [111616 2008-07-15] (Andrea Electronics Corporation)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440392 2013-10-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440392 2013-10-01] (Avira Operations GmbH & Co. KG)
R2 ASBroker; C:\Program Files (x86)\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll [192784 2009-07-23] (Bioscrypt Inc.)
R2 ASChannel; C:\Program Files (x86)\Hewlett-Packard\IAM\Bin\AsChnl.dll [150288 2009-07-23] (Bioscrypt Inc.)
R2 BcmSqlStartupSvc; C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe [34216 2010-03-25] (Microsoft Corporation)
R2 CVPND; C:\Program Files (x86)\Cisco\VPNClient\cvpnd.exe [1529856 2011-03-04] (Cisco Systems, Inc.)
S3 HP ProtectTools Service; C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe [45056 2009-07-30] (Hewlett-Packard Development Company, L.P)
R2 HpFkCryptService; C:\Program Files (x86)\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [256544 2009-07-29] (McAfee, Inc.)
R2 HPM1210RcvFaxSrvc; C:\Program Files\HP\HP LaserJet M1210 MFP Series\ReceiveFaxUtility.exe [361888 2012-07-25] (HP)
S3 MSSQL$MSSMLBIZ; C:\Program Files (x86)\Microsoft SQL Server\MSSQL10.MSSMLBIZ\MSSQL\Binn\sqlservr.exe [43010392 2009-03-30] (Microsoft Corporation)
R2 NitroReaderDriverReadSpool3; C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe [230416 2012-12-17] (Nitro PDF Software)
R2 Radio.fx; C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe [3673944 2011-11-18] ()
R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-08-14] ()
S4 SQLAgent$MSSMLBIZ; C:\Program Files (x86)\Microsoft SQL Server\MSSQL10.MSSMLBIZ\MSSQL\Binn\SQLAGENT.EXE [366936 2009-03-30] (Microsoft Corporation)
R2 yksvc; C:\Windows\System32\yk62x64.dll [382976 2009-07-20] (Marvell)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105856 2013-10-01] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132600 2013-10-01] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-01] (Avira Operations GmbH & Co. KG)
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
S3 HP1210FAX; C:\Windows\System32\Drivers\HPM1210FAX.sys [16896 2012-11-08] ()
S3 mvusbews; C:\Windows\System32\Drivers\mvusbews.sys [20480 2012-12-24] (Marvell Semiconductor, Inc.)
R1 RsvLock; C:\Windows\System32\Drivers\RsvLock.sys [14880 2009-07-29] (SafeBoot International)
R0 SafeBoot; C:\Windows\System32\Drivers\SafeBoot.sys [55840 2009-07-29] ()
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R0 SbAlg; C:\Windows\System32\Drivers\SbAlg.sys [60160 2007-07-16] (SafeBoot N.V.)
R0 SbFsLock; C:\Windows\System32\Drivers\SbFsLock.sys [15392 2009-07-29] (SafeBoot International)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1805104 2009-07-02] ()
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
========================== Drivers MD5 =======================
C:\Windows\system32\drivers\1394ohci.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\Accelerometer.sys 1CFFE9C06E66A57DAE1452E449A58240
C:\Windows\System32\drivers\ACPI.sys ==> MD5 is legit
C:\Windows\system32\drivers\acpipmi.sys ==> MD5 is legit
C:\Windows\System32\drivers\ADIHdAud.sys 560649E6A9C11F6124F97310EF387C45
C:\Windows\system32\DRIVERS\adp94xx.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adpahci.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adpu320.sys ==> MD5 is legit
C:\Windows\system32\drivers\afd.sys 314C17917AC8523EC77A710215012A65
C:\Windows\System32\DRIVERS\agrsm64.sys AF4748EF93416159459769A24A0053AF
C:\Windows\system32\drivers\agp440.sys ==> MD5 is legit
C:\Windows\system32\drivers\aliide.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdide.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\amdk8.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\amdppm.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdsata.sys D4121AE6D0C0E7E13AA221AA57EF2D49
C:\Windows\system32\DRIVERS\amdsbs.sys ==> MD5 is legit
C:\Windows\System32\drivers\amdxata.sys 540DAF1CEA6094886D72126FD7C33048
C:\Windows\system32\drivers\appid.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\arc.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\arcsas.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\asyncmac.sys ==> MD5 is legit
C:\Windows\System32\drivers\atapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\avgntflt.sys 29F9901C22E7BFE23DF8389AFC530D3D
C:\Windows\System32\DRIVERS\avipbb.sys 033CA7F2EABD7EFDC482FE45DD7E1B60
C:\Windows\System32\DRIVERS\avkmgr.sys 390184FAD8FCC1B6DA25AEBAE928C3B6
C:\Windows\system32\DRIVERS\bxvbda.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\b57nd60a.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Beep.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\blbdrive.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bowser.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\BrFiltLo.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\BrFiltUp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bridge.sys 5C2F352A4E961D72518261257AAE204B
C:\Windows\System32\Drivers\Brserid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrSerWdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbMdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbSer.sys ==> MD5 is legit
C:\Windows\system32\drivers\BthEnum.sys CF98190A94F62E405C8CB255018B2315
C:\Windows\system32\DRIVERS\bthmodem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bthpan.sys 02DD601B708DD0667E1331FA8518E9FF
C:\Windows\System32\Drivers\BTHport.sys 738D0E9272F59EB7A1449C3EC118E6C4
C:\Windows\System32\Drivers\BTHUSB.sys F188B7394D81010767B6DF3178519A37
C:\Windows\System32\DRIVERS\cdfs.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\cdrom.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\circlass.sys ==> MD5 is legit
C:\Windows\System32\CLFS.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\CmBatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\cmdide.sys ==> MD5 is legit
C:\Windows\System32\Drivers\cng.sys 9AC4F97C2D3E93367E2148EA940CD2CD
C:\Windows\System32\DRIVERS\compbatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\CompositeBus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\crcdisk.sys ==> MD5 is legit
C:\Windows\System32\drivers\csc.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\CVirtA64.sys 44BDDEB03C84A1C993C992FFB5700357
C:\Windows\system32\Drivers\CVPNDRVA.sys 79AF0E203D089AF442A3F70ED00A37FB
C:\Windows\System32\Drivers\dfsc.sys ==> MD5 is legit
C:\Windows\System32\drivers\discache.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\disk.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\dne64x.sys 05CB5910B3CA6019FC3CCA815EE06FFB
C:\Windows\System32\DRIVERS\Dot4.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\Dot4Prt.sys E9F5969233C5D89F3C35E3A66A52A361
C:\Windows\System32\DRIVERS\dot4usb.sys ==> MD5 is legit
C:\Windows\System32\drivers\drmkaud.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\dsNcAdpt.sys F2D97A85F4F6E0942BC17C4EECEEE6B7
C:\Windows\System32\drivers\dxgkrnl.sys 88612F1CE3BF42256913BF6E61C70D52
C:\Windows\system32\DRIVERS\evbda.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\elxstor.sys ==> MD5 is legit
C:\Windows\system32\drivers\errdev.sys ==> MD5 is legit
C:\Windows\System32\Drivers\exfat.sys ==> MD5 is legit
C:\Windows\System32\Drivers\fastfat.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\fdc.sys ==> MD5 is legit
C:\Windows\System32\drivers\fileinfo.sys ==> MD5 is legit
C:\Windows\System32\drivers\filetrace.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\flpydisk.sys ==> MD5 is legit
C:\Windows\System32\drivers\fltmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\FsDepends.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Fs_Rec.sys 6BD9295CC032DD3077C671FCCF579A7B
C:\Windows\System32\DRIVERS\fvevol.sys 8F6322049018354F45F05A2FD2D4E5E0
C:\Windows\system32\DRIVERS\gagp30kx.sys ==> MD5 is legit
C:\Windows\system32\drivers\hcw85cir.sys ==> MD5 is legit
C:\Windows\system32\drivers\HdAudio.sys 975761C778E33CD22498059B91E7373A
C:\Windows\system32\drivers\HDAudBus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\HidBatt.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\hidbth.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\hidir.sys ==> MD5 is legit
C:\Windows\system32\drivers\hidusb.sys ==> MD5 is legit
C:\Windows\System32\Drivers\HPM1210FAX.sys A92C9C5736F158D27C01C5EE239B29DC
C:\Windows\System32\DRIVERS\hpdskflt.sys 05712FDDBD45A5864EB326FAABC6A4E3
C:\Windows\system32\drivers\HpSAMD.sys ==> MD5 is legit
C:\Windows\System32\drivers\HTTP.sys ==> MD5 is legit
C:\Windows\System32\drivers\hwpolicy.sys ==> MD5 is legit
C:\Windows\system32\drivers\i8042prt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\iaStor.sys BBB3B6DF1ABB0FE35802EDE85CC1C011
C:\Windows\system32\drivers\iaStorV.sys AAAF44DB3BD0B9D1FB6969B23ECC8366
C:\Windows\System32\DRIVERS\igdkmd64.sys DFEAF0A1D98D397035012C8E28D1520F
C:\Windows\system32\DRIVERS\iirsp.sys ==> MD5 is legit
C:\Windows\System32\drivers\IntcHdmi.sys D485D3BD3E2179AA86853A182F70699F
C:\Windows\system32\drivers\intelide.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\intelppm.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ipfltdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\IPMIDrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\ipnat.sys ==> MD5 is legit
C:\Windows\System32\drivers\irenum.sys ==> MD5 is legit
C:\Windows\system32\drivers\isapnp.sys ==> MD5 is legit
C:\Windows\system32\drivers\msiscsi.sys ==> MD5 is legit
C:\Windows\system32\drivers\kbdclass.sys ==> MD5 is legit
C:\Windows\system32\drivers\kbdhid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\ksecdd.sys 97A7070AEA4C058B6418519E869A63B4
C:\Windows\System32\Drivers\ksecpkg.sys 26C43A7C2862447EC59DEDA188D1DA07
C:\Windows\system32\drivers\ksthunk.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\lltdio.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_fc.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_sas.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_sas2.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_scsi.sys ==> MD5 is legit
C:\Windows\system32\drivers\luafv.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\megasas.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\MegaSR.sys ==> MD5 is legit
C:\Windows\System32\drivers\modem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\monitor.sys ==> MD5 is legit
C:\Windows\system32\drivers\mouclass.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\mouhid.sys ==> MD5 is legit
C:\Windows\System32\drivers\mountmgr.sys ==> MD5 is legit
C:\Windows\system32\drivers\mpio.sys ==> MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\mrxdav.sys 1A4F75E63C9FB84B85DFFC6B63FD5404
C:\Windows\System32\DRIVERS\mrxsmb.sys A5D9106A73DC88564C825D317CAC68AC
C:\Windows\System32\DRIVERS\mrxsmb10.sys D711B3C1D5F42C0C2415687BE09FC163
C:\Windows\System32\DRIVERS\mrxsmb20.sys 9423E9D355C8D303E76B8CFBD8A5C30C
C:\Windows\System32\drivers\msahci.sys ==> MD5 is legit
C:\Windows\system32\drivers\msdsm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Msfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\mshidkmdf.sys ==> MD5 is legit
C:\Windows\System32\drivers\msisadrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSKSSRV.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPCLOCK.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPQM.sys ==> MD5 is legit
C:\Windows\System32\Drivers\MsRPC.sys ==> MD5 is legit
C:\Windows\system32\drivers\mssmbios.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSTEE.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\MTConfig.sys ==> MD5 is legit
C:\Windows\System32\Drivers\mup.sys ==> MD5 is legit
C:\Windows\System32\Drivers\mvusbews.sys 705E9675014EB688BEDD967B1ABECF19
C:\Windows\System32\DRIVERS\nwifi.sys ==> MD5 is legit
C:\Windows\System32\drivers\ndis.sys 760E38053BF56E501D562B70AD796B88
C:\Windows\System32\DRIVERS\ndiscap.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndistapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndisuio.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndiswan.sys ==> MD5 is legit
C:\Windows\System32\Drivers\NDProxy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbios.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\NETw5s64.sys 39EDE676D17F37AF4573C2B33EC28ACA
C:\Windows\system32\DRIVERS\nfrd960.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Npfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Ntfs.sys B98F8C6E31CD07B2E6F71F7F648E38C0
C:\Windows\System32\Drivers\Null.sys ==> MD5 is legit
C:\Windows\system32\drivers\nvraid.sys 0A92CB65770442ED0DC44834632F66AD
C:\Windows\system32\drivers\nvstor.sys DAB0E87525C10052BF65F06152F37E4A
C:\Windows\system32\drivers\nv_agp.sys ==> MD5 is legit
C:\Windows\system32\drivers\ohci1394.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\parport.sys ==> MD5 is legit
C:\Windows\System32\drivers\partmgr.sys E9766131EEADE40A27DC27D2D68FBA9C
C:\Windows\System32\drivers\pci.sys ==> MD5 is legit
C:\Windows\system32\drivers\pciide.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\pcmcia.sys ==> MD5 is legit
C:\Windows\System32\drivers\pcw.sys ==> MD5 is legit
C:\Windows\System32\drivers\peauth.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspptp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\processr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\pacer.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\ql2300.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\ql40xx.sys ==> MD5 is legit
C:\Windows\system32\drivers\qwavedrv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasacd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\AgileVpn.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasl2tp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspppoe.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rassstp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rdbss.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rdpbus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\RDPCDD.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpdr.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpencdd.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdprefmp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\RDPWD.sys E61608AA35E98999AF9AAEEEA6114B0A
C:\Windows\System32\drivers\rdyboost.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rfcomm.sys 3DD798846E2C28102B922C56E71B7932
C:\Windows\System32\DRIVERS\rspndr.sys ==> MD5 is legit
C:\Windows\System32\Drivers\RsvLock.sys 67834AF0371F69A1B512998DAECCE098
C:\Windows\system32\drivers\vms3cap.sys ==> MD5 is legit
C:\Windows\System32\Drivers\SafeBoot.sys D41D8CD98F00B204E9800998ECF8427E
C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS 3289766038DB2CB14D07DC84392138D5
C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS 58A38E75F3316A83C23DF6173D41F2B5
C:\Windows\System32\Drivers\SbAlg.sys 1CFC2E8659484FA6E512405A0F79A00A
C:\Windows\System32\Drivers\SbFsLock.sys D11E0001180353F83177C3B869C6CE8E
C:\Windows\system32\drivers\sbp2port.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\scfilter.sys ==> MD5 is legit
C:\Windows\System32\Drivers\secdrv.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\serenum.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\serial.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sermouse.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffdisk.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_mmc.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_sd.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sfloppy.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\SiSRaid2.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sisraid4.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\smb.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\snp2uvc.sys 882989F257A746FE02D3AC582E4C839B
C:\Windows\System32\Drivers\spldr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\srv.sys 441FBA48BFF01FDB9D5969EBC1838F0B
C:\Windows\System32\DRIVERS\srv2.sys B4ADEBBF5E3677CCE9651E0F01F7CC28
C:\Windows\System32\DRIVERS\srvnet.sys 27E461F0BE5BFF5FC737328F749538C3
C:\Windows\System32\DRIVERS\ss_bbus.sys EF806D212D34B0E173BAEB3564D53E37
C:\Windows\System32\DRIVERS\ss_bmdfl.sys 08B1B34ABEBEB6AC2DEA06900C56411E
C:\Windows\System32\DRIVERS\ss_bmdm.sys 71A9DA6BEAA4CB54DFB827FB78600A5D
C:\Windows\system32\DRIVERS\stexstor.sys ==> MD5 is legit
C:\Windows\system32\drivers\serscan.sys DECACB6921DED1A38642642685D77DAC
C:\Windows\System32\drivers\vmstorfl.sys ==> MD5 is legit
C:\Windows\system32\drivers\storvsc.sys ==> MD5 is legit
C:\Windows\system32\drivers\swenum.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\SynTP.sys FD0FE92DD56C704D0AEDEC79DBFF1728
C:\Windows\System32\drivers\tbhsd.sys 93F0F5EF8A4CA261372DF98B31B2BD05
C:\Windows\System32\drivers\tcpip.sys 40AF23633D197905F03AB5628C558C51
C:\Windows\System32\DRIVERS\tcpip.sys 40AF23633D197905F03AB5628C558C51
C:\Windows\System32\drivers\tcpipreg.sys 1B16D0BD9841794A6E0CDE0CEF744ABC
C:\Windows\System32\drivers\tdpipe.sys ==> MD5 is legit
C:\Windows\System32\drivers\tdtcp.sys 51C5ECEB1CDEE2468A1748BE550CFBC8
C:\Windows\System32\DRIVERS\tdx.sys ==> MD5 is legit
C:\Windows\system32\drivers\termdd.sys ==> MD5 is legit
C:\Windows\System32\Drivers\TFsExDisk.sys 48D9D00C2E0E72C3D4F52772C80355F6
C:\Windows\SysWow64\Drivers\TFsExDisk.sys 48D9D00C2E0E72C3D4F52772C80355F6
C:\Windows\System32\DRIVERS\tssecsrv.sys 4CE278FC9671BA81A138D70823FCAA09
C:\Windows\System32\drivers\tsusbflt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\tunnel.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\uagp35.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\udfs.sys ==> MD5 is legit
