| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Windows 7 & BKA Trojaner 1.18 -> Nur teilweise erfolgreich entferntWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
02.02.2015, 17:30
| #1 |
 |  Windows 7 & BKA Trojaner 1.18 -> Nur teilweise erfolgreich entfernt Hallo, habe hier einen iMac mit Bootcamp und Windows 7. Der Rechner ist von meiner Mutter. Die hat sich leider irgendwas eingefangen - die Kiste war total verseucht. Ich habe in den letzten Tagen mehrere Versuche unternommen die Kiste zu reinigen, unter anderem mit Kaspersky Rescue CD, Avira, Avast, Spybot, Mailwarebytes, aber irgendwie ist immer noch nicht so alles "rund". Der Windows Sicherheitsdienst kannst nicht gestartet werden. Netzwerk geht zwar, jedoch kein WLAN. Auch kommen beim starten des Computers noch zwei Fehlermeldungen über irgendwelche fehlenden DLLs. Die Meldung vom BKA Trojaner (es war Version 1.18) erschein nicht mehr, auch sonst keine AUffälligkeiten. Es wurden wirklich TONNEN von Viren, Trojanern und AdWare von den verschiedenen Scannern gefunden, auch ein Rootkit. Auch nach der Entfernung selbiger bin ich mir ziemlich sicher, dass hier noch einiges im Argen ist. Wie ich oben schon schrieb sind einige Dienste nicht mehr zu starten. Ich habe nun ein Log mit FRST erstellt, dass ich hier zur Verfügung stellen möchte. Auch habe ich noch Logs von Avast sowie Malwarebytes die ich unten anhänge. Ich würde mich wirklich sehr freuen wenn mir jemand helfen könnte. Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-02-2015
Ran by Sabine (administrator) on SABINE-PC on 02-02-2015 17:13:48
Running from C:\Users\Sabine\Downloads
Loaded Profiles: Sabine (Available profiles: Sabine)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Boot Camp\Bootcamp.exe
(Haufe-Lexware GmbH & Co. KG) C:\Program Files (x86)\Lexware\Update Manager\LxUpdateManager.exe
() C:\Windows\System32\AppleOSSMgr.exe
(Apple Inc.) C:\Windows\System32\AppleTimeSrv.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Haufe-Lexware GmbH & Co. KG) C:\Program Files (x86)\Lexware\Update Service\Hmg.InstallationService.Service.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\VS7Debug\mdm.exe
(Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\ng\ngservice.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [Apple_KbdMgr] => C:\Program Files\Boot Camp\Bootcamp.exe [741760 2011-06-29] (Apple Inc.)
HKLM-x32\...\Run: [LexwareInfoService] => C:\Program Files (x86)\Lexware\Update Manager\LxUpdateManager.exe [196648 2014-09-26] (Haufe-Lexware GmbH & Co. KG)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2015-02-01] (AVAST Software)
HKU\S-1-5-21-892020284-3589852367-1128131356-1000\...\Run: [IimbIxxuq] => regsvr32.exe "C:\ProgramData\IimbIxxuq\XaldIyojg.bih"
Startup: C:\Users\Sabine\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CAE505C80.lnk
ShortcutTarget: CAE505C80.lnk -> c:\progra~3\08c505eac.cpp (No File)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)
BootExecute: autocheck autochk * bootdeletesdnclean64.exe
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-892020284-3589852367-1128131356-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:62511;https=127.0.0.1:62511
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\S-1-5-21-892020284-3589852367-1128131356-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab
Handler-x32: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files (x86)\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
FireFox:
========
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\4.0.60310.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-02-01]
Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR Profile: C:\Users\Sabine\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Avast Online Security) - C:\Users\Sabine\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2015-02-01]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-02-01]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S4 AAV UpdateService; C:\Program Files (x86)\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
R2 AppleOSSMgr; C:\Windows\system32\AppleOSSMgr.exe [224640 2011-06-29] ()
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2015-02-01] (AVAST Software)
R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4012248 2015-02-01] (Avast Software)
S2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [182520 2015-01-19] (Avira Operations GmbH & Co. KG)
R2 Lexware_Update_Service; C:\Program Files (x86)\Lexware\Update Service\Hmg.InstallationService.Service.exe [64552 2014-08-14] (Haufe-Lexware GmbH & Co. KG)
R2 MDM; C:\Program Files (x86)\Common Files\Microsoft Shared\VS7Debug\mdm.exe [270336 2001-02-23] (Microsoft Corporation) [File not signed]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R3 applebmt; C:\Windows\System32\DRIVERS\applebmt.sys [52736 2011-06-03] (Apple Inc.)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2015-02-01] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [87912 2015-02-01] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2015-02-01] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2015-02-01] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2015-02-01] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2015-02-01] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2015-02-01] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2015-02-01] ()
S3 hitmanpro37; C:\Windows\system32\drivers\hitmanpro37.sys [43664 2015-02-01] ()
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2013-03-18] (Apple, Inc.) [File not signed]
R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [271752 2015-02-01] (Avast Software)
S3 cpuz134; \??\C:\Users\Sabine\AppData\Local\Temp\cpuz134\cpuz134_x64.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-02-02 17:13 - 2015-02-02 17:14 - 00010247 _____ () C:\Users\Sabine\Downloads\FRST.txt
2015-02-02 17:13 - 2015-02-02 17:13 - 02131456 _____ (Farbar) C:\Users\Sabine\Downloads\FRST64.exe
2015-02-02 17:13 - 2015-02-02 17:13 - 00000000 ____D () C:\FRST
2015-02-02 17:03 - 2015-02-02 17:03 - 00000085 _____ () C:\Windows\wininit.ini
2015-02-02 09:15 - 2015-02-02 09:15 - 00000847 _____ () C:\Users\Sabine\Desktop\viri.txt
2015-02-01 14:36 - 2015-02-01 14:36 - 00000000 ____D () C:\Program Files (x86)\ESET
2015-02-01 14:34 - 2015-02-01 14:35 - 02347384 _____ (ESET) C:\Users\Sabine\Downloads\esetsmartinstaller_deu.exe
2015-02-01 14:26 - 2015-02-01 14:26 - 00000000 ____D () C:\Users\Sabine\AppData\Roaming\AVAST Software
2015-02-01 14:25 - 2015-02-02 16:55 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2015-02-01 14:25 - 2015-02-01 14:25 - 00087912 _____ (AVAST Software) C:\Windows\system32\Drivers\aswmonflt.sys
2015-02-01 14:25 - 2015-02-01 14:25 - 00001972 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2015-02-01 14:25 - 2015-02-01 14:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2015-02-01 14:25 - 2015-02-01 14:24 - 00436624 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2015-02-01 14:25 - 2015-02-01 14:24 - 00267632 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2015-02-01 14:25 - 2015-02-01 14:24 - 00116728 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2015-02-01 14:25 - 2015-02-01 14:24 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2015-02-01 14:24 - 2015-02-01 14:25 - 01050432 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2015-02-01 14:24 - 2015-02-01 14:24 - 00364512 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2015-02-01 14:24 - 2015-02-01 14:24 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2015-02-01 14:24 - 2015-02-01 14:24 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2015-02-01 14:24 - 2015-02-01 14:24 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2015-02-01 14:23 - 2015-02-01 14:23 - 00000000 ____D () C:\Program Files\AVAST Software
2015-02-01 14:22 - 2015-02-01 14:23 - 00000000 ____D () C:\ProgramData\AVAST Software
2015-02-01 14:20 - 2015-02-01 14:22 - 132469808 _____ (AVAST Software) C:\Users\Sabine\Downloads\avast_free_antivirus_setup.exe
2015-02-01 14:20 - 2015-02-01 14:22 - 132469808 _____ (AVAST Software) C:\Users\Public\Desktop\avast_free_antivirus_setup.exe
2015-02-01 14:16 - 2015-02-01 14:27 - 00000000 ____D () C:\OETemp
2015-02-01 14:16 - 2015-02-01 14:16 - 00001145 _____ () C:\Users\Public\Desktop\Avira.lnk
2015-02-01 14:16 - 2015-02-01 14:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-02-01 14:16 - 2015-02-01 14:16 - 00000000 ____D () C:\ProgramData\Avira
2015-02-01 14:16 - 2015-02-01 14:16 - 00000000 ____D () C:\Program Files (x86)\Avira
2015-02-01 14:12 - 2015-02-01 14:16 - 00000700 _____ () C:\DelFix.txt
2015-02-01 14:12 - 2015-02-01 14:12 - 00000000 ____D () C:\Windows\ERUNT
2015-02-01 13:31 - 2015-02-01 13:31 - 00001110 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-02-01 13:31 - 2015-02-01 13:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-02-01 13:31 - 2015-02-01 13:31 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-02-01 13:31 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-02-01 13:31 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-02-01 13:24 - 2015-02-01 13:24 - 04515896 _____ (Avira Operations & Co. KG) C:\Users\Sabine\Downloads\avira_de_av_5821065637__ws.exe
2015-02-01 12:44 - 2015-02-01 13:31 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-01 12:44 - 2015-02-01 13:31 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-02-01 12:44 - 2015-02-01 13:28 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-02-01 12:44 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-02-01 12:42 - 2015-02-01 12:43 - 16466552 _____ (Malwarebytes Corp.) C:\Users\Sabine\Downloads\mbar-1.08.3.1004.exe
2015-02-01 12:12 - 2015-02-02 17:03 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2015-02-01 12:12 - 2015-02-02 17:03 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-02-01 12:12 - 2015-02-01 12:12 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2015-02-01 12:09 - 2015-02-01 12:09 - 00000004 _____ () C:\Users\Sabine\AppData\Roaming\appdataFr2.bin
2015-02-01 12:08 - 2015-02-01 12:08 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Sabine\Downloads\mbam-setup-2.0.4.1028.exe
2015-02-01 12:06 - 2015-02-01 12:06 - 00043664 _____ () C:\Windows\system32\Drivers\hitmanpro37.sys
2015-02-01 12:00 - 2015-02-01 12:00 - 00379488 _____ () C:\Windows\system32\.crusader
2015-02-01 11:35 - 2015-02-01 11:59 - 00000000 ____D () C:\ProgramData\HitmanPro
2015-02-01 11:35 - 2015-02-01 11:35 - 00000000 ____D () C:\Program Files\HitmanPro
2015-02-01 11:28 - 2015-02-01 14:26 - 00000000 ____D () C:\Windows\pss
2015-01-31 14:53 - 2015-01-31 14:54 - 00000000 ____D () C:\Kaspersky Rescue Disk 10.0
2015-01-27 21:49 - 2015-01-29 17:37 - 00000000 ____D () C:\Users\Sabine\Sicherung Buchhaltung Lexware
2015-01-27 17:21 - 2015-01-27 17:21 - 00025087 _____ () C:\Windows\system32\ScanResults.xml
2015-01-25 21:02 - 2015-01-25 21:02 - 00643544 _____ () C:\Windows\Minidump\012515-34975-01.dmp
2015-01-25 17:06 - 2015-01-25 17:06 - 00000000 ____D () C:\Users\Sabine\AppData\Roaming\QuickScan
2015-01-25 17:00 - 2015-01-25 17:00 - 00000000 ____D () C:\Users\Sabine\AppData\Roaming\Opera Software
2015-01-25 17:00 - 2015-01-25 17:00 - 00000000 ____D () C:\Users\Sabine\AppData\Local\Opera Software
2015-01-25 16:57 - 2015-01-25 17:30 - 00000000 ____D () C:\Program Files (x86)\Opera
2015-01-20 20:59 - 2015-01-20 22:06 - 00000000 ____D () C:\Users\Sabine\AppData\Roaming\Lexware
2015-01-20 20:58 - 2015-01-20 20:58 - 00002771 _____ () C:\Users\Public\Desktop\Lexware buchhalter.lnk
2015-01-20 20:58 - 2015-01-20 20:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lexware
2015-01-20 20:57 - 2015-01-29 16:05 - 00000000 ____D () C:\ProgramData\Lexware
2015-01-20 20:57 - 2015-01-27 21:48 - 00000000 ____D () C:\Program Files (x86)\Lexware
2015-01-20 20:57 - 2014-06-05 09:45 - 09016832 _____ (Amyuni Technologies hxxp://www.amyuni.com) C:\Windows\system32\cdintf500_64.dll
2015-01-20 20:57 - 2014-06-05 09:45 - 07235584 _____ (Amyuni Technologies hxxp://www.amyuni.com) C:\Windows\SysWOW64\cdintf500.dll
2015-01-20 20:30 - 2015-01-20 20:31 - 01686192 _____ (Haufe-Lexware GmbH & Co.KG) C:\Users\Sabine\Downloads\Buchhalter_plus_Setup.exe
2015-01-18 19:08 - 2015-01-18 19:13 - 00001904 _____ () C:\Users\Public\Desktop\Steuer-Sparer 2015.lnk
2015-01-18 19:08 - 2015-01-18 19:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steuer-Sparer 2015
2015-01-18 19:07 - 2015-01-18 19:13 - 00000000 ____D () C:\Program Files (x86)\Steuer-Sparer 2015
2015-01-18 18:13 - 2015-02-01 14:27 - 00000000 ____D () C:\ProgramData\Package Cache
2015-01-16 02:49 - 2015-01-25 21:02 - 00000000 ____D () C:\Windows\Minidump
2015-01-16 02:49 - 2015-01-25 21:01 - 402575744 _____ () C:\Windows\MEMORY.DMP
2015-01-16 02:49 - 2015-01-16 02:49 - 00375208 _____ () C:\Windows\Minidump\011615-26457-01.dmp
2015-01-16 00:54 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-16 00:54 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-16 00:54 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-01-16 00:54 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-01-16 00:54 - 2014-12-11 18:47 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-16 00:54 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-16 00:54 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2015-01-16 00:54 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2015-01-16 00:53 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-01-16 00:53 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-01-16 00:53 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-01-16 00:53 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-01-16 00:53 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-01-15 19:52 - 2015-01-18 18:22 - 00000000 ____D () C:\Users\Sabine\AppData\Local\elfopatch
2015-01-12 20:03 - 2014-12-13 06:09 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-01-12 20:03 - 2014-12-13 04:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-01-12 19:38 - 2015-01-12 19:38 - 00000000 ____D () C:\Windows\system32\appraiser
