Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung
logfile mit OTL durchgeführt (interpretiert von Hijackthis)

logfile mit OTL durchgeführt (interpretiert von Hijackthis)


Log-Analyse und Auswertung: logfile mit OTL durchgeführt (interpretiert von Hijackthis)

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML

Antwort
Alt 07.03.2014, 15:48   #1
hannes121
 
logfile mit OTL durchgeführt (interpretiert von Hijackthis) - Standard

logfile mit OTL durchgeführt (interpretiert von Hijackthis)


Hallo!

Die folgenden logfiles stammen aus OTL von Oldtimer, habe dann einen Scan mit HijackThis gemacht. Dabei wurde alles als schädlich eingestuft. Kann mir jemand sagen, worum es sich hier handeln könnte?

Vielen Dank!


Besucherbewertung Analysedetails
MOD - [2014.02.19 10:20:40 | 000,014,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\ca708d556b8236f0e2a4 2a36d74c2118\IAStorCommon.ni.dll
Art

Schädlich (2.7 / 5.00)
Besucherbewertung Analysedetails
MOD - [2014.02.19 09:11:54 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\59312674865d c2a19c27f9f460b1673b\System.Runtime.Remoting.ni.dll
Art

Schädlich (2.7 / 5.00)
Besucherbewertung Analysedetails
MOD - [2014.02.19 09:11:34 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\8bc548587e91 ecf0552a40e47bbf99cc\System.Windows.Forms.ni.dll
Art

Schädlich (2.7 / 5.00)
Besucherbewertung Analysedetails
MOD - [2014.02.19 09:11:28 | 001,593,344 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\5c24d3b0041ebf4f48 a93615b9fa3de9\System.Drawing.ni.dll
Art

Schädlich (2.7 / 5.00)
Besucherbewertung Analysedetails
MOD - [2014.02.19 09:11:15 | 003,348,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\1d696b2d3de530f7ee971 070263667ff\WindowsBase.ni.dll
Art

Schädlich (2.7 / 5.00)
Besucherbewertung Analysedetails
MOD - [2014.02.19 09:11:11 | 005,464,064 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\217ece46920546d7184142 91d463bb1c\System.Xml.ni.dll
Art

Schädlich (2.7 / 5.00)
Besucherbewertung Analysedetails
MOD - [2014.02.19 09:11:08 | 000,978,432 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\5b6ddf934128 d538cd5cd77bf4209b93\System.Configuration.ni.dll
Art

Schädlich (2.7 / 5.00)
Besucherbewertung Analysedetails
MOD - [2014.02.19 09:11:07 | 007,989,760 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\b3a78269847005365001c33870 cd121f\System.ni.dll
Art

Schädlich (2.7 / 5.00)

Alt 07.03.2014, 16:09   #2
deeprybka
/// TB-Ausbilder
/// Anleitungs-Guru
 
logfile mit OTL durchgeführt (interpretiert von Hijackthis) - Standard

logfile mit OTL durchgeführt (interpretiert von Hijackthis)


Onlineauswertungen sind oft ungenau. Schauen wir uns das System mal genauer an OK?



Mein Name ist Jürgen und ich werde Dir bei Deinem Problem behilflich sein.
  • Bitte arbeite alle Schritte der Reihe nach ab.
  • Lese die Anleitungen sorgfältig durch bevor Du beginnst. Wenn es Probleme gibt oder Du etwas nicht verstehst, dann stoppe mit Deiner Ausführung und beschreibe mir das Problem.
  • Führe bitte nur Scans durch zu denen Du von mir aufgefordert wirst.
  • Bitte kein Crossposting (posten in mehreren Foren).
  • Installiere oder deinstalliere während der Bereinigung keine Software, außer Du wurdest dazu aufgefordert.
  • Speichere alle unsere Toosl auf dem Desktop ab.
  • Poste die Logfiles direkt in deinen Thread in Code-Tags.
  • Bedenke, dass wir hier alle während unserer Freizeit tätig sind, wenn du innerhalb von 2 Tagen nichts von mir hörst, dann schreibe mir bitte eine PM.

Hinweise: Ich kann Dir niemals eine Garantie geben, dass wir alle schädlichen Dateien finden werden. Eine Formatierung ist meist der schnellere und immer der sicherste Weg.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis Dir jemand vom Team sagt, dass Du clean bist.

Bitte beachte, dass alle meine Antworten zuerst von einem Ausbilder freigegeben werden müssen, bevor ich diese hier posten darf. Dies garantiert, dass Du Hilfe von einem ausgebildeten Helfer bekommst. Siehe hier...

Ich bedanke mich für Deine Geduld!



Schritt 1 (Scan mit FRST)
Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)



Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
__________________

__________________
Geändert von deeprybka (07.03.2014 um 16:22 Uhr)

Alt 07.03.2014, 18:57   #3
hannes121
 
logfile mit OTL durchgeführt (interpretiert von Hijackthis) - Standard

logfile mit OTL durchgeführt (interpretiert von Hijackthis)


FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-03-2014
Ran by Admin (administrator) on ADMIN-PC on 07-03-2014 18:44:40
Running from C:\Users\Admin\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(SurfRight B.V.) C:\Program Files\HitmanPro\hmpsched.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
() C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
() C:\Program Files (x86)\XSManager\WTGService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
() C:\Program Files (x86)\AntiBrowserSpy\BrowserMask.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.5\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.5\GoogleCrashHandler64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
() C:\Program Files (x86)\Vidalia Relay Bundle\Vidalia\vidalia.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Dolby Laboratories Inc.) C:\DOLBY PCEE4\pcee4.exe
(CyberLink Corp.) C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Intel Corporation) C:\Windows\system32\igfxext.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe
(CyberLink Corp.) C:\Program Files (x86)\Acer\clear.fi\MVP\clear.fiAgent.exe
(CyberLink) C:\Program Files (x86)\Acer\clear.fi\MVP\.\Kernel\DMR\DMREngine.exe
() C:\Program Files (x86)\Vidalia Relay Bundle\Tor\tor.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [IntelTBRunOnce] - wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs"
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2280232 2010-07-29] (Synaptics Incorporated)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11785832 2011-03-10] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2189416 2011-03-09] (Realtek Semiconductor)
HKLM\...\Run: [Power Management] - C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [1796200 2011-02-22] (Acer Incorporated)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2010-09-14] (Intel Corporation)
HKLM-x32\...\Run: [SuiteTray] - C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe [340336 2010-09-28] (Egis Technology Inc.)
HKLM-x32\...\Run: [EgisTecPMMUpdate] - C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe [407920 2010-09-18] (Egis Technology Inc.)
HKLM-x32\...\Run: [EgisUpdate] - C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe [201584 2010-09-18] (Egis Technology Inc.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [35696 2009-02-28] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [BackupManagerTray] - C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe [297280 2011-02-15] (NTI Corporation)
HKLM-x32\...\Run: [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe [1081424 2011-03-14] (Dritek System Inc.)
HKLM-x32\...\Run: [Dolby Advanced Audio v2] - C:\Dolby PCEE4\pcee4.exe [506712 2011-02-03] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [ArcadeMovieService] - C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe [177448 2011-02-18] (CyberLink Corp.)
HKLM-x32\...\Run: [BCSSync] - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2010-06-09] (Hewlett-Packard)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [937920 2011-06-06] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [TrojanScanner] - C:\Program Files (x86)\Trojan Remover\Trjscan.exe [1704720 2014-01-23] (Simply Super Software)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\.DEFAULT\...\RunOnce: [IsMyWinLockerReboot] - msiexec.exe /qn /x{voidguid}
HKU\S-1-5-19\...\RunOnce: [IsMyWinLockerReboot] - msiexec.exe /qn /x{voidguid}
HKU\S-1-5-20\...\RunOnce: [IsMyWinLockerReboot] - msiexec.exe /qn /x{voidguid}
HKU\S-1-5-21-2713217424-4135445284-309746539-1000\...\Run: [Vidalia] - C:\Program Files (x86)\Vidalia Relay Bundle\Vidalia\vidalia.exe [6239727 2014-01-18] ()
HKU\S-1-5-21-2713217424-4135445284-309746539-1000\...\Run: [RESTART_STICKY_NOTES] - C:\Windows\System32\StikyNot.exe [427520 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-21-2713217424-4135445284-309746539-1000\...\Run: [GoogleChromeAutoLaunch_A5B343D047FD8BD2F268B0EA0F8DBD7C] - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [859464 2014-03-02] (Google Inc.)
HKU\S-1-5-21-2713217424-4135445284-309746539-1000\...\MountPoints2: E - E:\AutoRun.exe
HKU\S-1-5-21-2713217424-4135445284-309746539-1000\...\MountPoints2: {02027cae-2193-11e1-bcdc-ccaf780045df} - F:\AutoRun.exe
HKU\S-1-5-21-2713217424-4135445284-309746539-1000\...\MountPoints2: {02027cb2-2193-11e1-bcdc-ccaf780045df} - F:\AutoRun.exe
HKU\S-1-5-21-2713217424-4135445284-309746539-1000\...\MountPoints2: {02027cee-2193-11e1-bcdc-b870f48f0452} - F:\AutoRun.exe
HKU\S-1-5-21-2713217424-4135445284-309746539-1000\...\MountPoints2: {0d65f75e-d00d-11e1-ae46-b870f48f0452} - E:\setup.exe
HKU\S-1-5-21-2713217424-4135445284-309746539-1000\...\MountPoints2: {181d41de-c9de-11e0-a1f7-ccaf780045df} - E:\AutoRun.exe
HKU\S-1-5-21-2713217424-4135445284-309746539-1000\...\MountPoints2: {181d41ec-c9de-11e0-a1f7-ccaf780045df} - E:\AutoRun.exe
HKU\S-1-5-21-2713217424-4135445284-309746539-1000\...\MountPoints2: {22653fb5-232b-11e1-bd52-ccaf780045df} - F:\AutoRun.exe
HKU\S-1-5-21-2713217424-4135445284-309746539-1000\...\MountPoints2: {22653fba-232b-11e1-bd52-ccaf780045df} - F:\AutoRun.exe
HKU\S-1-5-21-2713217424-4135445284-309746539-1000\...\MountPoints2: {26ec484c-233a-11e1-a967-ccaf780045df} - F:\AutoRun.exe
HKU\S-1-5-21-2713217424-4135445284-309746539-1000\...\MountPoints2: {26ec4874-233a-11e1-a967-ccaf780045df} - F:\AutoRun.exe
HKU\S-1-5-21-2713217424-4135445284-309746539-1000\...\MountPoints2: {26ec487a-233a-11e1-a967-ccaf780045df} - F:\AutoRun.exe
HKU\S-1-5-21-2713217424-4135445284-309746539-1000\...\MountPoints2: {27518a48-0fb2-11e1-9f8b-ccaf780045df} - E:\AutoRun.exe
HKU\S-1-5-21-2713217424-4135445284-309746539-1000\...\MountPoints2: {27518a5f-0fb2-11e1-9f8b-ccaf780045df} - E:\AutoRun.exe
HKU\S-1-5-21-2713217424-4135445284-309746539-1000\...\MountPoints2: {27518a9d-0fb2-11e1-9f8b-ccaf780045df} - E:\AutoRun.exe
HKU\S-1-5-21-2713217424-4135445284-309746539-1000\...\MountPoints2: {27518aa0-0fb2-11e1-9f8b-ccaf780045df} - E:\AutoRun.exe
HKU\S-1-5-21-2713217424-4135445284-309746539-1000\...\MountPoints2: {36307b5c-0fac-11e1-bc4c-ccaf780045df} - E:\AutoRun.exe
HKU\S-1-5-21-2713217424-4135445284-309746539-1000\...\MountPoints2: {36307b8d-0fac-11e1-bc4c-ccaf780045df} - E:\AutoRun.exe
HKU\S-1-5-21-2713217424-4135445284-309746539-1000\...\MountPoints2: {56c9a2f5-1084-11e1-bd56-ccaf780045df} - F:\AutoRun.exe
HKU\S-1-5-21-2713217424-4135445284-309746539-1000\...\MountPoints2: {5c524d3e-ca54-11e0-888f-ccaf780045df} - E:\AutoRun.exe
HKU\S-1-5-21-2713217424-4135445284-309746539-1000\...\MountPoints2: {792a862a-1b7f-11e1-a843-ccaf780045df} - F:\AutoRun.exe
HKU\S-1-5-21-2713217424-4135445284-309746539-1000\...\MountPoints2: {792a862d-1b7f-11e1-a843-ccaf780045df} - F:\AutoRun.exe
HKU\S-1-5-21-2713217424-4135445284-309746539-1000\...\MountPoints2: {7b0a31e8-23f9-11e1-a8c4-ccaf780045df} - F:\AutoRun.exe
HKU\S-1-5-21-2713217424-4135445284-309746539-1000\...\MountPoints2: {c9cd2154-1d92-11e1-867b-ccaf780045df} - F:\AutoRun.exe
HKU\S-1-5-21-2713217424-4135445284-309746539-1000\...\MountPoints2: {c9cd215b-1d92-11e1-867b-ccaf780045df} - F:\AutoRun.exe
HKU\S-1-5-21-2713217424-4135445284-309746539-1000\...\MountPoints2: {dc5500dd-8a93-11e2-94c2-b870f48f0452} - E:\XSManagerinstallation.exe
HKU\S-1-5-21-2713217424-4135445284-309746539-1000\...\MountPoints2: {e76e9d8c-1d3a-11e1-abbd-ccaf780045df} - F:\AutoRun.exe
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://Nina
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=dnldmsd&cd=2XzuyEtN2Y1L1Qzu0C0C0A0FyBzztDtDyEyD0D0FyEyCyEyBtN0D0Tzu0CyDyEyBtN1L2XzutBtFtBtFtCtFyDyByEtN1L1Czu1Q1G1I1Q1H1B1Q&cr=1812616864&ir=
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=dnldmsd&cd=2XzuyEtN2Y1L1Qzu0C0C0A0FyBzztDtDyEyD0D0FyEyCyEyBtN0D0Tzu0CyDyEyBtN1L2XzutBtFtBtFtCtFyDyByEtN1L1Czu1Q1G1I1Q1H1B1Q&cr=1812616864&ir=
SearchScopes: HKLM-x32 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search
SearchScopes: HKCU - DefaultScope {0633ee93-d776-472f-a0ff-e1416b8b2e3a} URL = 
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {547BABD2-C335-3A5F-9F6A-594B1A70A742} URL = 
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={sear
SearchScopes: HKCU - {7B107F0B-8268-586C-8B91-4B7A189905C3} URL = 
SearchScopes: HKCU - {901D3513-A0F2-4369-9D08-3F6FD6CCE718} URL = hxxp://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=407956&p={searchTerms}
BHO: ExplorerWnd Helper - {10921475-03CE-4E04-90CE-E2E7EF20C814} - C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer64.dll (IObit)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Hotspot Shield Class - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE_64.dll No File
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: PasswordBox Helper - {5DB69B97-934B-451D-94DB-32EF802A01CD} - C:\Program Files (x86)\PasswordBox\Application\pbbtn.dll No File
BHO-x32: visualbee Helper Object - {66F57190-01EB-45A6-8260-7895267209F7} - C:\Program Files (x86)\visualbee\visualbee\1.8.9.1\bh\visualbee.dll No File
BHO-x32: No Name - {7825CFB6-490A-436B-9F26-4A7B5CFC01A9} -  No File
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} -  No File
Toolbar: HKLM-x32 - PasswordBox Toolbar - {25E2E5C9-C43C-4EE8-B23E-4383915F2BCE} - C:\Program Files (x86)\PasswordBox\Application\pbbtn.dll No File
Toolbar: HKLM-x32 - No Name - {610AF794-9293-4129-9FAF-A81BBDFBFA14} -  No File
Toolbar: HKCU - No Name - {25E2E5C9-C43C-4EE8-B23E-4383915F2BCE} -  No File
Hosts: 127.0.0.1 google-analytics.com
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u35hbzvs.default
FF DefaultSearchEngine: Yahoo
FF SelectedSearchEngine: Yahoo
FF Homepage: about:home
FF Keyword.URL: hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=407956&p=
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u35hbzvs.default\searchplugins\visualbee.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: HTTPS-Everywhere - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u35hbzvs.default\Extensions\https-everywhere@eff.org [2014-01-06]
FF HKLM-x32\...\Firefox\Extensions: [jid0-1wPBLrijxGVkIUhu0kFYq6ZaWzA@jetpack] - C:\Program Files (x86)\AntiBrowserSpy\Addons\Firefox
FF Extension: AntiBrowserSpy - SocialBlocker - C:\Program Files (x86)\AntiBrowserSpy\Addons\Firefox [2014-01-31]

Chrome: 
=======
CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
CHR Extension: (Google Docs) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-11-06]
CHR Extension: (Google Drive) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-11-06]
CHR Extension: (YouTube) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-11-06]
CHR Extension: (Google-Suche) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-11-06]
CHR Extension: (ZenMate for Google Chrome™) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdcgdnkidjaadafnichfpabhfomcebme [2014-01-31]
CHR Extension: (HTTPS Everywhere) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gcbommkclmclpchllfjekcdonpmejbdp [2014-01-31]
CHR Extension: (MapsGalaxy) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpmpoonbkphmkpjmcbgpeoondejnaaic [2014-01-13]
CHR Extension: (Google Wallet) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-11-06]
CHR Extension: (AntiBrowserSpy - SocialBlocker) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oohfajmmkkdjdoaoncnnbgfoomiakgbd [2014-01-31]
CHR Extension: (Google Mail) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-11-06]
CHR HKLM\...\Chrome\Extension: [pflphaooapbgpeakohlggbpidpppgdff] - C:\Users\Admin\AppData\Local\mysearchdial.crx [2013-06-30]
CHR HKLM-x32\...\Chrome\Extension: [oohfajmmkkdjdoaoncnnbgfoomiakgbd] - C:\Program Files (x86)\AntiBrowserSpy\Addons\Chrome.crx [2014-01-31]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

S2 CLKMSVC10_34E30CCC; C:\Program Files (x86)\Acer\clear.fi\Movie\NavFilter\kmsvc.exe [238576 2011-02-18] (CyberLink)
R2 DirMngr; C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe [218112 2013-10-07] ()
R2 HitmanProScheduler; C:\Program Files\HitmanPro\hmpsched.exe [127752 2014-03-07] (SurfRight B.V.)
S2 LiveUpdateSvc; C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [2151744 2014-03-07] (IObit)
R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [257344 2011-02-15] (NTI Corporation)
S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [118520 2013-03-01] (Riverbed Technology, Inc.)
R2 WTGService; C:\Program Files (x86)\XSManager\WTGService.exe [327392 2012-01-14] ()
S2 PasswordBox; "C:\Program Files (x86)\PasswordBox\pbbtnService.exe" [X]