C:\Windows\system32\drivers\uliagpkx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\umbus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\umpass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\usbccgp.sys 6F1A3157A1C89435352CEB543CDB359C
C:\Windows\system32\drivers\usbcir.sys 80B0F7D5CCF86CEB5D402EAAF61FEC31
C:\Windows\System32\DRIVERS\usbehci.sys C025055FE7B87701EB042095DF1A2D7B
C:\Windows\System32\DRIVERS\usbhub.sys 287C6C9410B111B68B52CA298F7B8C24
C:\Windows\system32\drivers\usbohci.sys 9840FC418B4CBD632D3D0A667A725C31
C:\Windows\System32\DRIVERS\usbprint.sys ==> MD5 is legit
C:\Windows\system32\drivers\usbscan.sys 9661DA76B4531B2DA272ECCE25A8AF24
C:\Windows\System32\DRIVERS\USBSTOR.SYS FED648B01349A3C8395A5169DB5FB7D6
C:\Windows\System32\DRIVERS\usbuhci.sys 62069A34518BCF9C1FD9E74B3F6DB7CD
C:\Windows\System32\Drivers\usbvideo.sys 1F775DA4CF1A3A1834207E975A72E9D7
C:\Windows\System32\drivers\vdrvroot.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vgapnp.sys ==> MD5 is legit
C:\Windows\System32\drivers\vga.sys ==> MD5 is legit
C:\Windows\system32\drivers\vhdmp.sys ==> MD5 is legit
C:\Windows\system32\drivers\viaide.sys ==> MD5 is legit
C:\Windows\System32\drivers\vmbus.sys ==> MD5 is legit
C:\Windows\system32\drivers\VMBusHID.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgrx.sys ==> MD5 is legit
C:\Windows\System32\drivers\volsnap.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\vsmraid.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwifibus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwififlt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwifimp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\wacompen.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\wd.sys ==> MD5 is legit
C:\Windows\System32\drivers\Wdf01000.sys E2C933EDBC389386EBE6D2BA953F43D8
C:\Windows\System32\DRIVERS\wfplwf.sys ==> MD5 is legit
C:\Windows\System32\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\SysWow64\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\WinUsb.sys FE88B288356E7B47B74B13372ADD906D
C:\Windows\system32\drivers\wmiacpi.sys ==> MD5 is legit
C:\Windows\system32\drivers\ws2ifsl.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\WSDPrint.sys 8D918B1DB190A4D9B1753A66FA8C96E8
C:\Windows\System32\drivers\WudfPf.sys AB886378EEB55C6C75B4F2D14B6C869F
C:\Windows\System32\DRIVERS\WUDFRd.sys DDA4CAF29D8C0A297F886BFE561E6659
C:\Windows\System32\DRIVERS\yk62x64.sys 6AFFD75C6807B3DD3AB018E27B88EF95
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-10-26 20:21 - 2013-10-26 20:21 - 00000899 _____ C:\Users\Schröder\Desktop\JRT.txt
2013-10-26 20:12 - 2013-10-26 20:12 - 00000000 ____D C:\Windows\ERUNT
2013-10-26 20:09 - 2013-10-26 20:09 - 00001997 _____ C:\Users\Schröder\Desktop\AdwCleaner[S0].txt
2013-10-26 20:04 - 2013-10-26 20:05 - 00000000 ____D C:\AdwCleaner
2013-10-26 19:52 - 2013-10-26 19:52 - 00000000 ____D C:\Users\Schröder\AppData\Roaming\Malwarebytes
2013-10-26 19:51 - 2013-10-26 19:51 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-10-26 19:51 - 2013-10-26 19:51 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-26 19:51 - 2013-10-26 19:51 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-10-26 19:51 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-10-26 19:35 - 2013-10-26 19:35 - 01060070 _____ C:\Users\Schröder\Desktop\adwcleaner.exe
2013-10-26 19:35 - 2013-10-26 19:35 - 01033335 _____ (Thisisu) C:\Users\Schröder\Desktop\JRT.exe
2013-10-26 19:34 - 2013-10-26 19:34 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Schröder\Desktop\mbam-setup-1.75.0.1300.exe
2013-10-26 14:07 - 2013-10-26 14:07 - 00029265 _____ C:\ComboFix.txt
2013-10-26 13:36 - 2013-10-26 14:07 - 00000000 ____D C:\Qoobox
2013-10-26 13:36 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-10-26 13:36 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-10-26 13:36 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-10-26 13:36 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-10-26 13:36 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-10-26 13:36 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-10-26 13:36 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-10-26 13:36 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-10-26 13:35 - 2013-10-26 14:04 - 00000000 ____D C:\Windows\erdnt
2013-10-26 13:30 - 2013-10-26 13:30 - 05136694 ____R (Swearware) C:\Users\Schröder\Desktop\ComboFix.exe
2013-10-26 10:10 - 2013-10-26 10:10 - 00007652 _____ C:\Users\Schröder\Desktop\GMER.txt
2013-10-26 09:34 - 2013-10-26 09:38 - 00034479 _____ C:\Users\Schröder\Desktop\FRSTerstes.txt
2013-10-26 09:33 - 2013-10-26 09:34 - 00031532 _____ C:\Users\Schröder\Desktop\AdditionErstes.txt
2013-10-26 09:31 - 2013-10-26 09:31 - 01956086 _____ (Farbar) C:\Users\Schröder\Desktop\FRST64.exe
2013-10-25 20:48 - 2013-10-25 20:48 - 00377856 _____ C:\Users\Schröder\Desktop\gmer_2.1.19163.exe
2013-10-25 20:43 - 2013-10-25 20:43 - 00000000 ____D C:\FRST
2013-10-25 20:41 - 2013-10-25 20:41 - 00000478 _____ C:\Users\Schröder\Desktop\defogger_disable.log
2013-10-25 20:41 - 2013-10-25 20:41 - 00000000 _____ C:\Users\Schröder\defogger_reenable
2013-10-25 20:40 - 2013-10-25 20:40 - 00050477 _____ C:\Users\Schröder\Desktop\Defogger.exe
2013-10-25 20:27 - 2013-10-25 20:27 - 00035820 _____ C:\Users\Schröder\Desktop\SUPERAntiSpyware Scan Log - 10-25-2013 - 20-24-59.log
2013-10-25 20:02 - 2013-10-25 20:02 - 00701332 _____ C:\Users\Schröder\Desktop\Unterstützungsantrag Lehrpreis.jpeg
2013-10-25 12:44 - 2013-10-25 12:44 - 00000000 ____D C:\Users\Schröder\AppData\Roaming\SUPERAntiSpyware.com
2013-10-25 12:43 - 2013-10-25 12:45 - 00000000 ____D C:\Program Files\SUPERAntiSpyware
2013-10-25 12:43 - 2013-10-25 12:43 - 00001808 _____ C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
2013-10-25 12:43 - 2013-10-25 12:43 - 00000000 ____D C:\ProgramData\SUPERAntiSpyware.com
2013-10-25 12:40 - 2013-10-25 12:42 - 27853504 _____ (SUPERAntiSpyware) C:\Users\Schröder\Desktop\SUPERAntiSpyware.exe
2013-10-19 00:05 - 2013-10-19 00:05 - 00000000 ____D C:\Program Files\Common Files\Deterministic Networks
2013-10-19 00:05 - 2013-10-19 00:05 - 00000000 ____D C:\Program Files (x86)\Cisco Systems
2013-10-19 00:05 - 2013-10-19 00:05 - 00000000 ____D C:\Program Files (x86)\Cisco
2013-10-19 00:04 - 2013-10-19 00:07 - 00001593 _____ C:\Windows\VPNInstall.MIF
2013-10-19 00:03 - 2013-10-19 00:03 - 05333322 _____ C:\Users\Schröder\Downloads\rzinst-Cisco-VPNClient-5.0.07.0440x64.exe
2013-10-19 00:03 - 2013-10-19 00:03 - 00000594 _____ C:\Windows\RRZE.LOG
2013-10-19 00:03 - 2013-10-19 00:03 - 00000000 ____D C:\Windows\RRZE
2013-10-18 12:33 - 2013-10-18 12:33 - 00915368 _____ (Oracle Corporation) C:\Users\Schröder\Downloads\jre-7u45-windows-i586-iftw.exe
2013-10-18 12:31 - 2013-10-18 12:31 - 00000000 ____D C:\ProgramData\Oracle
2013-10-18 12:30 - 2013-10-18 12:30 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-10-18 12:30 - 2013-10-18 12:30 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-10-18 12:30 - 2013-10-18 12:30 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-10-18 12:30 - 2013-10-18 12:30 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-10-11 16:59 - 2013-10-11 17:03 - 00000000 ____D C:\Users\Schröder\Desktop\Erlangen
2013-10-10 22:57 - 2013-09-14 03:10 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-10-10 22:57 - 2013-09-08 04:30 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-10-10 22:57 - 2013-09-08 04:27 - 00327168 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2013-10-10 22:57 - 2013-09-08 04:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswsock.dll
2013-10-10 22:57 - 2013-08-29 04:17 - 05549504 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-10-10 22:57 - 2013-08-29 04:16 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-10-10 22:57 - 2013-08-29 04:16 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2013-10-10 22:57 - 2013-08-29 04:16 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-10-10 22:57 - 2013-08-29 04:13 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2013-10-10 22:57 - 2013-08-29 03:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-10-10 22:57 - 2013-08-29 03:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-10-10 22:57 - 2013-08-29 03:50 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-10-10 22:57 - 2013-08-29 03:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2013-10-10 22:57 - 2013-08-29 03:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-10-10 22:57 - 2013-08-29 03:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2013-10-10 22:57 - 2013-08-29 02:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-10-10 22:57 - 2013-08-29 02:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-10-10 22:57 - 2013-08-29 02:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-10-10 22:57 - 2013-08-29 02:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-10-10 22:57 - 2013-08-28 03:21 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-10-10 22:57 - 2013-08-28 03:12 - 00461312 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll
2013-10-10 22:57 - 2013-08-01 14:09 - 00983488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-10-10 22:57 - 2013-07-20 12:33 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-10 22:57 - 2013-07-20 12:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2013-10-10 22:57 - 2013-07-12 12:41 - 00185344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys
2013-10-10 22:57 - 2013-07-12 12:41 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
2013-10-10 22:57 - 2013-07-04 14:57 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2013-10-10 22:57 - 2013-07-04 14:50 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2013-10-10 22:57 - 2013-07-04 14:50 - 00102400 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2013-10-10 22:57 - 2013-07-04 13:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll
2013-10-10 22:57 - 2013-07-04 13:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll
2013-10-10 22:57 - 2013-07-04 13:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2013-10-10 22:57 - 2013-07-04 12:11 - 00140800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2013-10-10 22:57 - 2013-07-03 06:40 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys
2013-10-10 22:57 - 2013-07-03 06:05 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2013-10-10 22:57 - 2013-07-03 06:05 - 00032896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2013-10-10 22:57 - 2013-06-26 00:55 - 00785624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2013-10-10 22:57 - 2013-06-06 07:50 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2013-10-10 22:57 - 2013-06-06 07:49 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2013-10-10 22:57 - 2013-06-06 07:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2013-10-10 22:57 - 2013-06-06 07:47 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2013-10-10 22:57 - 2013-06-06 06:57 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2013-10-10 22:57 - 2013-06-06 06:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2013-10-10 22:57 - 2013-06-06 06:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2013-10-10 22:57 - 2013-06-06 05:30 - 00368128 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-10-10 22:57 - 2013-06-06 05:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2013-10-10 22:57 - 2013-06-06 05:01 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2013-09-30 21:33 - 2013-09-30 21:33 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-26 20:42 - 2013-09-26 20:42 - 98009570 _____ C:\Windows\SysWOW64\璅ḼM
2013-09-26 14:42 - 2013-09-26 14:42 - 97961477 _____ C:\Windows\SysWOW64\灷檪Ḽ¡
==================== One Month Modified Files and Folders =======
2013-10-26 20:21 - 2013-10-26 20:21 - 00000899 _____ C:\Users\Schröder\Desktop\JRT.txt
2013-10-26 20:15 - 2009-07-14 06:45 - 00009712 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-26 20:15 - 2009-07-14 06:45 - 00009712 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-26 20:12 - 2013-10-26 20:12 - 00000000 ____D C:\Windows\ERUNT
2013-10-26 20:11 - 2010-08-25 21:23 - 01798944 _____ C:\Windows\WindowsUpdate.log
2013-10-26 20:11 - 2009-08-30 07:25 - 00724550 _____ C:\Windows\system32\perfh007.dat
2013-10-26 20:11 - 2009-08-30 07:25 - 00157018 _____ C:\Windows\system32\perfc007.dat
2013-10-26 20:11 - 2009-07-14 07:13 - 01695360 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-26 20:10 - 2009-07-14 04:34 - 00000422 _____ C:\Windows\win.ini
2013-10-26 20:09 - 2013-10-26 20:09 - 00001997 _____ C:\Users\Schröder\Desktop\AdwCleaner[S0].txt
2013-10-26 20:07 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-26 20:07 - 2009-07-14 06:51 - 00213499 _____ C:\Windows\setupact.log
2013-10-26 20:05 - 2013-10-26 20:04 - 00000000 ____D C:\AdwCleaner
2013-10-26 20:05 - 2013-03-13 12:56 - 00000000 ____D C:\ProgramData\Uniblue
2013-10-26 19:52 - 2013-10-26 19:52 - 00000000 ____D C:\Users\Schröder\AppData\Roaming\Malwarebytes
2013-10-26 19:51 - 2013-10-26 19:51 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-10-26 19:51 - 2013-10-26 19:51 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-26 19:51 - 2013-10-26 19:51 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-10-26 19:35 - 2013-10-26 19:35 - 01060070 _____ C:\Users\Schröder\Desktop\adwcleaner.exe
2013-10-26 19:35 - 2013-10-26 19:35 - 01033335 _____ (Thisisu) C:\Users\Schröder\Desktop\JRT.exe
2013-10-26 19:34 - 2013-10-26 19:34 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Schröder\Desktop\mbam-setup-1.75.0.1300.exe
2013-10-26 19:30 - 2013-09-22 12:58 - 00003374 _____ C:\Windows\System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-1242068612-3420065025-570463520-1000
2013-10-26 19:30 - 2013-09-22 12:58 - 00003246 _____ C:\Windows\System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-1242068612-3420065025-570463520-1000
2013-10-26 16:52 - 2013-05-26 17:14 - 00000000 ____D C:\Users\Schröder\Desktop\Einzelzeug
2013-10-26 16:51 - 2010-10-15 19:21 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-10-26 14:07 - 2013-10-26 14:07 - 00029265 _____ C:\ComboFix.txt
2013-10-26 14:07 - 2013-10-26 13:36 - 00000000 ____D C:\Qoobox
2013-10-26 14:07 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2013-10-26 14:04 - 2013-10-26 13:35 - 00000000 ____D C:\Windows\erdnt
2013-10-26 14:00 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2013-10-26 13:58 - 2010-08-26 20:43 - 07422800 _____ C:\Windows\PFRO.log
2013-10-26 13:58 - 2009-07-14 04:34 - 89915392 _____ C:\Windows\system32\config\SOFTWARE.bak
2013-10-26 13:58 - 2009-07-14 04:34 - 17825792 _____ C:\Windows\system32\config\SYSTEM.bak
2013-10-26 13:58 - 2009-07-14 04:34 - 00524288 _____ C:\Windows\system32\config\DEFAULT.bak
2013-10-26 13:58 - 2009-07-14 04:34 - 00262144 _____ C:\Windows\system32\config\SECURITY.bak
2013-10-26 13:58 - 2009-07-14 04:34 - 00262144 _____ C:\Windows\system32\config\SAM.bak
2013-10-26 13:30 - 2013-10-26 13:30 - 05136694 ____R (Swearware) C:\Users\Schröder\Desktop\ComboFix.exe
2013-10-26 12:02 - 2010-10-15 19:22 - 00000000 ____D C:\Program Files\Microsoft Office
2013-10-26 10:10 - 2013-10-26 10:10 - 00007652 _____ C:\Users\Schröder\Desktop\GMER.txt
2013-10-26 09:42 - 2010-08-26 20:40 - 00000000 ____D C:\Program Files\Fingerprint Sensor
2013-10-26 09:38 - 2013-10-26 09:34 - 00034479 _____ C:\Users\Schröder\Desktop\FRSTerstes.txt
2013-10-26 09:34 - 2013-10-26 09:33 - 00031532 _____ C:\Users\Schröder\Desktop\AdditionErstes.txt
2013-10-26 09:31 - 2013-10-26 09:31 - 01956086 _____ (Farbar) C:\Users\Schröder\Desktop\FRST64.exe
2013-10-25 20:48 - 2013-10-25 20:48 - 00377856 _____ C:\Users\Schröder\Desktop\gmer_2.1.19163.exe
2013-10-25 20:43 - 2013-10-25 20:43 - 00000000 ____D C:\FRST
2013-10-25 20:41 - 2013-10-25 20:41 - 00000478 _____ C:\Users\Schröder\Desktop\defogger_disable.log
2013-10-25 20:41 - 2013-10-25 20:41 - 00000000 _____ C:\Users\Schröder\defogger_reenable
2013-10-25 20:41 - 2010-08-25 21:31 - 00000000 ____D C:\Users\Schröder
2013-10-25 20:40 - 2013-10-25 20:40 - 00050477 _____ C:\Users\Schröder\Desktop\Defogger.exe
2013-10-25 20:27 - 2013-10-25 20:27 - 00035820 _____ C:\Users\Schröder\Desktop\SUPERAntiSpyware Scan Log - 10-25-2013 - 20-24-59.log
2013-10-25 20:02 - 2013-10-25 20:02 - 00701332 _____ C:\Users\Schröder\Desktop\Unterstützungsantrag Lehrpreis.jpeg
2013-10-25 12:45 - 2013-10-25 12:43 - 00000000 ____D C:\Program Files\SUPERAntiSpyware
2013-10-25 12:44 - 2013-10-25 12:44 - 00000000 ____D C:\Users\Schröder\AppData\Roaming\SUPERAntiSpyware.com
2013-10-25 12:43 - 2013-10-25 12:43 - 00001808 _____ C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
2013-10-25 12:43 - 2013-10-25 12:43 - 00000000 ____D C:\ProgramData\SUPERAntiSpyware.com
2013-10-25 12:42 - 2013-10-25 12:40 - 27853504 _____ (SUPERAntiSpyware) C:\Users\Schröder\Desktop\SUPERAntiSpyware.exe
2013-10-24 23:53 - 2010-08-31 15:48 - 00000000 ____D C:\Users\Schröder\Desktop\Uni
2013-10-22 19:42 - 2013-09-02 10:35 - 00003352 _____ C:\Windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1242068612-3420065025-570463520-1000
2013-10-22 19:42 - 2013-09-02 10:35 - 00003224 _____ C:\Windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1242068612-3420065025-570463520-1000
2013-10-21 00:56 - 2012-01-29 13:48 - 00016976 _____ C:\Users\Schröder\Meine Konzerte.xlsx
2013-10-21 00:29 - 2010-09-07 21:10 - 00000000 ____D C:\Users\Schröder\AppData\Roaming\Skype
2013-10-19 00:07 - 2013-10-19 00:04 - 00001593 _____ C:\Windows\VPNInstall.MIF
2013-10-19 00:05 - 2013-10-19 00:05 - 00000000 ____D C:\Program Files\Common Files\Deterministic Networks
2013-10-19 00:05 - 2013-10-19 00:05 - 00000000 ____D C:\Program Files (x86)\Cisco Systems
2013-10-19 00:05 - 2013-10-19 00:05 - 00000000 ____D C:\Program Files (x86)\Cisco