2015-01-04 17:35 - 2014-12-04 03:50 - 00830976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-01-04 17:35 - 2014-12-04 03:50 - 00741376 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-01-04 17:35 - 2014-12-04 03:50 - 00413184 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-01-04 17:35 - 2014-12-04 03:50 - 00396800 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-01-04 17:35 - 2014-12-04 03:50 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-01-04 17:35 - 2014-12-04 03:50 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-01-04 17:35 - 2014-12-04 03:44 - 01083392 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-01-04 17:35 - 2014-12-02 00:28 - 01232040 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2015-01-04 17:34 - 2014-11-11 04:09 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-01-04 17:34 - 2014-11-11 03:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-01-04 17:34 - 2014-11-11 02:46 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2015-01-04 17:33 - 2014-11-27 02:43 - 00389296 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-01-04 17:33 - 2014-11-27 02:10 - 00342200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-01-04 17:33 - 2014-11-22 04:13 - 25059840 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-01-04 17:33 - 2014-11-22 04:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-01-04 17:33 - 2014-11-22 04:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-01-04 17:33 - 2014-11-22 03:50 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-01-04 17:33 - 2014-11-22 03:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-01-04 17:33 - 2014-11-22 03:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-01-04 17:33 - 2014-11-22 03:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-01-04 17:33 - 2014-11-22 03:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-01-04 17:33 - 2014-11-22 03:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-01-04 17:33 - 2014-11-22 03:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-01-04 17:33 - 2014-11-22 03:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-01-04 17:33 - 2014-11-22 03:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-01-04 17:33 - 2014-11-22 03:34 - 06039552 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-01-04 17:33 - 2014-11-22 03:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-01-04 17:33 - 2014-11-22 03:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-01-04 17:33 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-01-04 17:33 - 2014-11-22 03:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-01-04 17:33 - 2014-11-22 03:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-01-04 17:33 - 2014-11-22 03:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-01-04 17:33 - 2014-11-22 03:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-01-04 17:33 - 2014-11-22 03:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-01-04 17:33 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-01-04 17:33 - 2014-11-22 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-01-04 17:33 - 2014-11-22 03:06 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-01-04 17:33 - 2014-11-22 03:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-01-04 17:33 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-01-04 17:33 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-01-04 17:33 - 2014-11-22 02:59 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-01-04 17:33 - 2014-11-22 02:58 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-01-04 17:33 - 2014-11-22 02:56 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-01-04 17:33 - 2014-11-22 02:54 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-01-04 17:33 - 2014-11-22 02:49 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-01-04 17:33 - 2014-11-22 02:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-01-04 17:33 - 2014-11-22 02:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-01-04 17:33 - 2014-11-22 02:46 - 02125312 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-01-04 17:33 - 2014-11-22 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-01-04 17:33 - 2014-11-22 02:43 - 14412800 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-01-04 17:33 - 2014-11-22 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-01-04 17:33 - 2014-11-22 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-01-04 17:33 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-01-04 17:33 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-01-04 17:33 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-01-04 17:33 - 2014-11-22 02:28 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-01-04 17:33 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-01-04 17:33 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-01-04 17:33 - 2014-11-22 02:21 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-01-04 17:33 - 2014-11-22 02:15 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-01-04 17:33 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-01-04 17:33 - 2014-11-22 02:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-01-04 17:33 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-01-04 17:33 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-01-04 17:33 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-01-04 11:07 - 2014-10-18 03:05 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2015-01-04 11:07 - 2014-10-18 02:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2015-01-04 11:07 - 2014-07-07 03:06 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2015-01-04 11:07 - 2014-07-07 03:06 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2015-01-04 11:07 - 2014-07-07 03:06 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2015-01-04 11:07 - 2014-07-07 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2015-01-04 11:07 - 2014-07-07 02:40 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
2015-01-04 11:07 - 2014-07-07 02:39 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe
2015-01-04 11:07 - 2014-07-07 02:39 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe
2015-01-04 11:07 - 2014-07-07 02:37 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll
2015-01-04 11:05 - 2014-11-08 04:16 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2015-01-04 11:05 - 2014-11-08 03:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2015-01-04 11:05 - 2014-10-30 03:03 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe
2015-01-04 11:05 - 2014-10-30 02:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\charmap.exe
2015-01-04 11:05 - 2014-10-03 03:12 - 02020352 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll
2015-01-04 11:05 - 2014-10-03 03:12 - 00346624 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll
2015-01-04 11:05 - 2014-10-03 03:12 - 00310272 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll
2015-01-04 11:05 - 2014-10-03 03:12 - 00181248 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll
2015-01-04 11:05 - 2014-10-03 03:11 - 00266240 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe
2015-01-04 11:05 - 2014-10-03 02:45 - 01177088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll
2015-01-04 11:05 - 2014-10-03 02:45 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManMigrationPlugin.dll
2015-01-04 11:05 - 2014-10-03 02:45 - 00214016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll
2015-01-04 11:05 - 2014-10-03 02:45 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmAuto.dll
2015-01-04 11:05 - 2014-10-03 02:44 - 00198656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManHTTPConfig.exe
2015-01-04 10:59 - 2015-01-04 10:59 - 00003886 _____ () C:\Windows\System32\Tasks\Adobe Acrobat Update Task
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-02-02 17:10 - 2009-07-14 05:45 - 00028912 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-02 17:10 - 2009-07-14 05:45 - 00028912 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-02 17:05 - 2013-09-12 20:09 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-02-02 16:55 - 2013-09-12 20:10 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-02 16:28 - 2013-08-31 06:52 - 01859813 _____ () C:\Windows\WindowsUpdate.log
2015-02-02 13:55 - 2013-09-12 20:10 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-02 10:20 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-02 10:20 - 2009-07-14 05:51 - 00045776 _____ () C:\Windows\setupact.log
2015-02-02 09:19 - 2014-08-30 20:26 - 00000000 ____D () C:\93d47d12-ade2-409a-9cb7-1f47344046a5
2015-02-01 14:30 - 2010-11-21 04:47 - 00140214 _____ () C:\Windows\PFRO.log
2015-02-01 14:08 - 2013-09-12 20:10 - 00000000 ____D () C:\Program Files\Google
2015-02-01 14:08 - 2013-09-12 20:09 - 00000000 ____D () C:\Program Files (x86)\Google
2015-02-01 14:08 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\Vss
2015-02-01 14:07 - 2014-04-13 15:03 - 00000000 ____D () C:\temp
2015-02-01 13:34 - 2013-09-12 20:09 - 00000000 ____D () C:\Users\Sabine\AppData\Local\Google
2015-02-01 12:58 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows\addins
2015-02-01 12:00 - 2014-06-26 20:21 - 00000000 ____D () C:\Program Files (x86)\19A6D51C-2D35-44DB-B412-0B01BF8D2D62
2015-01-31 17:07 - 2013-09-01 15:42 - 00000000 ____D () C:\Users\Sabine\Desktop\Alte Daten
2015-01-31 08:55 - 2013-09-02 19:12 - 00000072 _____ () C:\Users\Public\LMDebug.log
2015-01-29 15:59 - 2013-10-12 19:32 - 00000000 ____D () C:\Users\Sabine\AppData\Local\Lexware
2015-01-27 21:49 - 2013-08-31 08:55 - 00000000 ____D () C:\Users\Sabine
2015-01-25 18:42 - 2011-04-12 08:43 - 00699092 _____ () C:\Windows\system32\perfh007.dat
2015-01-25 18:42 - 2011-04-12 08:43 - 00149232 _____ () C:\Windows\system32\perfc007.dat
2015-01-25 18:42 - 2009-07-14 06:13 - 01619284 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-01-25 13:53 - 2009-07-14 05:45 - 00359912 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-01-20 21:00 - 2013-09-02 19:11 - 00091264 _____ () C:\Users\Sabine\AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-20 20:59 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\Help
2015-01-20 20:00 - 2013-11-02 11:02 - 00000000 ____D () C:\Users\Sabine\AppData\Local\.elfohilfe
2015-01-18 19:25 - 2013-09-01 18:31 - 00000000 ____D () C:\Users\Sabine\Documents\Steuerfälle
2015-01-18 18:38 - 2013-09-21 22:21 - 00000000 ____D () C:\Program Files (x86)\ElsterFormular
2015-01-16 03:02 - 2013-08-31 14:07 - 00000000 ____D () C:\Windows\system32\MRT
2015-01-16 03:00 - 2013-08-31 14:07 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-01-16 02:31 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\LiveKernelReports
2015-01-12 20:24 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2015-01-12 19:49 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-01-12 19:38 - 2014-05-07 02:00 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-01-12 19:38 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2015-01-12 19:38 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\AppCompat
2015-01-08 09:55 - 2010-11-21 04:27 - 00298120 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
==================== Files in the root of some directories =======
2015-02-01 12:09 - 2015-02-01 12:09 - 0000004 _____ () C:\Users\Sabine\AppData\Roaming\appdataFr2.bin
2013-08-31 16:40 - 2013-08-31 16:40 - 0012358 _____ () C:\Users\Sabine\AppData\Roaming\PFP110JCM.{PB
2013-08-31 16:40 - 2013-08-31 16:40 - 0061678 _____ () C:\Users\Sabine\AppData\Roaming\PFP110JPR.{PB
2014-08-30 20:47 - 2014-08-30 20:47 - 0575544 _____ (ClickMeIn Limited) C:\Users\Sabine\AppData\Local\nsy538B.tmp
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-01-25 15:24
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-02-2015
Ran by Sabine at 2015-02-02 17:14:22
Running from C:\Users\Sabine\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
AAVUpdateManager (HKLM-x32\...\{0D410F4D-9009-43F8-9DF1-BDADCE7FC43F}) (Version: 3.00.0000 - Akademische Arbeitsgemeinschaft)
AAVUpdateManager (HKLM-x32\...\{AFA42FE1-A5C3-485F-9180-BFCF5BF1F1C3}) (Version: 18.00.0000 - Wolters Kluwer Deutschland GmbH)
Adobe Flash Player 12 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 12.0.0.77 - Adobe Systems Incorporated)
Adobe Photoshop Elements (HKLM-x32\...\Adobe Photoshop Elements 1.0) (Version: 1.0 - Adobe Systems, Inc.)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Adobe SVG Viewer (HKLM-x32\...\Adobe SVG Viewer) (Version: 1.0 - Adobe Systems, Inc.)
Apple Application Support (HKLM-x32\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{BDD99690-3541-4619-9D2A-3CDDB3E15F9E}) (Version: 8.0.5.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.0.2208 - AVAST Software)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Boot Camp-Dienste (HKLM\...\{ADA3F9C8-A6D3-4FCF-BFBB-EAD69AC0884E}) (Version: 4.0.4033 - Apple Inc.)
Buchhaltung (HKLM-x32\...\{13CE6A18-2936-49E5-B10C-148A12C035DD}) (Version: 14.0.4722.0 - Buhl Data Service GmbH)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.2.4291 - CDBurnerXP)
ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 16.0.15910 - Landesfinanzdirektion Thüringen)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version: - )
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 37.0.2062.120 - Google Inc.)
iCloud (HKLM\...\{6096C0CC-7E19-4355-87F0-627EC5AA146D}) (Version: 4.0.3.56 - Apple Inc.)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1118 - Intel Corporation)
iTunes (HKLM\...\{2ABBBD91-91E5-4AD7-929A-FE15D1DC0576}) (Version: 12.0.1.26 - Apple Inc.)
Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.510 - Oracle)
Lexware buchhalter 2015 (x32 Version: 20.01.00.0168 - Haufe-Lexware GmbH & Co.KG) Hidden
Lexware buchhalter plus 2015 (HKLM-x32\...\{5b78258f-ba7f-48ce-bfa2-613a25a21aa6}) (Version: 20.1.0.121 - Haufe-Lexware GmbH & Co.KG)
Lexware Elster (x32 Version: 15.00.00.0056 - Haufe-Lexware GmbH & Co.KG) Hidden
Lexware Info Service (x32 Version: 5.00.00.0044 - Haufe-Lexware GmbH & Co.KG) Hidden
Lexware Installations Dienst (x32 Version: 4.00.00.0005 - Haufe-Lexware GmbH & Co.KG) Hidden
Lexware online banking (x32 Version: 22.00.00.0035 - Haufe-Lexware GmbH & Co.KG) Hidden
Lexware PDF-Export 5 (x32 Version: 5.00.00.0005 - Haufe-Lexware GmbH & Co.KG) Hidden
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office XP Standard (HKLM-x32\...\{90120407-6000-11D3-8CFE-0050048383C9}) (Version: 10.0.2701.01 - Microsoft Corporation)
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 4.0.60310.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022.218 (HKLM\...\{BBBE35B2-9349-3C48-BD3D-F574B17C7924}) (Version: 9.0.21022.218 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{4fcf070a-daac-45e9-a8b0-6850941f7ed8}) (Version: 12.0.21005.1 - Microsoft Corporation)
QuickTime 7 (HKLM-x32\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5936 - Realtek Semiconductor Corp.)
Steuerprogramm2009 (HKLM-x32\...\{7E3F4E29-823B-440A-9219-011452AAE502}) (Version: 14.02.0000 - Akademische Arbeitsgemeinschaft Verlag)
Steuer-Sparer 2010 (HKLM-x32\...\{37A4C887-CD6A-46A5-9902-E8EA6D97AE61}) (Version: 15.02 - Akademische Arbeitsgemeinschaft Verlag)
Steuer-Sparer 2011 (HKLM-x32\...\{3499BB0F-E68A-4353-B6F0-701D0AD1CE2F}) (Version: 16.17 - Akademische Arbeitsgemeinschaft Verlag)
Steuer-Sparer 2012 (HKLM-x32\...\{1CC7263A-9A5E-4EFB-9BB8-67642D10FA7C}) (Version: 17.13 - Wolters Kluwer Deutschland GmbH)
Steuer-Sparer 2013 (HKLM-x32\...\{0B914F2C-6CC2-4328-B84E-411A81B50FA4}) (Version: 18.09 - Wolters Kluwer Deutschland GmbH)
Steuer-Sparer 2014 (HKLM-x32\...\{943F3FFF-6A9B-4F9C-889E-433A5D7ABC4B}) (Version: 19.11.90 - Akademische Arbeitsgemeinschaft)
Steuer-Sparer 2015 (HKLM-x32\...\{80AE3F90-9650-4030-A8F8-8B69B062A304}) (Version: 20.25.123 - Akademische Arbeitsgemeinschaft)
Windows-Treiberpaket - Apple Inc. (AppleUSBEthernet) Net (02/01/2008 3.10.3.10) (HKLM\...\D53CBF2C12DF51DA5E9C1A9DA97FF0DCA0C524C5) (Version: 02/01/2008 3.10.3.10 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple Bluetooth (03/01/2010 3.0.0.5) (HKLM\...\EA3C044F6FD39CEC8F4F596836BF4197E97E1D39) (Version: 03/01/2010 3.0.0.5 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple Bluetooth Enabler (06/27/2007 2.0.0.1) (HKLM\...\2CD6536AAFFF9B465A871060CF483EC9F3341D29) (Version: 06/27/2007 2.0.0.1 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple Broadcom Bluetooth (10/05/2010 3.2.0.1) (HKLM\...\0B6B49213CF56838AFC233905FA14AC47EAA9B28) (Version: 10/05/2010 3.2.0.1 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple Built-in iSight (10/25/2007 2.0.1.0) (HKLM\...\70C7CBB0824BF74552A2F28F5FFBF62A15053DA8) (Version: 10/25/2007 2.0.1.0 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple Display (01/23/2009 3.0.0.0) (HKLM\...\E0EAD0CEA9119B77350ED4DE28D9A82E57014D94) (Version: 01/23/2009 3.0.0.0 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple IR Receiver (02/21/2008 2.0.4.0) (HKLM\...\D5BB697E7D0C75712F3AD00AB1B85412CB5C0FD3) (Version: 02/21/2008 2.0.4.0 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple Keyboard (05/05/2011 4.0.0.1) (HKLM\...\703003CF14C8E79F68CA5A750AF4E02B9BD4B4D8) (Version: 05/05/2011 4.0.0.1 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple Multitouch (05/05/2011 4.0.0.1) (HKLM\...\455287ECCB4BABCDE9C6713B82B1BDA990D55398) (Version: 05/05/2011 4.0.0.1 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple Multitouch Mouse (05/05/2011 4.0.0.1) (HKLM\...\F08FFCF5C857951E0CC5F736988F3D01BF425252) (Version: 05/05/2011 4.0.0.1 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple ODD (05/17/2010 3.1.0.0) (HKLM\...\D6B4CB6AD2F81752C2EF8DCF6AD5EBC567ADD45C) (Version: 05/17/2010 3.1.0.0 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple System Device (04/05/2011 3.2.0.8) (HKLM\...\D76172B51B1ECB34E38F97F42F51B7A46FA15F52) (Version: 04/05/2011 3.2.0.8 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple Trackpad (07/13/2009 3.0.0.1) (HKLM\...\A0A897639A1D288A8B472FE790EBF9DB71E52ACF) (Version: 07/13/2009 3.0.0.1 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple Trackpad Enabler (07/13/2009 3.0.0.1) (HKLM\...\76830D11874044260C923425E7F5A72F25EDA758) (Version: 07/13/2009 3.0.0.1 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple Wireless Mouse (06/01/2011 4.0.0.1) (HKLM\...\D088EE4BD2819FBA2B349EF9D55176F223419BE6) (Version: 06/01/2011 4.0.0.1 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple Wireless Trackpad (01/17/2011 3.2.0.0) (HKLM\...\C7DD621795A42EAE550280D4D7601459F35C4EC2) (Version: 01/17/2011 3.2.0.0 - Apple Inc.)