==================== Drivers (Whitelisted) ====================

S3 cmntnet; C:\Windows\System32\DRIVERS\cmntnet.sys [141824 2013-03-11] (Wireless Data Device)
S3 cmnuusbser; C:\Windows\System32\DRIVERS\cmnuusbser.sys [123904 2013-03-11] (Wireless Device)
R0 gfibto; C:\Windows\System32\drivers\gfibto.sys [14456 2013-06-30] (GFI Software)
R2 NPF; C:\Windows\System32\drivers\npf.sys [36600 2013-03-01] (Riverbed Technology, Inc.)
S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2013-02-12] (Anchorfree Inc.)
S3 cleanhlp; \??\C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [X]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [X]
S3 Lavasoft Kernexplorer; \??\C:\Program Files (x86)\Lavasoft\Ad-Aware\KernExplorer64.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-03-07 18:28 - 2014-03-07 18:28 - 00471681 _____ () C:\Users\Admin\Downloads\scan frst.txt
2014-03-07 18:27 - 2014-03-07 18:27 - 00053263 _____ () C:\Users\Admin\Downloads\scan mit frst.txt
2014-03-07 18:26 - 2014-03-07 18:26 - 00471681 _____ () C:\Users\Admin\Downloads\scan mit e.txt
2014-03-07 18:25 - 2014-03-07 18:44 - 00022722 _____ () C:\Users\Admin\Downloads\FRST.txt
2014-03-07 18:25 - 2014-03-07 18:29 - 00471678 _____ () C:\Users\Admin\Downloads\Addition.txt
2014-03-07 18:24 - 2014-03-07 18:44 - 00000000 ____D () C:\FRST
2014-03-07 18:24 - 2014-03-07 18:24 - 02156544 _____ (Farbar) C:\Users\Admin\Downloads\FRST64.exe
2014-03-07 18:01 - 2014-03-07 18:44 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-03-07 18:01 - 2014-03-07 18:01 - 00119000 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-03-07 18:00 - 2014-03-07 18:00 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-03-07 18:00 - 2014-03-07 18:00 - 00016220 _____ () C:\Users\Admin\Downloads\analyse I.txt
2014-03-07 17:57 - 2014-03-07 17:57 - 00016220 _____ () C:\Users\Admin\Desktop\JRT.txt
2014-03-07 17:56 - 2014-03-07 18:44 - 00000000 ____D () C:\Users\Admin\Desktop\mbar
2014-03-07 17:55 - 2014-03-07 17:56 - 12589848 _____ (Malwarebytes Corp.) C:\Users\Admin\Downloads\mbar-1.07.0.1009.exe
2014-03-07 17:50 - 2014-03-07 17:50 - 01037734 _____ (Thisisu) C:\Users\Admin\Downloads\JRT_6.1.2.exe
2014-03-07 17:50 - 2014-03-07 17:50 - 01037734 _____ (Thisisu) C:\Users\Admin\Downloads\JRT_6.1.2 (1).exe
2014-03-07 17:50 - 2014-03-07 17:50 - 00000000 ____D () C:\Windows\ERUNT
2014-03-07 17:40 - 2014-03-07 17:40 - 00002886 _____ () C:\Windows\System32\Tasks\Uninstaller_SkipUac_Administrator
2014-03-07 17:40 - 2014-03-07 17:40 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\ProductData
2014-03-07 17:40 - 2014-03-07 17:40 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\IObit
2014-03-07 17:40 - 2014-03-07 17:40 - 00000000 ____D () C:\ProgramData\IObit
2014-03-07 17:39 - 2014-03-07 17:40 - 00000000 ____D () C:\ProgramData\ProductData
2014-03-07 17:39 - 2014-03-07 17:40 - 00000000 ____D () C:\Program Files (x86)\IObit
2014-03-07 17:39 - 2014-03-07 17:39 - 00001216 _____ () C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Uninstall Programs.lnk
2014-03-07 17:39 - 2014-03-07 17:39 - 00001192 _____ () C:\Users\Public\Desktop\IObit Uninstaller.lnk
2014-03-07 17:38 - 2014-03-07 17:39 - 11201344 _____ (IObit) C:\Users\Admin\Downloads\iobituninstaller3.1.7.2405.exe
2014-03-07 17:35 - 2014-03-07 18:11 - 00880774 _____ () C:\Users\Admin\Desktop\Rkill.txt
2014-03-07 17:35 - 2014-03-07 17:35 - 01933048 _____ (Bleeping Computer, LLC) C:\Users\Admin\Downloads\eXplorer.exe
2014-03-07 17:34 - 2014-03-07 17:34 - 00454120 _____ () C:\Users\Admin\Downloads\Nicht bestätigt 774871.crdownload
2014-03-07 17:33 - 2014-03-07 17:33 - 00300264 _____ (Appsinstaller) C:\Users\Admin\Downloads\RKill (1).exe
2014-03-07 17:33 - 2014-03-07 17:33 - 00001094 _____ () C:\Users\Admin\Desktop\Continue Zip Opener Installation.lnk
2014-03-07 17:31 - 2014-03-07 17:31 - 00300264 _____ (Appsinstaller) C:\Users\Admin\Downloads\RKill.exe
2014-03-07 17:27 - 2014-03-07 17:27 - 01933048 _____ (Bleeping Computer, LLC) C:\Users\Admin\Downloads\rkill.com
2014-03-07 17:27 - 2014-03-07 17:27 - 00667952 _____ ( ) C:\Users\Admin\Downloads\ZipSetup.exe
2014-03-07 17:23 - 2014-03-07 17:23 - 00000022 _____ () C:\Windows\S.dirmngr
2014-03-07 17:22 - 2014-03-07 17:22 - 00011326 _____ () C:\Users\Admin\Desktop\HitmanPro_20140307_1722.log
2014-03-07 17:01 - 2014-03-07 17:01 - 00380416 _____ () C:\Users\Admin\Downloads\vow8y4fs.exe
2014-03-07 17:01 - 2014-03-07 17:01 - 00380416 _____ () C:\Users\Admin\Downloads\2k0zvdw0.exe
2014-03-07 16:56 - 2014-03-07 16:56 - 00000000 ____D () C:\Users\Admin\Downloads\RootkitRevealer171 (3)
2014-03-07 16:54 - 2014-03-07 16:54 - 00000000 ____D () C:\Users\Admin\Downloads\RootkitRevealer
2014-03-07 16:53 - 2014-03-07 16:53 - 00231390 _____ () C:\Users\Admin\Downloads\RootkitRevealer.zip
2014-03-07 16:47 - 2014-03-07 16:47 - 00001909 _____ () C:\Users\Public\Desktop\HitmanPro.lnk
2014-03-07 16:47 - 2014-03-07 16:47 - 00000000 ____D () C:\Program Files\HitmanPro
2014-03-07 16:46 - 2014-03-07 16:46 - 10820032 _____ (SurfRight B.V.) C:\Users\Admin\Downloads\HitmanPro_x64.exe
2014-03-07 16:45 - 2014-03-07 17:02 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-03-07 16:45 - 2014-03-07 16:45 - 09988304 _____ (SurfRight B.V.) C:\Users\Admin\Downloads\hitmanpro.exe
2014-03-07 16:38 - 2014-03-07 16:38 - 00000000 ____D () C:\Users\Admin\Documents\Simply Super Software
2014-03-07 16:38 - 2014-03-07 16:38 - 00000000 ____D () C:\ProgramData\Licenses
2014-03-07 16:37 - 2014-03-07 16:37 - 00001103 _____ () C:\Users\Public\Desktop\Trojan Remover.lnk
2014-03-07 16:36 - 2014-03-07 16:36 - 00231390 _____ () C:\Users\Admin\Downloads\RootkitRevealer171 (3).zip
2014-03-07 16:33 - 2014-03-07 16:33 - 00231390 _____ () C:\Users\Admin\Downloads\RootkitRevealer171 (2).zip
2014-03-07 16:33 - 2014-03-07 16:33 - 00000000 ____D () C:\Users\Admin\Downloads\RootkitRevealer171 (2)
2014-03-07 16:27 - 2014-03-07 16:27 - 00000000 ____D () C:\Users\Admin\Downloads\RootkitRevealer171
2014-03-07 16:22 - 2014-03-07 16:37 - 00000000 ____D () C:\Users\Admin\Downloads\RootkitRevealer171 (1)
2014-03-07 16:22 - 2014-03-07 16:22 - 00231390 _____ () C:\Users\Admin\Downloads\RootkitRevealer171 (1).zip
2014-03-07 16:21 - 2014-03-07 16:21 - 00231390 _____ () C:\Users\Admin\Downloads\RootkitRevealer171.zip
2014-03-07 16:14 - 2014-03-07 16:37 - 00000000 ____D () C:\Program Files (x86)\Trojan Remover
2014-03-07 16:14 - 2014-03-07 16:14 - 00000000 ____D () C:\ProgramData\Simply Super Software
2014-03-07 16:11 - 2014-03-07 16:12 - 21407864 _____ (Simply Super Software ) C:\Users\Admin\Downloads\trjsetup690.exe
2014-03-07 14:05 - 2014-03-07 14:05 - 00152392 _____ () C:\Users\Admin\Downloads\OTL Scan.txt
2014-03-07 14:03 - 2014-03-07 14:03 - 00097524 _____ () C:\Users\Admin\Downloads\OTL.Txt SCAN.txt
2014-03-07 13:56 - 2014-03-07 13:56 - 00602112 _____ (OldTimer Tools) C:\Users\Admin\Downloads\OTL (1).exe
2014-03-07 13:03 - 2014-03-07 13:03 - 00613200 _____ (Chip Digital GmbH) C:\Users\Admin\Desktop\HijackThis - CHIP-Downloader.exe
2014-03-07 12:17 - 2014-03-07 12:17 - 00304857 _____ () C:\Users\Admin\Downloads\HijackThis_205.zip
2014-02-27 20:39 - 2014-02-27 20:39 - 00002176 _____ () C:\Users\Public\Desktop\Google Earth.lnk
2014-02-27 20:37 - 2014-02-27 20:37 - 00847816 _____ (Google Inc.) C:\Users\Admin\Downloads\GoogleEarthSetup.exe
2014-02-23 13:07 - 2014-02-23 13:07 - 00000000 ___SD () C:\Users\Admin\Documents\Meine Datenquellen
2014-02-18 14:09 - 2013-12-21 10:53 - 00548864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-02-18 14:09 - 2013-12-21 09:56 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-02-17 14:05 - 2014-02-06 13:16 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-17 14:05 - 2014-02-06 12:30 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-17 14:05 - 2014-02-06 12:30 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-02-17 14:05 - 2014-02-06 12:12 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-17 14:05 - 2014-02-06 12:07 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-02-17 14:05 - 2014-02-06 12:06 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-02-17 14:05 - 2014-02-06 11:57 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-17 14:05 - 2014-02-06 11:56 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-02-17 14:05 - 2014-02-06 11:52 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-17 14:05 - 2014-02-06 11:49 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-17 14:05 - 2014-02-06 11:48 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-02-17 14:05 - 2014-02-06 11:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-02-17 14:05 - 2014-02-06 11:38 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-02-17 14:05 - 2014-02-06 11:32 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-02-17 14:05 - 2014-02-06 11:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-02-17 14:05 - 2014-02-06 11:17 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-02-17 14:05 - 2014-02-06 11:11 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-17 14:05 - 2014-02-06 11:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-02-17 14:05 - 2014-02-06 11:00 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-02-17 14:05 - 2014-02-06 10:57 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-02-17 14:05 - 2014-02-06 10:57 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-17 14:05 - 2014-02-06 10:52 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-02-17 14:05 - 2014-02-06 10:52 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-02-17 14:05 - 2014-02-06 10:50 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-17 14:05 - 2014-02-06 10:49 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-02-17 14:05 - 2014-02-06 10:47 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-02-17 14:05 - 2014-02-06 10:46 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-02-17 14:05 - 2014-02-06 10:25 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-02-17 14:05 - 2014-02-06 10:25 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-02-17 14:05 - 2014-02-06 10:24 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-17 14:05 - 2014-02-06 10:22 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-17 14:05 - 2014-02-06 10:13 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-02-17 14:05 - 2014-02-06 10:09 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-02-17 14:05 - 2014-02-06 10:03 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-02-17 14:05 - 2014-02-06 09:55 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-17 14:05 - 2014-02-06 09:41 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-02-17 14:05 - 2014-02-06 09:40 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-02-17 14:05 - 2014-02-06 09:36 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-02-17 14:05 - 2014-02-06 09:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-02-13 16:16 - 2014-01-01 00:05 - 00420008 _____ () C:\Windows\SysWOW64\locale.nls
2014-02-13 16:16 - 2014-01-01 00:04 - 00420008 _____ () C:\Windows\system32\locale.nls
2014-02-13 16:16 - 2013-12-25 00:09 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-02-13 16:16 - 2013-12-24 23:48 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-02-13 16:16 - 2013-12-06 03:30 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-02-13 16:16 - 2013-12-06 03:30 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-02-13 16:16 - 2013-12-06 03:02 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-02-13 16:16 - 2013-12-06 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-02-13 16:16 - 2013-12-04 03:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll
2014-02-13 16:16 - 2013-12-04 03:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll
2014-02-13 16:16 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll
2014-02-13 16:16 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll
2014-02-13 16:16 - 2013-12-04 03:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll
2014-02-13 16:16 - 2013-12-04 03:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe
2014-02-13 16:16 - 2013-12-04 03:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe
2014-02-13 16:16 - 2013-12-04 03:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe
2014-02-13 16:16 - 2013-12-04 03:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe
2014-02-13 16:16 - 2013-12-04 03:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll
2014-02-13 16:16 - 2013-12-04 03:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll
2014-02-13 16:16 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll
2014-02-13 16:16 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll
2014-02-13 16:16 - 2013-12-04 03:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll
2014-02-13 16:16 - 2013-12-04 02:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe
2014-02-13 16:16 - 2013-12-04 02:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe
2014-02-13 16:16 - 2013-12-04 02:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe
2014-02-13 16:16 - 2013-12-04 02:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe
2014-02-13 16:16 - 2013-11-26 09:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2014-02-13 16:16 - 2013-11-22 23:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2014-02-11 12:40 - 2014-02-11 12:40 - 00000000 ____D () C:\Users\Admin\Desktop\Tor Browser II
2014-02-11 12:27 - 2014-02-11 12:39 - 24145274 _____ () C:\Users\Admin\Downloads\torbrowser-install-3.5.2_en-US.exe
2014-02-08 15:06 - 2014-02-08 15:06 - 00000047 _____ () C:\Users\Admin\Downloads\pnm.cgi