2013-10-19 00:03 - 2013-10-19 00:03 - 05333322 _____ C:\Users\Schröder\Downloads\rzinst-Cisco-VPNClient-5.0.07.0440x64.exe
2013-10-19 00:03 - 2013-10-19 00:03 - 00000594 _____ C:\Windows\RRZE.LOG
2013-10-19 00:03 - 2013-10-19 00:03 - 00000000 ____D C:\Windows\RRZE
2013-10-18 12:33 - 2013-10-18 12:33 - 00915368 _____ (Oracle Corporation) C:\Users\Schröder\Downloads\jre-7u45-windows-i586-iftw.exe
2013-10-18 12:31 - 2013-10-18 12:31 - 00000000 ____D C:\ProgramData\Oracle
2013-10-18 12:30 - 2013-10-18 12:30 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-10-18 12:30 - 2013-10-18 12:30 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-10-18 12:30 - 2013-10-18 12:30 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-10-18 12:30 - 2013-10-18 12:30 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-10-13 21:20 - 2012-04-06 09:48 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-10-13 21:20 - 2011-05-28 20:52 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-10-11 17:03 - 2013-10-11 16:59 - 00000000 ____D C:\Users\Schröder\Desktop\Erlangen
2013-10-11 17:02 - 2013-06-05 23:35 - 00000000 ____D C:\Users\Schröder\Desktop\Anderes
2013-10-11 08:08 - 2009-07-14 06:45 - 00418464 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-10 23:55 - 2013-08-14 22:29 - 00000000 ____D C:\Windows\system32\MRT
2013-10-10 23:52 - 2010-08-30 13:57 - 80541720 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-10-09 21:27 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2013-10-01 10:20 - 2013-05-02 11:06 - 00083160 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-10-01 10:20 - 2013-03-30 18:01 - 00132600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-10-01 10:20 - 2013-03-30 18:01 - 00105856 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-10-01 10:20 - 2013-03-30 18:01 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-10-01 10:16 - 2012-04-24 20:16 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-09-30 21:34 - 2010-08-27 19:30 - 00000000 ____D C:\Users\Schröder\AppData\Local\Mozilla
2013-09-30 21:33 - 2013-09-30 21:33 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-26 20:42 - 2013-09-26 20:42 - 98009570 _____ C:\Windows\SysWOW64\璅ḼM
2013-09-26 20:04 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-09-26 14:42 - 2013-09-26 14:42 - 97961477 _____ C:\Windows\SysWOW64\灷檪Ḽ¡
Some content of TEMP:
====================
C:\Users\Schröder\AppData\Local\Temp\avgnt.exe
C:\Users\Schröder\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== BCD ================================
Windows-Start-Manager
---------------------
Bezeichner {bootmgr}
device partition=C:
description Windows Boot Manager
locale de-DE
inherit {globalsettings}
default {current}
resumeobject {28f06da2-b0d1-11df-8ceb-db82f01d490c}
displayorder {current}
toolsdisplayorder {memdiag}
timeout 30
Windows-Startladeprogramm
-------------------------
Bezeichner {current}
device partition=C:
path \Windows\system32\winload.exe
description Windows 7
locale de-DE
inherit {bootloadersettings}
recoverysequence {28f06da4-b0d1-11df-8ceb-db82f01d490c}
recoveryenabled Yes
osdevice partition=C:
systemroot \Windows
resumeobject {28f06da2-b0d1-11df-8ceb-db82f01d490c}
nx OptIn
Windows-Startladeprogramm
-------------------------
Bezeichner {28f06da4-b0d1-11df-8ceb-db82f01d490c}
device ramdisk=[C:]\Recovery\28f06da4-b0d1-11df-8ceb-db82f01d490c\Winre.wim,{28f06da5-b0d1-11df-8ceb-db82f01d490c}
path \windows\system32\winload.exe
description Windows Recovery Environment
inherit {bootloadersettings}
osdevice ramdisk=[C:]\Recovery\28f06da4-b0d1-11df-8ceb-db82f01d490c\Winre.wim,{28f06da5-b0d1-11df-8ceb-db82f01d490c}
systemroot \windows
nx OptIn
winpe Yes
Wiederaufnahme aus dem Ruhezustand
----------------------------------
Bezeichner {28f06da2-b0d1-11df-8ceb-db82f01d490c}
device partition=C:
path \Windows\system32\winresume.exe
description Windows Resume Application
locale de-DE
inherit {resumeloadersettings}
filedevice partition=C:
filepath \hiberfil.sys
debugoptionenabled No
Windows-Speichertestprogramm
----------------------------
Bezeichner {memdiag}
device partition=C:
path \boot\memtest.exe
description Windows-Speicherdiagnose
locale de-DE
inherit {globalsettings}
badmemoryaccess Yes
Windows-Legacybetriebssystem-Ladeprogramm
-----------------------------------------
Bezeichner {ntldr}
device partition=C:
path \ntldr
description Frhere Windows-Version
EMS-Einstellungen
-----------------
Bezeichner {emssettings}
bootems Yes
Debuggereinstellungen
---------------------
Bezeichner {dbgsettings}
debugtype Serial
debugport 1
baudrate 115200
RAM-Defekte
-----------
Bezeichner {badmemory}
Globale Einstellungen
---------------------
Bezeichner {globalsettings}
inherit {dbgsettings}
{emssettings}
{badmemory}
Startladeprogramm-Einstellungen
-------------------------------
Bezeichner {bootloadersettings}
inherit {globalsettings}
{hypervisorsettings}
Hypervisoreinstellungen
-------------------
Bezeichner {hypervisorsettings}
hypervisordebugtype Serial
hypervisordebugport 1
hypervisorbaudrate 115200
Einstellungen zur Ladeprogrammfortsetzung
-----------------------------------------
Bezeichner {resumeloadersettings}
inherit {globalsettings}
Ger„teoptionen
--------------
Bezeichner {28f06da5-b0d1-11df-8ceb-db82f01d490c}
description Ramdisk Options
ramdisksdidevice partition=C:
ramdisksdipath \Recovery\28f06da4-b0d1-11df-8ceb-db82f01d490c\boot.sdi
LastRegBack: 2013-10-21 14:00
==================== End Of Log ============================
--- --- --- --- --- --- Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 26-10-2013
Ran by Schröder at 2013-10-26 20:24:17
Running from C:\Users\Schröder\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Disabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Disabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
64 Bit HP CIO Components Installer (Version: 7.2.8)
Adobe Flash Player 10 ActiveX (x32 Version: 10.1.53.64)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.117)
Adobe Reader X (10.1.8) - Deutsch (x32 Version: 10.1.8)
Amazon MP3-Downloader 1.0.17 (x32 Version: 1.0.17)
Apple Application Support (x32 Version: 2.3.4)
Apple Software Update (x32 Version: 2.1.3.127)
AuthenTec Fingerprint System (Version: 8.0.202.0)
Avira Free Antivirus (x32 Version: 14.0.0.383)
B109n-z (x32 Version: 130.0.396.000)
Bombermaaan 1.4 (x32)
Bonjour (Version: 3.0.0.10)
BufferChm (x32 Version: 130.0.331.000)
Business Contact Manager for Microsoft Outlook 2010 (Version: 4.0.11308.0)
Business Contact Manager für Microsoft Outlook 2010 (Version: 4.0.11308.0)
CDBurnerXP (Version: 4.3.8.2631)
CDBurnerXP (x32 Version: 4.4.0.2838)
Cisco Systems VPN Client 5.0.07.0440 (Version: 5.0.7)
Credential Manager for HP ProtectTools (x32 Version: 4.1.5.1483)
D3DX10 (x32 Version: 15.4.2368.0902)
Definition Update for Microsoft Office 2010 (KB982726) 64-Bit Edition
Destinations (x32 Version: 130.0.0.0)
DeviceDiscovery (x32 Version: 130.0.372.000)
DoulosSIL 4.106 (x32)
Drive Encryption for HP ProtectTools (Version: 4.0.24)
Dropbox (HKCU Version: 2.0.22)
Fotogalerie (x32 Version: 16.4.3503.0728)
Free FLV Converter V 7.1.0 (x32 Version: 7.1.0.0)
GPBaseService2 (x32 Version: 130.0.371.000)
Hewlett-Packard ACLM.NET v1.1.1.0 (x32 Version: 1.00.0000)
HP 3D DriveGuard (Version: 4.0.3.1)
HP Customer Participation Program 13.0 (Version: 13.0)
HP ePrint (x32 Version: 10.0.13228.1563)
HP ESU for Microsoft Windows 7 (x32 Version: 1.0.3.1)
HP Imaging Device Functions 13.0 (Version: 13.0)
HP JavaCard for HP ProtectTools (x32 Version: 04.10.9.0013)
HP LaserJet Professional M1130-M1210 MFP Series
HP LaserJet Professional M1210 MFP Series Fax Installer (Version: 1.3.0)
HP Photosmart Wireless B109n-z All-In-One Driver Software 13.0 Rel .6
HP Postscript Converter (Version: 4.5.12202)
HP Print Projects 1.0 (Version: 1.0)
HP Product Detection (x32 Version: 11.14.0001)
HP ProtectTools Security Manager (x32 Version: 04.10.9.0013)
HP ProtectTools Security Manager Suite (x32 Version: 04.10.9.0013)
HP Smart Web Printing 4.5 (Version: 4.5)
HP Solution Center 13.0 (Version: 13.0)
HP Support Assistant (x32 Version: 6.0.5.4)
HP Unified IO (Version: 2.0.0.479)
HP Unified IO (x32 Version: 2.0.0.479)
HP Update (x32 Version: 5.005.000.001)
HP Webcam Driver (x32 Version: 5.8.50008.0)
HPDiagnosticAlert (x32 Version: 1.00.0000)
HPPhotoGadget (x32 Version: 130.0.282.000)
hpPrintProjects (x32 Version: 130.0.303.000)
HPProductAssistant (x32 Version: 130.0.371.000)
HPSSupply (x32 Version: 130.0.371.000)
hpWLPGInstaller (x32 Version: 130.0.303.000)
Intel(R) Graphics Media Accelerator Driver
Intel® Matrix Storage Manager
Java 7 Update 45 (x32 Version: 7.0.450)
Java Auto Updater (x32 Version: 2.1.9.8)
Juniper Networks Network Connect 7.0.0 (x32 Version: 7.0.0.17289)
Juniper Networks Network Connect 7.2.0 (x32 Version: 7.2.0.21697)
Juniper Networks Network Connect 7.3.0 (x32 Version: 7.3.0.26561)
Juniper Networks, Inc. Setup Client (HKCU Version: 7.3.7.38707)
Juniper Networks, Inc. Setup Client 64-bit Activex Control (Version: 2.1.1.1)
Juniper Networks, Inc. Setup Client Activex Control (x32 Version: 2.1.1.1)
LSI HDA Modem (Version: 2.1.94)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
MarketResearch (x32 Version: 130.0.374.000)
Marvell Miniport Driver (x32 Version: 10.70.5.3)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Chart Controls for Microsoft .NET Framework 3.5 (KB2500170) (x32 Version: 3.5.30730.0)
Microsoft Chart Controls for Microsoft .NET Framework 3.5 Language Pack - deu (x32 Version: 3.5.0.0)
Microsoft Office 2010 Service Pack 1 (SP1)
Microsoft Office Access MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Excel MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Groove MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Groove MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office InfoPath MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office InfoPath MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Office 32-bit Components 2010 (Version: 14.0.6029.1000)
Microsoft Office OneNote MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Outlook MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office PowerPoint MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Professional Plus 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (English) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (French) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (Italian) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proofing (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Publisher MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Shared 32-bit MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Shared MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Word MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft SQL Server 2008 (x32)
Microsoft SQL Server 2008 Browser (x32 Version: 10.1.2531.0)
Microsoft SQL Server 2008 Common Files (x32 Version: 10.0.1600.22)
Microsoft SQL Server 2008 Common Files (x32 Version: 10.1.2531.0)
Microsoft SQL Server 2008 Database Engine Services (x32 Version: 10.1.2531.0)
Microsoft SQL Server 2008 Database Engine Shared (x32 Version: 10.1.2531.0)
Microsoft SQL Server 2008 Native Client (Version: 10.1.2531.0)
Microsoft SQL Server 2008 RsFx Driver (x32 Version: 10.1.2531.0)
Microsoft SQL Server VSS Writer (Version: 10.1.2531.0)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 (Version: 8.0.51011)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (x32 Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft® Office Language Pack 2010 – Deutsch (Business Contact Manager für Microsoft Outlook 2010) (Version: 4.0.11308.0)
Miranda IM 0.9.9 (x32)
Movie Maker (x32 Version: 16.4.3503.0728)
Mozilla Firefox 24.0 (x86 de) (x32 Version: 24.0)
Mozilla Maintenance Service (x32 Version: 24.0)
MP4 To MP3 Converter V3.0 (x32)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT110 (x32 Version: 16.4.1108.0727)
MSVCRT110_amd64 (Version: 16.4.1108.0727)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
Network64 (Version: 130.0.572.000)
Network64 (Version: 140.0.221.000)
Nitro Reader 3 (Version: 3.0.10.7)
PDF24 Creator 5.4.0 (x32)
Photo Gallery (x32 Version: 16.4.3503.0728)
Pidgin (x32 Version: 2.7.4)
PS_AIO_06_B109n-z_SW_Min (x32 Version: 130.0.396.000)
QuickTime (x32 Version: 7.74.80.86)
RealDownloader (x32 Version: 1.3.3)
RealNetworks - Microsoft Visual C++ 2008 Runtime (x32 Version: 9.0)
RealNetworks - Microsoft Visual C++ 2010 Runtime (x32 Version: 10.0)
RealPlayer (x32 Version: 16.0.3)
RealUpgrade 1.1 (x32 Version: 1.1.0)
Safari (x32 Version: 5.34.57.2)
Samsung New PC Studio (x32 Version: 1.00.0000)
SAMSUNG USB Driver for Mobile Phones (Version: 1.3.650.0)
Scan (x32 Version: 13.0.0.0)
Scan To (Version: 2.0.1)
SCR3xxx Smart Card Reader (x32 Version: 8.35)
Service Pack 1 für SQL Server 2008 (KB 968369) (x32 Version: 10.1.2531.0)
Shop for HP Supplies (Version: 13.0)
Skype™ 6.6 (x32 Version: 6.6.106)
SmartWebPrinting (x32 Version: 130.0.373.000)
SolutionCenter (x32 Version: 130.0.373.000)
SoundMAX (x32 Version: 6.10.2.7255)
Sql Server Customer Experience Improvement Program (x32 Version: 10.1.2531.0)
Status (x32 Version: 130.0.373.000)
SUPERAntiSpyware (Version: 5.6.1040)
Synaptics Pointing Device Driver (Version: 13.2.6.2)
Toolbox (x32 Version: 130.0.648.000)
TrayApp (x32 Version: 130.0.376.000)
Unterstützungsdateien für Microsoft SQL Server 2008-Setup (x32 Version: 10.1.2531.0)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3)
Update for Microsoft Access 2010 (KB2553446) 64-Bit Edition
Update for Microsoft Filter Pack 2.0 (KB2810071) 64-Bit Edition
Update for Microsoft Office 2010 (KB2494150)
Update for Microsoft Office 2010 (KB2553065)
Update for Microsoft Office 2010 (KB2553181) 64-Bit Edition
Update for Microsoft Office 2010 (KB2553267) 64-Bit Edition
Update for Microsoft Office 2010 (KB2553270) 64-Bit Edition
Update for Microsoft Office 2010 (KB2553310) 64-Bit Edition
Update for Microsoft Office 2010 (KB2566458)
Update for Microsoft Office 2010 (KB2589298) 64-Bit Edition
Update for Microsoft Office 2010 (KB2589375) 64-Bit Edition
Update for Microsoft Office 2010 (KB2598242) 64-Bit Edition
Update for Microsoft Office 2010 (KB2760598) 64-Bit Edition
Update for Microsoft Office 2010 (KB2760631) 64-Bit Edition
Update for Microsoft Office 2010 (KB2767886) 64-Bit Edition
Update for Microsoft Office 2010 (KB2794737) 64-Bit Edition
Update for Microsoft Office 2010 (KB2825640) 64-Bit Edition
Update for Microsoft Office 2010 (KB2826026) 64-Bit Edition
Update for Microsoft OneNote 2010 (KB2553290) 64-Bit Edition
Update for Microsoft OneNote 2010 (KB2810072) 64-Bit Edition
Update for Microsoft Outlook 2010 (KB2687623) 64-Bit Edition
Update for Microsoft Outlook Social Connector 2010 (KB2553406) 64-Bit Edition
Update for Microsoft PowerPoint 2010 (KB2553145) 64-Bit Edition
Update for Microsoft SharePoint Workspace 2010 (KB2589371) 64-Bit Edition
Update for Microsoft Visio Viewer 2010 (KB2810066) 64-Bit Edition
Update for Microsoft Word 2010 (KB2827323) 64-Bit Edition
Visual C++ 9.0 CRT (x86) WinSXS MSM (x32 Version: 9.0)
VLC media player 1.1.5 (x32 Version: 1.1.5)
WDR RadioRecorder (x32)
WebReg (x32 Version: 130.0.132.017)
Windows Live Communications Platform (x32 Version: 16.4.3503.0728)
Windows Live Essentials (x32 Version: 16.4.3503.0728)
Windows Live ID Sign-in Assistant (Version: 7.250.4311.0)
Windows Live Installer (x32 Version: 16.4.3503.0728)
Windows Live Photo Common (x32 Version: 16.4.3503.0728)
Windows Live PIMT Platform (x32 Version: 16.4.3503.0728)
Windows Live SOXE (x32 Version: 16.4.3503.0728)
Windows Live SOXE Definitions (x32 Version: 16.4.3503.0728)
Windows Live UX Platform (x32 Version: 16.4.3503.0728)
Windows Live UX Platform Language Pack (x32 Version: 16.4.3503.0728)
Windows Media Player Firefox Plugin (x32 Version: 1.0.0.8)
WinSCP 4.3.6 (x32 Version: 4.3.6)
==================== Restore Points =========================
26-10-2013 10:00:29 Configured Microsoft Office Professional Plus 2010
==================== Hosts content: ==========================
2009-07-14 04:34 - 2013-10-26 13:59 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
Task: {0103D669-25C6-4921-9C25-267D4B3D986C} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Total Care Tune-Up => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPTuneUp.exe [2011-03-22] (Hewlett-Packard Company)
Task: {14A92BFC-0CCD-4E08-B4D5-30B6CBFF3590} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-1242068612-3420065025-570463520-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {2FBA85DE-F502-4AA9-9087-8751C9C406C0} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1242068612-3420065025-570463520-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {4CFD163F-1AEC-4588-A024-5EB8F6AFA17B} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1242068612-3420065025-570463520-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {60A7468A-75EE-4BA5-B645-F9B22C9F09AE} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPSFMessenger\HPSFMsgr.exe [2011-06-21] (Hewlett-Packard Company)
Task: {6B8BAFE7-7C15-4C17-BD8D-E28E94F98AAC} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-1242068612-3420065025-570463520-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {7FB01293-4705-4613-81EB-114F701C1A47} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2010-11-20] (Microsoft Corporation)
Task: {827EFB2F-8A87-4711-86E7-858C2893BCD1} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-1242068612-3420065025-570463520-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {9011E21F-0118-4746-B4BD-48295DE67EBE} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {9C8D6621-F0A6-445A-8295-9D021F07E1AA} - System32\Tasks\{D48C862A-0792-4541-81B9-56A1B0286F49} => C:\Program Files (x86)\Skype\Phone\Skype.exe [2013-06-21] (Skype Technologies S.A.)