Windows-Treiberpaket - Atheros Communications Inc. (athr) Net (11/13/2010 9.2.0.113) (HKLM\...\F0A3F8394866FA91E82C8D5AB92C918FE40FE1DF) (Version: 11/13/2010 9.2.0.113 - Atheros Communications Inc.)
Windows-Treiberpaket - Broadcom (b57nd60a) Net (12/02/2010 14.4.2.2) (HKLM\...\7C9678A21221D0575C74AF7CE68E28C2771F9E41) (Version: 12/02/2010 14.4.2.2 - Broadcom)
Windows-Treiberpaket - Broadcom (BCM43XX) Net (04/06/2011 5.100.198.22) (HKLM\...\110E24F054DE5F4F72985BC1F3A53F61985BD4CC) (Version: 04/06/2011 5.100.198.22 - Broadcom)
Windows-Treiberpaket - Broadcom Corporation (bScsiSDa) SDHost (01/18/2011 1.0.0.220) (HKLM\...\26D089A9557429904D9851293EA25C911B64CCF8) (Version: 01/18/2011 1.0.0.220 - Broadcom Corporation)
Windows-Treiberpaket - Cirrus Logic, Inc. (CirrusFilter) MEDIA (12/03/2010 6.6001.1.30) (HKLM\...\43B83D262B11C05DBFE8BEB0E2CBD5A9EA1E7F9C) (Version: 12/03/2010 6.6001.1.30 - Cirrus Logic, Inc.)
Windows-Treiberpaket - Intel (e1express) Net (03/26/2010 9.13.41.0) (HKLM\...\159439476E3A00F9FAE49DD6C1A78F2F6288A5B9) (Version: 03/26/2010 9.13.41.0 - Intel)
Windows-Treiberpaket - Intel (e1kexpress) Net (04/12/2010 11.6.92.0) (HKLM\...\5BEF08C10896D86DC13394FFA75874564B700368) (Version: 04/12/2010 11.6.92.0 - Intel)
Windows-Treiberpaket - Intel (e1qexpress) Net (12/04/2009 11.4.7.0) (HKLM\...\57AFA39B22ADEC4E383572E9331167546EB3C9C7) (Version: 12/04/2009 11.4.7.0 - Intel)
Windows-Treiberpaket - Intel (e1rexpress) Net (01/07/2010 11.4.16.0) (HKLM\...\F71DB41300D30088C8D3716343D1429488E605C1) (Version: 01/07/2010 11.4.16.0 - Intel)
Windows-Treiberpaket - Intel (e1yexpress) Net (04/07/2010 10.1.9.0) (HKLM\...\CB599752301BCA080D135697FDD05900F5A5CF4C) (Version: 04/07/2010 10.1.9.0 - Intel)
Windows-Treiberpaket - Intel System (07/20/2007 1.2.76.0) (HKLM\...\E2708073906571A0B56F17FD825EF19281ECE29B) (Version: 07/20/2007 1.2.76.0 - Intel)
Windows-Treiberpaket - Marvell (yukonx64) Net (12/06/2007 10.51.1.3) (HKLM\...\CDD703ED0B390A5643DB748EBFA5BD55FEEC0D8A) (Version: 12/06/2007 10.51.1.3 - Marvell)
WordPerfect Office 11 (HKLM-x32\...\{54F90B55-BEB3-4F0D-8802-228822FA5921}) (Version: 11.0 - Corel Corporation)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-892020284-3589852367-1128131356-1000_Classes\CLSID\{F6BF8414-962C-40FE-90F1-B80A7E72DB9A}\InprocServer32 -> C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}\secproc.dll No File
==================== Restore Points =========================
Could not list restore points.
Check "winmgmt" service or repair WMI.
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {2D4537D8-C650-4FAD-B910-0213D9EC41E8} - \ReimageUpdater No Task File <==== ATTENTION
Task: {75132F20-FACA-46E0-971C-DE2AC5F766BD} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-02-01] (AVAST Software)
Task: {8057C503-2A82-4A60-BE1A-8D60E4A252F3} - System32\Tasks\{F42F1F53-DA2E-4024-9BE5-65069125198F} => pcalua.exe -a C:\Users\Sabine\AppData\Roaming\istartsurf\UninstallManager.exe -c -ptid=bdo
Task: {88115310-0537-43C1-9B8E-7CF11A1C02F5} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {8F2495DB-F802-4AC7-B961-4B387F8B1B5F} - \Reimage Reminder No Task File <==== ATTENTION
Task: {A22ABC94-8A4B-4385-B826-7A03BA5BC081} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-09-12] (Google Inc.)
Task: {C898DB9E-BBE1-43C9-BD9B-4AEE208387E6} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {D34026B6-C43B-4400-886C-C5EF2EBAE0A2} - System32\Tasks\{A4F078AA-9CBA-49CF-85EC-259469E1FC30} => pcalua.exe -a C:\Users\Sabine\Downloads\Setup.exe -d C:\Users\Sabine\Downloads
Task: {D71C912F-DD3F-41C4-B04B-D5CA4FBA1FC6} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-09-12] (Google Inc.)
Task: {FFAC1CA3-71A6-4EB9-BDBE-795F732DCDC5} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-03-12] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2011-06-22 05:48 - 2011-06-22 05:48 - 00034304 _____ () C:\Windows\System32\ssp7ml6.dll
2011-06-29 06:49 - 2011-06-29 06:49 - 00224640 _____ () C:\Windows\system32\AppleOSSMgr.exe
2015-02-01 14:24 - 2015-02-01 14:24 - 00388208 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxDDU.dll
2015-02-01 14:24 - 2015-02-01 14:24 - 05851328 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxRT.dll
2015-02-01 23:13 - 2015-02-01 23:13 - 02913280 _____ () C:\Program Files\AVAST Software\Avast\defs\15020101\algo.dll
2015-02-01 14:24 - 2015-02-01 14:24 - 04495336 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\x86\VBoxRT-x86.dll
2015-02-02 10:21 - 2015-02-02 10:21 - 02913280 _____ () C:\Program Files\AVAST Software\Avast\defs\15020200\algo.dll
2014-02-12 19:58 - 2014-02-12 19:58 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-10-11 13:05 - 2014-10-11 13:05 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-09-11 14:09 - 2014-09-11 14:09 - 00176168 _____ () C:\Program Files (x86)\Lexware\Update Manager\Haufe.Core.Diagnostics.Logging.Targets.Etw.dll
2014-09-11 14:09 - 2014-09-11 14:09 - 00043048 _____ () C:\Program Files (x86)\Lexware\Update Manager\Haufe.Core.Diagnostics.Etw.dll
2015-02-01 14:24 - 2015-02-01 14:24 - 38562088 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2014-09-10 22:56 - 2014-09-04 04:01 - 01098056 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.120\libglesv2.dll
2014-09-10 22:56 - 2014-09-04 04:01 - 00174408 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.120\libegl.dll
2014-09-10 22:56 - 2014-09-04 04:01 - 08577864 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.120\pdf.dll
2014-09-10 22:56 - 2014-09-04 04:01 - 00331592 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.120\ppGoogleNaClPluginChrome.dll
2014-09-10 22:56 - 2014-09-04 04:01 - 01660232 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.120\ffmpegsumo.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
MSCONFIG\Services: AAV UpdateService => 2
MSCONFIG\Services: AdobeARMservice => 2
MSCONFIG\Services: AdobeFlashPlayerUpdateSvc => 3
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma Loader.exe.lnk => C:\Windows\pss\Adobe Gamma Loader.exe.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Microsoft Office.lnk => C:\Windows\pss\Microsoft Office.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^Sabine^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^CAE505C80.lnk => C:\Windows\pss\CAE505C80.lnk.Startup
MSCONFIG\startupfolder: C:^Users^Sabine^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^MyPC Backup.lnk => C:\Windows\pss\MyPC Backup.lnk.Startup
MSCONFIG\startupreg: AnyProtect Scanner => "C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe"
MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: Avira Systray => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
MSCONFIG\startupreg: GoogleChromeAutoLaunch_B84BB6A678B33052272306EF0834F926 => "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --no-startup-window
MSCONFIG\startupreg: iLivid => "C:\Users\Sabine\AppData\Local\iLivid\iLivid.exe" -autorun
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: OneMoreGame => C:\Users\Sabine\AppData\Roaming\OneMoreGame\OMG.exe
MSCONFIG\startupreg: PCSpeedUp => C:\Program Files (x86)\PC Speed Up\PCSUNotifier.exe
MSCONFIG\startupreg: QuickFinder Scheduler => "C:\Program Files (x86)\WordPerfect Office 11\Programs\QFSCHD110.EXE"
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: RocketTab => "C:\Users\Sabine\AppData\Local\Search Extensions\Client.exe"
MSCONFIG\startupreg: RocketTab Update Task => "C:\Users\Sabine\AppData\Local\Search Extensions\uninstall.exe" /CheckUpdate=true
MSCONFIG\startupreg: SDTray => "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
========================= Accounts: ==========================
Administrator (S-1-5-21-892020284-3589852367-1128131356-500 - Administrator - Disabled)
Gast (S-1-5-21-892020284-3589852367-1128131356-501 - Limited - Disabled)
Sabine (S-1-5-21-892020284-3589852367-1128131356-1000 - Administrator - Enabled) => C:\Users\Sabine
==================== Faulty Device Manager Devices =============
Could not list Devices. Check "winmgmt" service or repair WMI.
==================== Event log errors: =========================
Application errors:
==================
Error: (02/02/2015 11:46:42 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (02/01/2015 02:23:23 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".
Details:
AddLegacyDriverFiles: Unable to back up image of binary eriynjme.
System Error:
Das System kann die angegebene Datei nicht finden.
.
Error: (02/01/2015 02:22:13 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Avira.OE.Setup.Bundle.exe, Version 1.1.30.21727 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: b58
Startzeit: 01d03e21b17f9713
Endzeit: 2
Anwendungspfad: C:\ProgramData\Package Cache\{bd538030-07d4-4999-a525-7fafa2483f56}\Avira.OE.Setup.Bundle.exe
Berichts-ID:
Error: (02/01/2015 02:17:39 PM) (Source: MsiInstaller) (EventID: 11920) (User: Sabine-PC)
Description: Product: Avira -- Error 1920. Service 'Avira Service Host' (Avira.OE.ServiceHost) failed to start. Verify that you have sufficient privileges to start system services.
Error: (02/01/2015 00:43:33 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm SDScan.exe, Version 2.4.40.181 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: bec
Startzeit: 01d03e104766c059
Endzeit: 0
Anwendungspfad: C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe
Berichts-ID: 77113746-aa07-11e4-af40-7cc3a15401fb
Error: (02/01/2015 00:07:32 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/01/2015 00:03:00 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\Windows\system32\svchost.exe -k netsvcs; Beschreibung = Windows Update; Fehler = 0x80070005).
Error: (02/01/2015 00:00:13 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine "RegSetValueExW(0x000002e4,SYSTEM\CurrentControlSet\Services\VSS\Diag\VssvcPublisher,0,REG_BINARY,0000000002D7EB40.72)" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Error: (02/01/2015 00:00:13 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine "RegSetValueExW(0x00000328,(null),0,REG_BINARY,0000000004F2DE90.72)" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Vorgang:
BackupShutdown-Ereignis
Kontext:
Ausführungskontext: Writer
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {7e0ec588-6e04-4a9b-b767-75bdf0d9dfe3}
Error: (02/01/2015 00:00:13 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine "RegSetValueExW(0x00000928,(null),0,REG_BINARY,0000000005C3E060.72)" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Vorgang:
BackupShutdown-Ereignis
Kontext:
Ausführungskontext: Writer
Generatorklassen-ID: {cd3f2362-8bef-46c7-9181-d62844cdc0b2}
Generatorname: MSSearch Service Writer
Generatorinstanz-ID: {6e94dbb6-bad1-49b5-945d-244da40d6490}
System errors:
=============
Error: (02/02/2015 05:05:34 PM) (Source: Service Control Manager) (EventID: 7003) (User: )
Description: Der Dienst "Sicherheitscenter" ist von folgendem Dienst abhängig: Winmgmt. Dieser Dienst ist eventuell nicht installiert.
Error: (02/02/2015 10:43:44 AM) (Source: Service Control Manager) (EventID: 7003) (User: )
Description: Der Dienst "Sicherheitscenter" ist von folgendem Dienst abhängig: Winmgmt. Dieser Dienst ist eventuell nicht installiert.