==================== One Month Modified Files and Folders =======

2014-03-07 18:44 - 2014-03-07 18:25 - 00022722 _____ () C:\Users\Admin\Downloads\FRST.txt
2014-03-07 18:44 - 2014-03-07 18:24 - 00000000 ____D () C:\FRST
2014-03-07 18:44 - 2014-03-07 18:01 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-03-07 18:44 - 2014-03-07 17:56 - 00000000 ____D () C:\Users\Admin\Desktop\mbar
2014-03-07 18:37 - 2014-01-25 16:56 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\tor
2014-03-07 18:29 - 2014-03-07 18:25 - 00471678 _____ () C:\Users\Admin\Downloads\Addition.txt
2014-03-07 18:28 - 2014-03-07 18:28 - 00471681 _____ () C:\Users\Admin\Downloads\scan frst.txt
2014-03-07 18:27 - 2014-03-07 18:27 - 00053263 _____ () C:\Users\Admin\Downloads\scan mit frst.txt
2014-03-07 18:26 - 2014-03-07 18:26 - 00471681 _____ () C:\Users\Admin\Downloads\scan mit e.txt
2014-03-07 18:24 - 2014-03-07 18:24 - 02156544 _____ (Farbar) C:\Users\Admin\Downloads\FRST64.exe
2014-03-07 18:19 - 2013-02-27 15:39 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-03-07 18:11 - 2014-03-07 17:35 - 00880774 _____ () C:\Users\Admin\Desktop\Rkill.txt
2014-03-07 18:01 - 2014-03-07 18:01 - 00119000 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-03-07 18:00 - 2014-03-07 18:00 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-03-07 18:00 - 2014-03-07 18:00 - 00016220 _____ () C:\Users\Admin\Downloads\analyse I.txt
2014-03-07 17:57 - 2014-03-07 17:57 - 00016220 _____ () C:\Users\Admin\Desktop\JRT.txt
2014-03-07 17:56 - 2014-03-07 17:55 - 12589848 _____ (Malwarebytes Corp.) C:\Users\Admin\Downloads\mbar-1.07.0.1009.exe
2014-03-07 17:50 - 2014-03-07 17:50 - 01037734 _____ (Thisisu) C:\Users\Admin\Downloads\JRT_6.1.2.exe
2014-03-07 17:50 - 2014-03-07 17:50 - 01037734 _____ (Thisisu) C:\Users\Admin\Downloads\JRT_6.1.2 (1).exe
2014-03-07 17:50 - 2014-03-07 17:50 - 00000000 ____D () C:\Windows\ERUNT
2014-03-07 17:43 - 2011-04-06 11:50 - 00000000 ____D () C:\Program Files (x86)\Acer
2014-03-07 17:43 - 2011-04-06 11:30 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-03-07 17:42 - 2011-04-06 11:35 - 00000000 ____D () C:\Program Files (x86)\Acer GameZone
2014-03-07 17:40 - 2014-03-07 17:40 - 00002886 _____ () C:\Windows\System32\Tasks\Uninstaller_SkipUac_Administrator
2014-03-07 17:40 - 2014-03-07 17:40 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\ProductData
2014-03-07 17:40 - 2014-03-07 17:40 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\IObit
2014-03-07 17:40 - 2014-03-07 17:40 - 00000000 ____D () C:\ProgramData\IObit
2014-03-07 17:40 - 2014-03-07 17:39 - 00000000 ____D () C:\ProgramData\ProductData
2014-03-07 17:40 - 2014-03-07 17:39 - 00000000 ____D () C:\Program Files (x86)\IObit
2014-03-07 17:39 - 2014-03-07 17:39 - 00001216 _____ () C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Uninstall Programs.lnk
2014-03-07 17:39 - 2014-03-07 17:39 - 00001192 _____ () C:\Users\Public\Desktop\IObit Uninstaller.lnk
2014-03-07 17:39 - 2014-03-07 17:38 - 11201344 _____ (IObit) C:\Users\Admin\Downloads\iobituninstaller3.1.7.2405.exe
2014-03-07 17:35 - 2014-03-07 17:35 - 01933048 _____ (Bleeping Computer, LLC) C:\Users\Admin\Downloads\eXplorer.exe
2014-03-07 17:34 - 2014-03-07 17:34 - 00454120 _____ () C:\Users\Admin\Downloads\Nicht bestätigt 774871.crdownload
2014-03-07 17:33 - 2014-03-07 17:33 - 00300264 _____ (Appsinstaller) C:\Users\Admin\Downloads\RKill (1).exe
2014-03-07 17:33 - 2014-03-07 17:33 - 00001094 _____ () C:\Users\Admin\Desktop\Continue Zip Opener Installation.lnk
2014-03-07 17:32 - 2011-05-26 21:13 - 01912349 _____ () C:\Windows\WindowsUpdate.log
2014-03-07 17:31 - 2014-03-07 17:31 - 00300264 _____ (Appsinstaller) C:\Users\Admin\Downloads\RKill.exe
2014-03-07 17:30 - 2009-07-14 05:45 - 00016976 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-03-07 17:30 - 2009-07-14 05:45 - 00016976 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-03-07 17:29 - 2011-05-27 07:06 - 02899222 _____ () C:\Windows\system32\perfh007.dat
2014-03-07 17:29 - 2011-05-27 07:06 - 00857842 _____ () C:\Windows\system32\perfc007.dat
2014-03-07 17:29 - 2009-07-14 06:13 - 00006248 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-03-07 17:27 - 2014-03-07 17:27 - 01933048 _____ (Bleeping Computer, LLC) C:\Users\Admin\Downloads\rkill.com
2014-03-07 17:27 - 2014-03-07 17:27 - 00667952 _____ ( ) C:\Users\Admin\Downloads\ZipSetup.exe
2014-03-07 17:25 - 2011-07-28 16:22 - 00000000 ____D () C:\ProgramData\clear.fi
2014-03-07 17:25 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing
2014-03-07 17:24 - 2013-07-03 00:39 - 00000000 ____D () C:\Users\Admin\AppData\Local\Vidalia
2014-03-07 17:24 - 2013-02-27 15:39 - 00001104 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-03-07 17:23 - 2014-03-07 17:23 - 00000022 _____ () C:\Windows\S.dirmngr
2014-03-07 17:23 - 2013-06-02 10:14 - 00273638 _____ () C:\Windows\PFRO.log
2014-03-07 17:23 - 2013-02-28 08:27 - 00042113 _____ () C:\Windows\setupact.log
2014-03-07 17:23 - 2011-12-10 15:30 - 00065536 _____ () C:\Windows\system32\Ikeext.etl
2014-03-07 17:23 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-03-07 17:22 - 2014-03-07 17:22 - 00011326 _____ () C:\Users\Admin\Desktop\HitmanPro_20140307_1722.log
2014-03-07 17:02 - 2014-03-07 16:45 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-03-07 17:01 - 2014-03-07 17:01 - 00380416 _____ () C:\Users\Admin\Downloads\vow8y4fs.exe
2014-03-07 17:01 - 2014-03-07 17:01 - 00380416 _____ () C:\Users\Admin\Downloads\2k0zvdw0.exe
2014-03-07 16:56 - 2014-03-07 16:56 - 00000000 ____D () C:\Users\Admin\Downloads\RootkitRevealer171 (3)
2014-03-07 16:54 - 2014-03-07 16:54 - 00000000 ____D () C:\Users\Admin\Downloads\RootkitRevealer
2014-03-07 16:53 - 2014-03-07 16:53 - 00231390 _____ () C:\Users\Admin\Downloads\RootkitRevealer.zip
2014-03-07 16:47 - 2014-03-07 16:47 - 00001909 _____ () C:\Users\Public\Desktop\HitmanPro.lnk
2014-03-07 16:47 - 2014-03-07 16:47 - 00000000 ____D () C:\Program Files\HitmanPro
2014-03-07 16:46 - 2014-03-07 16:46 - 10820032 _____ (SurfRight B.V.) C:\Users\Admin\Downloads\HitmanPro_x64.exe
2014-03-07 16:45 - 2014-03-07 16:45 - 09988304 _____ (SurfRight B.V.) C:\Users\Admin\Downloads\hitmanpro.exe
2014-03-07 16:38 - 2014-03-07 16:38 - 00000000 ____D () C:\Users\Admin\Documents\Simply Super Software
2014-03-07 16:38 - 2014-03-07 16:38 - 00000000 ____D () C:\ProgramData\Licenses
2014-03-07 16:37 - 2014-03-07 16:37 - 00001103 _____ () C:\Users\Public\Desktop\Trojan Remover.lnk
2014-03-07 16:37 - 2014-03-07 16:22 - 00000000 ____D () C:\Users\Admin\Downloads\RootkitRevealer171 (1)
2014-03-07 16:37 - 2014-03-07 16:14 - 00000000 ____D () C:\Program Files (x86)\Trojan Remover
2014-03-07 16:36 - 2014-03-07 16:36 - 00231390 _____ () C:\Users\Admin\Downloads\RootkitRevealer171 (3).zip
2014-03-07 16:33 - 2014-03-07 16:33 - 00231390 _____ () C:\Users\Admin\Downloads\RootkitRevealer171 (2).zip
2014-03-07 16:33 - 2014-03-07 16:33 - 00000000 ____D () C:\Users\Admin\Downloads\RootkitRevealer171 (2)
2014-03-07 16:27 - 2014-03-07 16:27 - 00000000 ____D () C:\Users\Admin\Downloads\RootkitRevealer171
2014-03-07 16:22 - 2014-03-07 16:22 - 00231390 _____ () C:\Users\Admin\Downloads\RootkitRevealer171 (1).zip
2014-03-07 16:21 - 2014-03-07 16:21 - 00231390 _____ () C:\Users\Admin\Downloads\RootkitRevealer171.zip
2014-03-07 16:14 - 2014-03-07 16:14 - 00000000 ____D () C:\ProgramData\Simply Super Software
2014-03-07 16:12 - 2014-03-07 16:11 - 21407864 _____ (Simply Super Software ) C:\Users\Admin\Downloads\trjsetup690.exe
2014-03-07 15:59 - 2011-11-15 20:18 - 00155206 _____ () C:\Users\Admin\Downloads\OTL.Txt
2014-03-07 14:05 - 2014-03-07 14:05 - 00152392 _____ () C:\Users\Admin\Downloads\OTL Scan.txt
2014-03-07 14:03 - 2014-03-07 14:03 - 00097524 _____ () C:\Users\Admin\Downloads\OTL.Txt SCAN.txt
2014-03-07 13:56 - 2014-03-07 13:56 - 00602112 _____ (OldTimer Tools) C:\Users\Admin\Downloads\OTL (1).exe
2014-03-07 13:45 - 2011-11-16 22:07 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy
2014-03-07 13:44 - 2011-11-16 22:07 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-03-07 13:03 - 2014-03-07 13:03 - 00613200 _____ (Chip Digital GmbH) C:\Users\Admin\Desktop\HijackThis - CHIP-Downloader.exe
2014-03-07 12:17 - 2014-03-07 12:17 - 00304857 _____ () C:\Users\Admin\Downloads\HijackThis_205.zip
2014-03-07 12:04 - 2013-11-06 19:48 - 00002139 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-03-07 02:28 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-03-07 02:27 - 2011-07-28 13:22 - 00000000 ____D () C:\Users\Admin\AppData\Local\PowerCinema
2014-03-07 02:27 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration
2014-03-07 02:27 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\AppCompat
2014-03-06 18:12 - 2011-07-28 13:21 - 00000000 ____D () C:\Users\Admin
2014-02-27 20:39 - 2014-02-27 20:39 - 00002176 _____ () C:\Users\Public\Desktop\Google Earth.lnk
2014-02-27 20:39 - 2013-02-27 15:39 - 00000000 ____D () C:\Users\Admin\AppData\Local\Google
2014-02-27 20:39 - 2013-02-27 15:39 - 00000000 ____D () C:\Program Files (x86)\Google
2014-02-27 20:37 - 2014-02-27 20:37 - 00847816 _____ (Google Inc.) C:\Users\Admin\Downloads\GoogleEarthSetup.exe
2014-02-26 15:14 - 2014-01-31 22:29 - 00000000 ____D () C:\Users\Admin\AppData\Local\Abelssoft
2014-02-23 14:17 - 2011-11-12 16:37 - 00000000 ____D () C:\Users\Admin\AppData\Local\Microsoft Help
2014-02-23 13:07 - 2014-02-23 13:07 - 00000000 ___SD () C:\Users\Admin\Documents\Meine Datenquellen
2014-02-19 12:51 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-02-17 20:14 - 2013-02-27 15:39 - 00004104 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-02-17 20:14 - 2013-02-27 15:39 - 00003852 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-02-17 14:07 - 2011-11-12 16:37 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-02-17 14:07 - 2009-07-14 03:34 - 00000478 _____ () C:\Windows\win.ini
2014-02-11 12:40 - 2014-02-11 12:40 - 00000000 ____D () C:\Users\Admin\Desktop\Tor Browser II
2014-02-11 12:39 - 2014-02-11 12:27 - 24145274 _____ () C:\Users\Admin\Downloads\torbrowser-install-3.5.2_en-US.exe
2014-02-08 15:06 - 2014-02-08 15:06 - 00000047 _____ () C:\Users\Admin\Downloads\pnm.cgi
2014-02-06 13:16 - 2014-02-17 14:05 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-06 12:30 - 2014-02-17 14:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-06 12:30 - 2014-02-17 14:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-02-06 12:12 - 2014-02-17 14:05 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-06 12:07 - 2014-02-17 14:05 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-02-06 12:06 - 2014-02-17 14:05 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-02-06 11:57 - 2014-02-17 14:05 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-06 11:56 - 2014-02-17 14:05 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-02-06 11:52 - 2014-02-17 14:05 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-06 11:49 - 2014-02-17 14:05 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-06 11:48 - 2014-02-17 14:05 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-02-06 11:48 - 2014-02-17 14:05 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-02-06 11:38 - 2014-02-17 14:05 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-02-06 11:32 - 2014-02-17 14:05 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-02-06 11:20 - 2014-02-17 14:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-02-06 11:17 - 2014-02-17 14:05 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-02-06 11:11 - 2014-02-17 14:05 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-06 11:01 - 2014-02-17 14:05 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-02-06 11:00 - 2014-02-17 14:05 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-02-06 10:57 - 2014-02-17 14:05 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-02-06 10:57 - 2014-02-17 14:05 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-06 10:52 - 2014-02-17 14:05 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-02-06 10:52 - 2014-02-17 14:05 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-02-06 10:50 - 2014-02-17 14:05 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-06 10:49 - 2014-02-17 14:05 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-02-06 10:47 - 2014-02-17 14:05 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-02-06 10:46 - 2014-02-17 14:05 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-02-06 10:25 - 2014-02-17 14:05 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-02-06 10:25 - 2014-02-17 14:05 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-02-06 10:24 - 2014-02-17 14:05 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-06 10:22 - 2014-02-17 14:05 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-06 10:13 - 2014-02-17 14:05 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-02-06 10:09 - 2014-02-17 14:05 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-02-06 10:03 - 2014-02-17 14:05 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-02-06 09:55 - 2014-02-17 14:05 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-06 09:41 - 2014-02-17 14:05 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-02-06 09:40 - 2014-02-17 14:05 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-02-06 09:36 - 2014-02-17 14:05 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-02-06 09:34 - 2014-02-17 14:05 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