Task: {B8834A7F-E2D9-42C4-95E3-F7DC6C2187DD} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater\HPSFUpdater.exe [2011-06-14] (Hewlett-Packard)
Task: {C229A2BE-4B26-4902-9BAD-F2B0FA8DA6DC} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2011-06-21] (Hewlett-Packard Company)
Task: {CB80004F-1B39-4DFD-B8B8-558CC22C1D67} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-1242068612-3420065025-570463520-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {CFC7ABA2-77C8-4C6F-9A63-166E62FDE5B0} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {D8DFDF03-B77A-4CD1-B3B4-1F55DA2C5D4D} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2011-06-21] (Hewlett-Packard Company)
Task: {F85E4298-AC5B-4C47-ABD2-76E188535005} - System32\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-1242068612-3420065025-570463520-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\recordingmanager.exe [2013-08-14] (RealNetworks, Inc.)
==================== Loaded Modules (whitelisted) =============
2011-03-17 01:07 - 2011-03-17 01:07 - 04297568 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2013-02-26 11:10 - 2013-02-26 10:24 - 00397704 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2011-03-04 12:49 - 2011-03-04 12:49 - 00202752 _____ () C:\Program Files (x86)\Cisco\VPNClient\vpnapi.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\Users\Schröder\Desktop\Unterstützungsantrag Lehrpreis.jpeg:3or4kl4x13tuuug3Byamue2s4b
AlternateDataStreams: C:\Users\Schröder\Desktop\Unterstützungsantrag Lehrpreis.jpeg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
==================== Safe Mode (whitelisted) ===================
==================== Faulty Device Manager Devices =============
Name: Deskjet 3000 J310 series
Description: Deskjet 3000 J310 series
Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}
Manufacturer: HP
Service:
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: Deskjet 3000 J310 series
Description: Deskjet 3000 J310 series
Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}
Manufacturer: HP
Service:
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: Deskjet 3000 J310 series
Description: Deskjet 3000 J310 series
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: HP Photosmart Wireless B109n-z
Description: HP Photosmart Wireless B109n-z
Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
Manufacturer: Hewlett-Packard
Service: StillCam
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: Cisco Systems VPN Adapter for 64-bit Windows
Description: Cisco Systems VPN Adapter for 64-bit Windows
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: CVirtA
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: Photosmart Wireless B109n-z
Description: Photosmart Wireless B109n-z
Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}
Manufacturer: HP
Service:
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
System errors:
=============
Microsoft Office Sessions:
=========================
CodeIntegrity Errors:
===================================
Date: 2013-10-26 13:56:04.179
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-10-26 13:56:03.976
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Percentage of memory in use: 52%
Total physical RAM: 1976.27 MB
Available physical RAM: 938.29 MB
Total Pagefile: 3952.53 MB
Available Pagefile: 2424.44 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:230.87 GB) (Free:107.42 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (HP_TOOLS) (Fixed) (Total:2 GB) (Free:1.93 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: B0C9B0C9)
Partition 1: (Active) - (Size=231 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=2 GB) - (Type=0C)
==================== End Of Log ============================
|
|
27.10.2013, 07:49
| #6 |
| /// the machine /// TB-Ausbilder | Windows 7: Spammailversand, dann SchädlingsfundESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ --> Windows 7: Spammailversand, dann Schädlingsfund |
|
27.10.2013, 14:21
| #7 |
| | Windows 7: Spammailversand, dann Schädlingsfund Und wieder vielen Dank für deine Antwort! Hier sind die Logs. Probleme gibts immer, aber die, wegen derer ich hierher gekommen war, hätten sich erledigt, wenn du mir nun verkünden würdest, dass nun kein Scanner mehr schädliche Dateien finden würde. ;-) Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=f7090fafbf5c0a44b6c00beb9afdddf0
# engine=15649
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-10-27 11:07:09
# local_time=2013-10-27 12:07:09 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 96 56670 153543334 6759 0
# compatibility_mode=5893 16776574 100 94 176244 134501879 0 0
# scanned=381944
# found=0
# cleaned=0
# scan_time=9102
Code:
ATTFilter Results of screen317's Security Check version 0.99.74 Windows 7 Service Pack 1 x64 (UAC is enabled) ``````````````Antivirus/Firewall Check:`````````````` Avira Desktop Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware Version 1.75.0.1300 Java 7 Update 45 HP JavaCard for HP ProtectTools Java version out of Date! Adobe Flash Player 11.9.900.117 Adobe Reader XI Mozilla Firefox (24.0) ````````Process Check: objlist.exe by Laurent```````` Avira Antivir avgnt.exe Avira Antivir avguard.exe Microsoft Small Business Business Contact Manager BcmSqlStartupSvc.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-10-2013 01
Ran by Schröder (administrator) on SCHRÖDER-PC on 27-10-2013 14:11:46
Running from C:\Users\Schröder\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(AuthenTec, Inc.) C:\Program Files\Fingerprint Sensor\ATService.exe
(McAfee, Inc.) C:\Program Files (x86)\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe
(Hewlett-Packard) C:\Windows\system32\Hpservice.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
(Andrea Electronics Corporation) C:\Windows\system32\AEADISRV.EXE
(LSI Corporation) C:\Program Files\LSI SoftModem\agr64svc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corporation) C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\VPNClient\cvpnd.exe
(Juniper Networks) C:\Program Files (x86)\Juniper Networks\Common Files\dsNcService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(HP) C:\Program Files\HP\HP LaserJet M1210 MFP Series\ReceiveFaxUtility.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(HP) C:\Windows\system32\HPSIsvc.exe
(Nitro PDF Software) C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe
() C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe
() C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Bioscrypt Inc.) C:\Program Files (x86)\Hewlett-Packard\IAM\Bin\AsGHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANOTIF.EXE
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE
(SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE
(Analog Devices, Inc.) C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\pthosttr.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(RealNetworks, Inc.) C:\Program Files (x86)\RealNetworks\RealDownloader\recordingmanager.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [IAAnotif] - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-08-25] (Intel Corporation)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1815848 2009-07-30] (Synaptics Incorporated)
HKLM\...\Run: [BCSSync] - C:\Program Files\Microsoft Office\Office14\BCSSync.exe [112512 2010-03-13] (Microsoft Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKCU\...\Run: [OfficeSyncProcess] - C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE [911040 2013-04-22] (Microsoft Corporation)
HKCU\...\Run: [SUPERAntiSpyware] - C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [6588144 2013-10-02] (SUPERAntiSpyware)
HKLM-x32\...\Run: [SoundMAXPnP] - C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe [1314816 2009-05-18] (Analog Devices, Inc.)
HKLM-x32\...\Run: [PTHOSTTR] - C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE [354360 2009-07-30] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [CognizanceTS] - C:\PROGRA~3\HEWLET~1\IAM\Bin\ASTSVCC.dll [24848 2009-07-23] (Bioscrypt Inc.)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2011-05-10] (Hewlett-Packard)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [681032 2013-10-01] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [162856 2013-03-20] (Geek Software GmbH)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [TkBellExe] - c:\program files (x86)\real\realplayer\Update\realsched.exe [295512 2013-09-02] (RealNetworks, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-09-05] (Adobe Systems Incorporated)
AppInit_DLLs: C:\PROGRA~3\HEWLET~1\IAM\Bin\APSHook64.dll C:\PROGRA~3\HEWLET~1\IAM\bin\APSHOO~1.DLL [382224 2009-07-23] (Bioscrypt Inc.)
AppInit_DLLs-x32: C:\PROGRA~3\HEWLET~1\IAM\Bin\APSHook.dll [89872 2009-07-23] (Bioscrypt Inc.)
Startup: C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Credential Manager for HP ProtectTools - {0EA99306-BC87-4930-9E1D-1D1EA32A7E4E} - C:\Program Files (x86)\Hewlett-Packard\IAM\Bin\ItIEAddIn64.dll (Bioscrypt Inc.)
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Credential Manager for HP ProtectTools - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files (x86)\Hewlett-Packard\IAM\Bin\ItIEAddIn.dll (Bioscrypt Inc.)
DPF: HKLM {AA570693-00E2-4907-B6F1-60A1199B030C} https://juniper.net/dana-cached/sc/JuniperSetupClient64.cab
DPF: HKLM-x32 {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://juniper.net/dana-cached/sc/JuniperSetupClient.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Schröder\AppData\Roaming\Mozilla\Firefox\Profiles\g0g0n6qj.default
FF Homepage: hxxp://www.gmx.net/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~3\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~3\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3503.0728 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nitropdf.com/NitroPDF - C:\Program Files (x86)\Nitro\Reader 3\npnitromozilla.dll (Nitro PDF)
FF Plugin-x32: @real.com/nppl3260;version=16.0.3.51 - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=16.0.3.51 - c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @phonostar.de/phonostar - C:\Program Files (x86)\phonostar-Player\npphonostarDetectNP.dll No File
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101721.dll (Amazon.com, Inc.)
FF SearchPlugin: C:\Users\Schröder\AppData\Roaming\Mozilla\Firefox\Profiles\g0g0n6qj.default\searchplugins\amazon-search-suggestions.xml
FF SearchPlugin: C:\Users\Schröder\AppData\Roaming\Mozilla\Firefox\Profiles\g0g0n6qj.default\searchplugins\myvideo-suche-.xml
FF SearchPlugin: C:\Users\Schröder\AppData\Roaming\Mozilla\Firefox\Profiles\g0g0n6qj.default\searchplugins\ponseu--englisch--deutsch.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: personas - C:\Users\Schröder\AppData\Roaming\Mozilla\Firefox\Profiles\g0g0n6qj.default\Extensions\personas@christopher.beard.xpi
FF Extension: Adblock Plus - C:\Users\Schröder\AppData\Roaming\Mozilla\Firefox\Profiles\g0g0n6qj.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF HKLM-x32\...\Firefox\Extensions: [{DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
==================== Services (Whitelisted) =================
R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [143120 2013-05-23] (SUPERAntiSpyware.com)
R2 AEADIFilters; C:\Windows\system32\AEADISRV.EXE [111616 2008-07-15] (Andrea Electronics Corporation)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440392 2013-10-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440392 2013-10-01] (Avira Operations GmbH & Co. KG)
R2 ASBroker; C:\Program Files (x86)\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll [192784 2009-07-23] (Bioscrypt Inc.)
R2 ASChannel; C:\Program Files (x86)\Hewlett-Packard\IAM\Bin\AsChnl.dll [150288 2009-07-23] (Bioscrypt Inc.)
R2 BcmSqlStartupSvc; C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe [34216 2010-03-25] (Microsoft Corporation)
R2 CVPND; C:\Program Files (x86)\Cisco\VPNClient\cvpnd.exe [1529856 2011-03-04] (Cisco Systems, Inc.)
S3 HP ProtectTools Service; C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe [45056 2009-07-30] (Hewlett-Packard Development Company, L.P)
R2 HpFkCryptService; C:\Program Files (x86)\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [256544 2009-07-29] (McAfee, Inc.)
R2 HPM1210RcvFaxSrvc; C:\Program Files\HP\HP LaserJet M1210 MFP Series\ReceiveFaxUtility.exe [361888 2012-07-25] (HP)
S3 MSSQL$MSSMLBIZ; C:\Program Files (x86)\Microsoft SQL Server\MSSQL10.MSSMLBIZ\MSSQL\Binn\sqlservr.exe [43010392 2009-03-30] (Microsoft Corporation)
R2 NitroReaderDriverReadSpool3; C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe [230416 2012-12-17] (Nitro PDF Software)
R2 Radio.fx; C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe [3673944 2011-11-18] ()
R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-08-14] ()
S4 SQLAgent$MSSMLBIZ; C:\Program Files (x86)\Microsoft SQL Server\MSSQL10.MSSMLBIZ\MSSQL\Binn\SQLAGENT.EXE [366936 2009-03-30] (Microsoft Corporation)
R2 yksvc; C:\Windows\System32\yk62x64.dll [382976 2009-07-20] (Marvell)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105856 2013-10-01] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132600 2013-10-01] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-01] (Avira Operations GmbH & Co. KG)
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
S3 HP1210FAX; C:\Windows\System32\Drivers\HPM1210FAX.sys [16896 2012-11-08] ()
S3 mvusbews; C:\Windows\System32\Drivers\mvusbews.sys [20480 2012-12-24] (Marvell Semiconductor, Inc.)
R1 RsvLock; C:\Windows\System32\Drivers\RsvLock.sys [14880 2009-07-29] (SafeBoot International)
R0 SafeBoot; C:\Windows\System32\Drivers\SafeBoot.sys [55840 2009-07-29] ()
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R0 SbAlg; C:\Windows\System32\Drivers\SbAlg.sys [60160 2007-07-16] (SafeBoot N.V.)
R0 SbFsLock; C:\Windows\System32\Drivers\SbFsLock.sys [15392 2009-07-29] (SafeBoot International)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1805104 2009-07-02] ()
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
========================== Drivers MD5 =======================
C:\Windows\system32\drivers\1394ohci.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\Accelerometer.sys 1CFFE9C06E66A57DAE1452E449A58240
C:\Windows\System32\drivers\ACPI.sys ==> MD5 is legit
C:\Windows\system32\drivers\acpipmi.sys ==> MD5 is legit
C:\Windows\System32\drivers\ADIHdAud.sys 560649E6A9C11F6124F97310EF387C45
C:\Windows\system32\DRIVERS\adp94xx.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adpahci.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adpu320.sys ==> MD5 is legit
C:\Windows\system32\drivers\afd.sys 314C17917AC8523EC77A710215012A65
C:\Windows\System32\DRIVERS\agrsm64.sys AF4748EF93416159459769A24A0053AF
C:\Windows\system32\drivers\agp440.sys ==> MD5 is legit
C:\Windows\system32\drivers\aliide.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdide.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\amdk8.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\amdppm.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdsata.sys D4121AE6D0C0E7E13AA221AA57EF2D49
C:\Windows\system32\DRIVERS\amdsbs.sys ==> MD5 is legit
C:\Windows\System32\drivers\amdxata.sys 540DAF1CEA6094886D72126FD7C33048
C:\Windows\system32\drivers\appid.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\arc.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\arcsas.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\asyncmac.sys ==> MD5 is legit
C:\Windows\System32\drivers\atapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\avgntflt.sys 29F9901C22E7BFE23DF8389AFC530D3D
C:\Windows\System32\DRIVERS\avipbb.sys 033CA7F2EABD7EFDC482FE45DD7E1B60
C:\Windows\System32\DRIVERS\avkmgr.sys 390184FAD8FCC1B6DA25AEBAE928C3B6
C:\Windows\system32\DRIVERS\bxvbda.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\b57nd60a.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Beep.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\blbdrive.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bowser.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\BrFiltLo.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\BrFiltUp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bridge.sys 5C2F352A4E961D72518261257AAE204B
C:\Windows\System32\Drivers\Brserid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrSerWdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbMdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbSer.sys ==> MD5 is legit
C:\Windows\system32\drivers\BthEnum.sys CF98190A94F62E405C8CB255018B2315
C:\Windows\system32\DRIVERS\bthmodem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bthpan.sys 02DD601B708DD0667E1331FA8518E9FF
C:\Windows\System32\Drivers\BTHport.sys 738D0E9272F59EB7A1449C3EC118E6C4
C:\Windows\System32\Drivers\BTHUSB.sys F188B7394D81010767B6DF3178519A37
C:\Windows\System32\DRIVERS\cdfs.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\cdrom.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\circlass.sys ==> MD5 is legit
C:\Windows\System32\CLFS.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\CmBatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\cmdide.sys ==> MD5 is legit
C:\Windows\System32\Drivers\cng.sys 9AC4F97C2D3E93367E2148EA940CD2CD
C:\Windows\System32\DRIVERS\compbatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\CompositeBus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\crcdisk.sys ==> MD5 is legit
C:\Windows\System32\drivers\csc.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\CVirtA64.sys 44BDDEB03C84A1C993C992FFB5700357
C:\Windows\system32\Drivers\CVPNDRVA.sys 79AF0E203D089AF442A3F70ED00A37FB
C:\Windows\System32\Drivers\dfsc.sys ==> MD5 is legit
C:\Windows\System32\drivers\discache.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\disk.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\dne64x.sys 05CB5910B3CA6019FC3CCA815EE06FFB
C:\Windows\System32\DRIVERS\Dot4.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\Dot4Prt.sys E9F5969233C5D89F3C35E3A66A52A361
C:\Windows\System32\DRIVERS\dot4usb.sys ==> MD5 is legit