Error: (02/02/2015 10:43:31 AM) (Source: Service Control Manager) (EventID: 7003) (User: )
Description: Der Dienst "Sicherheitscenter" ist von folgendem Dienst abhängig: Winmgmt. Dieser Dienst ist eventuell nicht installiert.
Error: (02/02/2015 10:38:57 AM) (Source: Service Control Manager) (EventID: 7003) (User: )
Description: Der Dienst "Sicherheitscenter" ist von folgendem Dienst abhängig: Winmgmt. Dieser Dienst ist eventuell nicht installiert.
Error: (02/02/2015 10:38:57 AM) (Source: Service Control Manager) (EventID: 7003) (User: )
Description: Der Dienst "Sicherheitscenter" ist von folgendem Dienst abhängig: Winmgmt. Dieser Dienst ist eventuell nicht installiert.
Error: (02/02/2015 10:38:56 AM) (Source: Service Control Manager) (EventID: 7003) (User: )
Description: Der Dienst "Sicherheitscenter" ist von folgendem Dienst abhängig: Winmgmt. Dieser Dienst ist eventuell nicht installiert.
Error: (02/02/2015 10:38:56 AM) (Source: Service Control Manager) (EventID: 7003) (User: )
Description: Der Dienst "Sicherheitscenter" ist von folgendem Dienst abhängig: Winmgmt. Dieser Dienst ist eventuell nicht installiert.
Error: (02/02/2015 10:38:55 AM) (Source: Service Control Manager) (EventID: 7003) (User: )
Description: Der Dienst "Sicherheitscenter" ist von folgendem Dienst abhängig: Winmgmt. Dieser Dienst ist eventuell nicht installiert.
Error: (02/02/2015 10:38:55 AM) (Source: Service Control Manager) (EventID: 7003) (User: )
Description: Der Dienst "Sicherheitscenter" ist von folgendem Dienst abhängig: Winmgmt. Dieser Dienst ist eventuell nicht installiert.
Error: (02/02/2015 10:38:54 AM) (Source: Service Control Manager) (EventID: 7003) (User: )
Description: Der Dienst "Sicherheitscenter" ist von folgendem Dienst abhängig: Winmgmt. Dieser Dienst ist eventuell nicht installiert.
Microsoft Office Sessions:
=========================
Error: (02/02/2015 11:46:42 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestc:\program files (x86)\ESET\eset online scanner\ESETSmartInstaller.exe
Error: (02/01/2015 02:23:23 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description:
Details:
AddLegacyDriverFiles: Unable to back up image of binary eriynjme.
System Error:
Das System kann die angegebene Datei nicht finden.
Error: (02/01/2015 02:22:13 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Avira.OE.Setup.Bundle.exe1.1.30.21727b5801d03e21b17f97132C:\ProgramData\Package Cache\{bd538030-07d4-4999-a525-7fafa2483f56}\Avira.OE.Setup.Bundle.exe
Error: (02/01/2015 02:17:39 PM) (Source: MsiInstaller) (EventID: 11920) (User: Sabine-PC)
Description: Product: Avira -- Error 1920. Service 'Avira Service Host' (Avira.OE.ServiceHost) failed to start. Verify that you have sufficient privileges to start system services.(NULL)(NULL)(NULL)(NULL)(NULL)
Error: (02/01/2015 00:43:33 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: SDScan.exe2.4.40.181bec01d03e104766c0590C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe77113746-aa07-11e4-af40-7cc3a15401fb
Error: (02/01/2015 00:07:32 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/01/2015 00:03:00 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: C:\Windows\system32\svchost.exe -k netsvcsWindows Update0x80070005
Error: (02/01/2015 00:00:13 PM) (Source: VSS) (EventID: 8193) (User: )
Description: RegSetValueExW(0x000002e4,SYSTEM\CurrentControlSet\Services\VSS\Diag\VssvcPublisher,0,REG_BINARY,0000000002D7EB40.72)0x80070005, Zugriff verweigert
Error: (02/01/2015 00:00:13 PM) (Source: VSS) (EventID: 8193) (User: )
Description: RegSetValueExW(0x00000328,(null),0,REG_BINARY,0000000004F2DE90.72)0x80070005, Zugriff verweigert
Vorgang:
BackupShutdown-Ereignis
Kontext:
Ausführungskontext: Writer
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {7e0ec588-6e04-4a9b-b767-75bdf0d9dfe3}
Error: (02/01/2015 00:00:13 PM) (Source: VSS) (EventID: 8193) (User: )
Description: RegSetValueExW(0x00000928,(null),0,REG_BINARY,0000000005C3E060.72)0x80070005, Zugriff verweigert
Vorgang:
BackupShutdown-Ereignis
Kontext:
Ausführungskontext: Writer
Generatorklassen-ID: {cd3f2362-8bef-46c7-9181-d62844cdc0b2}
Generatorname: MSSearch Service Writer
Generatorinstanz-ID: {6e94dbb6-bad1-49b5-945d-244da40d6490}
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i5-2500S CPU @ 2.70GHz
Percentage of memory in use: 50%
Total physical RAM: 4071.73 MB
Available physical RAM: 2027.15 MB
Total Pagefile: 8441.65 MB
Available Pagefile: 6046.95 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB
==================== Drives ================================
Drive c: (BOOTCAMP) (Fixed) (Total:374.71 GB) (Free:308.2 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive e: (Apple HDD) (Fixed) (Total:556 GB) (Free:528.01 GB) HFS
Drive g: (HITMANPRO) (Removable) (Total:29.76 GB) (Free:29.73 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 00004408)
Partition: GPT Partition Type.
Partition 2: (Not Active) - (Size=556 GB) - (Type=AF)
Partition 3: (Not Active) - (Size=620 MB) - (Type=AB)
Partition 4: (Active) - (Size=374.7 GB) - (Type=07 NTFS)
========================================================
Disk: 2 (Size: 29.8 GB) (Disk ID: 500E2278)
Partition 1: (Active) - (Size=29.8 GB) - (Type=0B)
==================== End Of Log ============================
Auch GMER habe ich laut Anleitung ausgeführt: Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-02-02 17:24:24
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ST31000528AS rev.AP63 931,51GB
Running: Gmer-19357.exe; Driver: C:\Users\Sabine\AppData\Local\Temp\pxdiqpob.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 448 fffff80002db5000 45 bytes [00, 00, 00, 00, 00, 00, 00, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 495 fffff80002db502f 23 bytes [00, 00, 00, 00, 00, 00, 00, ...]
---- User code sections - GMER 2.1 ----
.text C:\Windows\Explorer.EXE[1448] C:\Windows\system32\kernel32.dll!CreateProcessW 00000000778b0650 14 bytes {JMP QWORD [RIP+0x0]}
.text C:\Windows\Explorer.EXE[1448] C:\Windows\system32\kernel32.dll!CreateProcessA 000000007792acf0 14 bytes {JMP QWORD [RIP+0x0]}
.text C:\Windows\Explorer.EXE[1448] C:\Windows\system32\ADVAPI32.dll!CreateProcessAsUserW 000007fefdc3e780 12 bytes {JMP QWORD [RIP+0x0]}
.text C:\Windows\Explorer.EXE[1448] C:\Windows\system32\ADVAPI32.dll!CreateProcessAsUserA 000007fefdc7a6f0 14 bytes {JMP QWORD [RIP+0x0]}
.text C:\Windows\Explorer.EXE[1448] C:\Windows\system32\CRYPT32.dll!PFXImportCertStore 000007fefd937f08 14 bytes {JMP QWORD [RIP+0x0]}
.text C:\Program Files\Boot Camp\Bootcamp.exe[1112] C:\Windows\system32\kernel32.dll!CreateProcessW 00000000778b0650 14 bytes {JMP QWORD [RIP+0x0]}
.text C:\Program Files\Boot Camp\Bootcamp.exe[1112] C:\Windows\system32\kernel32.dll!CreateProcessA 000000007792acf0 14 bytes {JMP QWORD [RIP+0x0]}
.text C:\Program Files\Boot Camp\Bootcamp.exe[1112] C:\Windows\system32\ADVAPI32.dll!CreateProcessAsUserW 000007fefdc3e780 12 bytes {JMP QWORD [RIP+0x0]}
.text C:\Program Files\Boot Camp\Bootcamp.exe[1112] C:\Windows\system32\ADVAPI32.dll!CreateProcessAsUserA 000007fefdc7a6f0 14 bytes {JMP QWORD [RIP+0x0]}
.text C:\Program Files\Boot Camp\Bootcamp.exe[1112] C:\Windows\system32\CRYPT32.dll!PFXImportCertStore 000007fefd937f08 14 bytes {JMP QWORD [RIP+0x0]}
.text C:\Program Files\AVAST Software\Avast\avastui.exe[2144] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 0000000077348791 8 bytes [31, C0, C2, 04, 00, 90, 90, ...]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7Debug\mdm.exe[2748] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 00000000770d1465 2 bytes [0D, 77]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7Debug\mdm.exe[2748] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000770d14bb 2 bytes [0D, 77]
.text ... * 2
---- Threads - GMER 2.1 ----
Thread C:\Windows\Explorer.EXE [1448:1348] 000007fffff275d0
Thread C:\Windows\Explorer.EXE [1448:996] 000007fffff1cc00
Thread C:\Windows\Explorer.EXE [1448:2028] 000007fffff2701c
---- Processes - GMER 2.1 ----
Library C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{8A1006C8-A5D9-46D7-9967-85A3E5232CA6}\offreg.dll (*** suspicious ***) @ C:\Windows\System32\svchost.exe [3760](2015-02-02 10:57:22) 000007fefbc60000
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\7cc3a15401fb
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\7cc3a15401fb@7cc3a15da0d8 0xC1 0x68 0x7A 0x27 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\7cc3a15401fb@7cc3a18c226f 0xE2 0xE1 0x2F 0xA4 ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\7cc3a15401fb (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\7cc3a15401fb@7cc3a15da0d8 0xC1 0x68 0x7A 0x27 ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\7cc3a15401fb@7cc3a18c226f 0xE2 0xE1 0x2F 0xA4 ...
---- EOF - GMER 2.1 ----
Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Scan Date: 01.02.2015 Scan Time: 13:32:29 Logfile: Administrator: Yes Version: 2.00.4.1028 Malware Database: v2015.02.01.03 Rootkit Database: v2015.01.14.01 License: Free Malware Protection: Disabled Malicious Website Protection: Disabled Self-protection: Disabled OS: Windows 7 Service Pack 1 CPU: x64 File System: NTFS User: Sabine Scan Type: Threat Scan Result: Completed Objects Scanned: 361478 Time Elapsed: 9 min, 15 sec Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Disabled Heuristics: Enabled PUP: Enabled PUM: Enabled Processes: 0 (No malicious items detected) Modules: 0 (No malicious items detected) Registry Keys: 7 PUP.Optional.Bandoo.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{D1DAC034-9FD9-4C13-A388-D2E10E57707F}, Quarantined, [86c18e8bd3b7e84e6f637a7bc9392dd3], PUP.Optional.SearchProtect, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\INSTALLEDSDB\{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}, Quarantined, [99ae0415b0daf24454073ac8c93c5aa6], PUP.Optional.SearchProtect, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\INSTALLEDSDB\{cf2797aa-b7ec-e311-8ed9-005056c00008}, Quarantined, [f6513bde0a806ec85802e220a065748c], PUP.Optional.PlusHD.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Plus-HD-9.1, Quarantined, [cc7baf6a9dede84e16b9ead1ec1718e8], PUP.Optional.SmartSaver.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\SmartSaver+ 21, Quarantined, [192edd3c8802e94dfe7d9b27867dda26], PUP.Optional.SupraSavings.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Supra Savings, Quarantined, [430470a9523847eff2b8f5c4a75c1ae6], PUP.Optional.SearchProtect.A, HKU\S-1-5-21-892020284-3589852367-1128131356-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SearchProtectIN4T, Quarantined, [d86f8594bad0d1656ed993720ef7f20e], Registry Values: 2 PUP.Optional.FirstSeenToday.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|fst_de_2, Quarantined, [de69859494f6d56195b814a1d92ae51b], PUP.Optional.FirstSeenToday.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|fst_de_173, Quarantined, [42051afff298290df35ad0e5768dd030], Registry Data: 0 (No malicious items detected) Folders: 6 PUP.Optional.CouponSupport.A, C:\Support, Quarantined, [66e1f326e0aad165e43db6e20af9af51], PUP.Optional.CouponSupport.A, C:\Support\649636217, Quarantined, [66e1f326e0aad165e43db6e20af9af51], PUP.Optional.Extutil.A, C:\Users\Sabine\AppData\Local\Temp\D7ADFCCA-EE7E-442C-9999-C4D14FEF360B, Quarantined, [ac9bf02946442d092c1e83dcaf547888], PUP.Optional.Managera.A, C:\Users\Sabine\AppData\Local\Temp\38fdaae5-8e0e-493c-88ec-e05c3be06e42, Quarantined, [0344fd1c2c5eb086fc4f8ad5ae5514ec], PUP.Optional.GlobalUpdate.A, C:\Users\Sabine\AppData\Local\Temp\comh.165107, Quarantined, [cb7cc653305a80b688c0283939cae61a], PUP.Optional.ChampionDeals.A, C:\ProgramData\ChampionDeals, Quarantined, [df683edbeaa0fe383c8dfb731be8f10f], Files: 7 PUP.Optional.AdPeak.A, C:\temp\InstallFilter64.msi, Quarantined, [c08760b93555f44200e04eefe020837d], PUP.Optional.FlashPro, C:\Users\Sabine\Downloads\flashplayerpro-setup.exe, Quarantined, [db6ca871cfbb0036b4ecf585ed186c94], PUP.Optional.SearchProtect.A, C:\Windows\AppPatch\AppPatch64\VCLdr64.dll, Quarantined, [c384a17846449c9a101cc7eb04fd8b75], PUP.Optional.SearchProtect.A, C:\Windows\AppPatch\nbin\VC32Loader.dll, Quarantined, [1a2d76a3cfbb6bcb42ea248e1be6817f], PUP.Optional.CouponSupport.A, C:\Support\649636217.ini, Quarantined, [66e1f326e0aad165e43db6e20af9af51], PUP.Optional.SearchProtect, C:\Windows\AppPatch\Custom\Custom64\{cf2797aa-b7ec-e311-8ed9-005056c00008}.sdb, Quarantined, [1e29dd3c5832cd694618ec16a95c5aa6], PUP.Optional.ChampionDeals.A, C:\ProgramData\ChampionDeals\ChampionDeals.exe, Quarantined, [df683edbeaa0fe383c8dfb731be8f10f], Physical Sectors: 0 (No malicious items detected) (end) aswBoot.txt Code:
ATTFilter 02/02/2015 09:17
Prüfung aller lokalen Laufwerke
Datei C:\93d47d12-ade2-409a-9cb7-1f47344046a5\lib82672.dll ist infiziert von Win32:Adware-gen [Adw], In Container verschoben
