| |
| |||||||
Log-Analyse und Auswertung: Infektion auf dem Notebook Inline-HookWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
24.06.2013, 21:19
| #1 |
| |  Infektion auf dem Notebook Inline-Hook Guten Abend zusammen, gestern begrüßte mich nach der Arbeit mein Notebook mit einer tollen Info nachdem der geplante Virenscan (AVG) durchgeführt wurde. Da ich gestern allerdings nicht viel Zeit hatte, nahm ich alles zur Kenntnis und habe mich heute wieder daran gesetzt. Nun werden mit einem Neustart mehrere Seiten im Internet automatisch geöffnet. Hier der Bericht vom AVG-Scanner: "Status";"Priorität";"Name";"Beschreibung";"Ergebnis" "Infiziert";"Mittel";"Inline-Hook ataport.SYS DllUnload -> spab.sys +0x299FE";"C:\Windows\System32\Drivers\spab.sys";"Infiziert" "Infiziert";"Mittel";"atapi.sys, Import-Hook ataport.SYS AtaPortReadPortBufferUshort -> spab.sys +0x213E";"C:\Windows\System32\Drivers\spab.sys";"Infiziert" "Infiziert";"Mittel";"atapi.sys, Import-Hook ataport.SYS AtaPortWritePortBufferUshort -> spab.sys +0x2800";"C:\Windows\System32\Drivers\spab.sys";"Infiziert" "Infiziert";"Mittel";"atapi.sys, Import-Hook ataport.SYS AtaPortWritePortUchar -> spab.sys +0x26D6";"C:\Windows\System32\Drivers\spab.sys";"Infiziert" "Infiziert";"Mittel";"atapi.sys, Import-Hook ataport.SYS AtaPortReadPortUchar -> spab.sys +0x2042";"C:\Windows\System32\Drivers\spab.sys";"Infiziert" Über gut gemeinte Ratschläge wäre ich sehr dankbar! |
|
24.06.2013, 21:27
| #2 |
| /// the machine /// TB-Ausbilder    | Infektion auf dem Notebook Inline-Hook Hi,
__________________Systemscan mit FRST Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit (Wenn du nicht sicher bist: Start > Computer (Rechtsklick) > Eigenschaften)
__________________ |
|
24.06.2013, 21:38
| #3 |
| | Infektion auf dem Notebook Inline-Hook FRST:
__________________FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 22-06-2013
Ran by Raphael (administrator) on 24-06-2013 22:31:37
Running from C:\Users\Raphael\Downloads
Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) ===================
(AVG Technologies CZ, s.r.o.) C:\PROGRA~1\AVG\AVG2013\avgrsx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgcsrvx.exe
(NVIDIA Corporation) C:\windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\windows\system32\nvvsvc.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgwdsvc.exe
() C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe
() C:\windows\SYSTEM32\Rezip.exe
() C:\Program Files\CyberLink\Shared files\RichVideo.exe
(Iminent) C:\Program Files\Common Files\Umbrella\umbrella.exe
(AVG Secure Search) C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.2.0\ToolbarUpdater.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgnsx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgemcx.exe
(Wajam) C:\Program Files\Wajam\Updater\WajamUpdater.exe
(SAMSUNG Electronics) C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
(SEC) C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(CyberLink) C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe
(CyberLink Corp.) C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Nero AG) C:\Program Files\Nero\Nero 10\Nero BackItUp\NBAgent.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
(Nokia) C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgui.exe
(AVG Secure Search) C:\Program Files\AVG Secure Search\vprot.exe
(Geek Software GmbH) C:\Program Files\PDF24\pdf24.exe
(Iminent) C:\Program Files\Iminent\Iminent.exe
(Iminent) C:\Program Files\Iminent\Iminent.Messengers.exe
(DT Soft Ltd) C:\Program Files\DAEMON Tools Lite\DTLite.exe
(Facebook) C:\Users\Raphael\AppData\Local\Facebook\Messenger\2.1.4814.0\FacebookMessenger.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
(Nero AG) C:\Program Files\Nero\Update\NASvc.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Mozilla Corporation) C:\Program Files\Mozilla Thunderbird\thunderbird.exe
(Microsoft Corporation) C:\Program Files\Microsoft Games\hearts\hearts.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s [8120864 2009-12-15] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [1578280 2009-10-10] (Synaptics Incorporated)
HKLM\...\Run: [UpdateLBPShortCut] "C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.5" [222504 2009-05-19] (CyberLink Corp.)
HKLM\...\Run: [CLMLServer] "C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe" [103720 2009-06-03] (CyberLink)
HKLM\...\Run: [UpdateP2GoShortCut] "C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0" [222504 2009-05-19] (CyberLink Corp.)
HKLM\...\Run: [UpdatePDRShortCut] "C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\PowerDirector" UpdateWithCreateOnce "Software\CyberLink\PowerDirector\7.0" [222504 2008-01-04] (CyberLink Corp.)
HKLM\...\Run: [RemoteControl8] "C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe" [91432 2009-04-15] (CyberLink Corp.)
HKLM\...\Run: [PDVD8LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe" [50472 2009-04-15] (CyberLink Corp.)
HKLM\...\Run: [UpdatePPShortCut] "C:\Program Files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\PowerProducer" UpdateWithCreateOnce "Software\CyberLink\PowerProducer\5.0" [218408 2008-12-03] (CyberLink Corp.)