Files to move or delete:
====================
C:\Users\Admin\snort_10169.exe


Some content of TEMP:
====================
C:\Users\Admin\AppData\Local\Temp\GHR.exe
C:\Users\Admin\AppData\Local\Temp\ICReinstall_ZipSetup.exe
C:\Users\Admin\AppData\Local\Temp\IO.exe
C:\Users\Admin\AppData\Local\Temp\KNMUQZBUD.exe
C:\Users\Admin\AppData\Local\Temp\PBA.exe
C:\Users\Admin\AppData\Local\Temp\PGMGYUBPKWZ.exe
C:\Users\Admin\AppData\Local\Temp\SHSetup.exe
C:\Users\Admin\AppData\Local\Temp\TRDXMRJGZZA.exe
C:\Users\Admin\AppData\Local\Temp\VL.exe
C:\Users\Admin\AppData\Local\Temp\ZXHNIHCA.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-02-28 21:20

==================== End Of Log ============================
--- --- ---

--- --- ---
__________________
Alt 07.03.2014, 19:04   #4
deeprybka
/// TB-Ausbilder
/// Anleitungs-Guru
 
logfile mit OTL durchgeführt (interpretiert von Hijackthis) - Standard

logfile mit OTL durchgeführt (interpretiert von Hijackthis)




Gut gemacht.

Bitte noch dieses Log posten

Code:
ATTFilter
2014-03-07 18:25 - 2014-03-07 18:29 - 00471678 _____ () C:\Users\Admin\Downloads\Addition.txt
__________________
Gruß
deeprybka

Lob, Kritik, Wünsche?

Spende fürs trojaner-board?
_______________________________________________
„Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer

Alt 07.03.2014, 20:18   #5
hannes121
 
logfile mit OTL durchgeführt (interpretiert von Hijackthis) - Standard

Addition Scan Teil I


Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 07-03-2014
Ran by Admin at 2014-03-07 18:45:03
Running from C:\Users\Admin\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