Datei C:\ProgramData\CAE505C80.zot ist infiziert von Win64:Malware-gen, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\15KFQRAU\ETL03LMG.htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\15KFQRAU\RBOA7FFO.htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\15KFQRAU\real-estate[1].htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\15KFQRAU\ads[1].htm ist infiziert von JS:ScriptIP-inf [Trj], In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\15KFQRAU\ads[2].htm ist infiziert von JS:ScriptIP-inf [Trj], In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\15KFQRAU\ads[3].htm ist infiziert von JS:ScriptIP-inf [Trj], In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\15KFQRAU\ads[4].htm ist infiziert von JS:ScriptIP-inf [Trj], In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\15KFQRAU\ads[6].htm ist infiziert von JS:ScriptIP-inf [Trj], In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\15KFQRAU\7JV76AJK.htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2YNPW332\alibaba-china-credit-scoring-system[1].htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2YNPW332\debbie-reynolds-sag-lifetime-award[1].htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2YNPW332\politics[1].htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2YNPW332\sports[1].htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\336YWDAB\money[1].htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\336YWDAB\most-violent-year-exclusive-interview-jessica-chastain[1].htm ist infiziert von HTML:Script-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\336YWDAB\regeneron-sanofi-cholesterol-drug[1].htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\336YWDAB\YDKUVGMT.htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\336YWDAB\6D3E422D494C4F7C417A3E3A772A636FAA5DDE6E6D77BDFE6491E8943103108C3677A377612777AFC3F7A4AACEE9A6C4[1].htm ist infiziert von HTML:RedirBA-inf [Trj], In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\52LWM1DB\GKGQI302.htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\55SJZDZ5\1MPYOAD9.htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\55SJZDZ5\positive-earnings-europe-stocks[1].htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\55SJZDZ5\amazon-luxembourg-tax-deal[1].htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\55SJZDZ5\TOES891Z.htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\55SJZDZ5\VKLC1BK7.htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\55SJZDZ5\ads[2].htm ist infiziert von JS:ScriptIP-inf [Trj], In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\55SJZDZ5\ads[5].htm ist infiziert von JS:ScriptIP-inf [Trj], In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\55SJZDZ5\politics[1].htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\55SJZDZ5\7T8JDEOJ.htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9JHOZPHB\theory-everything-two-leads[1].htm ist infiziert von HTML:Script-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CPGHAO7D\01P1AGC9.htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CPGHAO7D\ads[1].htm ist infiziert von JS:ScriptIP-inf [Trj], In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CPGHAO7D\l[1].htm ist infiziert von HTML:Script-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0ES5CU4\ads[1].htm ist infiziert von JS:ScriptIP-inf [Trj], In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0ES5CU4\JKBVPC99.htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0ES5CU4\pentagon-troops-syrian-rebels[1].htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JL9HVYBP\AHE3OMP6.htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JL9HVYBP\top-news[1].htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JL9HVYBP\tt00OAPFE2.htm ist infiziert von JS:ScriptPE-inf [Trj], In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JL9HVYBP\ads[3].htm ist infiziert von JS:ScriptIP-inf [Trj], In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L4FQ82LS\birdman-oscar[1].htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L4FQ82LS\ads[2].htm ist infiziert von JS:ScriptIP-inf [Trj], In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L4FQ82LS\ab[3].htm ist infiziert von JS:ScriptPE-inf [Trj], In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M7W05Q4R\ads[1].htm ist infiziert von JS:ScriptIP-inf [Trj], In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M7W05Q4R\ads[5].htm ist infiziert von JS:ScriptIP-inf [Trj], In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MB9038NM\QEKINFBZ.htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MB9038NM\climbers-yosemite[1].htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MB9038NM\H1SSF2OF.htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R7NTZKJA\UA9M58VB.htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R7NTZKJA\6G62PXXC.htm ist infiziert von HTML:Script-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R7NTZKJA\yellowshield[1].htm ist infiziert von HTML:RedirBA-inf [Trj], In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R7NTZKJA\LUML4AXU.htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RQFEL3FL\audi-investments[1].htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RQFEL3FL\world[1].htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RQFEL3FL\23665565532828496B64412B3754253BC07318EBB7472A722327C079CC126E15D8FDC9C14BAE4EA2B9EE3164AD99BB75[1].htm ist infiziert von HTML:RedirBA-inf [Trj], In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RQFEL3FL\ads[3].htm ist infiziert von JS:ScriptIP-inf [Trj], In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RQFEL3FL\613F426824406B73694177624B7E5231FC55278B9F8DA972515A73E63FFA927CCC33787541DE7B1D19B8A4EF8596BBA4[1].htm ist infiziert von HTML:RedirBA-inf [Trj], In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TFUVWK33\sports[1].htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TFUVWK33\2129444D25283A2341224A4374314E2CBFB4DA46F3E39CD307172A5356B31A65451B8589BDAC3EBD0BF807BF60BBA739[1].htm ist infiziert von HTML:RedirBA-inf [Trj], In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TFUVWK33\367157395E71714F6A404D373A507C5C21FD2A89842E6AC4D1881888E04709EEE8D23F138A826FE895B4F8439061802B[1].htm ist infiziert von HTML:RedirBA-inf [Trj], In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TFUVWK33\samsung-blackberry[1].htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TFUVWK33\44624C68427E7C3124562B6E5B3F5526CDB36BABB9749EE686E8915873F8D63431B3CAD560478AEE53DB9D938FDC12B8[1].htm ist infiziert von HTML:RedirBA-inf [Trj], In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TFUVWK33\health[1].htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TLZZQDRW\0AWQP20E.htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TLZZQDRW\bush-hospital[1].htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TLZZQDRW\ads[1].htm ist infiziert von JS:ScriptIP-inf [Trj], In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TLZZQDRW\ads[2].htm ist infiziert von JS:ScriptIP-inf [Trj], In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TLZZQDRW\ads[3].htm ist infiziert von JS:ScriptIP-inf [Trj], In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TLZZQDRW\ads[4].htm ist infiziert von JS:ScriptIP-inf [Trj], In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TLZZQDRW\UPKRQU5T.htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TLZZQDRW\8PF72R6W.htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WZ39V5DP\new_releases[1].htm ist infiziert von HTML:Script-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WZ39V5DP\ads[1].htm ist infiziert von JS:ScriptIP-inf [Trj], In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WZ39V5DP\amazon-luxembourg-tax-deal[1].htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WZ39V5DP\YOA0SGTS.htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XT8QLTNM\B9RFWM9A.htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XT8QLTNM\republicans-bill-obama-internet-plan[1].htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XT8QLTNM\3Z6U7VRF.htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XT8QLTNM\obama-immigration-suit[1].htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XT8QLTNM\U0CVLON4.htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z7DA48K6\calvin-klein[1].htm ist infiziert von HTML:Script-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z7DA48K6\technology[1].htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z7DA48K6\R8FD1IF5.htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z7DA48K6\afghan-bruce-lee[1].htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\Sabine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z7DA48K6\cia-misled[1].htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\Sabine\Desktop\Alte Daten\WINDOWS\Debug\DCPROMO.LOG ist infiziert von MPPT97:ShellCode-O [Expl], In Container verschoben
Anzahl durchsuchter Ordner: 30903
Anzahl der geprüften Dateien: 247848
Anzahl infizierter Dateien: 87
Ich wäre euch wirklich sehr dankbar, wenn sich meiner jemand annehmen könnte. Vielen Dank im Voraus! Philipp |
|
02.02.2015, 17:47
| #2 |
| /// the machine /// TB-Ausbilder    | Windows 7 & BKA Trojaner 1.18 -> Nur teilweise erfolgreich entfernt hi,
__________________Scan mit Combofix
__________________ |
|
02.02.2015, 20:37
| #3 |
| | Windows 7 & BKA Trojaner 1.18 -> Nur teilweise erfolgreich entfernt Hallo,
__________________hier das Combofix log: Code:
ATTFilter ComboFix 15-02-02.01 - Sabine 02.02.2015 17:58:57.1.4 - x64 ausgeführt von:: c:\users\Sabine\Downloads\ComboFix.exe * Neuer Wiederherstellungspunkt wurde erstellt . . (((((((((((((((((((((((((((((((((((( Weitere Löschungen )))))))))))))))))))))))))))))))))))))))))))))))) . . C:\install.exe C:\LILBD35.tmp C:\LILBD45.tmp C:\LILBD55.tmp C:\LILBD74.tmp C:\LILBD83.tmp C:\LILBDA3.tmp C:\LILBDA4.tmp C:\LILBDC2.tmp c:\users\Sabine\AppData\Local\nsy538B.tmp c:\windows\IsUn0407.exe c:\windows\SysWow64\SETF68C.tmp c:\windows\SysWow64\SETF788.tmp c:\users\Sabine\AppData\Local\Temp\_av_iup.tm~a01688\aswOfferTool.exe . . . . Nicht in der Lage zu löschen c:\users\Sabine\AppData\Local\Temp\_av_iup.tm~a01688\avBugReport.exe . . . . Nicht in der Lage zu löschen c:\users\Sabine\AppData\Local\Temp\_av_iup.tm~a01688\avbugreport_ais-8a0.vpx . . . . Nicht in der Lage zu löschen c:\users\Sabine\AppData\Local\Temp\_av_iup.tm~a01688\eriynjme.sys . . . . Nicht in der Lage zu löschen c:\users\Sabine\AppData\Local\Temp\_av_iup.tm~a01688\HTMLayout.dll . . . . Nicht in der Lage zu löschen c:\users\Sabine\AppData\Local\Temp\_av_iup.tm~a01688\instcont_ais-8a0.vpx . . . . Nicht in der Lage zu löschen c:\users\Sabine\AppData\Local\Temp\_av_iup.tm~a01688\Instup.dll . . . . Nicht in der Lage zu löschen c:\users\Sabine\AppData\Local\Temp\_av_iup.tm~a01688\instup.exe . . . . Nicht in der Lage zu löschen c:\users\Sabine\AppData\Local\Temp\_av_iup.tm~a01688\instup_ais-8a0.vpx . . . . Nicht in der Lage zu löschen c:\users\Sabine\AppData\Local\Temp\_av_iup.tm~a01688\ngiodriver_x64_ais-8a0.vpx . . . . Nicht in der Lage zu löschen c:\users\Sabine\AppData\Local\Temp\_av_iup.tm~a01688\ngiodriver_x86_ais-8a0.vpx . . . . Nicht in der Lage zu löschen c:\users\Sabine\AppData\Local\Temp\_av_iup.tm~a01688\offertool_ais-8a0.vpx . . . . Nicht in der Lage zu löschen c:\users\Sabine\AppData\Local\Temp\_av_iup.tm~a01688\selfdefense_x64_ais-8a0.vpx . . . . Nicht in der Lage zu löschen c:\users\Sabine\AppData\Local\Temp\_av_iup.tm~a01688\selfdefense_x86_ais-8a0.vpx . . . . Nicht in der Lage zu löschen c:\users\Sabine\AppData\Local\Temp\_av_iup.tm~a01688\setgui_ais-8a0.vpx . . . . Nicht in der Lage zu löschen . . ((((((((((((((((((((((( Dateien erstellt von 2015-01-02 bis 2015-02-02 )))))))))))))))))))))))))))))) . . 2015-02-02 17:04 . 2015-02-02 17:04 -------- d-----w- c:\users\Default\AppData\Local\temp 2015-02-02 16:13 . 2015-02-02 16:14 -------- d-----w- C:\FRST 2015-02-01 13:36 . 2015-02-01 13:36 -------- d-----w- c:\program files (x86)\ESET 2015-02-01 13:26 . 2015-02-01 13:26 -------- d-----w- c:\users\Sabine\AppData\Roaming\AVAST Software 2015-02-01 13:25 . 2015-02-01 13:24 116728 ----a-w- c:\windows\system32\drivers\aswStm.sys 2015-02-01 13:25 . 2015-02-01 13:24 267632 ----a-w- c:\windows\system32\drivers\aswVmm.sys 2015-02-01 13:25 . 2015-02-01 13:24 436624 ----a-w- c:\windows\system32\drivers\aswSP.sys 2015-02-01 13:25 . 2015-02-01 13:24 65776 ----a-w- c:\windows\system32\drivers\aswRvrt.sys 2015-02-01 13:25 . 2015-02-01 13:25 87912 ----a-w- c:\windows\system32\drivers\aswmonflt.sys 2015-02-01 13:24 . 2015-02-01 13:24 29208 ----a-w- c:\windows\system32\drivers\aswHwid.sys 2015-02-01 13:24 . 2015-02-01 13:24 93568 ----a-w- c:\windows\system32\drivers\aswRdr2.sys 2015-02-01 13:24 . 2015-02-01 13:25 1050432 ----a-w- c:\windows\system32\drivers\aswsnx.sys 2015-02-01 13:24 . 2015-02-01 13:24 364512 ----a-w- c:\windows\system32\aswBoot.exe 2015-02-01 13:24 . 2015-02-01 13:24 43152 ----a-w- c:\windows\avastSS.scr 2015-02-01 13:23 . 2015-02-01 13:23 -------- d-----w- c:\program files\AVAST Software 2015-02-01 13:22 . 2015-02-01 13:23 -------- d-----w- c:\programdata\AVAST Software 2015-02-01 13:16 . 2015-02-01 13:16 -------- d-----w- c:\programdata\Avira 2015-02-01 13:16 . 2015-02-01 13:16 -------- d-----w- c:\program files (x86)\Avira 2015-02-01 13:12 . 2015-02-01 13:12 -------- d-----w- c:\windows\ERUNT 2015-02-01 12:31 . 2015-02-01 12:31 -------- d-----w- c:\program files (x86)\ Malwarebytes Anti-Malware 2015-02-01 12:31 . 2014-11-21 05:14 63704 ----a-w- c:\windows\system32\drivers\mwac.sys 2015-02-01 12:31 . 2014-11-21 05:14 25816 ----a-w- c:\windows\system32\drivers\mbam.sys 2015-02-01 11:44 . 2015-02-01 12:31 -------- d-----w- c:\programdata\Malwarebytes 2015-02-01 11:44 . 2015-02-01 12:28 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable) 2015-02-01 11:44 . 2015-02-02 16:26 129752 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys 2015-02-01 11:44 . 2014-11-21 05:14 93400 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys 2015-02-01 11:12 . 2015-02-02 16:03 -------- d-----w- c:\programdata\Spybot - Search & Destroy 2015-02-01 11:12 . 2015-02-02 17:06 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy 2 2015-02-01 11:09 . 2015-02-01 11:09 4 ----a-w- c:\users\Sabine\AppData\Roaming\appdataFr2.bin 2015-02-01 11:06 . 2015-02-01 11:06 43664 ----a-w- c:\windows\system32\drivers\hitmanpro37.sys 2015-02-01 11:03 . 2014-12-02 10:26 11870360 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{8A1006C8-A5D9-46D7-9967-85A3E5232CA6}\mpengine.dll 2015-02-01 10:35 . 2015-02-01 10:35 -------- d-----w- c:\program files\HitmanPro 2015-02-01 10:35 . 2015-02-01 10:59 -------- d-----w- c:\programdata\HitmanPro 2015-01-31 13:53 . 2015-01-31 13:54 -------- d---a-w- C:\Kaspersky Rescue Disk 10.0 2015-01-27 20:49 . 2015-01-29 16:37 -------- d-----w- c:\users\Sabine\Sicherung Buchhaltung Lexware 2015-01-25 16:06 . 2015-01-25 16:06 -------- d-----w- c:\users\Sabine\AppData\Roaming\QuickScan 2015-01-25 16:00 . 2015-01-25 16:00 -------- d-----w- c:\users\Sabine\AppData\Local\Opera Software 2015-01-25 16:00 . 2015-01-25 16:00 -------- d-----w- c:\users\Sabine\AppData\Roaming\Opera Software 2015-01-25 15:57 . 2015-01-25 16:30 -------- d-----w- c:\program files (x86)\Opera 2015-01-20 19:59 . 2015-01-20 21:06 -------- d-----w- c:\users\Sabine\AppData\Roaming\Lexware 2015-01-20 19:59 . 2015-01-20 19:59 -------- d-----w- c:\program files (x86)\Common Files\DataDesign 2015-01-20 19:57 . 2015-01-29 15:05 -------- d-----w- c:\programdata\Lexware 2015-01-20 19:57 . 2015-01-27 20:48 -------- d-----w- c:\program files (x86)\Lexware 2015-01-20 19:57 . 2014-06-05 08:45 9016832 ----a-w- c:\windows\system32\cdintf500_64.dll 2015-01-20 19:57 . 