HKLM\...\Run: [UpdatePSTShortCut] "C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\DVD Suite" UpdateWithCreateOnce "Software\CyberLink\PowerStarter" [210216 2009-07-21] (CyberLink Corp.)
HKLM\...\Run: [APLangApp] "C:\Program Files\AnyPC Client\APLangApp.exe" [13312 2009-11-20] (DoctorSoft)
HKLM\...\Run: [NvCplDaemon] RUNDLL32.EXE C:\windows\system32\NvCpl.dll,NvStartup [13834856 2010-01-07] (NVIDIA Corporation)
HKLM\...\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" UpdateWithCreateOnce "Software\CyberLink\YouCam\2.0" [222504 2009-05-19] (CyberLink Corp.)
HKLM\...\Run: [NBAgent] "C:\Program Files\Nero\Nero 10\Nero BackItUp\NBAgent.exe" /WinStart [1234216 2010-03-26] (Nero AG)
HKLM\...\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [30040 2009-02-26] (Microsoft Corporation)
HKLM\...\Run: [NokiaMServer] C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup [x]
HKLM\...\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59280 2012-10-11] (Apple Inc.)
HKLM\...\Run: [AVG_UI] "C:\Program Files\AVG\AVG2013\avgui.exe" /TRAYONLY [4408368 2013-04-29] (AVG Technologies CZ, s.r.o.)
HKLM\...\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [421888 2012-10-25] (Apple Inc.)
HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [vProt] "C:\Program Files\AVG Secure Search\vprot.exe" [1226928 2013-05-20] (AVG Secure Search)
HKLM\...\Run: [PDFPrint] C:\Program Files\PDF24\pdf24.exe [162856 2013-03-20] (Geek Software GmbH)
HKLM\...\Run: [Iminent] C:\Program Files\Iminent\Iminent.exe /warmup "F77F87E5-A6BD-4922-A530-EDF63D7E9F8C" [1074736 2013-06-18] (Iminent)
HKLM\...\Run: [IminentMessenger] C:\Program Files\Iminent\Iminent.Messengers.exe [884784 2013-06-18] (Iminent)
HKCU\...\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun [357696 2010-04-01] (DT Soft Ltd)
HKCU\...\Run: [] [x]
HKCU\...\Run: [Facebook Update] "C:\Users\Raphael\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver [138096 2012-07-12] (Facebook Inc.)
HKCU\...\Run: [SCheck] "C:\Users\Raphael\AppData\Roaming\SCheck\SCheck.exe" check [36864 2013-04-10] ()
HKCU\...\Run: [SSync] "C:\Users\Raphael\AppData\Roaming\SSync\SSync.exe" [36864 2013-04-10] ()
HKCU\...\Run: [Intermediate] "C:\Users\Raphael\AppData\Roaming\Intermediate\Intermediate.exe" [36864 2013-04-10] ()
MountPoints2: {69909c08-c174-11df-a38a-0024546416a4} - G:\SETUP.EXE
MountPoints2: {f529950b-b193-11df-8c33-0024546416a4} - F:\launcher.exe /cfg:.\script.ini /lng:ger
Startup: C:\Users\Raphael\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk
ShortcutTarget: Facebook Messenger.lnk -> C:\Users\Raphael\AppData\Local\Facebook\Messenger\2.1.4814.0\FacebookMessenger.exe (Facebook)
Startup: C:\Users\Raphael\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.fbdownloader.com/?channel=sfde206
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=smsn&bmod=smsn
URLSearchHook: (No Name) - {1ce76c93-a797-4ca2-ab3c-f4a6cfba3440} - No File
HKCU SearchScopes: DefaultScope {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxp://search.fbdownloader.com/search.php?channel=sfde206&q={searchTerms}
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL =
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
SearchScopes: HKCU - {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxp://search.fbdownloader.com/search.php?channel=sfde206&q={searchTerms}
BHO: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No File
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\15.2.0.5\AVG Secure Search_toolbar.dll (AVG Secure Search)
BHO: IMinent WebBooster (BHO) - {A09AB6EB-31B5-454C-97EC-9B294D92EE2A} - C:\Program Files\Iminent\Iminent.WebBooster.InternetExplorer.dll (Iminent)
BHO: Wajam - {A7A6995D-6EE1-4FD1-A258-49395D5BF99C} - C:\Program Files\Wajam\IE\priam_bho.dll (Wajam)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\15.2.0.5\AVG Secure Search_toolbar.dll (AVG Secure Search)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_09-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0009-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_09-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_09-windows-i586.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - No File
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\15.2.0\ViProtocol.dll (AVG Secure Search)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Raphael\AppData\Roaming\Mozilla\Firefox\Profiles\q3y2f0i3.default
FF user.js: detected! => C:\Users\Raphael\AppData\Roaming\Mozilla\Firefox\Profiles\q3y2f0i3.default\user.js
FF SearchEngine: Google
FF Homepage: hxxp://isearch.avg.com?pid=avg&sg=&cid=%7Bb896722c-2d04-41bf-930e-b98ece517d1f%7D&mid=f303faea6d2f6745ef908130b5263ba6-d402e679bbb58162408a515bb7a765655f2fa08a&ds=AVG&v=15.2.0.5&lang=de&pr=fr&d=2013-01-27%2021%3A39%3A49&sap=hp
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin - C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\15.2.0\\npsitesafety.dll (AVG Technologies)
FF Plugin: @java.com/DTPlugin,version=10.9.2 - C:\windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.9.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Visualisateur 3D de 20-20 - C:\Users\Raphael\AppData\Roaming\Mozilla\Firefox\Profiles\q3y2f0i3.default\Extensions\2020Player_IKEA@2020Technologies.com
FF Extension: om - C:\Users\Raphael\AppData\Roaming\Mozilla\Firefox\Profiles\q3y2f0i3.default\Extensions\om@offermosquito.com.xpi
FF Extension: webbooster - C:\Users\Raphael\AppData\Roaming\Mozilla\Firefox\Profiles\q3y2f0i3.default\Extensions\webbooster@iminent.com.xpi
FF Extension: No Name - C:\Users\Raphael\AppData\Roaming\Mozilla\Firefox\Profiles\q3y2f0i3.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
Chrome:
=======
CHR HomePage: http:\/\/search.fbdownloader.com\/?channel=sfde206
CHR RestoreOnStartup: "urls_to_restore_on_startup": [
CHR Extension: (OfferMosquito) - C:\Users\Raphael\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbmdkmlcnbapgegninelmjbfibaghdmk\0.4_0
========================== Services (Whitelisted) =================
R2 AVGIDSAgent; C:\Program Files\AVG\AVG2013\avgidsagent.exe [4937264 2013-05-14] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files\AVG\AVG2013\avgwdsvc.exe [283136 2013-04-18] (AVG Technologies CZ, s.r.o.)