1912 Titanic Mystery (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-117897550}) (Version:  - Oberon Media)
Absolute Key Logger Removal Tool (HKLM-x32\...\Absolute Key Logger Removal Tool_is1) (Version: 1.0 - Security Stronghold)
Acer Backup Manager (HKLM-x32\...\InstallShield_{0B61BBD5-DA3C-409A-8730-0C3DC3B0F270}) (Version: 3.0.0.85 - NTI Corporation)
Acer ePower Management (HKLM-x32\...\{3DB0448D-AD82-4923-B305-D001E521A964}) (Version: 6.00.3006 - Acer Incorporated)
Acer eRecovery Management (HKLM-x32\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 5.00.3002 - Acer Incorporated)
Acer GameZone Console (HKLM-x32\...\{C97623E2-0614-4845-B199-8E8BEC8E131C}_is1) (Version: 6.1.0.40497 - Oberon Media, Inc.)
Acer Registration (HKLM-x32\...\Acer Registration) (Version: 1.03.3004 - Acer Incorporated)
Acer ScreenSaver (HKLM-x32\...\Acer Screensaver) (Version: 1.1.1130.2010 - Acer Incorporated)
Acer Updater (HKLM-x32\...\{EE171732-BEB4-4576-887D-CB62727F01CA}) (Version: 1.02.3502 - Acer Incorporated)
Acrobat.com (HKLM-x32\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)
Ad-Aware Browsing Protection (HKLM-x32\...\Ad-Aware Browsing Protection) (Version: 0.9.0.2 - )
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 1.5.0.7220 - Adobe Systems Inc.)
Adobe AIR (x32 Version: 1.5.0.7220 - Adobe Systems Inc.) Hidden
Adobe Flash Player 10 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 10.2.152.32 - Adobe Systems Incorporated)
Adobe Flash Player 10 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 10.3.183.5 - Adobe Systems Incorporated)
Adobe Reader 9.1 MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-A91000000001}) (Version: 9.1.0 - Adobe Systems Incorporated)
Adobe Reader X (10.1.1) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.1 - Adobe Systems Incorporated)
AntiBrowserSpy (HKLM-x32\...\{F78B5B4F-075A-4C81-AA27-E707861EB5B7}_is1) (Version: 141 - Abelssoft)
Backup Manager V3 (x32 Version: 3.0.0.85 - NTI Corporation) Hidden
Bejeweled 2 Deluxe (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110265407}) (Version:  - Oberon Media)
Belles Beauty Boutique (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112623650}) (Version:  - Oberon Media)
Broadcom Card Reader Driver Installer (HKLM\...\{4710662C-8204-4334-A977-B1AC9E547819}) (Version: 14.6.1.2 - Broadcom Corporation)
Broadcom Gigabit NetLink Controller (HKLM\...\{C91DCB72-F5BB-410D-A91A-314F5D1B4284}) (Version: 14.6.1.2 - Broadcom Corporation)
Canon MG5100 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG5100_series) (Version:  - )
Chanalyzer 4 (HKLM-x32\...\{AF2ACE0A-440C-44AC-B205-C6071AE42FC3}) (Version: 4.2.1.28 - MetaGeek, LLC)
Chicken Invaders 3 (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112531267}) (Version:  - Oberon Media)
clear.fi (HKLM-x32\...\InstallShield_{2637C347-9DAD-11D6-9EA2-00055D0CA761}) (Version: 1.0.1422.00 - CyberLink Corp.)
clear.fi (x32 Version: 1.0.1422.00 - CyberLink Corp.) Hidden
clear.fi (x32 Version: 9.0.7418 - CyberLink Corp.) Hidden
clear.fi Client (HKLM-x32\...\{43AAE145-83CF-4C96-9A5E-756CEFCE879F}) (Version: 1.00.3008 - Acer Incorporated)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Definition update for Microsoft Office 2010 (KB982726) (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{E14AE329-F210-4EDD-B775-290821C66C1F}) (Version:  - Microsoft)
Dolby Advanced Audio v2 (HKLM-x32\...\{B9E70C7A-9F85-4A39-A4A3-BFA3C3BF7613}) (Version: 7.2.7000.4 - Dolby Laboratories Inc)
Dream Day First Home (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113832110}) (Version:  - Oberon Media)
eBay Worldwide (HKLM-x32\...\{E0B19DF7-B1C7-4937-82C4-0E4B1E346965}) (Version: 2.1.0901 - OEM)
Farm Frenzy 3 Ice Age (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-118399487}) (Version:  - Oberon Media)
Flip Words (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110109903}) (Version:  - Oberon Media)
Fotogalerija Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galapago (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111307457}) (Version:  - Oberon Media)
Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria fotogràfica del Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria fotografii usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie foto Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 33.0.1750.146 - Google Inc.)
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.22.5 - Google Inc.) Hidden
Google+ Auto Backup (HKLM-x32\...\{D1D4D7EA-62B8-4665-9FF7-02A91B925CC9}) (Version: 1.0.18.74 - Google)
Gpg4win (2.2.1) (HKLM-x32\...\GPG4Win) (Version: 2.2.1 - The Gpg4win Project)
HitmanPro 3.7 (HKLM\...\HitmanPro37) (Version: 3.7.9.212 - SurfRight B.V.)
HP Deskjet 1000 J110 series - Grundlegende Software für das Gerät (HKLM\...\{ECFFD23C-3111-4685-8118-E1F79644203F}) (Version: 22.50.231.0 - Hewlett-Packard Co.)
HP Deskjet 1000 J110 series Hilfe (HKLM-x32\...\{DDDFCC77-7F9C-45E9-B38E-721BA599BA0C}) (Version: 140.0.65.65 - Hewlett Packard)
HP Photo Creations (HKLM-x32\...\HP Photo Creations) (Version: 1.0.0.3781 - HP Photo Creations Powered by RocketLife)
HP Update (HKLM-x32\...\{B0069CFA-5BB9-4C03-B1C6-89CE290E5AFE}) (Version: 5.002.006.003 - Hewlett-Packard)
Identity Card (HKLM-x32\...\Identity Card) (Version: 1.00.3006 - Acer Incorporated)
inSSIDer Office (HKLM-x32\...\{8C127DE3-EC36-4BA3-A6EE-6DC4A9B6C526}) (Version: 3.1.1.6 - MetaGeek, LLC)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2342 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.0.0.1046 - Intel Corporation)
IObit Uninstaller (HKLM-x32\...\IObitUninstall) (Version: 3.1.7.2405 - IObit)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Launch Manager (HKLM-x32\...\LManager) (Version: 5.1.4 - Acer Inc.)
Malwarebytes Anti-Malware Version 1.75.0.1300 (HKLM-x32\...\Malwarebytes' Anti-Malware_is1) (Version: 1.75.0.1300 - Malwarebytes Corporation)
MediaEspresso (x32 Version: 1.0.1418_35759 - CyberLink Corp.) Hidden
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Extended DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Home and Student 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Single Image 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Outlook 2010 (HKLM-x32\...\Office14.OUTLOOKR) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Mozilla Firefox 26.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 26.0 (x86 de)) (Version: 26.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 24.2.0 - Mozilla)
Mozilla Thunderbird 24.2.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 24.2.0 (x86 de)) (Version: 24.2.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MyWinLocker (Version: 4.0.14.11 - Egis Technology Inc.) Hidden
MyWinLocker 4 (x32 Version: 4.0.14.11 - Egis Technology Inc.) Hidden
MyWinLocker Suite (HKLM-x32\...\InstallShield_{17DF9714-60C9-43C9-A9C2-32BCAED44CBE}) (Version: 4.0.14.11 - Egis Technology Inc.)
MyWinLocker Suite (x32 Version: 4.0.14.11 - Egis Technology Inc.) Hidden
newsXpresso (HKLM-x32\...\InstallShield_{613C0AC5-3A67-4B94-8B13-9176AD83F5BF}) (Version: 1.0.0.40 - esobi Inc.)
newsXpresso (x32 Version: 1.0.0.40 - esobi Inc.) Hidden
NTI Media Maker 9 (HKLM-x32\...\InstallShield_{D3D5C4E8-040F-4C6F-8105-41D43CF94F44}) (Version: 9.0.2.8942 - NTI Corporation)
NTI Media Maker 9 (x32 Version: 9.0.2.8942 - NTI Corporation) Hidden
NVIDIA Grafiktreiber 267.21 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 267.21 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.265.39.0 - NVIDIA Corporation) Hidden
NVIDIA PhysX (HKLM-x32\...\{B9DB4C76-01A4-46D5-8910-F7AA6376DBAF}) (Version: 9.10.0514 - NVIDIA Corporation)
NVIDIA Systemsteuerung 267.21 (Version: 267.21 - NVIDIA Corporation) Hidden
PDF Editor 3 (HKLM-x32\...\PDF Editor 3) (Version:  - )
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9 - Google, Inc.)
Poczta usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Pošta Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6329 - Realtek Semiconductor Corp.)
Security Task Manager 1.8d (HKLM-x32\...\Security Task Manager) (Version: 1.8d - Neuber Software)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version:  - Microsoft) Hidden
Shredder (Version: 2.0.8.7 - Egis Technology Inc.) Hidden
Shredder (x32 Version: 2.0.8.7 - Egis Technology Inc.) Hidden
Sprill and Ritchie (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-117932650}) (Version:  - Oberon Media)
Studie zur Verbesserung von HP Deskjet 1000 J110 series Produkten (HKLM\...\{3F7C54EA-F59C-45DD-BA93-AD1E084A9550}) (Version: 22.50.231.0 - Hewlett-Packard Co.)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.1.6.0 - Synaptics Incorporated)
Tor 0.2.4.20 (HKLM-x32\...\Tor) (Version:  - )
Trojan Remover 6.9.0 (HKLM-x32\...\Trojan Remover_is1) (Version: 6.9.0 - Simply Super Software)
Überwachungstool für die Intel® Turbo-Boost-Technik 2.0 (HKLM\...\{B77EFA0B-9BD3-4122-9F9A-15A963B5EA24}) (Version: 2.0.82.0 - Intel)
Update for Microsoft Office 2010 (KB2202188) (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{86B7A074-265D-420C-9E1E-7A920EF0ECA7}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2413186) (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{556146F7-74AE-4E0A-B64F-5B8B93469F61}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2413186) (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{B5516874-E926-4BFD-B412-D0E70112F244}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2413186) (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{D6CE7280-6EE3-419A-8F47-DB111C040B1B}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2494150) (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{3FCFD88F-4D13-4F38-8625-ABABEA7F61EA}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2494150) (HKLM-x32\...\{91140000-001A-0000-0000-0000000FF1CE}_Office14.OUTLOOKR_{3FCFD88F-4D13-4F38-8625-ABABEA7F61EA}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0407-0000-0000000FF1CE}_Office14.OUTLOOKR_{C70D2038-A2C4-4A99-87DE-5272BB44F0CE}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0407-0000-0000000FF1CE}_Office14.SingleImage_{C70D2038-A2C4-4A99-87DE-5272BB44F0CE}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0409-0000-0000000FF1CE}_Office14.OUTLOOKR_{B5C70C99-B109-42FD-B219-FF12CA543F19}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0409-0000-0000000FF1CE}_Office14.SingleImage_{B5C70C99-B109-42FD-B219-FF12CA543F19}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-040C-0000-0000000FF1CE}_Office14.OUTLOOKR_{82F87E28-B18E-46D6-A399-E2F19CF5949B}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-040C-0000-0000000FF1CE}_Office14.SingleImage_{82F87E28-B18E-46D6-A399-E2F19CF5949B}) (Version:  - Microsoft)
Update for Microsoft OneNote 2010 (KB2433299) (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{6C845127-B949-4D76-A732-BCB396AD9AA5}) (Version:  - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-001A-0407-0000-0000000FF1CE}_Office14.OUTLOOKR_{A0657506-69DC-44AE-8DC1-58E7C6F5B1C9}) (Version:  - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-001A-0407-0000-0000000FF1CE}_Office14.SingleImage_{A0657506-69DC-44AE-8DC1-58E7C6F5B1C9}) (Version:  - Microsoft)
Update for Microsoft Outlook Social Connector (KB2583935) (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{EDF9874C-9E37-4110-9FC3-094247E114DF}) (Version:  - Microsoft)
Update for Microsoft Outlook Social Connector (KB2583935) (HKLM-x32\...\{91140000-001A-0000-0000-0000000FF1CE}_Office14.OUTLOOKR_{EDF9874C-9E37-4110-9FC3-094247E114DF}) (Version:  - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (HKLM-x32\...\{90140000-0018-0407-0000-0000000FF1CE}_Office14.SingleImage_{81812245-FC84-426A-BC02-6659C88CC7B2}) (Version:  - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.OUTLOOKR_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version:  - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version:  - Microsoft)
Vidalia 0.2.21 (HKLM-x32\...\Vidalia) (Version:  - )
Welcome Center (HKLM-x32\...\Acer Welcome Center) (Version: 1.02.3102 - Acer Incorporated)
Windows Live Argazki Galeria (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogaléria (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalleri (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotoğraf Galerisi (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotótár (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Galeria de Fotos (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Galerija fotografija (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 15.4.3502.0922 - Корпорация Майкрософт) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Temel Parçalar (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 影像中心 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 程式集 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Liven asennustyökalu (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Liven sähköposti (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Liven valokuvavalikoima (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
WinPcap 4.1.3 (HKLM-x32\...\WinPcapInst) (Version: 4.1.0.2980 - Riverbed Technology, Inc.)
Wireshark 1.10.5 (32-bit) (HKLM-x32\...\Wireshark) (Version: 1.10.5 - The Wireshark developer community, hxxp://www.wireshark.org)
XSManager (HKLM-x32\...\XSManager) (Version: 3.0 - XSManager)
Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Основные компоненты Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Почта Windows Live (x32 Version: 15.4.3502.0922 - Корпорация Майкрософт) Hidden
Фотоальбом Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Фотогалерия на Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
גלריית התמונות של Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
بريد Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
معرض صور Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Code:
ATTFilter
==================== Restore Points  =========================