2014-06-05 08:45 7235584 ----a-w- c:\windows\SysWow64\cdintf500.dll 2015-01-18 18:07 . 2015-01-18 18:13 -------- d-----w- c:\program files (x86)\Steuer-Sparer 2015 2015-01-18 17:13 . 2015-02-01 13:27 -------- d-----w- c:\programdata\Package Cache 2015-01-15 23:54 . 2014-12-19 03:06 210432 ----a-w- c:\windows\system32\profsvc.dll 2015-01-15 23:54 . 2014-12-11 17:47 62976 ----a-w- c:\windows\system32\TSWbPrxy.exe 2015-01-15 23:54 . 2014-12-06 04:17 303616 ----a-w- c:\windows\system32\nlasvc.dll 2015-01-15 23:54 . 2014-12-06 03:50 52224 ----a-w- c:\windows\SysWow64\nlaapi.dll 2015-01-15 23:54 . 2014-12-06 03:50 156672 ----a-w- c:\windows\SysWow64\ncsi.dll 2015-01-15 23:54 . 2014-12-19 01:46 141312 ----a-w- c:\windows\system32\drivers\mrxdav.sys 2015-01-15 23:54 . 2014-12-12 05:35 5553592 ----a-w- c:\windows\system32\ntoskrnl.exe 2015-01-15 23:54 . 2014-12-12 05:11 3971512 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe 2015-01-15 23:53 . 2014-12-12 05:11 3916728 ----a-w- c:\windows\SysWow64\ntoskrnl.exe 2015-01-15 23:53 . 2014-12-12 05:31 503808 ----a-w- c:\windows\system32\srcore.dll 2015-01-15 23:53 . 2014-12-12 05:31 50176 ----a-w- c:\windows\system32\srclient.dll 2015-01-15 23:53 . 2014-12-12 05:31 296960 ----a-w- c:\windows\system32\rstrui.exe 2015-01-15 23:53 . 2014-12-12 05:07 43008 ----a-w- c:\windows\SysWow64\srclient.dll 2015-01-15 18:52 . 2015-01-18 17:22 -------- d-----w- c:\users\Sabine\AppData\Local\elfopatch 2015-01-12 19:03 . 2014-12-13 05:09 144384 ----a-w- c:\windows\system32\ieUnatt.exe 2015-01-12 19:03 . 2014-12-13 03:33 115712 ----a-w- c:\windows\SysWow64\ieUnatt.exe 2015-01-12 18:38 . 2015-01-12 18:38 -------- d-----w- c:\windows\system32\appraiser 2015-01-04 16:35 . 2014-12-04 02:50 741376 ----a-w- c:\windows\system32\invagent.dll 2015-01-04 16:35 . 2014-12-04 02:50 192000 ----a-w- c:\windows\system32\aepic.dll 2015-01-04 16:35 . 2014-12-04 02:44 1083392 ----a-w- c:\windows\system32\aeinv.dll 2015-01-04 16:35 . 2014-12-01 23:28 1232040 ----a-w- c:\windows\system32\aitstatic.exe 2015-01-04 16:35 . 2014-12-04 02:50 413184 ----a-w- c:\windows\system32\generaltel.dll 2015-01-04 16:35 . 2014-12-04 02:50 396800 ----a-w- c:\windows\system32\devinv.dll 2015-01-04 16:35 . 2014-12-04 02:50 227328 ----a-w- c:\windows\system32\aepdu.dll 2015-01-04 16:34 . 2014-11-11 03:09 1424384 ----a-w- c:\windows\system32\WindowsCodecs.dll 2015-01-04 16:34 . 2014-11-11 02:44 1230336 ----a-w- c:\windows\SysWow64\WindowsCodecs.dll 2015-01-04 16:34 . 2014-11-11 01:46 119296 ----a-w- c:\windows\system32\drivers\tdx.sys 2015-01-04 10:07 . 2014-07-07 02:02 2048 ----a-w- c:\windows\system32\mferror.dll 2015-01-04 10:07 . 2014-07-07 01:37 2048 ----a-w- c:\windows\SysWow64\mferror.dll 2015-01-04 10:07 . 2014-10-18 02:05 4121600 ----a-w- c:\windows\system32\mf.dll 2015-01-04 10:07 . 2014-10-18 01:33 3209728 ----a-w- c:\windows\SysWow64\mf.dll 2015-01-04 10:07 . 2014-07-07 02:06 206848 ----a-w- c:\windows\system32\mfps.dll 2015-01-04 10:07 . 2014-07-07 02:06 55808 ----a-w- c:\windows\system32\rrinstaller.exe 2015-01-04 10:07 . 2014-07-07 02:06 24576 ----a-w- c:\windows\system32\mfpmp.exe 2015-01-04 10:07 . 2014-07-07 01:40 103424 ----a-w- c:\windows\SysWow64\mfps.dll 2015-01-04 10:07 . 2014-07-07 01:39 50176 ----a-w- c:\windows\SysWow64\rrinstaller.exe 2015-01-04 10:07 . 2014-07-07 01:39 23040 ----a-w- c:\windows\SysWow64\mfpmp.exe . . . (((((((((((((((((((((((((((((((((((( Find3M Bericht )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2015-01-16 02:00 . 2013-08-31 13:07 113365784 ----a-w- c:\windows\system32\MRT.exe 2015-01-08 08:55 . 2010-11-21 03:27 298120 ------w- c:\windows\system32\MpSigStub.exe 2014-12-15 16:23 . 2014-12-15 16:23 4779560 ----a-w- c:\windows\SysWow64\LxXtreme110.dll 2014-12-15 16:23 . 2014-12-15 16:23 28200 ----a-w- c:\windows\SysWow64\LxTPSW100.dll 2014-12-15 16:23 . 2014-12-15 16:23 106536 ----a-w- c:\windows\SysWow64\LxUISettingsN100.dll 2014-12-15 16:23 . 2014-12-15 16:23 65576 ----a-w- c:\windows\SysWow64\LxPXTree100.dll 2014-12-15 16:23 . 2014-12-15 16:23 1341992 ----a-w- c:\windows\SysWow64\LxTool115.dll 2014-12-15 16:23 . 2014-12-15 16:23 129576 ----a-w- c:\windows\SysWow64\LxMail100.dll 2014-12-15 16:23 . 2014-12-15 16:23 51752 ----a-w- c:\windows\SysWow64\LXCurr100.dll 2014-12-15 16:22 . 2014-12-15 16:22 70184 ----a-w- c:\windows\SysWow64\LxCI12.dll 2014-12-15 16:22 . 2014-12-15 16:22 213032 ----a-w- c:\windows\SysWow64\LxBasics100.dll 2014-12-10 12:51 . 2014-12-10 12:51 51752 ----a-w- c:\windows\SysWow64\FKStampPainter20.dll 2014-11-11 03:08 . 2014-11-18 20:20 241152 ----a-w- c:\windows\system32\pku2u.dll 2014-11-11 03:08 . 2014-11-18 20:20 728064 ----a-w- c:\windows\system32\kerberos.dll 2014-11-11 02:44 . 2014-11-18 20:20 186880 ----a-w- c:\windows\SysWow64\pku2u.dll 2014-11-11 02:44 . 2014-11-18 20:20 550912 ----a-w- c:\windows\SysWow64\kerberos.dll 2014-11-06 09:51 . 2014-11-06 09:51 76840 ----a-w- c:\windows\SysWow64\LxDNTvm115.dll 2014-11-06 09:51 . 2014-11-06 09:51 209960 ----a-w- c:\windows\SysWow64\LXPrnUtil10.dll 2014-11-06 09:51 . 2014-11-06 09:51 141352 ----a-w- c:\windows\SysWow64\LXReportManage.ocx 2014-11-06 09:51 . 2014-11-06 09:51 140840 ----a-w- c:\windows\SysWow64\LxDNTvmc115.dll 2014-11-06 09:51 . 2014-11-06 09:51 322088 ----a-w- c:\windows\SysWow64\LxDNT115.dll . . (((((((((((((((((((((((((((( Autostartpunkte der Registrierung )))))))))))))))))))))))))))))))))))))))) . . *Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IimbIxxuq"="c:\programdata\IimbIxxuq\XaldIyojg.bih" [2015-01-27 297976] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "LexwareInfoService"="c:\program files (x86)\Lexware\Update Manager\LxUpdateManager.exe" [2014-09-26 196648] "AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2015-02-01 5227112] . c:\users\Sabine\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ CAE505C80.lnk - c:\windows\system32\rundll32.exe c:\progra~3\08c505eac.cpp,work [2009-7-14 45568] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) "EnableSecureUIAPath"= 1 (0x1) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows] "LoadAppInit_DLLs"=1 (0x1) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0bootdelete\0sdnclean64.exe . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37] @="" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys] @="" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37Crusader] @="" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37CrusaderBoot] @="" . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x] R3 cpuz134;cpuz134;c:\users\Sabine\AppData\Local\Temp\cpuz134\cpuz134_x64.sys;c:\users\Sabine\AppData\Local\Temp\cpuz134\cpuz134_x64.sys [x] R3 hitmanpro37;HitmanPro 3.7 Support Driver;c:\windows\system32\drivers\hitmanpro37.sys;c:\windows\SYSNATIVE\drivers\hitmanpro37.sys [x] R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x] R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x] R4 AAV UpdateService;AAV UpdateService;c:\program files (x86)\AAVUpdateManager\aavus.exe;c:\program files (x86)\AAVUpdateManager\aavus.exe [x] S0 AppleHFS;AppleHFS; [x] S0 AppleMNT;AppleMNT; [x] S0 aswRvrt;avast! Revert; [x] S0 aswVmm;avast! VM Monitor; [x] S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x] S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x] S2 AppleOSSMgr;Apple OS Switch Manager;c:\windows\system32\AppleOSSMgr.exe;c:\windows\SYSNATIVE\AppleOSSMgr.exe [x] S2 AppleTimeSrv;Apple-Time-Server;c:\windows\system32\AppleTimeSrv.exe;c:\windows\SYSNATIVE\AppleTimeSrv.exe [x] S2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys;c:\windows\SYSNATIVE\drivers\aswHwid.sys [x] S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x] S2 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x] S2 Avira.OE.ServiceHost;Avira Service Host;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [x] S2 KeyAgent;KeyAgent;c:\windows\system32\drivers\KeyAgent.sys;c:\windows\SYSNATIVE\drivers\KeyAgent.sys [x] S2 Lexware_Update_Service;Lexware Update Service;c:\program files (x86)\Lexware\Update Service\Hmg.InstallationService.Service.exe;c:\program files (x86)\Lexware\Update Service\Hmg.InstallationService.Service.exe [x] S2 MacHALDriver;Mac HAL;c:\windows\system32\drivers\MacHALDriver.sys;c:\windows\SYSNATIVE\drivers\MacHALDriver.sys [x] S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x] S2 VBoxAswDrv;VBoxAsw Support Driver;c:\program files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys;c:\program files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [x] S3 acpials;ALS-Sensorfilter;c:\windows\system32\DRIVERS\acpials.sys;c:\windows\SYSNATIVE\DRIVERS\acpials.sys [x] S3 applebmt;Apple Wireless Mouse;c:\windows\system32\DRIVERS\applebmt.sys;c:\windows\SYSNATIVE\DRIVERS\applebmt.sys [x] S3 AppleBtBc;Apple Broadcom Built-in Bluetooth;c:\windows\system32\DRIVERS\AppleBtBc.sys;c:\windows\SYSNATIVE\DRIVERS\AppleBtBc.sys [x] S3 AvastVBoxSvc;AvastVBox COM Service;c:\program files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe;c:\program files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [x] S3 CirrusFilter;CS420xLowerFilter;c:\windows\system32\DRIVERS\CS420x64.sys;c:\windows\SYSNATIVE\DRIVERS\CS420x64.sys [x] S3 IRRemoteFlt;IR Receiver Filter Driver;c:\windows\system32\DRIVERS\IRFilter.sys;c:\windows\SYSNATIVE\DRIVERS\IRFilter.sys [x] S3 KeyMagic;USB Keyboard HID Filter;c:\windows\system32\DRIVERS\KeyMagic.sys;c:\windows\SYSNATIVE\DRIVERS\KeyMagic.sys [x] . . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}] 2014-09-10 21:55 1096520 ----a-w- c:\program files (x86)\Google\Chrome\Application\37.0.2062.120\Installer\chrmstp.exe . Inhalt des "geplante Tasks" Ordners . 2015-02-02 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-09-12 20:07] . 2015-02-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-09-12 19:09] . 2015-02-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-09-12 19:09] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast] @="{472083B0-C522-11CF-8763-00608CC02F24}" [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}] 2015-02-01 13:24 860984 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Apple_KbdMgr"="c:\program files\Boot Camp\Bootcamp.exe" [2011-06-29 741760] . ------- Zusätzlicher Suchlauf ------- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://www.google.de/ mDefault_Search_URL = hxxp://www.google.com mDefault_Page_URL = hxxp://www.google.com mStart Page = hxxp://www.google.com mLocal Page = c:\windows\SysWOW64\blank.htm mSearch Page = hxxp://www.google.com IE: Nach Microsoft &Excel exportieren - c:\progra~2\MICROS~1\Office10\EXCEL.EXE/3000 Trusted Zone: samsungsetup.com\www TCP: DhcpNameServer = 192.168.2.1 . - - - - Entfernte verwaiste Registrierungseinträge - - - - . Toolbar-10 - (no file) HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start Toolbar-10 - (no file) AddRemove-Adobe Photoshop Elements 1.0 - c:\windows\ISUN0407.EXE AddRemove-Adobe SVG Viewer - c:\windows\IsUn0407.exe . . . --------------------- Gesperrte Registrierungsschluessel --------------------- . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_77_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_77_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_77_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_77_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.12" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ------------------------ Weitere laufende Prozesse ------------------------ . c:\program files\AVAST Software\Avast\AvastSvc.exe c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\program files (x86)\Common Files\Microsoft Shared\VS7Debug\mdm.exe c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe . ************************************************************************** . Zeit der Fertigstellung: 2015-02-02 18:10:19 - PC wurde neu gestartet ComboFix-quarantined-files.txt 2015-02-02 17:10 . Vor Suchlauf: 15 Verzeichnis(se), 331.828.109.312 Bytes frei Nach Suchlauf: 20 Verzeichnis(se), 331.522.797.568 Bytes frei . - - End Of File - - D54CC8316806A5608A6D5F1A32DBAB6D A36C5E4F47E84449FF07ED3517B43A31 Nun geht zumindest wieder der Sicherheitsdienst sowie WLAN. |
|
03.02.2015, 08:04
| #4 |
| /// the machine /// TB-Ausbilder | Windows 7 & BKA Trojaner 1.18 -> Nur teilweise erfolgreich entfernt Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
03.02.2015, 19:02
| #5 |
| | Windows 7 & BKA Trojaner 1.18 -> Nur teilweise erfolgreich entfernt Hallo, MBAM Log: Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Scan Date: 03.02.2015 Scan Time: 18:39:23 Logfile: Administrator: Yes Version: 2.00.4.1028 Malware Database: v2015.02.03.06 Rootkit Database: v2015.02.03.01 License: Free Malware Protection: Disabled Malicious Website Protection: Disabled Self-protection: Disabled OS: Windows 7 Service Pack 1 CPU: x64 File System: NTFS User: Sabine Scan Type: Threat Scan Result: Completed Objects Scanned: 388237 Time Elapsed: 9 min, 24 sec Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Disabled Heuristics: Enabled PUP: Enabled PUM: Enabled Processes: 0 (No malicious items detected) Modules: 0 (No malicious items detected) Registry Keys: 0 (No malicious items detected) Registry Values: 0 (No malicious items detected) Registry Data: 0 (No malicious items detected) Folders: 0 (No malicious items detected) Files: 0 (No malicious items detected) Physical Sectors: 0 (No malicious items detected) (end) Code:
ATTFilter # AdwCleaner v4.109 - Bericht erstellt am 03/02/2015 um 18:53:28
# Aktualisiert 24/01/2015 von Xplode
# Database : 2015-02-02.1 [Live]
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Sabine - SABINE-PC
# Gestartet von : C:\Users\Sabine\Downloads\AdwCleaner_4.109.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
***** [ Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17496
-\\ Mozilla Firefox v35.0.1 (x86 de)
-\\ Comodo Dragon v
-\\ Opera v0.0.0.0
-\\ Chrome Canary v
*************************
AdwCleaner[R0].txt - [858 octets] - [03/02/2015 18:51:45]
AdwCleaner[S0].txt - [780 octets] - [03/02/2015 18:53:28]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [839 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.2 (02.02.2015:1)
OS: Windows 7 Home Premium x64