R2 NAUpdate; C:\Program Files\Nero\Update\NASvc.exe [490280 2010-03-25] (Nero AG)
R2 OberonGameConsoleService; C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe [44312 2009-08-13] ()
R2 Rezip; C:\windows\SYSTEM32\Rezip.exe [311296 2009-03-05] ()
R2 RichVideo; C:\Program Files\CyberLink\Shared files\RichVideo.exe [247152 2009-07-07] ()
R2 SProtection; C:\Program Files\Common Files\Umbrella\umbrella.exe [2723368 2013-06-17] (Iminent)
R2 vToolbarUpdater15.2.0; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.2.0\ToolbarUpdater.exe [1015984 2013-05-20] (AVG Secure Search)
R2 WajamUpdater; C:\Program Files\Wajam\Updater\WajamUpdater.exe [109064 2012-10-05] (Wajam)
==================== Drivers (Whitelisted) ====================
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdriverx.sys [208184 2013-03-29] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHX; C:\Windows\System32\DRIVERS\avgidshx.sys [60216 2013-02-08] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSShim; C:\Windows\System32\DRIVERS\avgidsshimx.sys [22328 2013-03-01] (AVG Technologies CZ, s.r.o.)
R1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [170808 2013-02-08] (AVG Technologies CZ, s.r.o.)
R0 Avglogx; C:\Windows\System32\DRIVERS\avglogx.sys [245048 2013-02-08] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx86; C:\Windows\System32\DRIVERS\avgmfx86.sys [96568 2013-02-08] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx86; C:\Windows\System32\DRIVERS\avgrkx86.sys [39224 2013-02-08] (AVG Technologies CZ, s.r.o.)
R1 Avgtdix; C:\Windows\System32\DRIVERS\avgtdix.sys [182072 2013-03-21] (AVG Technologies CZ, s.r.o.)
R1 avgtp; C:\windows\system32\drivers\avgtpx86.sys [37664 2013-05-20] (AVG Technologies)
R1 SABI; C:\windows\system32\Drivers\SABI.sys [10752 2009-05-28] (SAMSUNG ELECTRONICS)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [691696 2010-08-21] ()
U3 azc9a4ez; C:\Windows\System32\Drivers\azc9a4ez.sys [0 ] (Microsoft Corporation)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-06-24 22:31 - 2013-06-24 22:31 - 01369655 ____A (Farbar) C:\Users\Raphael\Downloads\FRST.exe
2013-06-24 22:31 - 2013-06-24 22:31 - 00000000 ____D C:\FRST
2013-06-24 20:39 - 2013-06-24 21:58 - 00000000 ____D C:\Users\Raphael\AppData\Roaming\igdhbblpcellaljokkpfhcjlagemhgjl
2013-06-24 20:39 - 2013-06-24 20:39 - 00000611 ____A C:\Windows\System32\InstallUtil.InstallLog
2013-06-24 20:39 - 2013-06-24 20:39 - 00000000 ____D C:\Users\Raphael\AppData\Roaming\Iminent
2013-06-24 20:39 - 2013-06-24 20:39 - 00000000 ____D C:\ProgramData\Iminent
2013-06-24 20:39 - 2013-06-24 20:39 - 00000000 ____D C:\Program Files\Iminent
2013-06-24 20:39 - 2013-06-24 20:39 - 00000000 ____D C:\Program Files\Common Files\Umbrella
2013-06-24 20:35 - 2013-06-24 20:51 - 00000000 ____D C:\Users\Raphael\AppData\Roaming\DataMgr
2013-06-24 20:35 - 2013-06-24 20:35 - 00001934 ____A C:\Users\Raphael\Desktop\fbDownloader.lnk
2013-06-24 20:35 - 2013-06-24 20:35 - 00000000 ____D C:\Users\Raphael\AppData\Roaming\SSync
2013-06-24 20:35 - 2013-06-24 20:35 - 00000000 ____D C:\Users\Raphael\AppData\Roaming\SCheck
2013-06-24 20:35 - 2013-06-24 20:35 - 00000000 ____D C:\Users\Raphael\AppData\Roaming\Intermediate
2013-06-24 20:35 - 2013-06-24 20:35 - 00000000 ____D C:\Users\Raphael\AppData\Roaming\FBDownloader
2013-06-24 20:35 - 2013-06-24 20:35 - 00000000 ____D C:\Users\Raphael\AppData\Roaming\Common
2013-06-24 20:33 - 2013-06-24 20:33 - 00001067 ____A C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-06-24 20:33 - 2013-06-24 20:33 - 00000000 ____D C:\Users\Raphael\AppData\Roaming\Malwarebytes
2013-06-24 20:33 - 2013-06-24 20:33 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-06-24 20:33 - 2013-06-24 20:33 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-06-24 20:33 - 2013-04-04 14:50 - 00022856 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2013-06-24 20:29 - 2013-06-24 20:29 - 00393072 ____A (Softonic ) C:\Users\Raphael\Downloads\SoftonicDownloader_fuer_malwarebytes-anti-malware.exe