25-02-2014 14:41:59 Windows Update
26-02-2014 14:13:58 Windows Update
28-02-2014 11:53:59 Windows Update
04-03-2014 19:59:12 Windows Update
06-03-2014 17:13:37 Windows Update
07-03-2014 12:15:14 Windows Defender Checkpoint
07-03-2014 16:42:52 Konfiguriert Vedio WebCam

==================== Hosts content: ==========================

2009-07-14 03:34 - 2014-02-26 15:15 - 00439351 ____N C:\Windows\system32\Drivers\etc\hosts
Code:
ATTFilter
==================== Restore Points  =========================

25-02-2014 14:41:59 Windows Update
26-02-2014 14:13:58 Windows Update
28-02-2014 11:53:59 Windows Update
04-03-2014 19:59:12 Windows Update
06-03-2014 17:13:37 Windows Update
07-03-2014 12:15:14 Windows Defender Checkpoint
07-03-2014 16:42:52 Konfiguriert Vedio WebCam

==================== Hosts content: ==========================

2009-07-14 03:34 - 2014-02-26 15:15 - 00439351 ____N C:\Windows\system32\Drivers\etc\hosts


Alt 07.03.2014, 20:22   #6
hannes121
 
logfile mit OTL durchgeführt (interpretiert von Hijackthis) - Standard

logfile mit OTL durchgeführt (interpretiert von Hijackthis)


Code:
ATTFilter
127.0.0.1 google-analytics.com

==================== Scheduled Tasks (whitelisted) =============

Task: {0A74CD4C-69FE-4937-8277-BA5522BBE7EB} - System32\Tasks\Uninstaller_SkipUac_Administrator => C:\Program Files (x86)\IObit\IObit Uninstaller\IObitUninstaler.exe [2014-03-07] (IObit)
Task: {1D6AF306-F62D-4C3C-9395-44F1210E6432} - System32\Tasks\HP Deskjet 1000 J110 series.exe => C:\Program Files\HP\HP Deskjet 1000 J110 series\Bin\HP Deskjet 1000 J110 series.exe [2010-11-16] (Hewlett-Packard Co.)
Task: {2A18493F-B2C1-44F9-9C70-281A2EF72666} - System32\Tasks\{7A72CB89-EB8F-4589-8435-8DB16B5E6593} => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\starter.exe
Task: {303C12C4-DA6D-4F3B-B659-62733F1D4F6E} - System32\Tasks\HPCustParticipation HP Deskjet 1000 J110 series => C:\Program Files\HP\HP Deskjet 1000 J110 series\Bin\HPCustPartic.exe [2010-11-16] (Hewlett-Packard Co.)
Task: {36A0DF4F-D0C2-41DF-B3E3-716B4E74D8C8} - System32\Tasks\Ad-Aware Update (Weekly) => C:\Program Files (x86)\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe
Task: {390DF7C9-F2F2-463B-8FA0-82928477879E} - System32\Tasks\{8F13A350-70CE-4F58-BBF7-88E30A6C6D0B} => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\starter.exe
Task: {409D7134-9473-463F-889E-6F4F0528B31C} - System32\Tasks\Ad-Aware Antivirus Scheduled Scan => C:\PROGRA~2\AD-AWA~1\AdAwareLauncher.exe
Task: {513ACA75-12C9-43C3-B323-0D3C6AC17FA8} - System32\Tasks\clear.fiAgent => C:\Program Files (x86)\Acer\clear.fi\MVP\clear.fiAgent.exe [2011-02-22] (CyberLink Corp.)
Task: {7400874C-16EF-4B22-B0A7-327A69A7183A} - System32\Tasks\AntiBrowserSpy - BrowserMask => C:\Program Files (x86)\AntiBrowserSpy\BrowserMask.exe [2014-01-13] ()
Task: {7732E454-215E-4237-8277-6387A69F9807} - System32\Tasks\EPUpdater => C:\Users\Admin\AppData\Roaming\BABSOL~1\Shared\BabMaint.exe <==== ATTENTION
Task: {9789294C-1989-4258-BB61-0C90191C2545} - System32\Tasks\clear.fi => C:\Program Files (x86)\Acer\clear.fi\MVP\clear.fi.exe [2011-02-22] (Acer Incorporated)
Task: {A77CAF4F-6A60-4092-9F3B-05E754FA9D26} - System32\Tasks\{242550C1-D809-4E4F-95F3-8305FC98C87D} => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe [2009-02-28] (Adobe Systems Incorporated)
Task: {B6CCAD31-1F59-4133-825B-3CD883744960} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-02-27] (Google Inc.)
Task: {CA14B26B-8078-4A27-8023-F20BC72307DC} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {CFB784C8-CE6A-40FD-AB6B-0F3F301DA132} - System32\Tasks\DMREngine => C:\Program Files (x86)\Acer\clear.fi\MVP\.\Kernel\DMR\DMREngine.exe [2011-02-22] (CyberLink)
Task: {EEA7EB10-E3C7-445C-B5F7-F8F3154FBB34} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-02-27] (Google Inc.)
Task: {F20B6C6A-BF0A-4860-A53F-9958527C9D09} - System32\Tasks\{454D3617-5C7B-482C-806B-1770DE0F7C5B} => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\starter.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-10-07 15:54 - 2013-10-07 15:54 - 00218112 _____ () C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe
2013-03-11 22:51 - 2012-01-14 07:26 - 00327392 ____N () C:\Program Files (x86)\XSManager\WTGService.exe
2014-01-31 22:20 - 2014-01-13 09:45 - 00823424 _____ () C:\Program Files (x86)\AntiBrowserSpy\BrowserMask.exe
2014-01-31 22:20 - 2014-01-13 09:45 - 00055936 _____ () C:\Program Files (x86)\AntiBrowserSpy\AbSettings.dll
2014-01-31 22:20 - 2014-01-13 09:45 - 00861312 _____ () C:\Program Files (x86)\AntiBrowserSpy\AntiBrowserSpyResources.dll
2014-01-31 22:20 - 2014-01-13 09:45 - 01340032 _____ () C:\Program Files (x86)\AntiBrowserSpy\AntiBrowserSpyLibrary.dll
2014-01-31 22:20 - 2014-01-13 09:44 - 01401472 _____ () C:\Program Files (x86)\AntiBrowserSpy\AbGui.dll
2014-01-31 22:20 - 2014-01-13 09:45 - 00016000 _____ () C:\Program Files (x86)\AntiBrowserSpy\AbProcessManager.dll
2011-04-06 12:14 - 2011-03-26 01:28 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2014-01-18 10:42 - 2014-01-18 10:42 - 06239727 _____ () C:\Program Files (x86)\Vidalia Relay Bundle\Vidalia\vidalia.exe
2014-01-18 11:37 - 2014-01-18 11:37 - 03610126 _____ () C:\Program Files (x86)\Vidalia Relay Bundle\Tor\tor.exe
2013-10-07 15:49 - 2013-10-07 15:49 - 00221184 _____ () C:\Program Files (x86)\GNU\GnuPG\libksba-8.dll
2013-10-07 15:47 - 2013-10-07 15:47 - 00037888 _____ () C:\Program Files (x86)\GNU\GnuPG\libgpg-error-0.dll
2013-10-07 15:44 - 2013-10-07 15:44 - 00050176 _____ () C:\Program Files (x86)\GNU\GnuPG\libw32pth-0.dll
2013-10-07 15:49 - 2013-10-07 15:49 - 00069632 _____ () C:\Program Files (x86)\GNU\GnuPG\libassuan-0.dll
2013-10-07 15:49 - 2013-10-07 15:49 - 00628224 _____ () C:\Program Files (x86)\GNU\GnuPG\libgcrypt-11.dll
2011-02-15 19:37 - 2011-02-15 19:37 - 00465640 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\sqlite3.dll
2011-02-15 19:36 - 2011-02-15 19:36 - 01081664 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\ACE.dll
2011-02-15 19:37 - 2011-02-15 19:37 - 00125760 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\MailConverter32.dll
2009-06-23 03:42 - 2009-06-23 03:42 - 00043008 _____ () C:\Program Files (x86)\Vidalia Relay Bundle\Vidalia\libgcc_s_dw2-1.dll
2011-08-23 23:59 - 2011-08-23 23:59 - 00047972 _____ () C:\Program Files (x86)\Vidalia Relay Bundle\Vidalia\mingwm10.dll
2011-02-22 09:01 - 2011-02-22 09:01 - 00206216 _____ () C:\Program Files (x86)\Acer\clear.fi\MVP\Kernel\DMR\CLNetMediaDMA.dll
2014-02-19 10:20 - 2014-02-19 10:20 - 00169472 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\aa739380ca2b2fc7366d464d2f2301ac\IsdiInterop.ni.dll
2011-04-06 11:30 - 2010-09-14 02:28 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2014-03-07 12:04 - 2014-03-02 03:35 - 00051016 _____ () C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.146\chrome_elf.dll
2014-03-07 12:04 - 2014-03-02 03:35 - 00716616 _____ () C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.146\libglesv2.dll
2014-03-07 12:04 - 2014-03-02 03:35 - 00100168 _____ () C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.146\libegl.dll
2014-03-07 12:04 - 2014-03-02 03:35 - 04061000 _____ () C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.146\pdf.dll
2014-03-07 12:04 - 2014-03-02 03:35 - 00394568 _____ () C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.146\ppGoogleNaClPluginChrome.dll
2014-03-07 12:04 - 2014-03-02 03:35 - 01647432 _____ () C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.146\ffmpegsumo.dll
2014-03-07 12:04 - 2014-03-02 03:35 - 13632840 _____ () C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.146\PepperFlash\pepflashplayer.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\Temp:CB0AACC9