Ran by Sabine on 03.02.2015 at 18:56:44,09
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
Successfully deleted: [File] "C:\Windows\wininit.ini"
~~~ Folders
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 03.02.2015 at 19:00:29,89
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-02-2015
Ran by Sabine (administrator) on SABINE-PC on 03-02-2015 19:01:17
Running from C:\Users\Sabine\Downloads
Loaded Profiles: Sabine (Available profiles: Sabine)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
() C:\Windows\System32\AppleOSSMgr.exe
(Apple Inc.) C:\Windows\System32\AppleTimeSrv.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Haufe-Lexware GmbH & Co. KG) C:\Program Files (x86)\Lexware\Update Service\Hmg.InstallationService.Service.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\VS7Debug\mdm.exe
(Apple Inc.) C:\Program Files\Boot Camp\Bootcamp.exe
(Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
(Haufe-Lexware GmbH & Co. KG) C:\Program Files (x86)\Lexware\Update Manager\LxUpdateManager.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\ng\ngservice.exe
(Thisisu) C:\Users\Sabine\Downloads\JRT.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Haufe-Lexware GmbH & Co. KG) C:\Program Files (x86)\Common Files\Lexware\LxWebAccess\LxWebAccess.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [Apple_KbdMgr] => C:\Program Files\Boot Camp\Bootcamp.exe [741760 2011-06-29] (Apple Inc.)
HKLM-x32\...\Run: [LexwareInfoService] => C:\Program Files (x86)\Lexware\Update Manager\LxUpdateManager.exe [196648 2014-09-26] (Haufe-Lexware GmbH & Co. KG)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2015-02-01] (AVAST Software)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [271744 2014-12-18] (Oracle Corporation)
HKU\S-1-5-21-892020284-3589852367-1128131356-1000\...\Run: [IimbIxxuq] => regsvr32.exe "C:\ProgramData\IimbIxxuq\XaldIyojg.bih"
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)
BootExecute: autocheck autochk * bootdeletesdnclean64.exe
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-892020284-3589852367-1128131356-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:62511;https=127.0.0.1:62511
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-892020284-3589852367-1128131356-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKU\S-1-5-21-892020284-3589852367-1128131356-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab
Handler-x32: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files (x86)\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
FireFox:
========
FF ProfilePath: C:\Users\Sabine\AppData\Roaming\Mozilla\Firefox\Profiles\1qzce38i.default
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.76.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.76.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\4.0.60310.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Adblock Edge - C:\Users\Sabine\AppData\Roaming\Mozilla\Firefox\Profiles\1qzce38i.default\Extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi [2015-02-02]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-02-01]
Chrome:
=======
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-02-01]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S4 AAV UpdateService; C:\Program Files (x86)\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
R2 AppleOSSMgr; C:\Windows\system32\AppleOSSMgr.exe [224640 2011-06-29] ()
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2015-02-01] (AVAST Software)
R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4012248 2015-02-01] (Avast Software)
R2 Lexware_Update_Service; C:\Program Files (x86)\Lexware\Update Service\Hmg.InstallationService.Service.exe [64552 2014-08-14] (Haufe-Lexware GmbH & Co. KG)
R2 MDM; C:\Program Files (x86)\Common Files\Microsoft Shared\VS7Debug\mdm.exe [270336 2001-02-23] (Microsoft Corporation) [File not signed]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R3 applebmt; C:\Windows\System32\DRIVERS\applebmt.sys [52736 2011-06-03] (Apple Inc.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2015-02-01] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [87912 2015-02-01] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2015-02-01] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2015-02-01] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2015-02-01] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2015-02-01] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2015-02-01] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2015-02-01] ()
S3 hitmanpro37; C:\Windows\system32\drivers\hitmanpro37.sys [43664 2015-02-01] ()
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2013-03-18] (Apple, Inc.) [File not signed]
R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [271752 2015-02-01] (Avast Software)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 cpuz134; \??\C:\Users\Sabine\AppData\Local\Temp\cpuz134\cpuz134_x64.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-02-03 19:00 - 2015-02-03 19:00 - 00000683 _____ () C:\Users\Sabine\Desktop\JRT.txt
2015-02-03 18:56 - 2015-02-03 18:56 - 01388274 _____ (Thisisu) C:\Users\Sabine\Downloads\JRT.exe
2015-02-03 18:51 - 2015-02-03 18:53 - 00000000 ____D () C:\AdwCleaner
2015-02-03 18:51 - 2015-02-03 18:51 - 02194432 _____ () C:\Users\Sabine\Downloads\AdwCleaner_4.109.exe
2015-02-02 18:35 - 2015-02-02 18:35 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2015-02-02 18:35 - 2015-02-02 18:35 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2015-02-02 18:35 - 2015-02-02 18:35 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2015-02-02 18:35 - 2015-02-02 18:35 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-02-02 18:35 - 2015-02-02 18:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-02-02 18:35 - 2015-02-02 18:35 - 00000000 ____D () C:\Program Files (x86)\Java
2015-02-02 18:26 - 2015-02-02 18:26 - 00001167 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-02-02 18:26 - 2015-02-02 18:26 - 00001155 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-02-02 18:26 - 2015-02-02 18:26 - 00000000 ____D () C:\Users\Sabine\AppData\Roaming\Mozilla
2015-02-02 18:26 - 2015-02-02 18:26 - 00000000 ____D () C:\Users\Sabine\AppData\Local\Mozilla
2015-02-02 18:26 - 2015-02-02 18:26 - 00000000 ____D () C:\ProgramData\Mozilla
2015-02-02 18:26 - 2015-02-02 18:26 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-02-02 18:25 - 2015-02-02 18:25 - 00243664 _____ () C:\Users\Sabine\Downloads\Firefox Setup Stub 35.0.1.exe
2015-02-02 18:22 - 2015-02-02 18:22 - 00003280 _____ () C:\Windows\System32\Tasks\avastBCLRestartS-1-5-21-892020284-3589852367-1128131356-1000
2015-02-02 18:10 - 2015-02-02 18:10 - 00025569 _____ () C:\ComboFix.txt
2015-02-02 17:57 - 2015-02-02 18:10 - 00000000 ____D () C:\Qoobox
2015-02-02 17:57 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-02-02 17:57 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-02-02 17:57 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-02-02 17:57 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-02-02 17:57 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-02-02 17:57 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2015-02-02 17:57 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2015-02-02 17:57 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2015-02-02 17:56 - 2015-02-02 18:09 - 00000000 ____D () C:\Windows\erdnt
2015-02-02 17:56 - 2015-02-02 17:56 - 05611380 ____R (Swearware) C:\Users\Sabine\Downloads\ComboFix.exe
2015-02-02 17:24 - 2015-02-02 17:24 - 00006755 _____ () C:\Users\Sabine\Desktop\gmer.log
2015-02-02 17:18 - 2015-02-02 17:18 - 00380416 _____ () C:\Users\Sabine\Downloads\Gmer-19357.exe
2015-02-02 17:14 - 2015-02-02 17:14 - 00031241 _____ () C:\Users\Sabine\Downloads\Addition.txt
2015-02-02 17:13 - 2015-02-03 19:01 - 00010233 _____ () C:\Users\Sabine\Downloads\FRST.txt
2015-02-02 17:13 - 2015-02-03 19:01 - 00000000 ____D () C:\FRST
2015-02-02 17:13 - 2015-02-02 17:13 - 02131456 _____ (Farbar) C:\Users\Sabine\Downloads\FRST64.exe
2015-02-01 14:36 - 2015-02-01 14:36 - 00000000 ____D () C:\Program Files (x86)\ESET
2015-02-01 14:34 - 2015-02-01 14:35 - 02347384 _____ (ESET) C:\Users\Sabine\Downloads\esetsmartinstaller_deu.exe
2015-02-01 14:26 - 2015-02-01 14:26 - 00000000 ____D () C:\Users\Sabine\AppData\Roaming\AVAST Software
2015-02-01 14:25 - 2015-02-03 18:57 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2015-02-01 14:25 - 2015-02-01 14:25 - 00087912 _____ (AVAST Software) C:\Windows\system32\Drivers\aswmonflt.sys
2015-02-01 14:25 - 2015-02-01 14:25 - 00001972 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2015-02-01 14:25 - 2015-02-01 14:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2015-02-01 14:25 - 2015-02-01 14:24 - 00436624 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2015-02-01 14:25 - 2015-02-01 14:24 - 00267632 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2015-02-01 14:25 - 2015-02-01 14:24 - 00116728 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2015-02-01 14:25 - 2015-02-01 14:24 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2015-02-01 14:24 - 2015-02-01 14:25 - 01050432 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2015-02-01 14:24 - 2015-02-01 14:24 - 00364512 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2015-02-01 14:24 - 2015-02-01 14:24 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2015-02-01 14:24 - 2015-02-01 14:24 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2015-02-01 14:24 - 2015-02-01 14:24 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2015-02-01 14:23 - 2015-02-01 14:23 - 00000000 ____D () C:\Program Files\AVAST Software
2015-02-01 14:22 - 2015-02-01 14:23 - 00000000 ____D () C:\ProgramData\AVAST Software
2015-02-01 14:20 - 2015-02-01 14:22 - 132469808 _____ (AVAST Software) C:\Users\Sabine\Downloads\avast_free_antivirus_setup.exe
2015-02-01 14:16 - 2015-02-01 14:16 - 00000000 ____D () C:\ProgramData\Avira
2015-02-01 14:16 - 2015-02-01 14:16 - 00000000 ____D () C:\Program Files (x86)\Avira
2015-02-01 14:12 - 2015-02-01 14:16 - 00000700 _____ () C:\DelFix.txt
2015-02-01 14:12 - 2015-02-01 14:12 - 00000000 ____D () C:\Windows\ERUNT
2015-02-01 13:31 - 2015-02-01 13:31 - 00001110 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-02-01 13:31 - 2015-02-01 13:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-02-01 13:31 - 2015-02-01 13:31 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-02-01 13:31 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-02-01 13:31 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-02-01 13:24 - 2015-02-01 13:24 - 04515896 _____ (Avira Operations & Co. KG) C:\Users\Sabine\Downloads\avira_de_av_5821065637__ws.exe
2015-02-01 12:44 - 2015-02-03 18:39 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-01 12:44 - 2015-02-01 13:31 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-02-01 12:44 - 2015-02-01 13:28 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-02-01 12:44 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-02-01 12:42 - 2015-02-01 12:43 - 16466552 _____ (Malwarebytes Corp.) C:\Users\Sabine\Downloads\mbar-1.08.3.1004.exe
2015-02-01 12:12 - 2015-02-02 18:06 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-02-01 12:12 - 2015-02-02 17:03 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2015-02-01 12:12 - 2015-02-01 12:12 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2015-02-01 12:09 - 2015-02-01 12:09 - 00000004 _____ () C:\Users\Sabine\AppData\Roaming\appdataFr2.bin
2015-02-01 12:08 - 2015-02-01 12:08 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Sabine\Downloads\mbam-setup-2.0.4.1028.exe
2015-02-01 12:06 - 2015-02-01 12:06 - 00043664 _____ () C:\Windows\system32\Drivers\hitmanpro37.sys
2015-02-01 12:00 - 2015-02-01 12:00 - 00379488 _____ () C:\Windows\system32\.crusader
2015-02-01 11:35 - 2015-02-01 11:59 - 00000000 ____D () C:\ProgramData\HitmanPro
2015-02-01 11:35 - 2015-02-01 11:35 - 00000000 ____D () C:\Program Files\HitmanPro
2015-02-01 11:28 - 2015-02-01 14:26 - 00000000 ____D () C:\Windows\pss
2015-01-31 14:53 - 2015-01-31 14:54 - 00000000 ____D () C:\Kaspersky Rescue Disk 10.0
2015-01-27 21:49 - 2015-01-29 17:37 - 00000000 ____D () C:\Users\Sabine\Sicherung Buchhaltung Lexware
2015-01-27 17:21 - 2015-01-27 17:21 - 00025087 _____ () C:\Windows\system32\ScanResults.xml
2015-01-25 21:02 - 2015-01-25 21:02 - 00643544 _____ () C:\Windows\Minidump\012515-34975-01.dmp
2015-01-25 17:06 - 2015-01-25 17:06 - 00000000 ____D () C:\Users\Sabine\AppData\Roaming\QuickScan
2015-01-25 17:00 - 2015-01-25 17:00 - 00000000 ____D () C:\Users\Sabine\AppData\Roaming\Opera Software
2015-01-25 17:00 - 2015-01-25 17:00 - 00000000 ____D () C:\Users\Sabine\AppData\Local\Opera Software
2015-01-25 16:57 - 2015-01-25 17:30 - 00000000 ____D () C:\Program Files (x86)\Opera
2015-01-20 20:59 - 2015-01-20 22:06 - 00000000 ____D () C:\Users\Sabine\AppData\Roaming\Lexware
2015-01-20 20:58 - 2015-01-20 20:58 - 00002771 _____ () C:\Users\Public\Desktop\Lexware buchhalter.lnk
2015-01-20 20:58 - 2015-01-20 20:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lexware
2015-01-20 20:57 - 2015-01-29 16:05 - 00000000 ____D () C:\ProgramData\Lexware
2015-01-20 20:57 - 2015-01-27 21:48 - 00000000 ____D () C:\Program Files (x86)\Lexware
2015-01-20 20:57 - 2014-06-05 09:45 - 09016832 _____ (Amyuni Technologies hxxp://www.amyuni.com) C:\Windows\system32\cdintf500_64.dll
2015-01-20 20:57 - 2014-06-05 09:45 - 07235584 _____ (Amyuni Technologies hxxp://www.amyuni.com) C:\Windows\SysWOW64\cdintf500.dll
2015-01-20 20:30 - 2015-01-20 20:31 - 01686192 _____ (Haufe-Lexware GmbH & Co.KG) C:\Users\Sabine\Downloads\Buchhalter_plus_Setup.exe
2015-01-18 19:08 - 2015-01-18 19:13 - 00001904 _____ () C:\Users\Public\Desktop\Steuer-Sparer 2015.lnk
2015-01-18 19:08 - 2015-01-18 19:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steuer-Sparer 2015
2015-01-18 19:07 - 2015-01-18 19:13 - 00000000 ____D () C:\Program Files (x86)\Steuer-Sparer 2015
2015-01-18 18:13 - 2015-02-01 14:27 - 00000000 ____D () C:\ProgramData\Package Cache
2015-01-16 02:49 - 2015-01-25 21:02 - 00000000 ____D () C:\Windows\Minidump
2015-01-16 02:49 - 2015-01-25 21:01 - 402575744 _____ () C:\Windows\MEMORY.DMP