C:\Windows\System32\drivers\drmkaud.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\dsNcAdpt.sys F2D97A85F4F6E0942BC17C4EECEEE6B7
C:\Windows\System32\drivers\dxgkrnl.sys 88612F1CE3BF42256913BF6E61C70D52
C:\Windows\system32\DRIVERS\evbda.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\elxstor.sys ==> MD5 is legit
C:\Windows\system32\drivers\errdev.sys ==> MD5 is legit
C:\Windows\System32\Drivers\exfat.sys ==> MD5 is legit
C:\Windows\System32\Drivers\fastfat.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\fdc.sys ==> MD5 is legit
C:\Windows\System32\drivers\fileinfo.sys ==> MD5 is legit
C:\Windows\System32\drivers\filetrace.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\flpydisk.sys ==> MD5 is legit
C:\Windows\System32\drivers\fltmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\FsDepends.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Fs_Rec.sys 6BD9295CC032DD3077C671FCCF579A7B
C:\Windows\System32\DRIVERS\fvevol.sys 8F6322049018354F45F05A2FD2D4E5E0
C:\Windows\system32\DRIVERS\gagp30kx.sys ==> MD5 is legit
C:\Windows\system32\drivers\hcw85cir.sys ==> MD5 is legit
C:\Windows\system32\drivers\HdAudio.sys 975761C778E33CD22498059B91E7373A
C:\Windows\system32\drivers\HDAudBus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\HidBatt.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\hidbth.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\hidir.sys ==> MD5 is legit
C:\Windows\system32\drivers\hidusb.sys ==> MD5 is legit
C:\Windows\System32\Drivers\HPM1210FAX.sys A92C9C5736F158D27C01C5EE239B29DC
C:\Windows\System32\DRIVERS\hpdskflt.sys 05712FDDBD45A5864EB326FAABC6A4E3
C:\Windows\system32\drivers\HpSAMD.sys ==> MD5 is legit
C:\Windows\System32\drivers\HTTP.sys ==> MD5 is legit
C:\Windows\System32\drivers\hwpolicy.sys ==> MD5 is legit
C:\Windows\system32\drivers\i8042prt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\iaStor.sys BBB3B6DF1ABB0FE35802EDE85CC1C011
C:\Windows\system32\drivers\iaStorV.sys AAAF44DB3BD0B9D1FB6969B23ECC8366
C:\Windows\System32\DRIVERS\igdkmd64.sys DFEAF0A1D98D397035012C8E28D1520F
C:\Windows\system32\DRIVERS\iirsp.sys ==> MD5 is legit
C:\Windows\System32\drivers\IntcHdmi.sys D485D3BD3E2179AA86853A182F70699F
C:\Windows\system32\drivers\intelide.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\intelppm.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ipfltdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\IPMIDrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\ipnat.sys ==> MD5 is legit
C:\Windows\System32\drivers\irenum.sys ==> MD5 is legit
C:\Windows\system32\drivers\isapnp.sys ==> MD5 is legit
C:\Windows\system32\drivers\msiscsi.sys ==> MD5 is legit
C:\Windows\system32\drivers\kbdclass.sys ==> MD5 is legit
C:\Windows\system32\drivers\kbdhid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\ksecdd.sys 97A7070AEA4C058B6418519E869A63B4
C:\Windows\System32\Drivers\ksecpkg.sys 26C43A7C2862447EC59DEDA188D1DA07
C:\Windows\system32\drivers\ksthunk.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\lltdio.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_fc.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_sas.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_sas2.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_scsi.sys ==> MD5 is legit
C:\Windows\system32\drivers\luafv.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\megasas.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\MegaSR.sys ==> MD5 is legit
C:\Windows\System32\drivers\modem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\monitor.sys ==> MD5 is legit
C:\Windows\system32\drivers\mouclass.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\mouhid.sys ==> MD5 is legit
C:\Windows\System32\drivers\mountmgr.sys ==> MD5 is legit
C:\Windows\system32\drivers\mpio.sys ==> MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\mrxdav.sys 1A4F75E63C9FB84B85DFFC6B63FD5404
C:\Windows\System32\DRIVERS\mrxsmb.sys A5D9106A73DC88564C825D317CAC68AC
C:\Windows\System32\DRIVERS\mrxsmb10.sys D711B3C1D5F42C0C2415687BE09FC163
C:\Windows\System32\DRIVERS\mrxsmb20.sys 9423E9D355C8D303E76B8CFBD8A5C30C
C:\Windows\System32\drivers\msahci.sys ==> MD5 is legit
C:\Windows\system32\drivers\msdsm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Msfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\mshidkmdf.sys ==> MD5 is legit
C:\Windows\System32\drivers\msisadrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSKSSRV.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPCLOCK.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPQM.sys ==> MD5 is legit
C:\Windows\System32\Drivers\MsRPC.sys ==> MD5 is legit
C:\Windows\system32\drivers\mssmbios.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSTEE.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\MTConfig.sys ==> MD5 is legit
C:\Windows\System32\Drivers\mup.sys ==> MD5 is legit
C:\Windows\System32\Drivers\mvusbews.sys 705E9675014EB688BEDD967B1ABECF19
C:\Windows\System32\DRIVERS\nwifi.sys ==> MD5 is legit
C:\Windows\System32\drivers\ndis.sys 760E38053BF56E501D562B70AD796B88
C:\Windows\System32\DRIVERS\ndiscap.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndistapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndisuio.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndiswan.sys ==> MD5 is legit
C:\Windows\System32\Drivers\NDProxy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbios.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\NETw5s64.sys 39EDE676D17F37AF4573C2B33EC28ACA
C:\Windows\system32\DRIVERS\nfrd960.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Npfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Ntfs.sys B98F8C6E31CD07B2E6F71F7F648E38C0
C:\Windows\System32\Drivers\Null.sys ==> MD5 is legit
C:\Windows\system32\drivers\nvraid.sys 0A92CB65770442ED0DC44834632F66AD
C:\Windows\system32\drivers\nvstor.sys DAB0E87525C10052BF65F06152F37E4A
C:\Windows\system32\drivers\nv_agp.sys ==> MD5 is legit
C:\Windows\system32\drivers\ohci1394.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\parport.sys ==> MD5 is legit
C:\Windows\System32\drivers\partmgr.sys E9766131EEADE40A27DC27D2D68FBA9C
C:\Windows\System32\drivers\pci.sys ==> MD5 is legit
C:\Windows\system32\drivers\pciide.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\pcmcia.sys ==> MD5 is legit
C:\Windows\System32\drivers\pcw.sys ==> MD5 is legit
C:\Windows\System32\drivers\peauth.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspptp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\processr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\pacer.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\ql2300.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\ql40xx.sys ==> MD5 is legit
C:\Windows\system32\drivers\qwavedrv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasacd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\AgileVpn.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasl2tp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspppoe.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rassstp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rdbss.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rdpbus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\RDPCDD.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpdr.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpencdd.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdprefmp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\RDPWD.sys E61608AA35E98999AF9AAEEEA6114B0A
C:\Windows\System32\drivers\rdyboost.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rfcomm.sys 3DD798846E2C28102B922C56E71B7932
C:\Windows\System32\DRIVERS\rspndr.sys ==> MD5 is legit
C:\Windows\System32\Drivers\RsvLock.sys 67834AF0371F69A1B512998DAECCE098
C:\Windows\system32\drivers\vms3cap.sys ==> MD5 is legit
C:\Windows\System32\Drivers\SafeBoot.sys D41D8CD98F00B204E9800998ECF8427E
C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS 3289766038DB2CB14D07DC84392138D5
C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS 58A38E75F3316A83C23DF6173D41F2B5
C:\Windows\System32\Drivers\SbAlg.sys 1CFC2E8659484FA6E512405A0F79A00A
C:\Windows\System32\Drivers\SbFsLock.sys D11E0001180353F83177C3B869C6CE8E
C:\Windows\system32\drivers\sbp2port.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\scfilter.sys ==> MD5 is legit
C:\Windows\System32\Drivers\secdrv.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\serenum.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\serial.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sermouse.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffdisk.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_mmc.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_sd.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sfloppy.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\SiSRaid2.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sisraid4.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\smb.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\snp2uvc.sys 882989F257A746FE02D3AC582E4C839B
C:\Windows\System32\Drivers\spldr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\srv.sys 441FBA48BFF01FDB9D5969EBC1838F0B
C:\Windows\System32\DRIVERS\srv2.sys B4ADEBBF5E3677CCE9651E0F01F7CC28
C:\Windows\System32\DRIVERS\srvnet.sys 27E461F0BE5BFF5FC737328F749538C3
C:\Windows\System32\DRIVERS\ss_bbus.sys EF806D212D34B0E173BAEB3564D53E37
C:\Windows\System32\DRIVERS\ss_bmdfl.sys 08B1B34ABEBEB6AC2DEA06900C56411E
C:\Windows\System32\DRIVERS\ss_bmdm.sys 71A9DA6BEAA4CB54DFB827FB78600A5D
C:\Windows\system32\DRIVERS\stexstor.sys ==> MD5 is legit
C:\Windows\system32\drivers\serscan.sys DECACB6921DED1A38642642685D77DAC
C:\Windows\System32\drivers\vmstorfl.sys ==> MD5 is legit
C:\Windows\system32\drivers\storvsc.sys ==> MD5 is legit
C:\Windows\system32\drivers\swenum.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\SynTP.sys FD0FE92DD56C704D0AEDEC79DBFF1728
C:\Windows\System32\drivers\tbhsd.sys 93F0F5EF8A4CA261372DF98B31B2BD05
C:\Windows\System32\drivers\tcpip.sys 40AF23633D197905F03AB5628C558C51
C:\Windows\System32\DRIVERS\tcpip.sys 40AF23633D197905F03AB5628C558C51
C:\Windows\System32\drivers\tcpipreg.sys 1B16D0BD9841794A6E0CDE0CEF744ABC
C:\Windows\System32\drivers\tdpipe.sys ==> MD5 is legit
C:\Windows\System32\drivers\tdtcp.sys 51C5ECEB1CDEE2468A1748BE550CFBC8
C:\Windows\System32\DRIVERS\tdx.sys ==> MD5 is legit
C:\Windows\system32\drivers\termdd.sys ==> MD5 is legit
C:\Windows\System32\Drivers\TFsExDisk.sys 48D9D00C2E0E72C3D4F52772C80355F6
C:\Windows\SysWow64\Drivers\TFsExDisk.sys 48D9D00C2E0E72C3D4F52772C80355F6
C:\Windows\System32\DRIVERS\tssecsrv.sys 4CE278FC9671BA81A138D70823FCAA09
C:\Windows\System32\drivers\tsusbflt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\tunnel.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\uagp35.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\udfs.sys ==> MD5 is legit
C:\Windows\system32\drivers\uliagpkx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\umbus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\umpass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\usbccgp.sys 6F1A3157A1C89435352CEB543CDB359C
C:\Windows\system32\drivers\usbcir.sys 80B0F7D5CCF86CEB5D402EAAF61FEC31
C:\Windows\System32\DRIVERS\usbehci.sys C025055FE7B87701EB042095DF1A2D7B
C:\Windows\System32\DRIVERS\usbhub.sys 287C6C9410B111B68B52CA298F7B8C24
C:\Windows\system32\drivers\usbohci.sys 9840FC418B4CBD632D3D0A667A725C31
C:\Windows\System32\DRIVERS\usbprint.sys ==> MD5 is legit
C:\Windows\system32\drivers\usbscan.sys 9661DA76B4531B2DA272ECCE25A8AF24
C:\Windows\System32\DRIVERS\USBSTOR.SYS FED648B01349A3C8395A5169DB5FB7D6
C:\Windows\System32\DRIVERS\usbuhci.sys 62069A34518BCF9C1FD9E74B3F6DB7CD
C:\Windows\System32\Drivers\usbvideo.sys 1F775DA4CF1A3A1834207E975A72E9D7
C:\Windows\System32\drivers\vdrvroot.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vgapnp.sys ==> MD5 is legit
C:\Windows\System32\drivers\vga.sys ==> MD5 is legit
C:\Windows\system32\drivers\vhdmp.sys ==> MD5 is legit
C:\Windows\system32\drivers\viaide.sys ==> MD5 is legit
C:\Windows\System32\drivers\vmbus.sys ==> MD5 is legit
C:\Windows\system32\drivers\VMBusHID.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgrx.sys ==> MD5 is legit
C:\Windows\System32\drivers\volsnap.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\vsmraid.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwifibus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwififlt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwifimp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\wacompen.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\wd.sys ==> MD5 is legit
C:\Windows\System32\drivers\Wdf01000.sys E2C933EDBC389386EBE6D2BA953F43D8
C:\Windows\System32\DRIVERS\wfplwf.sys ==> MD5 is legit
C:\Windows\System32\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\SysWow64\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\WinUsb.sys FE88B288356E7B47B74B13372ADD906D
C:\Windows\system32\drivers\wmiacpi.sys ==> MD5 is legit
C:\Windows\system32\drivers\ws2ifsl.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\WSDPrint.sys 8D918B1DB190A4D9B1753A66FA8C96E8
C:\Windows\System32\drivers\WudfPf.sys AB886378EEB55C6C75B4F2D14B6C869F
C:\Windows\System32\DRIVERS\WUDFRd.sys DDA4CAF29D8C0A297F886BFE561E6659
C:\Windows\System32\DRIVERS\yk62x64.sys 6AFFD75C6807B3DD3AB018E27B88EF95
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-10-27 14:06 - 2013-10-27 14:06 - 01956160 _____ (Farbar) C:\Users\Schröder\Desktop\FRST64.exe
2013-10-27 14:02 - 2013-10-27 14:02 - 00000913 _____ C:\Users\Schröder\Desktop\checkup.txt
2013-10-27 13:51 - 2013-10-27 13:51 - 00002019 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk
2013-10-27 13:09 - 2013-10-27 13:09 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-10-27 13:09 - 2013-10-27 13:09 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-10-27 13:09 - 2013-10-27 13:09 - 00000000 ____D C:\Windows\SysWOW64\Macromed
2013-10-27 13:09 - 2013-10-27 13:09 - 00000000 ____D C:\Windows\system32\Macromed
2013-10-27 12:52 - 2013-10-27 12:52 - 00830344 _____ (Adobe Systems Incorporated) C:\Users\Schröder\Desktop\uninstall_flash_player.exe
2013-10-27 12:43 - 2013-10-27 12:43 - 00891167 _____ C:\Users\Schröder\Desktop\SecurityCheck.exe
2013-10-26 19:12 - 2013-10-26 19:12 - 00000000 ____D C:\Windows\ERUNT
2013-10-26 19:04 - 2013-10-26 19:05 - 00000000 ____D C:\AdwCleaner
2013-10-26 18:52 - 2013-10-26 18:52 - 00000000 ____D C:\Users\Schröder\AppData\Roaming\Malwarebytes
2013-10-26 18:51 - 2013-10-26 18:51 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-10-26 18:51 - 2013-10-26 18:51 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-26 18:51 - 2013-10-26 18:51 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-10-26 18:51 - 2013-04-04 13:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-10-26 18:35 - 2013-10-26 18:35 - 01060070 _____ C:\Users\Schröder\Desktop\adwcleaner.exe
2013-10-26 18:35 - 2013-10-26 18:35 - 01033335 _____ (Thisisu) C:\Users\Schröder\Desktop\JRT.exe
2013-10-26 18:34 - 2013-10-26 18:34 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Schröder\Desktop\mbam-setup-1.75.0.1300.exe
2013-10-26 13:07 - 2013-10-26 13:07 - 00029265 _____ C:\ComboFix.txt
2013-10-26 12:36 - 2013-10-26 13:07 - 00000000 ____D C:\Qoobox
2013-10-26 12:36 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2013-10-26 12:36 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2013-10-26 12:36 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-10-26 12:36 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-10-26 12:36 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-10-26 12:36 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2013-10-26 12:36 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2013-10-26 12:36 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2013-10-26 12:35 - 2013-10-26 13:04 - 00000000 ____D C:\Windows\erdnt
2013-10-25 19:48 - 2013-10-25 19:48 - 00377856 _____ C:\Users\Schröder\Desktop\gmer_2.1.19163.exe
2013-10-25 19:43 - 2013-10-25 19:43 - 00000000 ____D C:\FRST
2013-10-25 19:41 - 2013-10-25 19:41 - 00000000 _____ C:\Users\Schröder\defogger_reenable
2013-10-25 19:40 - 2013-10-25 19:40 - 00050477 _____ C:\Users\Schröder\Desktop\Defogger.exe
2013-10-25 19:02 - 2013-10-25 19:02 - 00701332 _____ C:\Users\Schröder\Desktop\Unterstützungsantrag Lehrpreis.jpeg
2013-10-25 11:44 - 2013-10-25 11:44 - 00000000 ____D C:\Users\Schröder\AppData\Roaming\SUPERAntiSpyware.com
2013-10-25 11:43 - 2013-10-25 11:45 - 00000000 ____D C:\Program Files\SUPERAntiSpyware
2013-10-25 11:43 - 2013-10-25 11:43 - 00001808 _____ C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
2013-10-25 11:43 - 2013-10-25 11:43 - 00000000 ____D C:\ProgramData\SUPERAntiSpyware.com
2013-10-25 11:40 - 2013-10-25 11:42 - 27853504 _____ (SUPERAntiSpyware) C:\Users\Schröder\Desktop\SUPERAntiSpyware.exe
2013-10-18 23:05 - 2013-10-18 23:05 - 00000000 ____D C:\Program Files\Common Files\Deterministic Networks
2013-10-18 23:05 - 2013-10-18 23:05 - 00000000 ____D C:\Program Files (x86)\Cisco Systems
2013-10-18 23:05 - 2013-10-18 23:05 - 00000000 ____D C:\Program Files (x86)\Cisco
2013-10-18 23:04 - 2013-10-18 23:07 - 00001593 _____ C:\Windows\VPNInstall.MIF
2013-10-18 23:03 - 2013-10-18 23:03 - 05333322 _____ C:\Users\Schröder\Downloads\rzinst-Cisco-VPNClient-5.0.07.0440x64.exe
2013-10-18 23:03 - 2013-10-18 23:03 - 00000594 _____ C:\Windows\RRZE.LOG
2013-10-18 23:03 - 2013-10-18 23:03 - 00000000 ____D C:\Windows\RRZE
2013-10-18 11:33 - 2013-10-18 11:33 - 00915368 _____ (Oracle Corporation) C:\Users\Schröder\Downloads\jre-7u45-windows-i586-iftw.exe
2013-10-18 11:31 - 2013-10-18 11:31 - 00000000 ____D C:\ProgramData\Oracle
2013-10-18 11:30 - 2013-10-18 11:30 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-10-18 11:30 - 2013-10-18 11:30 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-10-18 11:30 - 2013-10-18 11:30 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-10-18 11:30 - 2013-10-18 11:30 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-10-11 15:59 - 2013-10-11 16:03 - 00000000 ____D C:\Users\Schröder\Desktop\Erlangen