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"

==================== Disabled items from MSCONFIG ==============


==================== Faulty Device Manager Devices =============

Name: Microsoft-Adapter für Miniports virtueller WiFis
Description: Microsoft-Adapter für Miniports virtueller WiFis
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: vwifimp
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============

Microsoft Office Sessions:
=========================

==================== Memory info =========================== 

Percentage of memory in use: 34%
Total physical RAM: 8043.86 MB
Available physical RAM: 5260.12 MB
Total Pagefile: 16085.9 MB
Available Pagefile: 13173.84 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: (Acer) (Fixed) (Total:683.54 GB) (Free:396.24 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 699 GB) (Disk ID: 36581321)
Partition 1: (Not Active) - (Size=15 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=684 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Alt 08.03.2014, 20:37   #7
deeprybka
/// TB-Ausbilder
/// Anleitungs-Guru
 
logfile mit OTL durchgeführt (interpretiert von Hijackthis) - Standard

logfile mit OTL durchgeführt (interpretiert von Hijackthis)


Schritt 1

Starte Malwarebytes, klicke auf Aktualisierung --> Starte anschließend einen Quickscan
Wenn der Scan beendet ist, klicke auf Ergebnisse anzeigen.
Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
Poste das Logfile, welches sich in Notepad öffnet, hier in den Thread.
Nachträglich kannst du den Bericht unter "Log Dateien" finden.

Schritt 2

Starte das Junkware Removal Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


Schritt 3

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset



Schritt 4
Starte noch einmal FRST.
  • Ändere keine der Voreinstellungen und drücke auf Scan.
  • Wenn der Scan abgeschlossen ist, werden ein neues Logfile FRST.txt erstellt und auf dem Desktop gespeichert.
  • Poste den Inhalt dieses Logfiles bitte hier in deinen Thread.

Bitte poste mir also in Deiner nächsten Antwort den Inhalt der Logdateien wie gewohnt in Code Tags von:

- Malwarebytes
- JRT.txt
- log.txt
- FRST.txt
__________________
Gruß
deeprybka

Lob, Kritik, Wünsche?

Spende fürs trojaner-board?
_______________________________________________
„Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer

Alt 11.03.2014, 23:11   #8
deeprybka
/// TB-Ausbilder
/// Anleitungs-Guru
 
logfile mit OTL durchgeführt (interpretiert von Hijackthis) - Standard

logfile mit OTL durchgeführt (interpretiert von Hijackthis)


Hi,

ich hab schon länger keine Antwort mehr von Dir erhalten. Brauchst du noch Hilfe?

Hinweis: Wir sind noch nicht fertig! Sollte ich die nächsten 24h keine Nachricht von Dir bekommen, lösche ich das Thema aus meinen Abos und werde daher über Änderungen oder Beiträge nicht weiter informiert.
__________________
Gruß
deeprybka

Lob, Kritik, Wünsche?

Spende fürs trojaner-board?
_______________________________________________
„Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer

Alt 12.03.2014, 18:46   #9
hannes121
 
logfile mit OTL durchgeführt (interpretiert von Hijackthis) - Standard

logfile mit OTL durchgeführt (interpretiert von Hijackthis)


Hallo!

Sorry, ich bin in den letzten Tagen nicht dazu gekommen. Das werde ich jetzt nachholen. Vielen Dank.

Hannes

Alt 12.03.2014, 18:46   #10
deeprybka
/// TB-Ausbilder
/// Anleitungs-Guru
 
logfile mit OTL durchgeführt (interpretiert von Hijackthis) - Standard

logfile mit OTL durchgeführt (interpretiert von Hijackthis)


OK
__________________
Gruß
deeprybka

Lob, Kritik, Wünsche?

Spende fürs trojaner-board?
_______________________________________________
„Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer

Alt 12.03.2014, 19:38   #11
hannes121
 
logfile mit OTL durchgeführt (interpretiert von Hijackthis) - Standard

logfile mit OTL durchgeführt (interpretiert von Hijackthis)


Malwarebytes Anti-Malware 1.75.0.1300
Malwarebytes : Free Anti-Malware

Datenbank Version: v2014.03.12.10

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16518
Admin :: ADMIN-PC [Administrator]

12.03.2014 18:57:06
mbam-log-2014-03-12 (18-57-06).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 226906
Laufzeit: 8 Minute(n), 34 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 4
C:\Users\Admin\AppData\Local\Temp\n8726\s8726.exe (PUP.Optional.Rapiddown) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Admin\AppData\Local\Temp\n9059\s9059.exe (PUP.Optional.Rapiddown) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Admin\Downloads\RKill (1).exe (PUP.Optional.BundleInstaller.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Admin\Downloads\RKill.exe (PUP.Optional.BundleInstaller.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.2 (02.20.2014:1)
OS: Windows 7 Home Premium x64
Ran by Admin on 12.03.2014 at 19:27:38,40
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ FireFox

Successfully deleted the following from C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\u35hbzvs.default\prefs.js

user_pref("extensions.mysearchdial.pnu_base", "{\"newVrsn\":\"38\",\"lastVrsn\":\"38\",\"vrsnLoad\":\"\",\"showMsg\":\"false\",\"showSilent\":\"true\",\"msgTs\":0,\"lstMsgTs\"



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 12.03.2014 at 19:33:33,73
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Alt 16.03.2014, 16:59   #12
deeprybka
/// TB-Ausbilder
/// Anleitungs-Guru
 
logfile mit OTL durchgeführt (interpretiert von Hijackthis) - Standard

logfile mit OTL durchgeführt (interpretiert von Hijackthis)


Hallo,
es fehlen noch die Logs von ESET und FRST....
__________________
Gruß
deeprybka

Lob, Kritik, Wünsche?

Spende fürs trojaner-board?
_______________________________________________
„Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer

Alt 17.03.2014, 19:17   #13
deeprybka
/// TB-Ausbilder
/// Anleitungs-Guru
 
logfile mit OTL durchgeführt (interpretiert von Hijackthis) - Standard

logfile mit OTL durchgeführt (interpretiert von Hijackthis)


Hi,

ich hab schon länger keine Antwort mehr von Dir erhalten. Brauchst du noch Hilfe?

Hinweis: Wir sind noch nicht fertig! Sollte ich die nächsten 24h keine Nachricht von Dir bekommen, lösche ich das Thema aus meinen Abos und werde daher über Änderungen oder Beiträge nicht weiter informiert.
__________________
Gruß
deeprybka

Lob, Kritik, Wünsche?

Spende fürs trojaner-board?
_______________________________________________
„Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer

Antwort

Themen zu logfile mit OTL durchgeführt (interpretiert von Hijackthis)
assembly, c:\windows, durchgeführt, folge, folgende, folgenden, hijack, hijackthis, logfile, logfiles, oldtimer, scan, schädlich, windows


« Ständig neue Fenster in allen Browsern mit Mitteilung, dass Rechner zu lansam etc. | Win7: Unbekannter Trojaner oder Virus nach Fernwartung »


Ähnliche Themen: logfile mit OTL durchgeführt (interpretiert von Hijackthis)


  1. Ein OTL-Scan möchte interpretiert werden
    Log-Analyse und Auswertung - 19.12.2011 (2)
  2. Logfile von HiJackThis
    Plagegeister aller Art und deren Bekämpfung - 14.06.2011 (1)
  3. HijackThis Logfile
    Log-Analyse und Auswertung - 21.03.2010 (3)
  4. HijackThis-Logfile
    Mülltonne - 17.01.2010 (0)
  5. Virtumonde mal wieder ! combifix und hijackthis durchgeführt
    Mülltonne - 20.08.2008 (0)
  6. HijackThis - Logfile
    Log-Analyse und Auswertung - 22.06.2008 (1)
  7. HijackThis Logfile
    Log-Analyse und Auswertung - 23.05.2008 (2)
  8. Logfile of HijackThis
    Mülltonne - 20.05.2007 (0)
  9. HiJackThis LogFile - Need Help!!!
    Log-Analyse und Auswertung - 12.03.2007 (1)
  10. my hijackthis logfile:
    Log-Analyse und Auswertung - 17.06.2006 (4)
  11. Hijackthis logfile
    Log-Analyse und Auswertung - 12.06.2006 (4)
  12. HijackTHis Logfile!!!
    Log-Analyse und Auswertung - 27.11.2005 (5)
  13. HiJackThis Logfile
    Log-Analyse und Auswertung - 26.11.2005 (3)
  14. HijackTHis Logfile
    Log-Analyse und Auswertung - 24.11.2005 (8)
  15. ESCAN und HiJackThis durchgeführt, aber dann????
    Plagegeister aller Art und deren Bekämpfung - 26.09.2005 (10)
  16. Logfile Hijackthis
    Log-Analyse und Auswertung - 09.12.2004 (1)
  17. HiJackThis Logfile
    Log-Analyse und Auswertung - 29.11.2004 (14)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema logfile mit OTL durchgeführt (interpretiert von Hijackthis) - Hallo! Die folgenden logfiles stammen aus OTL von Oldtimer, habe dann einen Scan mit HijackThis gemacht. Dabei wurde alles als schädlich eingestuft. Kann mir jemand sagen, worum es sich hier - logfile mit OTL durchgeführt (interpretiert von Hijackthis)...
Archiv
Du betrachtest: logfile mit OTL durchgeführt (interpretiert von Hijackthis) auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129