2013-06-23 22:57 - 2013-06-08 13:42 - 01141248 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-23 22:57 - 2013-06-08 13:40 - 14327808 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-23 22:57 - 2013-06-08 13:40 - 13760512 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-23 22:57 - 2013-06-08 13:40 - 02046976 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-23 22:57 - 2013-06-08 13:40 - 00391168 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-23 22:57 - 2013-06-08 13:13 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-23 22:56 - 2013-05-17 03:26 - 00042496 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-06-23 22:56 - 2013-05-17 03:25 - 02877440 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-23 22:56 - 2013-05-17 03:25 - 01767936 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-23 22:56 - 2013-05-17 03:25 - 00690688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-23 22:56 - 2013-05-17 03:25 - 00493056 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-23 22:56 - 2013-05-17 03:25 - 00109056 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-06-23 22:56 - 2013-05-17 03:25 - 00061440 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-06-23 22:56 - 2013-05-17 03:25 - 00039424 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-23 22:56 - 2013-05-17 03:25 - 00033280 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-06-23 22:56 - 2013-05-14 10:40 - 00071680 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-22 14:44 - 2013-06-22 14:44 - 01441280 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-06-22 14:44 - 2013-06-22 14:44 - 01400416 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat
2013-06-22 14:44 - 2013-06-22 14:44 - 00745472 ____A (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2013-06-22 14:44 - 2013-06-22 14:44 - 00719360 ____A (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll
2013-06-22 14:44 - 2013-06-22 14:44 - 00629248 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2013-06-22 14:44 - 2013-06-22 14:44 - 00523264 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-06-22 14:44 - 2013-06-22 14:44 - 00361984 ____A (Microsoft Corporation) C:\Windows\System32\html.iec
2013-06-22 14:44 - 2013-06-22 14:44 - 00357888 ____A (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2013-06-22 14:44 - 2013-06-22 14:44 - 00242200 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2013-06-22 14:44 - 2013-06-22 14:44 - 00232960 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-06-22 14:44 - 2013-06-22 14:44 - 00226816 ____A (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2013-06-22 14:44 - 2013-06-22 14:44 - 00204800 ____A (Microsoft Corporation) C:\Windows\System32\webcheck.dll
2013-06-22 14:44 - 2013-06-22 14:44 - 00185344 ____A (Microsoft Corporation) C:\Windows\System32\elshyph.dll
2013-06-22 14:44 - 2013-06-22 14:44 - 00163840 ____A (Microsoft Corporation) C:\Windows\System32\msrating.dll
2013-06-22 14:44 - 2013-06-22 14:44 - 00158720 ____A (Microsoft Corporation) C:\Windows\System32\msls31.dll
2013-06-22 14:44 - 2013-06-22 14:44 - 00150528 ____A (Microsoft Corporation) C:\Windows\System32\iexpress.exe
2013-06-22 14:44 - 2013-06-22 14:44 - 00138752 ____A (Microsoft Corporation) C:\Windows\System32\wextract.exe
2013-06-22 14:44 - 2013-06-22 14:44 - 00137216 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-06-22 14:44 - 2013-06-22 14:44 - 00125440 ____A (Microsoft Corporation) C:\Windows\System32\occache.dll
2013-06-22 14:44 - 2013-06-22 14:44 - 00117248 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2013-06-22 14:44 - 2013-06-22 14:44 - 00110592 ____A (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll
2013-06-22 14:44 - 2013-06-22 14:44 - 00082432 ____A (Microsoft Corporation) C:\Windows\System32\inseng.dll
2013-06-22 14:44 - 2013-06-22 14:44 - 00079872 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-06-22 14:44 - 2013-06-22 14:44 - 00073728 ____A (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe
2013-06-22 14:44 - 2013-06-22 14:44 - 00069120 ____A (Microsoft Corporation) C:\Windows\System32\icardie.dll
2013-06-22 14:44 - 2013-06-22 14:44 - 00061952 ____A (Microsoft Corporation) C:\Windows\System32\tdc.ocx
2013-06-22 14:44 - 2013-06-22 14:44 - 00057344 ____A (Microsoft Corporation) C:\Windows\System32\pngfilt.dll
2013-06-22 14:44 - 2013-06-22 14:44 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\mshtmler.dll
2013-06-22 14:44 - 2013-06-22 14:44 - 00041984 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2013-06-22 14:44 - 2013-06-22 14:44 - 00038400 ____A (Microsoft Corporation) C:\Windows\System32\imgutil.dll
2013-06-22 14:44 - 2013-06-22 14:44 - 00023040 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2013-06-22 14:44 - 2013-06-22 14:44 - 00012800 ____A (Microsoft Corporation) C:\Windows\System32\mshta.exe
2013-06-22 14:44 - 2013-06-22 14:44 - 00011776 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2013-06-21 23:09 - 2013-06-22 14:47 - 00010672 ____A C:\Windows\IE10_main.log
2013-06-15 08:05 - 2013-06-15 08:42 - 00000000 ____D C:\Users\Raphael\Desktop\Stick Arbeit