2013-10-10 21:57 - 2013-09-14 02:10 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-10-10 21:57 - 2013-09-08 03:30 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-10-10 21:57 - 2013-09-08 03:27 - 00327168 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2013-10-10 21:57 - 2013-09-08 03:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswsock.dll
2013-10-10 21:57 - 2013-08-29 03:17 - 05549504 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-10-10 21:57 - 2013-08-29 03:16 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-10-10 21:57 - 2013-08-29 03:16 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2013-10-10 21:57 - 2013-08-29 03:16 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-10-10 21:57 - 2013-08-29 03:13 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2013-10-10 21:57 - 2013-08-29 02:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-10-10 21:57 - 2013-08-29 02:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-10-10 21:57 - 2013-08-29 02:50 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-10-10 21:57 - 2013-08-29 02:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2013-10-10 21:57 - 2013-08-29 02:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-10-10 21:57 - 2013-08-29 02:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2013-10-10 21:57 - 2013-08-29 01:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-10-10 21:57 - 2013-08-29 01:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-10-10 21:57 - 2013-08-29 01:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-10-10 21:57 - 2013-08-29 01:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-10-10 21:57 - 2013-08-28 02:21 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-10-10 21:57 - 2013-08-28 02:12 - 00461312 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll
2013-10-10 21:57 - 2013-08-01 13:09 - 00983488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-10-10 21:57 - 2013-07-20 11:33 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-10 21:57 - 2013-07-20 11:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2013-10-10 21:57 - 2013-07-12 11:41 - 00185344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys
2013-10-10 21:57 - 2013-07-12 11:41 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
2013-10-10 21:57 - 2013-07-04 13:57 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2013-10-10 21:57 - 2013-07-04 13:50 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2013-10-10 21:57 - 2013-07-04 13:50 - 00102400 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2013-10-10 21:57 - 2013-07-04 12:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll
2013-10-10 21:57 - 2013-07-04 12:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll
2013-10-10 21:57 - 2013-07-04 12:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2013-10-10 21:57 - 2013-07-04 11:11 - 00140800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2013-10-10 21:57 - 2013-07-03 05:40 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys
2013-10-10 21:57 - 2013-07-03 05:05 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2013-10-10 21:57 - 2013-07-03 05:05 - 00032896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2013-10-10 21:57 - 2013-06-25 23:55 - 00785624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2013-10-10 21:57 - 2013-06-06 06:50 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2013-10-10 21:57 - 2013-06-06 06:49 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2013-10-10 21:57 - 2013-06-06 06:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2013-10-10 21:57 - 2013-06-06 06:47 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2013-10-10 21:57 - 2013-06-06 05:57 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2013-10-10 21:57 - 2013-06-06 05:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2013-10-10 21:57 - 2013-06-06 05:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2013-10-10 21:57 - 2013-06-06 04:30 - 00368128 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-10-10 21:57 - 2013-06-06 04:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2013-10-10 21:57 - 2013-06-06 04:01 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2013-09-30 20:33 - 2013-09-30 20:33 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
==================== One Month Modified Files and Folders =======
2013-10-27 14:06 - 2013-10-27 14:06 - 01956160 _____ (Farbar) C:\Users\Schröder\Desktop\FRST64.exe
2013-10-27 14:02 - 2013-10-27 14:02 - 00000913 _____ C:\Users\Schröder\Desktop\checkup.txt
2013-10-27 13:55 - 2009-07-14 05:45 - 00009712 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-27 13:55 - 2009-07-14 05:45 - 00009712 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-27 13:54 - 2009-08-30 06:25 - 00724550 _____ C:\Windows\system32\perfh007.dat
2013-10-27 13:54 - 2009-08-30 06:25 - 00157018 _____ C:\Windows\system32\perfc007.dat
2013-10-27 13:54 - 2009-07-14 06:13 - 01695360 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-27 13:53 - 2010-08-25 20:23 - 02030445 _____ C:\Windows\WindowsUpdate.log
2013-10-27 13:52 - 2010-08-31 14:35 - 00000000 ____D C:\Users\Schröder\AppData\Local\Adobe
2013-10-27 13:51 - 2013-10-27 13:51 - 00002019 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk
2013-10-27 13:51 - 2010-10-08 19:42 - 00000000 ____D C:\Program Files (x86)\Adobe
2013-10-27 13:51 - 2010-08-31 14:37 - 00000000 ____D C:\ProgramData\Adobe
2013-10-27 13:48 - 2009-07-14 03:34 - 00000422 _____ C:\Windows\win.ini
2013-10-27 13:47 - 2010-08-26 19:43 - 07424680 _____ C:\Windows\PFRO.log
2013-10-27 13:47 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-27 13:47 - 2009-07-14 05:51 - 00213667 _____ C:\Windows\setupact.log
2013-10-27 13:09 - 2013-10-27 13:09 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-10-27 13:09 - 2013-10-27 13:09 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-10-27 13:09 - 2013-10-27 13:09 - 00000000 ____D C:\Windows\SysWOW64\Macromed
2013-10-27 13:09 - 2013-10-27 13:09 - 00000000 ____D C:\Windows\system32\Macromed
2013-10-27 13:06 - 2013-09-22 11:58 - 00003374 _____ C:\Windows\System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-1242068612-3420065025-570463520-1000
2013-10-27 13:06 - 2013-09-22 11:58 - 00003246 _____ C:\Windows\System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-1242068612-3420065025-570463520-1000
2013-10-27 12:52 - 2013-10-27 12:52 - 00830344 _____ (Adobe Systems Incorporated) C:\Users\Schröder\Desktop\uninstall_flash_player.exe
2013-10-27 12:43 - 2013-10-27 12:43 - 00891167 _____ C:\Users\Schröder\Desktop\SecurityCheck.exe
2013-10-26 19:12 - 2013-10-26 19:12 - 00000000 ____D C:\Windows\ERUNT
2013-10-26 19:05 - 2013-10-26 19:04 - 00000000 ____D C:\AdwCleaner
2013-10-26 19:05 - 2013-03-13 11:56 - 00000000 ____D C:\ProgramData\Uniblue
2013-10-26 18:52 - 2013-10-26 18:52 - 00000000 ____D C:\Users\Schröder\AppData\Roaming\Malwarebytes
2013-10-26 18:51 - 2013-10-26 18:51 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-10-26 18:51 - 2013-10-26 18:51 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-26 18:51 - 2013-10-26 18:51 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-10-26 18:35 - 2013-10-26 18:35 - 01060070 _____ C:\Users\Schröder\Desktop\adwcleaner.exe
2013-10-26 18:35 - 2013-10-26 18:35 - 01033335 _____ (Thisisu) C:\Users\Schröder\Desktop\JRT.exe
2013-10-26 18:34 - 2013-10-26 18:34 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Schröder\Desktop\mbam-setup-1.75.0.1300.exe
2013-10-26 15:52 - 2013-05-26 16:14 - 00000000 ____D C:\Users\Schröder\Desktop\Einzelzeug
2013-10-26 15:51 - 2010-10-15 18:21 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-10-26 13:07 - 2013-10-26 13:07 - 00029265 _____ C:\ComboFix.txt
2013-10-26 13:07 - 2013-10-26 12:36 - 00000000 ____D C:\Qoobox
2013-10-26 13:07 - 2009-07-14 04:20 - 00000000 __RHD C:\Users\Default
2013-10-26 13:04 - 2013-10-26 12:35 - 00000000 ____D C:\Windows\erdnt
2013-10-26 13:00 - 2009-07-14 03:34 - 00000215 _____ C:\Windows\system.ini
2013-10-26 12:58 - 2009-07-14 03:34 - 89915392 _____ C:\Windows\system32\config\SOFTWARE.bak
2013-10-26 12:58 - 2009-07-14 03:34 - 17825792 _____ C:\Windows\system32\config\SYSTEM.bak
2013-10-26 12:58 - 2009-07-14 03:34 - 00524288 _____ C:\Windows\system32\config\DEFAULT.bak
2013-10-26 12:58 - 2009-07-14 03:34 - 00262144 _____ C:\Windows\system32\config\SECURITY.bak
2013-10-26 12:58 - 2009-07-14 03:34 - 00262144 _____ C:\Windows\system32\config\SAM.bak
2013-10-26 11:02 - 2010-10-15 18:22 - 00000000 ____D C:\Program Files\Microsoft Office
2013-10-26 08:42 - 2010-08-26 19:40 - 00000000 ____D C:\Program Files\Fingerprint Sensor
2013-10-25 19:48 - 2013-10-25 19:48 - 00377856 _____ C:\Users\Schröder\Desktop\gmer_2.1.19163.exe
2013-10-25 19:43 - 2013-10-25 19:43 - 00000000 ____D C:\FRST
2013-10-25 19:41 - 2013-10-25 19:41 - 00000000 _____ C:\Users\Schröder\defogger_reenable
2013-10-25 19:41 - 2010-08-25 20:31 - 00000000 ____D C:\Users\Schröder
2013-10-25 19:40 - 2013-10-25 19:40 - 00050477 _____ C:\Users\Schröder\Desktop\Defogger.exe
2013-10-25 19:02 - 2013-10-25 19:02 - 00701332 _____ C:\Users\Schröder\Desktop\Unterstützungsantrag Lehrpreis.jpeg
2013-10-25 11:45 - 2013-10-25 11:43 - 00000000 ____D C:\Program Files\SUPERAntiSpyware
2013-10-25 11:44 - 2013-10-25 11:44 - 00000000 ____D C:\Users\Schröder\AppData\Roaming\SUPERAntiSpyware.com
2013-10-25 11:43 - 2013-10-25 11:43 - 00001808 _____ C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
2013-10-25 11:43 - 2013-10-25 11:43 - 00000000 ____D C:\ProgramData\SUPERAntiSpyware.com
2013-10-25 11:42 - 2013-10-25 11:40 - 27853504 _____ (SUPERAntiSpyware) C:\Users\Schröder\Desktop\SUPERAntiSpyware.exe
2013-10-24 22:53 - 2010-08-31 14:48 - 00000000 ____D C:\Users\Schröder\Desktop\Uni
2013-10-22 18:42 - 2013-09-02 09:35 - 00003352 _____ C:\Windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1242068612-3420065025-570463520-1000
2013-10-22 18:42 - 2013-09-02 09:35 - 00003224 _____ C:\Windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1242068612-3420065025-570463520-1000
2013-10-20 23:56 - 2012-01-29 12:48 - 00016976 _____ C:\Users\Schröder\Meine Konzerte.xlsx
2013-10-20 23:29 - 2010-09-07 20:10 - 00000000 ____D C:\Users\Schröder\AppData\Roaming\Skype
2013-10-18 23:07 - 2013-10-18 23:04 - 00001593 _____ C:\Windows\VPNInstall.MIF
2013-10-18 23:05 - 2013-10-18 23:05 - 00000000 ____D C:\Program Files\Common Files\Deterministic Networks
2013-10-18 23:05 - 2013-10-18 23:05 - 00000000 ____D C:\Program Files (x86)\Cisco Systems
2013-10-18 23:05 - 2013-10-18 23:05 - 00000000 ____D C:\Program Files (x86)\Cisco
2013-10-18 23:03 - 2013-10-18 23:03 - 05333322 _____ C:\Users\Schröder\Downloads\rzinst-Cisco-VPNClient-5.0.07.0440x64.exe
2013-10-18 23:03 - 2013-10-18 23:03 - 00000594 _____ C:\Windows\RRZE.LOG
2013-10-18 23:03 - 2013-10-18 23:03 - 00000000 ____D C:\Windows\RRZE
2013-10-18 11:33 - 2013-10-18 11:33 - 00915368 _____ (Oracle Corporation) C:\Users\Schröder\Downloads\jre-7u45-windows-i586-iftw.exe
2013-10-18 11:31 - 2013-10-18 11:31 - 00000000 ____D C:\ProgramData\Oracle
2013-10-18 11:30 - 2013-10-18 11:30 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-10-18 11:30 - 2013-10-18 11:30 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-10-18 11:30 - 2013-10-18 11:30 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-10-18 11:30 - 2013-10-18 11:30 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-10-11 16:03 - 2013-10-11 15:59 - 00000000 ____D C:\Users\Schröder\Desktop\Erlangen
2013-10-11 16:02 - 2013-06-05 22:35 - 00000000 ____D C:\Users\Schröder\Desktop\Anderes
2013-10-11 07:08 - 2009-07-14 05:45 - 00418464 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-10 22:55 - 2013-08-14 21:29 - 00000000 ____D C:\Windows\system32\MRT
2013-10-10 22:52 - 2010-08-30 12:57 - 80541720 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-10-09 20:27 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\NDF
2013-10-01 09:20 - 2013-05-02 10:06 - 00083160 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-10-01 09:20 - 2013-03-30 17:01 - 00132600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-10-01 09:20 - 2013-03-30 17:01 - 00105856 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-10-01 09:20 - 2013-03-30 17:01 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-10-01 09:16 - 2012-04-24 19:16 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-09-30 20:34 - 2010-08-27 18:30 - 00000000 ____D C:\Users\Schröder\AppData\Local\Mozilla
2013-09-30 20:33 - 2013-09-30 20:33 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
Some content of TEMP:
====================
C:\Users\Schröder\AppData\Local\Temp\avgnt.exe
C:\Users\Schröder\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== BCD ================================
Windows-Start-Manager
---------------------
Bezeichner {bootmgr}
device partition=C:
description Windows Boot Manager
locale de-DE
inherit {globalsettings}
default {current}
resumeobject {28f06da2-b0d1-11df-8ceb-db82f01d490c}
displayorder {current}
toolsdisplayorder {memdiag}
timeout 30
Windows-Startladeprogramm
-------------------------
Bezeichner {current}
device partition=C:
path \Windows\system32\winload.exe
description Windows 7
locale de-DE
inherit {bootloadersettings}
recoverysequence {28f06da4-b0d1-11df-8ceb-db82f01d490c}
recoveryenabled Yes
osdevice partition=C:
systemroot \Windows
resumeobject {28f06da2-b0d1-11df-8ceb-db82f01d490c}
nx OptIn
Windows-Startladeprogramm
-------------------------
Bezeichner {28f06da4-b0d1-11df-8ceb-db82f01d490c}
device ramdisk=[C:]\Recovery\28f06da4-b0d1-11df-8ceb-db82f01d490c\Winre.wim,{28f06da5-b0d1-11df-8ceb-db82f01d490c}
path \windows\system32\winload.exe
description Windows Recovery Environment
inherit {bootloadersettings}
osdevice ramdisk=[C:]\Recovery\28f06da4-b0d1-11df-8ceb-db82f01d490c\Winre.wim,{28f06da5-b0d1-11df-8ceb-db82f01d490c}
systemroot \windows
nx OptIn
winpe Yes
Wiederaufnahme aus dem Ruhezustand
----------------------------------
Bezeichner {28f06da2-b0d1-11df-8ceb-db82f01d490c}
device partition=C:
path \Windows\system32\winresume.exe
description Windows Resume Application
locale de-DE
inherit {resumeloadersettings}
filedevice partition=C:
filepath \hiberfil.sys
debugoptionenabled No
Windows-Speichertestprogramm
----------------------------
Bezeichner {memdiag}
device partition=C:
path \boot\memtest.exe
description Windows-Speicherdiagnose
locale de-DE
inherit {globalsettings}
badmemoryaccess Yes
Windows-Legacybetriebssystem-Ladeprogramm
-----------------------------------------
Bezeichner {ntldr}
device partition=C:
path \ntldr
description Frhere Windows-Version
EMS-Einstellungen
-----------------
Bezeichner {emssettings}
bootems Yes
Debuggereinstellungen
---------------------
Bezeichner {dbgsettings}
debugtype Serial
debugport 1
baudrate 115200
RAM-Defekte
-----------
Bezeichner {badmemory}
Globale Einstellungen
---------------------
Bezeichner {globalsettings}
inherit {dbgsettings}
{emssettings}
{badmemory}
Startladeprogramm-Einstellungen
-------------------------------
Bezeichner {bootloadersettings}
inherit {globalsettings}
{hypervisorsettings}
Hypervisoreinstellungen
-------------------
Bezeichner {hypervisorsettings}
hypervisordebugtype Serial
hypervisordebugport 1
hypervisorbaudrate 115200
Einstellungen zur Ladeprogrammfortsetzung
-----------------------------------------
Bezeichner {resumeloadersettings}
inherit {globalsettings}
Ger„teoptionen
--------------
Bezeichner {28f06da5-b0d1-11df-8ceb-db82f01d490c}
description Ramdisk Options
ramdisksdidevice partition=C:
ramdisksdipath \Recovery\28f06da4-b0d1-11df-8ceb-db82f01d490c\boot.sdi
LastRegBack: 2013-10-21 13:00
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 26-10-2013 01
Ran by Schröder at 2013-10-27 14:12:59
Running from C:\Users\Schröder\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
64 Bit HP CIO Components Installer (Version: 7.2.8)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.117)
Adobe Reader XI (11.0.04) - Deutsch (x32 Version: 11.0.04)
Amazon MP3-Downloader 1.0.17 (x32 Version: 1.0.17)
Apple Application Support (x32 Version: 2.3.4)
Apple Software Update (x32 Version: 2.1.3.127)
AuthenTec Fingerprint System (Version: 8.0.202.0)
Avira Free Antivirus (x32 Version: 14.0.0.383)
B109n-z (x32 Version: 130.0.396.000)
Bombermaaan 1.4 (x32)
Bonjour (Version: 3.0.0.10)
BufferChm (x32 Version: 130.0.331.000)
Business Contact Manager for Microsoft Outlook 2010 (Version: 4.0.11308.0)
Business Contact Manager für Microsoft Outlook 2010 (Version: 4.0.11308.0)
CDBurnerXP (Version: 4.3.8.2631)
CDBurnerXP (x32 Version: 4.4.0.2838)
Cisco Systems VPN Client 5.0.07.0440 (Version: 5.0.7)
Credential Manager for HP ProtectTools (x32 Version: 4.1.5.1483)
D3DX10 (x32 Version: 15.4.2368.0902)
Definition Update for Microsoft Office 2010 (KB982726) 64-Bit Edition
Destinations (x32 Version: 130.0.0.0)
DeviceDiscovery (x32 Version: 130.0.372.000)
DoulosSIL 4.106 (x32)
Drive Encryption for HP ProtectTools (Version: 4.0.24)
Dropbox (HKCU Version: 2.0.22)
Fotogalerie (x32 Version: 16.4.3503.0728)
Free FLV Converter V 7.1.0 (x32 Version: 7.1.0.0)
GPBaseService2 (x32 Version: 130.0.371.000)
Hewlett-Packard ACLM.NET v1.1.1.0 (x32 Version: 1.00.0000)
HP 3D DriveGuard (Version: 4.0.3.1)
HP Customer Participation Program 13.0 (Version: 13.0)
HP ePrint (x32 Version: 10.0.13228.1563)
HP ESU for Microsoft Windows 7 (x32 Version: 1.0.3.1)
HP Imaging Device Functions 13.0 (Version: 13.0)
HP JavaCard for HP ProtectTools (x32 Version: 04.10.9.0013)
HP LaserJet Professional M1130-M1210 MFP Series
HP LaserJet Professional M1210 MFP Series Fax Installer (Version: 1.3.0)
HP Photosmart Wireless B109n-z All-In-One Driver Software 13.0 Rel .6
HP Postscript Converter (Version: 4.5.12202)
HP Print Projects 1.0 (Version: 1.0)
HP Product Detection (x32 Version: 11.14.0001)
HP ProtectTools Security Manager (x32 Version: 04.10.9.0013)