2015-01-16 02:49 - 2015-01-16 02:49 - 00375208 _____ () C:\Windows\Minidump\011615-26457-01.dmp
2015-01-16 00:54 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-16 00:54 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-16 00:54 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-01-16 00:54 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-01-16 00:54 - 2014-12-11 18:47 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-16 00:54 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-16 00:54 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2015-01-16 00:54 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2015-01-16 00:53 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-01-16 00:53 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-01-16 00:53 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-01-16 00:53 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-01-16 00:53 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-01-15 19:52 - 2015-01-18 18:22 - 00000000 ____D () C:\Users\Sabine\AppData\Local\elfopatch
2015-01-12 20:03 - 2014-12-13 06:09 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-01-12 20:03 - 2014-12-13 04:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-01-12 19:38 - 2015-01-12 19:38 - 00000000 ____D () C:\Windows\system32\appraiser
2015-01-04 17:35 - 2014-12-04 03:50 - 00830976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-01-04 17:35 - 2014-12-04 03:50 - 00741376 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-01-04 17:35 - 2014-12-04 03:50 - 00413184 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-01-04 17:35 - 2014-12-04 03:50 - 00396800 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-01-04 17:35 - 2014-12-04 03:50 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-01-04 17:35 - 2014-12-04 03:50 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-01-04 17:35 - 2014-12-04 03:44 - 01083392 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-01-04 17:35 - 2014-12-02 00:28 - 01232040 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2015-01-04 17:34 - 2014-11-11 04:09 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-01-04 17:34 - 2014-11-11 03:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-01-04 17:34 - 2014-11-11 02:46 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2015-01-04 17:33 - 2014-11-27 02:43 - 00389296 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-01-04 17:33 - 2014-11-27 02:10 - 00342200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-01-04 17:33 - 2014-11-22 04:13 - 25059840 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-01-04 17:33 - 2014-11-22 04:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-01-04 17:33 - 2014-11-22 04:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-01-04 17:33 - 2014-11-22 03:50 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-01-04 17:33 - 2014-11-22 03:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-01-04 17:33 - 2014-11-22 03:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-01-04 17:33 - 2014-11-22 03:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-01-04 17:33 - 2014-11-22 03:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-01-04 17:33 - 2014-11-22 03:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-01-04 17:33 - 2014-11-22 03:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-01-04 17:33 - 2014-11-22 03:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-01-04 17:33 - 2014-11-22 03:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-01-04 17:33 - 2014-11-22 03:34 - 06039552 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-01-04 17:33 - 2014-11-22 03:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-01-04 17:33 - 2014-11-22 03:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-01-04 17:33 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-01-04 17:33 - 2014-11-22 03:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-01-04 17:33 - 2014-11-22 03:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-01-04 17:33 - 2014-11-22 03:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-01-04 17:33 - 2014-11-22 03:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-01-04 17:33 - 2014-11-22 03:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-01-04 17:33 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-01-04 17:33 - 2014-11-22 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-01-04 17:33 - 2014-11-22 03:06 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-01-04 17:33 - 2014-11-22 03:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-01-04 17:33 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-01-04 17:33 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-01-04 17:33 - 2014-11-22 02:59 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-01-04 17:33 - 2014-11-22 02:58 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-01-04 17:33 - 2014-11-22 02:56 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-01-04 17:33 - 2014-11-22 02:54 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-01-04 17:33 - 2014-11-22 02:49 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-01-04 17:33 - 2014-11-22 02:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-01-04 17:33 - 2014-11-22 02:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-01-04 17:33 - 2014-11-22 02:46 - 02125312 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-01-04 17:33 - 2014-11-22 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-01-04 17:33 - 2014-11-22 02:43 - 14412800 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-01-04 17:33 - 2014-11-22 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-01-04 17:33 - 2014-11-22 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-01-04 17:33 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-01-04 17:33 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-01-04 17:33 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-01-04 17:33 - 2014-11-22 02:28 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-01-04 17:33 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-01-04 17:33 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-01-04 17:33 - 2014-11-22 02:21 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-01-04 17:33 - 2014-11-22 02:15 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-01-04 17:33 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-01-04 17:33 - 2014-11-22 02:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-01-04 17:33 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-01-04 17:33 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-01-04 17:33 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-01-04 11:07 - 2014-10-18 03:05 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2015-01-04 11:07 - 2014-10-18 02:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2015-01-04 11:07 - 2014-07-07 03:06 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2015-01-04 11:07 - 2014-07-07 03:06 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2015-01-04 11:07 - 2014-07-07 03:06 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2015-01-04 11:07 - 2014-07-07 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2015-01-04 11:07 - 2014-07-07 02:40 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
2015-01-04 11:07 - 2014-07-07 02:39 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe
2015-01-04 11:07 - 2014-07-07 02:39 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe
2015-01-04 11:07 - 2014-07-07 02:37 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll
2015-01-04 11:05 - 2014-11-08 04:16 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2015-01-04 11:05 - 2014-11-08 03:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2015-01-04 11:05 - 2014-10-30 03:03 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe
2015-01-04 11:05 - 2014-10-30 02:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\charmap.exe
2015-01-04 11:05 - 2014-10-03 03:12 - 02020352 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll
2015-01-04 11:05 - 2014-10-03 03:12 - 00346624 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll
2015-01-04 11:05 - 2014-10-03 03:12 - 00310272 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll
2015-01-04 11:05 - 2014-10-03 03:12 - 00181248 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll
2015-01-04 11:05 - 2014-10-03 03:11 - 00266240 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe
2015-01-04 11:05 - 2014-10-03 02:45 - 01177088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll
2015-01-04 11:05 - 2014-10-03 02:45 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManMigrationPlugin.dll
2015-01-04 11:05 - 2014-10-03 02:45 - 00214016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll
2015-01-04 11:05 - 2014-10-03 02:45 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmAuto.dll
2015-01-04 11:05 - 2014-10-03 02:44 - 00198656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManHTTPConfig.exe
2015-01-04 10:59 - 2015-01-04 10:59 - 00003886 _____ () C:\Windows\System32\Tasks\Adobe Acrobat Update Task
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-02-03 18:54 - 2010-11-21 04:47 - 00143694 _____ () C:\Windows\PFRO.log
2015-02-03 18:54 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-03 18:54 - 2009-07-14 05:51 - 00045944 _____ () C:\Windows\setupact.log
2015-02-03 18:53 - 2013-08-31 06:52 - 01954111 _____ () C:\Windows\WindowsUpdate.log
2015-02-03 18:44 - 2009-07-14 05:45 - 00028912 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-03 18:44 - 2009-07-14 05:45 - 00028912 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-02 22:05 - 2013-09-12 20:09 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-02-02 18:59 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows\system32\FxsTmp
2015-02-02 18:58 - 2013-09-01 15:55 - 00000000 ___RD () C:\Users\Sabine\Desktop\Eigene Dateien
2015-02-02 18:33 - 2013-09-12 20:09 - 00000000 ____D () C:\Users\Sabine\AppData\Local\Google
2015-02-02 18:33 - 2013-09-12 20:09 - 00000000 ____D () C:\Program Files (x86)\Google
2015-02-02 18:32 - 2013-09-12 20:09 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-02-02 18:31 - 2013-09-12 20:09 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-02-02 18:31 - 2013-09-12 20:09 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-02 18:26 - 2014-04-13 15:07 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-02-02 18:10 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default
2015-02-02 18:07 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2015-02-02 09:19 - 2014-08-30 20:26 - 00000000 ____D () C:\93d47d12-ade2-409a-9cb7-1f47344046a5
2015-02-01 14:08 - 2013-09-12 20:10 - 00000000 ____D () C:\Program Files\Google
2015-02-01 14:08 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\Vss
2015-02-01 14:07 - 2014-04-13 15:03 - 00000000 ____D () C:\temp
2015-02-01 12:58 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows\addins
2015-02-01 12:00 - 2014-06-26 20:21 - 00000000 ____D () C:\Program Files (x86)\19A6D51C-2D35-44DB-B412-0B01BF8D2D62
2015-01-31 17:07 - 2013-09-01 15:42 - 00000000 ____D () C:\Users\Sabine\Desktop\Alte Daten
2015-01-31 08:55 - 2013-09-02 19:12 - 00000072 _____ () C:\Users\Public\LMDebug.log
2015-01-29 15:59 - 2013-10-12 19:32 - 00000000 ____D () C:\Users\Sabine\AppData\Local\Lexware
2015-01-27 21:49 - 2013-08-31 08:55 - 00000000 ____D () C:\Users\Sabine
2015-01-25 18:42 - 2011-04-12 08:43 - 00699092 _____ () C:\Windows\system32\perfh007.dat
2015-01-25 18:42 - 2011-04-12 08:43 - 00149232 _____ () C:\Windows\system32\perfc007.dat
2015-01-25 18:42 - 2009-07-14 06:13 - 01619284 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-01-25 13:53 - 2009-07-14 05:45 - 00359912 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-01-20 21:00 - 2013-09-02 19:11 - 00091264 _____ () C:\Users\Sabine\AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-20 20:59 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\Help
2015-01-20 20:00 - 2013-11-02 11:02 - 00000000 ____D () C:\Users\Sabine\AppData\Local\.elfohilfe
2015-01-18 19:25 - 2013-09-01 18:31 - 00000000 ____D () C:\Users\Sabine\Documents\Steuerfälle
2015-01-18 18:38 - 2013-09-21 22:21 - 00000000 ____D () C:\Program Files (x86)\ElsterFormular
2015-01-16 03:02 - 2013-08-31 14:07 - 00000000 ____D () C:\Windows\system32\MRT
2015-01-16 03:00 - 2013-08-31 14:07 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-01-16 02:31 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\LiveKernelReports
2015-01-12 20:24 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2015-01-12 19:49 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-01-12 19:38 - 2014-05-07 02:00 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-01-12 19:38 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2015-01-12 19:38 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\AppCompat
2015-01-08 09:55 - 2010-11-21 04:27 - 00298120 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
==================== Files in the root of some directories =======
2015-02-01 12:09 - 2015-02-01 12:09 - 0000004 _____ () C:\Users\Sabine\AppData\Roaming\appdataFr2.bin
2013-08-31 16:40 - 2013-08-31 16:40 - 0012358 _____ () C:\Users\Sabine\AppData\Roaming\PFP110JCM.{PB
2013-08-31 16:40 - 2013-08-31 16:40 - 0061678 _____ () C:\Users\Sabine\AppData\Roaming\PFP110JPR.{PB
Some content of TEMP:
====================
C:\Users\Sabine\AppData\Local\Temp\Quarantine.exe
C:\Users\Sabine\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-01-25 15:24
==================== End Of Log ============================
|
|
03.02.2015, 21:51
| #6 |
| /// the machine /// TB-Ausbilder | Windows 7 & BKA Trojaner 1.18 -> Nur teilweise erfolgreich entferntESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ --> Windows 7 & BKA Trojaner 1.18 -> Nur teilweise erfolgreich entfernt |
|
| Themen zu Windows 7 & BKA Trojaner 1.18 -> Nur teilweise erfolgreich entfernt |
| adware, antivirus, avira, bonjour, browser, desktop, failed, flash player, google, helper, home, install.exe, installmanager.exe, js:scriptip-inf, kaspersky, kis, mozilla, registry, scan, security, services.exe, software, starten, svchost.exe, system, trojaner, vc32loader.dll, viren, windows |
WARNUNG an die MITLESER: 
Linear-Darstellung