2013-06-12 23:49 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-12 23:49 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-12 23:49 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-12 23:49 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-12 23:49 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-12 23:49 - 2013-05-10 05:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-12 23:49 - 2013-05-06 07:06 - 03968872 ____A (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2013-06-12 23:49 - 2013-05-06 07:06 - 03913576 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-06-12 23:49 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-12 23:49 - 2013-04-26 01:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-06-12 23:49 - 2013-04-17 09:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-12 23:45 - 2013-05-08 07:38 - 01293672 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-07 21:00 - 2013-06-24 21:53 - 00000350 ____A C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv.job
2013-06-04 09:15 - 2013-06-04 09:15 - 00084248 ____A (DEVGURU Co., LTD.(www.devguru.co.kr)) C:\Windows\System32\Drivers\ssudbus.sys
2013-06-03 19:43 - 2013-06-24 21:53 - 00000350 ____A C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job
2013-05-28 21:30 - 2013-05-28 21:31 - 00000000 ____D C:\Users\Raphael\Desktop\Mama-Papa-Tag
==================== One Month Modified Files and Folders ========
2013-06-24 22:32 - 2012-04-10 19:35 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-24 22:31 - 2013-06-24 22:31 - 01369655 ____A (Farbar) C:\Users\Raphael\Downloads\FRST.exe
2013-06-24 22:31 - 2013-06-24 22:31 - 00000000 ____D C:\FRST
2013-06-24 22:00 - 2009-07-14 06:34 - 00014512 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-24 22:00 - 2009-07-14 06:34 - 00014512 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-24 21:58 - 2013-06-24 20:39 - 00000000 ____D C:\Users\Raphael\AppData\Roaming\igdhbblpcellaljokkpfhcjlagemhgjl
2013-06-24 21:53 - 2013-06-07 21:00 - 00000350 ____A C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv.job
2013-06-24 21:53 - 2013-06-03 19:43 - 00000350 ____A C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job
2013-06-24 21:53 - 2010-12-05 19:56 - 00105300 ____A C:\Windows\setupact.log
2013-06-24 21:53 - 2009-07-14 06:53 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-24 21:51 - 2010-02-07 08:25 - 02078256 ____A C:\Windows\WindowsUpdate.log
2013-06-24 20:54 - 2012-07-02 20:23 - 00001146 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3839526648-640461978-1128981970-1001UA.job
2013-06-24 20:54 - 2012-07-02 20:23 - 00001124 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3839526648-640461978-1128981970-1001Core.job
2013-06-24 20:51 - 2013-06-24 20:35 - 00000000 ____D C:\Users\Raphael\AppData\Roaming\DataMgr
2013-06-24 20:49 - 2011-04-11 06:07 - 00032570 ____A C:\Windows\PFRO.log
2013-06-24 20:39 - 2013-06-24 20:39 - 00000611 ____A C:\Windows\System32\InstallUtil.InstallLog
2013-06-24 20:39 - 2013-06-24 20:39 - 00000000 ____D C:\Users\Raphael\AppData\Roaming\Iminent
2013-06-24 20:39 - 2013-06-24 20:39 - 00000000 ____D C:\ProgramData\Iminent
2013-06-24 20:39 - 2013-06-24 20:39 - 00000000 ____D C:\Program Files\Iminent
2013-06-24 20:39 - 2013-06-24 20:39 - 00000000 ____D C:\Program Files\Common Files\Umbrella
2013-06-24 20:35 - 2013-06-24 20:35 - 00001934 ____A C:\Users\Raphael\Desktop\fbDownloader.lnk
2013-06-24 20:35 - 2013-06-24 20:35 - 00000000 ____D C:\Users\Raphael\AppData\Roaming\SSync
2013-06-24 20:35 - 2013-06-24 20:35 - 00000000 ____D C:\Users\Raphael\AppData\Roaming\SCheck
2013-06-24 20:35 - 2013-06-24 20:35 - 00000000 ____D C:\Users\Raphael\AppData\Roaming\Intermediate
2013-06-24 20:35 - 2013-06-24 20:35 - 00000000 ____D C:\Users\Raphael\AppData\Roaming\FBDownloader
2013-06-24 20:35 - 2013-06-24 20:35 - 00000000 ____D C:\Users\Raphael\AppData\Roaming\Common
2013-06-24 20:33 - 2013-06-24 20:33 - 00001067 ____A C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-06-24 20:33 - 2013-06-24 20:33 - 00000000 ____D C:\Users\Raphael\AppData\Roaming\Malwarebytes
2013-06-24 20:33 - 2013-06-24 20:33 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-06-24 20:33 - 2013-06-24 20:33 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-06-24 20:29 - 2013-06-24 20:29 - 00393072 ____A (Softonic ) C:\Users\Raphael\Downloads\SoftonicDownloader_fuer_malwarebytes-anti-malware.exe
2013-06-24 20:29 - 2009-07-14 04:37 - 00000000 ___RD C:\users\Public
2013-06-24 19:38 - 2013-01-30 20:43 - 00000000 ____A C:\END