HP ProtectTools Security Manager Suite (x32 Version: 04.10.9.0013)
HP Smart Web Printing 4.5 (Version: 4.5)
HP Solution Center 13.0 (Version: 13.0)
HP Support Assistant (x32 Version: 6.0.5.4)
HP Unified IO (Version: 2.0.0.479)
HP Unified IO (x32 Version: 2.0.0.479)
HP Update (x32 Version: 5.005.000.001)
HP Webcam Driver (x32 Version: 5.8.50008.0)
HPDiagnosticAlert (x32 Version: 1.00.0000)
HPPhotoGadget (x32 Version: 130.0.282.000)
hpPrintProjects (x32 Version: 130.0.303.000)
HPProductAssistant (x32 Version: 130.0.371.000)
HPSSupply (x32 Version: 130.0.371.000)
hpWLPGInstaller (x32 Version: 130.0.303.000)
Intel(R) Graphics Media Accelerator Driver
Intel® Matrix Storage Manager
Java 7 Update 45 (x32 Version: 7.0.450)
Java Auto Updater (x32 Version: 2.1.9.8)
Juniper Networks Network Connect 7.0.0 (x32 Version: 7.0.0.17289)
Juniper Networks Network Connect 7.2.0 (x32 Version: 7.2.0.21697)
Juniper Networks Network Connect 7.3.0 (x32 Version: 7.3.0.26561)
Juniper Networks, Inc. Setup Client (HKCU Version: 7.3.7.38707)
Juniper Networks, Inc. Setup Client 64-bit Activex Control (Version: 2.1.1.1)
Juniper Networks, Inc. Setup Client Activex Control (x32 Version: 2.1.1.1)
LSI HDA Modem (Version: 2.1.94)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
MarketResearch (x32 Version: 130.0.374.000)
Marvell Miniport Driver (x32 Version: 10.70.5.3)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Chart Controls for Microsoft .NET Framework 3.5 (KB2500170) (x32 Version: 3.5.30730.0)
Microsoft Chart Controls for Microsoft .NET Framework 3.5 Language Pack - deu (x32 Version: 3.5.0.0)
Microsoft Office 2010 Service Pack 1 (SP1)
Microsoft Office Access MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Excel MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Groove MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Groove MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office InfoPath MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office InfoPath MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Office 32-bit Components 2010 (Version: 14.0.6029.1000)
Microsoft Office OneNote MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Outlook MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office PowerPoint MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Professional Plus 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (English) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (French) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (Italian) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proofing (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Publisher MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Shared 32-bit MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Shared MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Word MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft SQL Server 2008 (x32)
Microsoft SQL Server 2008 Browser (x32 Version: 10.1.2531.0)
Microsoft SQL Server 2008 Common Files (x32 Version: 10.0.1600.22)
Microsoft SQL Server 2008 Common Files (x32 Version: 10.1.2531.0)
Microsoft SQL Server 2008 Database Engine Services (x32 Version: 10.1.2531.0)
Microsoft SQL Server 2008 Database Engine Shared (x32 Version: 10.1.2531.0)
Microsoft SQL Server 2008 Native Client (Version: 10.1.2531.0)
Microsoft SQL Server 2008 RsFx Driver (x32 Version: 10.1.2531.0)
Microsoft SQL Server VSS Writer (Version: 10.1.2531.0)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 (Version: 8.0.51011)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (x32 Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft® Office Language Pack 2010 – Deutsch (Business Contact Manager für Microsoft Outlook 2010) (Version: 4.0.11308.0)
Miranda IM 0.9.9 (x32)
Movie Maker (x32 Version: 16.4.3503.0728)
Mozilla Firefox 24.0 (x86 de) (x32 Version: 24.0)
Mozilla Maintenance Service (x32 Version: 24.0)
MP4 To MP3 Converter V3.0 (x32)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT110 (x32 Version: 16.4.1108.0727)
MSVCRT110_amd64 (Version: 16.4.1108.0727)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
Network64 (Version: 130.0.572.000)
Network64 (Version: 140.0.221.000)
Nitro Reader 3 (Version: 3.0.10.7)
PDF24 Creator 5.4.0 (x32)
Photo Gallery (x32 Version: 16.4.3503.0728)
Pidgin (x32 Version: 2.7.4)
PS_AIO_06_B109n-z_SW_Min (x32 Version: 130.0.396.000)
QuickTime (x32 Version: 7.74.80.86)
RealDownloader (x32 Version: 1.3.3)
RealNetworks - Microsoft Visual C++ 2008 Runtime (x32 Version: 9.0)
RealNetworks - Microsoft Visual C++ 2010 Runtime (x32 Version: 10.0)
RealPlayer (x32 Version: 16.0.3)
RealUpgrade 1.1 (x32 Version: 1.1.0)
Safari (x32 Version: 5.34.57.2)
Samsung New PC Studio (x32 Version: 1.00.0000)
SAMSUNG USB Driver for Mobile Phones (Version: 1.3.650.0)
Scan (x32 Version: 13.0.0.0)
Scan To (Version: 2.0.1)
SCR3xxx Smart Card Reader (x32 Version: 8.35)
Service Pack 1 für SQL Server 2008 (KB 968369) (x32 Version: 10.1.2531.0)
Shop for HP Supplies (Version: 13.0)
Skype™ 6.6 (x32 Version: 6.6.106)
SmartWebPrinting (x32 Version: 130.0.373.000)
SolutionCenter (x32 Version: 130.0.373.000)
SoundMAX (x32 Version: 6.10.2.7255)
Sql Server Customer Experience Improvement Program (x32 Version: 10.1.2531.0)
Status (x32 Version: 130.0.373.000)
SUPERAntiSpyware (Version: 5.6.1040)
Synaptics Pointing Device Driver (Version: 13.2.6.2)
Toolbox (x32 Version: 130.0.648.000)
TrayApp (x32 Version: 130.0.376.000)
Unterstützungsdateien für Microsoft SQL Server 2008-Setup (x32 Version: 10.1.2531.0)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3)
Update for Microsoft Access 2010 (KB2553446) 64-Bit Edition
Update for Microsoft Filter Pack 2.0 (KB2810071) 64-Bit Edition
Update for Microsoft Office 2010 (KB2494150)
Update for Microsoft Office 2010 (KB2553065)
Update for Microsoft Office 2010 (KB2553181) 64-Bit Edition
Update for Microsoft Office 2010 (KB2553267) 64-Bit Edition
Update for Microsoft Office 2010 (KB2553270) 64-Bit Edition
Update for Microsoft Office 2010 (KB2553310) 64-Bit Edition
Update for Microsoft Office 2010 (KB2566458)
Update for Microsoft Office 2010 (KB2589298) 64-Bit Edition
Update for Microsoft Office 2010 (KB2589375) 64-Bit Edition
Update for Microsoft Office 2010 (KB2598242) 64-Bit Edition
Update for Microsoft Office 2010 (KB2760598) 64-Bit Edition
Update for Microsoft Office 2010 (KB2760631) 64-Bit Edition
Update for Microsoft Office 2010 (KB2767886) 64-Bit Edition
Update for Microsoft Office 2010 (KB2794737) 64-Bit Edition
Update for Microsoft Office 2010 (KB2825640) 64-Bit Edition
Update for Microsoft Office 2010 (KB2826026) 64-Bit Edition
Update for Microsoft OneNote 2010 (KB2553290) 64-Bit Edition
Update for Microsoft OneNote 2010 (KB2810072) 64-Bit Edition
Update for Microsoft Outlook 2010 (KB2687623) 64-Bit Edition
Update for Microsoft Outlook Social Connector 2010 (KB2553406) 64-Bit Edition
Update for Microsoft PowerPoint 2010 (KB2553145) 64-Bit Edition
Update for Microsoft SharePoint Workspace 2010 (KB2589371) 64-Bit Edition
Update for Microsoft Visio Viewer 2010 (KB2810066) 64-Bit Edition
Update for Microsoft Word 2010 (KB2827323) 64-Bit Edition
Visual C++ 9.0 CRT (x86) WinSXS MSM (x32 Version: 9.0)
VLC media player 1.1.5 (x32 Version: 1.1.5)
WDR RadioRecorder (x32)
WebReg (x32 Version: 130.0.132.017)
Windows Live Communications Platform (x32 Version: 16.4.3503.0728)
Windows Live Essentials (x32 Version: 16.4.3503.0728)
Windows Live ID Sign-in Assistant (Version: 7.250.4311.0)
Windows Live Installer (x32 Version: 16.4.3503.0728)
Windows Live Photo Common (x32 Version: 16.4.3503.0728)
Windows Live PIMT Platform (x32 Version: 16.4.3503.0728)
Windows Live SOXE (x32 Version: 16.4.3503.0728)
Windows Live SOXE Definitions (x32 Version: 16.4.3503.0728)
Windows Live UX Platform (x32 Version: 16.4.3503.0728)
Windows Live UX Platform Language Pack (x32 Version: 16.4.3503.0728)
Windows Media Player Firefox Plugin (x32 Version: 1.0.0.8)
WinSCP 4.3.6 (x32 Version: 4.3.6)
==================== Restore Points =========================
26-10-2013 10:00:29 Configured Microsoft Office Professional Plus 2010
27-10-2013 12:42:40 Removed Adobe Reader X (10.1.8) - Deutsch.
==================== Hosts content: ==========================
2009-07-14 03:34 - 2013-10-26 12:59 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
Task: {0103D669-25C6-4921-9C25-267D4B3D986C} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Total Care Tune-Up => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPTuneUp.exe [2011-03-22] (Hewlett-Packard Company)
Task: {14A92BFC-0CCD-4E08-B4D5-30B6CBFF3590} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-1242068612-3420065025-570463520-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {2FBA85DE-F502-4AA9-9087-8751C9C406C0} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1242068612-3420065025-570463520-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {4CFD163F-1AEC-4588-A024-5EB8F6AFA17B} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1242068612-3420065025-570463520-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {60A7468A-75EE-4BA5-B645-F9B22C9F09AE} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPSFMessenger\HPSFMsgr.exe [2011-06-21] (Hewlett-Packard Company)
Task: {7FB01293-4705-4613-81EB-114F701C1A47} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2010-11-20] (Microsoft Corporation)
Task: {9011E21F-0118-4746-B4BD-48295DE67EBE} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {9C8D6621-F0A6-445A-8295-9D021F07E1AA} - System32\Tasks\{D48C862A-0792-4541-81B9-56A1B0286F49} => C:\Program Files (x86)\Skype\Phone\Skype.exe [2013-06-21] (Skype Technologies S.A.)
Task: {A5BF5868-813D-4463-95A4-276299CE74EB} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-1242068612-3420065025-570463520-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {B8834A7F-E2D9-42C4-95E3-F7DC6C2187DD} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater\HPSFUpdater.exe [2011-06-14] (Hewlett-Packard)
Task: {C229A2BE-4B26-4902-9BAD-F2B0FA8DA6DC} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2011-06-21] (Hewlett-Packard Company)
Task: {CB80004F-1B39-4DFD-B8B8-558CC22C1D67} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-1242068612-3420065025-570463520-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {CFC7ABA2-77C8-4C6F-9A63-166E62FDE5B0} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {D8DFDF03-B77A-4CD1-B3B4-1F55DA2C5D4D} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2011-06-21] (Hewlett-Packard Company)
Task: {F34D9774-77A4-404D-8B61-CD4F2FD2496F} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-1242068612-3420065025-570463520-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {F85E4298-AC5B-4C47-ABD2-76E188535005} - System32\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-1242068612-3420065025-570463520-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\recordingmanager.exe [2013-08-14] (RealNetworks, Inc.)
==================== Loaded Modules (whitelisted) =============
2011-03-17 00:07 - 2011-03-17 00:07 - 04297568 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2013-02-26 10:10 - 2013-02-26 09:24 - 00397704 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2011-03-04 11:49 - 2011-03-04 11:49 - 00202752 _____ () C:\Program Files (x86)\Cisco\VPNClient\vpnapi.dll
2013-09-30 20:33 - 2013-09-30 20:33 - 03279768 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2011-03-17 00:11 - 2011-03-17 00:11 - 04297568 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\Users\Schröder\Desktop\Unterstützungsantrag Lehrpreis.jpeg:3or4kl4x13tuuug3Byamue2s4b
AlternateDataStreams: C:\Users\Schröder\Desktop\Unterstützungsantrag Lehrpreis.jpeg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
==================== Safe Mode (whitelisted) ===================
==================== Faulty Device Manager Devices =============
Name: Deskjet 3000 J310 series
Description: Deskjet 3000 J310 series
Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}
Manufacturer: HP
Service:
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: Deskjet 3000 J310 series
Description: Deskjet 3000 J310 series
Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}
Manufacturer: HP
Service:
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: Deskjet 3000 J310 series
Description: Deskjet 3000 J310 series
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: HP Photosmart Wireless B109n-z
Description: HP Photosmart Wireless B109n-z
Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
Manufacturer: Hewlett-Packard
Service: StillCam
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: Cisco Systems VPN Adapter for 64-bit Windows
Description: Cisco Systems VPN Adapter for 64-bit Windows
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: CVirtA
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: Photosmart Wireless B109n-z
Description: Photosmart Wireless B109n-z
Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}
Manufacturer: HP
Service:
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (10/27/2013 01:13:31 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 24.0.0.5001, Zeitstempel: 0x522fd228
Name des fehlerhaften Moduls: mozalloc.dll, Version: 24.0.0.5001, Zeitstempel: 0x522fa829
Ausnahmecode: 0x80000003
Fehleroffset: 0x0000119c
ID des fehlerhaften Prozesses: 0x498
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3
Error: (10/27/2013 00:48:54 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: AsGHost.exe, Version: 3.1.1.74, Zeitstempel: 0x4a680dbf
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea8e7
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0002e3be
ID des fehlerhaften Prozesses: 0xd10
Startzeit der fehlerhaften Anwendung: 0xAsGHost.exe0
Pfad der fehlerhaften Anwendung: AsGHost.exe1
Pfad des fehlerhaften Moduls: AsGHost.exe2
Berichtskennung: AsGHost.exe3
Error: (10/27/2013 00:48:52 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: AsGHost.exe, Version: 3.1.1.74, Zeitstempel: 0x4a680dbf
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea8e7
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00042685
ID des fehlerhaften Prozesses: 0xd10
Startzeit der fehlerhaften Anwendung: 0xAsGHost.exe0
Pfad der fehlerhaften Anwendung: AsGHost.exe1
Pfad des fehlerhaften Moduls: AsGHost.exe2
Berichtskennung: AsGHost.exe3
Error: (10/27/2013 00:09:55 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (10/27/2013 09:29:58 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (10/27/2013 09:29:55 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (10/27/2013 09:29:47 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (10/27/2013 09:29:43 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
System errors:
=============
Error: (10/27/2013 01:44:36 PM) (Source: DCOM) (User: )
Description: {7429F543-2A60-4CB7-8BC5-F27EA898FB44}
Error: (10/27/2013 01:01:27 PM) (Source: DCOM) (User: )
Description: {7429F543-2A60-4CB7-8BC5-F27EA898FB44}
Error: (10/27/2013 09:21:13 AM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
Error: (10/27/2013 09:21:12 AM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
Error: (10/27/2013 09:21:12 AM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
Error: (10/27/2013 09:21:11 AM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
Error: (10/27/2013 09:15:16 AM) (Source: WMPNetworkSvc) (User: )
Description: WMPNetworkSvc0x80004005
Error: (10/26/2013 11:43:00 PM) (Source: DCOM) (User: )
Description: {7429F543-2A60-4CB7-8BC5-F27EA898FB44}
Error: (10/26/2013 08:54:04 PM) (Source: DCOM) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}
Microsoft Office Sessions:
=========================
Error: (10/27/2013 01:13:31 PM) (Source: Application Error)(User: )
Description: plugin-container.exe24.0.0.5001522fd228mozalloc.dll24.0.0.5001522fa829800000030000119c49801ced30db5303c31C:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dll30ff24ab-3f01-11e3-86d4-002713c2bfbb
Error: (10/27/2013 00:48:54 PM) (Source: Application Error)(User: )
Description: AsGHost.exe3.1.1.744a680dbfntdll.dll6.1.7601.18247521ea8e7c00000050002e3bed1001ced2ec7d71ef34C:\Program Files (x86)\Hewlett-Packard\IAM\Bin\AsGHost.exeC:\Windows\SysWOW64\ntdll.dllc0b448bd-3efd-11e3-b170-002713c2bfbb
Error: (10/27/2013 00:48:52 PM) (Source: Application Error)(User: )
Description: AsGHost.exe3.1.1.744a680dbfntdll.dll6.1.7601.18247521ea8e7c000000500042685d1001ced2ec7d71ef34C:\Program Files (x86)\Hewlett-Packard\IAM\Bin\AsGHost.exeC:\Windows\SysWOW64\ntdll.dllbf7c606b-3efd-11e3-b170-002713c2bfbb
Error: (10/27/2013 00:09:55 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe
Error: (10/27/2013 09:29:58 AM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Schröder\Desktop\esetsmartinstaller_enu.exe
Error: (10/27/2013 09:29:55 AM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Schröder\Desktop\esetsmartinstaller_enu.exe
Error: (10/27/2013 09:29:47 AM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Schröder\Desktop\esetsmartinstaller_enu.exe
Error: (10/27/2013 09:29:43 AM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Schröder\Downloads\esetsmartinstaller_enu.exe
CodeIntegrity Errors:
===================================
Date: 2013-10-26 13:56:04.179
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-10-26 13:56:03.976
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Percentage of memory in use: 71%
Total physical RAM: 1976.27 MB
Available physical RAM: 572.61 MB
Total Pagefile: 3952.53 MB
Available Pagefile: 1743.94 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:230.87 GB) (Free:107.31 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (HP_TOOLS) (Fixed) (Total:2 GB) (Free:1.93 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: B0C9B0C9)
Partition 1: (Active) - (Size=231 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=2 GB) - (Type=0C)
==================== End Of Log ============================
|
|
27.10.2013, 18:56
| #8 |
| /// the machine /// TB-Ausbilder | Windows 7: Spammailversand, dann Schädlingsfund Fertig Die Reihenfolge ist hier entscheidend.
Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
27.10.2013, 19:32
| #9 |
| | Windows 7: Spammailversand, dann Schädlingsfund Vielen Dank erst mal, Schrauber!  Bevor ich zum Abschluss noch etwas kaputt mache, frage ich lieber nach: Das Löschen von Combofix gelingt mir gerade leider nicht. Das Umbenennen und dann Löschen scheint nicht zu funktionieren. Oder soll es mich nach dem Umbenennen und Ausführen vor meinem Virenscanner und deshalb möglichen Schäden bei der Ausführung warnen? Ansonsten hatte ich bereits die Eingabe ins Ausführen-Fenster versucht, dann erscheint eine neue Anzeige, die sagt, dass Combofix nicht gefunden werden konnte. Gleiches gilt, wenn ich es noch mal in grün versuche, also das Gesuchte nach einem Klick auf das Windows-Symbol in die dort erscheinende Suchmaske eintippe. Das Icon von Combofix befindet sich immer noch auf dem Desktop. |
|
28.10.2013, 10:29
| #10 |
| /// the machine /// TB-Ausbilder | Windows 7: Spammailversand, dann Schädlingsfund Einfach Delfix laufen lassen, das entfernt auch Combofix.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
28.10.2013, 19:12
| #11 |
| | Windows 7: Spammailversand, dann Schädlingsfund So, Delfix ist durchgelaufen, Laptop auch neu gestartet. Allerdings habe ich bei noch mal SUPERAntiSpyware starten lassen und das hat bisher schon wieder eine Datei namens Trojan.Agent/Gen-Reputation gefunden. Irgendwann heute Abend sollte der Scan beendet sein, dann kann ich noch mal ein Log posten. Soll ich andere Scanner auch noch mal laufen lassen? Und wenn SAS mir anbieten sollte, die Datei unter Quarantäne zu setzen und zu löschen, soll ich das dann ausführen? EDIT: Schneller als erhofft, hier das Log von SAS. Dieses mal ist "nur" noch ein Trojaner gefunden worden. Habe das Programm noch geöffnet, soll ich es versuchen, die dann einfach per "Manage Allowed Items" zu entfernen? Code:
ATTFilter SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com
Generated 10/28/2013 at 07:07 PM
Application Version : 5.6.1040
Core Rules Database Version : 10854
Trace Rules Database Version: 8666
Scan type : Complete Scan
Total Scan Time : 04:40:52
Operating System Information
Windows 7 Professional 64-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Limited User
Memory items scanned : 657
Memory threats detected : 0
Registry items scanned : 74227
Registry threats detected : 0
File items scanned : 346325
File threats detected : 319
Adware.Tracking Cookie
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@247realmedia[1].txt [ /247realmedia ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@2o7[2].txt [ /2o7 ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@a.revenuemax[1].txt [ /a.revenuemax ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@accounts.google[1].txt [ /accounts.google ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@ad.ad-srv[1].txt [ /ad.ad-srv ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@ad.adserver01[1].txt [ /ad.adserver01 ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@ad.adserver01[3].txt [ /ad.adserver01 ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@ad.dyntracker[2].txt [ /ad.dyntracker ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@ad.dyntracker[3].txt [ /ad.dyntracker ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@ad.yieldmanager[1].txt [ /ad.yieldmanager ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@ad.yieldmanager[3].txt [ /ad.yieldmanager ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@ad.zanox[2].txt [ /ad.zanox ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@ad1.adfarm1.adition[2].txt [ /ad1.adfarm1.adition ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@ad1.adfarm1.adition[3].txt [ /ad1.adfarm1.adition ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@ad2.adfarm1.adition[2].txt [ /ad2.adfarm1.adition ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@ad3.adfarm1.adition[1].txt [ /ad3.adfarm1.adition ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@ad3.adfarm1.adition[2].txt [ /ad3.adfarm1.adition ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@ad4.adfarm1.adition[1].txt [ /ad4.adfarm1.adition ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@adfarm1.adition[1].txt [ /adfarm1.adition ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@adfarm1.adition[2].txt [ /adfarm1.adition ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@adformdsp[1].txt [ /adformdsp ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@adform[1].txt [ /adform ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@ads.creative-serving[1].txt [ /ads.creative-serving ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@ads.escinteractive[1].txt [ /ads.escinteractive ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@adtech[2].txt [ /adtech ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@adx.chip[2].txt [ /adx.chip ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@adxpose[1].txt [ /adxpose ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@apmebf[1].txt [ /apmebf ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@atwola[1].txt [ /atwola ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@atwola[2].txt [ /atwola ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@c.atdmt[2].txt [ /c.atdmt ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@casalemedia[1].txt [ /casalemedia ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@collective-media[1].txt [ /collective-media ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@content.yieldmanager[2].txt [ /content.yieldmanager ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@content.yieldmanager[3].txt [ /content.yieldmanager ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@doubleclick[2].txt [ /doubleclick ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@eas.apm.emediate[2].txt [ /eas.apm.emediate ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@eyewonder[1].txt [ /eyewonder ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@fastclick[1].txt [ /fastclick ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@fastclick[2].txt [ /fastclick ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@fastclick[3].txt [ /fastclick ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@googleads.g.doubleclick[1].txt [ /googleads.g.doubleclick ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@im.banner.t-online[2].txt [ /im.banner.t-online ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@imrworldwide[2].txt [ /imrworldwide ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@in.getclicky[1].txt [ /in.getclicky ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@insightexpressai[1].txt [ /insightexpressai ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@insightexpressai[2].txt [ /insightexpressai ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@invitemedia[2].txt [ /invitemedia ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@media.stage-entertainment[1].txt [ /media.stage-entertainment ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@media6degrees[1].txt [ /media6degrees ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@mediaplex[1].txt [ /mediaplex ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@mediaplex[3].txt [ /mediaplex ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@mediaplex[4].txt [ /mediaplex ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@pro-market[2].txt [ /pro-market ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@questionmarket[1].txt [ /questionmarket ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@questionmarket[3].txt [ /questionmarket ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@revsci[2].txt [ /revsci ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@ru4[2].txt [ /ru4 ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@server.adformdsp[1].txt [ /server.adformdsp ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@server.adform[2].txt [ /server.adform ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@serving-sys[1].txt [ /serving-sys ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@sevenoneintermedia.112.2o7[1].txt [ /sevenoneintermedia.112.2o7 ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@smartadserver[1].txt [ /smartadserver ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@specificclick[1].txt [ /specificclick ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@stat.dealtime[1].txt [ /stat.dealtime ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@statse.webtrendslive[1].txt [ /statse.webtrendslive ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@studivz.adfarm1.adition[2].txt [ /studivz.adfarm1.adition ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@track.adform[2].txt [ /track.adform ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@tracking.mindshare[1].txt [ /tracking.mindshare ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@tracking.quisma[2].txt [ /tracking.quisma ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@tradedoubler[1].txt [ /tradedoubler ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@traffictrack[1].txt [ /traffictrack ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@unitymedia[2].txt [ /unitymedia ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@webmasterplan[1].txt [ /webmasterplan ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@webmasterplan[2].txt [ /webmasterplan ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@www.etracker[1].txt [ /www.etracker ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@www.googleadservices[1].txt [ /www.googleadservices ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@www.mediamarkt[1].txt [ /www.mediamarkt ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@www.windowsmedia[2].txt [ /www.windowsmedia ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@www.zanox-affiliate[2].txt [ /www.zanox-affiliate ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@zanox-affiliate[1].txt [ /zanox-affiliate ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@zanox[2].txt [ /zanox ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@de.sitestat[3].txt [ /de.sitestat.com ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@de.sitestat[2].txt [ /de.sitestat.com ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\schröder@de.sitestat[1].txt [ /de.sitestat.com ]
C:\USERS\SCHRöDER\AppData\Roaming\Microsoft\Windows\Cookies\Low\schröder@ad2.adfarm1.adition[1].txt [ Cookie:schröder@ad2.adfarm1.adition.com/ ]
C:\USERS\SCHRöDER\AppData\Roaming\Microsoft\Windows\Cookies\Low\schröder@ad.yieldmanager[2].txt [ Cookie:schröder@ad.yieldmanager.com/ ]
C:\USERS\SCHRöDER\AppData\Roaming\Microsoft\Windows\Cookies\Low\schröder@interclick[1].txt [ Cookie:schröder@interclick.com/ ]
C:\USERS\SCHRöDER\AppData\Roaming\Microsoft\Windows\Cookies\Low\schröder@atdmt[1].txt [ Cookie:schröder@atdmt.com/ ]
C:\USERS\SCHRöDER\AppData\Roaming\Microsoft\Windows\Cookies\Low\schröder@statse.webtrendslive[2].txt [ Cookie:schröder@statse.webtrendslive.com/ ]
C:\USERS\SCHRöDER\AppData\Roaming\Microsoft\Windows\Cookies\Low\schröder@adfarm1.adition[1].txt [ Cookie:schröder@adfarm1.adition.com/ ]
C:\USERS\SCHRöDER\Cookies\schröder@imrworldwide[2].txt [ Cookie:schröder@imrworldwide.com/cgi-bin ]
C:\USERS\SCHRöDER\Cookies\schröder@mediaplex[4].txt [ Cookie:schröder@mediaplex.com/ ]
C:\USERS\SCHRöDER\Cookies\schröder@stat.dealtime[1].txt [ Cookie:schröder@stat.dealtime.com/ ]
C:\USERS\SCHRöDER\Cookies\schröder@adtech[2].txt [ Cookie:schröder@adtech.de/ ]
C:\USERS\SCHRöDER\Cookies\schröder@in.getclicky[1].txt [ Cookie:schröder@in.getclicky.com/ ]
C:\USERS\SCHRöDER\Cookies\schröder@server.adformdsp[1].txt [ Cookie:schröder@server.adformdsp.net/ ]
C:\USERS\SCHRöDER\Cookies\schröder@ad.adserver01[3].txt [ Cookie:schröder@ad.adserver01.de/ ]
C:\USERS\SCHRöDER\Cookies\schröder@www.zanox-affiliate[2].txt [ Cookie:schröder@www.zanox-affiliate.de/ ]
C:\USERS\SCHRöDER\Cookies\schröder@casalemedia[1].txt [ Cookie:schröder@casalemedia.com/ ]
C:\USERS\SCHRöDER\Cookies\schröder@tradedoubler[1].txt [ Cookie:schröder@tradedoubler.com/ ]
C:\USERS\SCHRöDER\Cookies\schröder@adx.chip[2].txt [ Cookie:schröder@adx.chip.de/ ]
C:\USERS\SCHRöDER\Cookies\schröder@smartadserver[1].txt [ Cookie:schröder@smartadserver.com/ ]
C:\USERS\SCHRöDER\Cookies\schröder@content.yieldmanager[3].txt [ Cookie:schröder@content.yieldmanager.com/ak/ ]
C:\USERS\SCHRöDER\Cookies\schröder@ad2.adfarm1.adition[2].txt [ Cookie:schröder@ad2.adfarm1.adition.com/ ]
C:\USERS\SCHRöDER\Cookies\schröder@www.windowsmedia[2].txt [ Cookie:schröder@www.windowsmedia.com/ ]
C:\USERS\SCHRöDER\Cookies\schröder@collective-media[1].txt [ Cookie:schröder@collective-media.net/ ]
C:\USERS\SCHRöDER\Cookies\schröder@adxpose[1].txt [ Cookie:schröder@adxpose.com/ ]
C:\USERS\SCHRöDER\Cookies\schröder@ad.yieldmanager[3].txt [ Cookie:schröder@ad.yieldmanager.com/ ]
C:\USERS\SCHRöDER\Cookies\schröder@apmebf[1].txt [ Cookie:schröder@apmebf.com/ ]
C:\USERS\SCHRöDER\Cookies\schröder@traffictrack[1].txt [ Cookie:schröder@traffictrack.de/ ]
C:\USERS\SCHRöDER\Cookies\schröder@eyewonder[1].txt [ Cookie:schröder@eyewonder.com/ ]
C:\USERS\SCHRöDER\Cookies\schröder@de.sitestat[3].txt [ Cookie:schröder@de.sitestat.com/ndr/ardsport/ ]
C:\USERS\SCHRöDER\Cookies\schröder@doubleclick[2].txt [ Cookie:schröder@doubleclick.net/ ]
C:\USERS\SCHRöDER\Cookies\schröder@im.banner.t-online[2].txt [ Cookie:schröder@im.banner.t-online.de/ ]
C:\USERS\SCHRöDER\Cookies\schröder@ad3.adfarm1.adition[1].txt [ Cookie:schröder@ad3.adfarm1.adition.com/ ]
C:\USERS\SCHRöDER\Cookies\schröder@2o7[2].txt [ Cookie:schröder@2o7.net/ ]
C:\USERS\SCHRöDER\Cookies\schröder@webmasterplan[1].txt [ Cookie:schröder@webmasterplan.com/ ]
C:\USERS\SCHRöDER\Cookies\schröder@statse.webtrendslive[1].txt [ Cookie:schröder@statse.webtrendslive.com/ ]
C:\USERS\SCHRöDER\Cookies\schröder@revsci[2].txt [ Cookie:schröder@revsci.net/ ]
C:\USERS\SCHRöDER\Cookies\schröder@ad.dyntracker[3].txt [ Cookie:schröder@ad.dyntracker.de/ ]
C:\USERS\SCHRöDER\Cookies\schröder@questionmarket[3].txt [ Cookie:schröder@questionmarket.com/ ]
C:\USERS\SCHRöDER\Cookies\schröder@adform[1].txt [ Cookie:schröder@adform.net/ ]
C:\USERS\SCHRöDER\Cookies\schröder@adfarm1.adition[1].txt [ Cookie:schröder@adfarm1.adition.com/ ]
C:\USERS\SCHRöDER\Cookies\schröder@server.adform[2].txt [ Cookie:schröder@server.adform.net/ ]
C:\USERS\SCHRöDER\Cookies\schröder@track.adform[2].txt [ Cookie:schröder@track.adform.net/ ]
C:\USERS\SCHRöDER\Cookies\schröder@pro-market[2].txt [ Cookie:schröder@pro-market.net/ ]
C:\USERS\SCHRöDER\Cookies\schröder@www.etracker[1].txt [ Cookie:schröder@www.etracker.de/ ]
C:\USERS\SCHRöDER\Cookies\schröder@studivz.adfarm1.adition[2].txt [ Cookie:schröder@studivz.adfarm1.adition.com/ ]
C:\USERS\SCHRöDER\Cookies\schröder@a.revenuemax[1].txt [ Cookie:schröder@a.revenuemax.de/ ]
C:\USERS\SCHRöDER\Cookies\schröder@media6degrees[1].txt [ Cookie:schröder@media6degrees.com/ ]
C:\USERS\SCHRöDER\Cookies\schröder@eas.apm.emediate[2].txt [ Cookie:schröder@eas.apm.emediate.eu/ ]
C:\USERS\SCHRöDER\Cookies\schröder@invitemedia[2].txt [ Cookie:schröder@invitemedia.com/ ]
C:\USERS\SCHRöDER\Cookies\schröder@tracking.quisma[2].txt [ Cookie:schröder@tracking.quisma.com/ ]
C:\USERS\SCHRöDER\Cookies\schröder@atwola[2].txt [ Cookie:schröder@atwola.com/ ]
C:\USERS\SCHRöDER\Cookies\schröder@247realmedia[1].txt [ Cookie:schröder@247realmedia.com/ ]
C:\USERS\SCHRöDER\Cookies\schröder@ru4[2].txt [ Cookie:schröder@ru4.com/ ]
C:\USERS\SCHRöDER\Cookies\schröder@sevenoneintermedia.112.2o7[1].txt [ Cookie:schröder@sevenoneintermedia.112.2o7.net/ ]
C:\USERS\SCHRöDER\Cookies\schröder@adformdsp[1].txt [ Cookie:schröder@adformdsp.net/ ]
C:\USERS\SCHRöDER\Cookies\schröder@tracking.mindshare[1].txt [ Cookie:schröder@tracking.mindshare.de/ ]
C:\USERS\SCHRöDER\Cookies\schröder@de.sitestat[2].txt [ Cookie:schröder@de.sitestat.com/ndr/ ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\Low\schröder@microsoftinternetexplorer.112.2o7[1].txt [ /microsoftinternetexplorer.112.2o7.net ]
C:\Users\Schröder\AppData\Roaming\Microsoft\Windows\Cookies\Low\schröder@fastclick[1].txt [ /fastclick.net ]
a.banner.t-online.de [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
cdnx.tribalfusion.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
content.oddcast.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
core.insightexpressai.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
core.saymedia.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
delivery.ibanner.de [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
fr-himedia.cdn.videoplaza.tv [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
ia.media-imdb.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
ictv-dread-ec.indieclicktv.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
media-vimg-net.vimg.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
media.bwfamily.tv [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
media.movieweb.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
media.mtvnservices.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
media.nbcdfw.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
media.rachaelrayshow.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
media.scanscout.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
media.spinmediavideo.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
media.stage-entertainment.de [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
media3.onsugar.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
msnbcmedia.msn.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
objects.tremormedia.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
s0.2mdn.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
secure-eu.imrworldwide.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
secure-nz.imrworldwide.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
secure-uk.imrworldwide.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
secure-us.imrworldwide.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
static.mediaworks.co.nz [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
swrmediathek.de [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
video.imedia.ro [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
www.ardmediathek.de [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
www.femalefirst.co.uk [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
www.ultimedia.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SPWJNSTV ]
.legolas-media.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.legolas-media.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.112.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.112.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.112.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
de.sitestat.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.rambler.ru [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.tracker.vinsight.de [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.imrworldwide.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.imrworldwide.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
in.getclicky.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.getclicky.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.static.getclicky.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.statcounter.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.invitemedia.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
ad.yieldmanager.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
ad.yieldmanager.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.tns-counter.ru [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
www.etracker.de [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
www.etracker.de [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
ad.yieldmanager.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.122.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.ru4.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
de.sitestat.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.doubleclick.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.invitemedia.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
www.etracker.de [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
track.adform.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.countingdownto.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.beiersdorf.122.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.dmtracker.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
de.sitestat.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.ardmediathek.de [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.ikea.122.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
stats.sumodesign.co.uk [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.mediacet.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
demandmedia.trc.taboola.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
demandmedia.trc.taboola.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
demandmedia.trc.taboola.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
demandmedia.trc.taboola.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.mmstat.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.cnzz.mmstat.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.moviepilot.de [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.moviepilot.de [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.tripod.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.tripod.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.tripod.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.tripod.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.superstats.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.yadro.ru [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.openstat.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.yadro.ru [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.histats.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.histats.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.atdmt.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.c.atdmt.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.c.atdmt.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
fr.sitestat.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
fr.sitestat.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
www.etracker.de [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.adtech.de [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.estat.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.ipcmedia.122.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
ad.yieldmanager.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.hearstdigital.122.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
www.etracker.de [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.webmasterplan.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.cbsdigitalmedia.112.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
ad.zanox.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
de.sitestat.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.chicagosuntimes.122.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.flagcounter.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
app.videostat.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
app.videostat.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.hearstmagazines.112.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
app.videostat.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.videostat.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
www.etracker.de [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
moviepilot.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
moviepilot.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
moviepilot.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.moviepilot.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.moviepilot.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.moviepilot.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.deutschepostag.112.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.trinitymirror.112.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.invitemedia.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.invitemedia.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.xiti.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.xiti.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.statcounter.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.timeinc.122.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
statse.webtrendslive.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
de.sitestat.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.oracle.112.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.vinsight.de [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.socialmedia-disney.de [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.socialmedia-disney.de [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.socialmedia-disney.de [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.oms.122.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
www.etracker.de [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
accounts.google.com [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.warnerbros.112.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
.olympiaverlag.122.2o7.net [ C:\USERS\SCHRöDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G0G0N6QJ.DEFAULT\COOKIES.SQLITE ]
Trojan.Agent/Gen-Reputation
C:\USERS\SCHRöDER\APPDATA\LOCAL\ADOBE\ACROBAT\11.0\CACHE\RDLANG_DIGSIG.DEU
Geändert von Sirenia (28.10.2013 um 19:17 Uhr) |
|
29.10.2013, 09:48
| #12 | |
| /// the machine /// TB-Ausbilder | Windows 7: Spammailversand, dann SchädlingsfundZitat:
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
29.10.2013, 16:32
| #13 |
| | Windows 7: Spammailversand, dann Schädlingsfund Fund 1/47: Bei SuperAntiSpyware. (Welch Überraschung.  )Das ist dann wohl ein Fehlalarm und die kleinen Biester sind weg? |
|
30.10.2013, 10:20
| #14 |
| /// the machine /// TB-Ausbilder | Windows 7: Spammailversand, dann Schädlingsfund Fehlalarm und wir sind fertig
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
31.10.2013, 19:45
| #15 |
| | Windows 7: Spammailversand, dann Schädlingsfund Wunderbar! Vielen, vielen Dank für deine geduldige und großartige Hilfe, schrauber!   |
|
| Themen zu Windows 7: Spammailversand, dann Schädlingsfund |
| 4d36e972-e325-11ce-bfc1-08002be10318, ad.yieldmanager, adblock, adobe, antivir, antivirus, avira, bonjour, browser, converter, defender, device driver, error, excel, farbar, farbar recovery scan tool, firefox, flash player, homepage, logfile, mozilla, plug-in, problem, scan, security, services.exe, software, superantispyware, system, temp, tracker, trojan.agent/gen-dundun, trojan.agent/gen-reputation, windows, windows.old, winlogon.exe |
Linear-Darstellung