2013-06-24 17:30 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\rescache
2013-06-24 17:21 - 2010-11-11 13:19 - 00000000 ____D C:\ProgramData\MFAData
2013-06-23 22:01 - 2012-09-28 08:49 - 00000000 ____D C:\ProgramData\AVG2013
2013-06-22 14:48 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\de-DE
2013-06-22 14:47 - 2013-06-21 23:09 - 00010672 ____A C:\Windows\IE10_main.log
2013-06-22 14:44 - 2013-06-22 14:44 - 01441280 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-06-22 14:44 - 2013-06-22 14:44 - 01400416 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat
2013-06-22 14:44 - 2013-06-22 14:44 - 00745472 ____A (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2013-06-22 14:44 - 2013-06-22 14:44 - 00719360 ____A (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll
2013-06-22 14:44 - 2013-06-22 14:44 - 00629248 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2013-06-22 14:44 - 2013-06-22 14:44 - 00523264 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-06-22 14:44 - 2013-06-22 14:44 - 00361984 ____A (Microsoft Corporation) C:\Windows\System32\html.iec
2013-06-22 14:44 - 2013-06-22 14:44 - 00357888 ____A (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2013-06-22 14:44 - 2013-06-22 14:44 - 00242200 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2013-06-22 14:44 - 2013-06-22 14:44 - 00232960 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-06-22 14:44 - 2013-06-22 14:44 - 00226816 ____A (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2013-06-22 14:44 - 2013-06-22 14:44 - 00204800 ____A (Microsoft Corporation) C:\Windows\System32\webcheck.dll
2013-06-22 14:44 - 2013-06-22 14:44 - 00185344 ____A (Microsoft Corporation) C:\Windows\System32\elshyph.dll
2013-06-22 14:44 - 2013-06-22 14:44 - 00163840 ____A (Microsoft Corporation) C:\Windows\System32\msrating.dll
2013-06-22 14:44 - 2013-06-22 14:44 - 00158720 ____A (Microsoft Corporation) C:\Windows\System32\msls31.dll
2013-06-22 14:44 - 2013-06-22 14:44 - 00150528 ____A (Microsoft Corporation) C:\Windows\System32\iexpress.exe
2013-06-22 14:44 - 2013-06-22 14:44 - 00138752 ____A (Microsoft Corporation) C:\Windows\System32\wextract.exe
2013-06-22 14:44 - 2013-06-22 14:44 - 00137216 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-06-22 14:44 - 2013-06-22 14:44 - 00125440 ____A (Microsoft Corporation) C:\Windows\System32\occache.dll
2013-06-22 14:44 - 2013-06-22 14:44 - 00117248 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2013-06-22 14:44 - 2013-06-22 14:44 - 00110592 ____A (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll
2013-06-22 14:44 - 2013-06-22 14:44 - 00082432 ____A (Microsoft Corporation) C:\Windows\System32\inseng.dll
2013-06-22 14:44 - 2013-06-22 14:44 - 00079872 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-06-22 14:44 - 2013-06-22 14:44 - 00073728 ____A (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe
2013-06-22 14:44 - 2013-06-22 14:44 - 00069120 ____A (Microsoft Corporation) C:\Windows\System32\icardie.dll
2013-06-22 14:44 - 2013-06-22 14:44 - 00061952 ____A (Microsoft Corporation) C:\Windows\System32\tdc.ocx
2013-06-22 14:44 - 2013-06-22 14:44 - 00057344 ____A (Microsoft Corporation) C:\Windows\System32\pngfilt.dll
2013-06-22 14:44 - 2013-06-22 14:44 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\mshtmler.dll
2013-06-22 14:44 - 2013-06-22 14:44 - 00041984 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2013-06-22 14:44 - 2013-06-22 14:44 - 00038400 ____A (Microsoft Corporation) C:\Windows\System32\imgutil.dll
2013-06-22 14:44 - 2013-06-22 14:44 - 00023040 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2013-06-22 14:44 - 2013-06-22 14:44 - 00012800 ____A (Microsoft Corporation) C:\Windows\System32\mshta.exe
2013-06-22 14:44 - 2013-06-22 14:44 - 00011776 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2013-06-15 08:42 - 2013-06-15 08:05 - 00000000 ____D C:\Users\Raphael\Desktop\Stick Arbeit
2013-06-15 08:07 - 2009-07-26 22:06 - 01498506 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-13 01:12 - 2010-06-10 20:33 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-06-13 01:04 - 2010-06-12 14:04 - 73381792 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-11 21:34 - 2012-04-10 19:35 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-06-11 21:34 - 2011-07-11 06:06 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-06-10 21:43 - 2012-09-28 08:50 - 00000951 ____A C:\Users\Public\Desktop\AVG 2013.lnk
2013-06-09 00:57 - 2013-04-03 17:57 - 00010825 ____A C:\Users\Raphael\Desktop\Gäste Feier.xlsx
2013-06-08 13:42 - 2013-06-23 22:57 - 01141248 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-08 13:40 - 2013-06-23 22:57 - 14327808 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-08 13:40 - 2013-06-23 22:57 - 13760512 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-08 13:40 - 2013-06-23 22:57 - 02046976 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-08 13:40 - 2013-06-23 22:57 - 00391168 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-08 13:13 - 2013-06-23 22:57 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-07 21:36 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\DriverStore
2013-06-07 21:00 - 2013-01-27 22:39 - 00000000 ____D C:\Program Files\AVG Secure Search
2013-06-06 20:01 - 2013-04-29 20:09 - 00000000 ____D C:\Users\Raphael\Desktop\april portfolio
2013-06-04 09:15 - 2013-06-04 09:15 - 00084248 ____A (DEVGURU Co., LTD.(www.devguru.co.kr)) C:\Windows\System32\Drivers\ssudbus.sys
2013-06-01 10:37 - 2012-12-27 13:58 - 00001030 ____A C:\Users\Raphael\Desktop\tiptoi.lnk
2013-06-01 10:37 - 2012-12-27 13:58 - 00000000 ____D C:\ProgramData\RavensburgerTipToi
2013-05-30 20:25 - 2011-05-27 20:42 - 00000000 ____D C:\ProgramData\tmp
2013-05-28 21:31 - 2013-05-28 21:30 - 00000000 ____D C:\Users\Raphael\Desktop\Mama-Papa-Tag
2013-05-26 23:34 - 2010-07-23 17:08 - 00000000 ____D C:\Users\Raphael\AppData\Roaming\UseNeXT
2013-05-26 23:24 - 2010-07-23 17:08 - 00000000 ____D C:\Users\Raphael\Documents\UseNeXT
2013-05-26 20:39 - 2011-05-30 22:05 - 00000000 ____D C:\Users\Raphael\Documents\Käferland
2013-05-26 11:22 - 2012-04-24 21:41 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
Files to move or delete:
====================
C:\ProgramData\FullRemove.exe
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-06-24 17:23
==================== End Of Log ============================
--- --- --- Addition: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 22-06-2013 Ran by Raphael at 2013-06-24 22:33:23 Running from C:\Users\Raphael\Downloads Boot Mode: Normal ========================================================== ==================== Installed Programs ======================= (Version: 1.00.0000) Update for Microsoft Office 2007 (KB2508958) 7-Zip 4.65 Adobe Flash Player 11 ActiveX (Version: 11.7.700.224) Adobe Flash Player 11 Plugin (Version: 11.7.700.224) Adobe Reader X (10.1.7) - Deutsch (Version: 10.1.7) Alice Greenfingers AnyPC Client (Version: 1.0.0.25) Apple Application Support (Version: 2.3) Apple Software Update (Version: 2.1.3.127) Atheros Client Installation Program (Version: 1.0.2.1119) AVG 2013 (Version: 13.0.3199) AVG 2013 (Version: 13.0.3345) AVG 2013 (Version: 2013.0.3345) AVG Security Toolbar (Version: 15.2.0.5) BatteryLifeExtender (Version: 1.0.1) Bob der Baumeister - Wir schaffen das Zoo (Version: 1.00.0000) Camera Window (Version: 4.5.2) Canon Camera WIA Driver (Version: 5.2) Canon Camera Window for ZoomBrowser EX (Version: 4.5.2) Canon EOS Kiss REBEL 300D WIA-Treiber (Version: 5.2) Canon Internet Library for ZoomBrowser EX (Version: 1.3.1) Canon PhotoRecord (Version: 02.00.00029) Canon RAW Image Task for ZoomBrowser EX (Version: 0.9.0) Canon RemoteCapture Task for ZoomBrowser EX (Version: 0.9.0) Canon Utilities File Viewer Utility 1.3 (Version: 1.3.2) Canon Utilities ZoomBrowser EX (Version: 04.05.01148) CCleaner (Version: 3.01) ChargeableUSB (Version: 1.0.0.0) CIG (Version: 1.3.1) Compatibility Pack für 2007 Office System (Version: 12.0.6612.1000) CyberLink DVD Suite (Version: 6.0.2806) CyberLink LabelPrint (Version: 2.5.1916) CyberLink Power2Go (Version: 6.0.3108a) CyberLink PowerDirector (Version: 7.0.3213) CyberLink PowerDVD 8 (Version: 8.0.2815b) CyberLink PowerProducer (Version: 5.0.1.1812) CyberLink YouCam (Version: 2.0.3625) Dairy Dash dm-Fotowelt (Version: 5.0.1) Easy Display Manager (Version: 3.0) Easy Network Manager (Version: 4.2.8) Easy SpeedUp Manager (Version: 3.0.0.5) EasyBatteryManager (Version: 4.0.0.3) Facebook Messenger 2.1.4814.0 (Version: 2.1.4814.0) Farm Frenzy 2 FBDownloader (HKCU Version: 1.0) FIFA 11 (Version: 1.0.0.0) Fifa 12 (c) Electronic Arts version 1 (Version: 1) File Viewer Utility 1.3.2 (Version: 1.3.2) Free Audio CD Burner version 1.4 Free Video to MP3 Converter version 5.0.4.1228 Free YouTube Download 2.7 Free YouTube to MP3 Converter version 3.10.15.1228 Game Pack (Version: 5.3.0.10) GIMP 2.6.11 (Version: 2.6.11) Go-Go Gourmet High-Definition Video Playback 10 (Version: 7.0.11400.29.0) ICQ7.4 (Version: 7.4) Iminent (Version: 6.25.21.0) Intel(R) Rapid Storage Technology (Version: 9.5.4.1001) Intel(R) Turbo Boost Technology Driver (Version: 01.00.01.1003) Java 7 Update 9 (Version: 7.0.90) Java Auto Updater (Version: 2.1.9.0) Junk Mail filter update (Version: 14.0.8089.726) Malwarebytes Anti-Malware Version 1.75.0.1300 (Version: 1.75.0.1300) Marvell Miniport Driver (Version: 11.22.3.3) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319) Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319) Microsoft Application Error Reporting (Version: 12.0.6012.5000) Microsoft Choice Guard (Version: 2.0.48.0) Microsoft Office 2007 Service Pack 3 (SP3) Microsoft Office Access MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Office Enterprise 2007 (Version: 12.0.6612.1000) Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Office File Validation Add-In (Version: 14.0.5130.5003) Microsoft Office Groove MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Office Home and Student 2007 (Version: 12.0.6612.1000) Microsoft Office InfoPath MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1) Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Office Outlook MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Office PowerPoint Viewer 2007 (German) (Version: 12.0.6612.1000) Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000) Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000) Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000) Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000) Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014) Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) Microsoft Office Publisher MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Office Suite Activation Assistant (Version: 2.9) Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Primary Interoperability Assemblies 2005 (Version: 8.0.50727.42) Microsoft Silverlight (Version: 5.1.20125.0) Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000) Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053) Microsoft Visual C++ 2005 Redistributable (Version: 8.0.59193) Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001) Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (Version: 9.0.30729.5570) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (Version: 10.0.40219) Microsoft Works (Version: 9.7.0621) Mozilla Firefox 21.0 (x86 de) (Version: 21.0) Mozilla Maintenance Service (Version: 17.0.6) Mozilla Thunderbird 17.0.6 (x86 de) (Version: 17.0.6) MSVC80_x86_v2 (Version: 1.0.3.0) MSVC90_x86 (Version: 1.0.1.2) MSVCRT (Version: 14.0.1468.721) MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0) MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0) Nero 10 ClipartPack (Version: 10.0.10300.0.0) Nero 10 Menu TemplatePack 1 (Version: 10.0.10300.0.0) Nero 10 Menu TemplatePack 2 (Version: 10.0.10300.0.0) Nero 10 Menu TemplatePack 3 (Version: 10.0.10300.0.0) Nero 10 Menu TemplatePack Basic (Version: 10.0.10600.6.0) Nero 10 Movie ThemePack 1 (Version: 10.0.10300.1.0) Nero 10 Movie ThemePack 2 (Version: 10.0.10300.1.0) Nero 10 Movie ThemePack Basic (Version: 10.0.10600.6.0) Nero 10 Sample ImagePack (Version: 10.0.10300.0.0) Nero 10 Sample Videos (Version: 10.0.10300.2.0) Nero BackItUp 10 (Version: 5.4.11600.19.100) Nero BackItUp 10 Help (CHM) (Version: 1.0.10700) Nero Burning ROM 10 (Version: 10.0.11100.10.100) Nero BurningROM 10 Help (CHM) (Version: 1.0.10700) Nero BurnRights 10 (Version: 4.0.11000.12.100) Nero BurnRights 10 Help (CHM) (Version: 1.0.10600) Nero Control Center 10 (Version: 10.0.12000.1.4) Nero Core Components 10 (Version: 2.0.13700.0.1) Nero CoverDesigner 10 (Version: 5.0.10900.11.100) Nero CoverDesigner 10 Help (CHM) (Version: 1.0.10600) Nero DiscCopy Gadget 10 (Version: 3.0.10700.9.100) Nero DiscCopyGadget 10 Help (CHM) (Version: 1.0.10600) Nero DiscSpeed 10 (Version: 6.0.10800.7.100) Nero DiscSpeed 10 Help (CHM) (Version: 1.0.10600) Nero Dolby Files 10 (Version: 2.0.11000.0.10) Nero Express 10 (Version: 10.0.11000.10.100) Nero Express 10 Help (CHM) (Version: 1.0.10700) Nero InfoTool 10 (Version: 7.0.10800.8.100) Nero InfoTool 10 Help (CHM) (Version: 1.0.10600) Nero MediaHub 10 (Version: 1.0.13400.11.100) Nero MediaHub 10 Help (CHM) (Version: 1.0.10700) Nero Multimedia Suite 10 (Version: 10.0.11200) Nero Recode 10 (Version: 4.6.10900.4.100) Nero Recode 10 Help (CHM) (Version: 1.0.10600) Nero RescueAgent 10 (Version: 3.0.10900.9.100) Nero RescueAgent 10 Help (CHM) (Version: 1.0.10700) Nero SoundTrax 10 (Version: 4.6.10600.2.100) Nero SoundTrax 10 Help (CHM) (Version: 1.0.10600) Nero StartSmart 10 (Version: 10.0.11200.12.100) Nero StartSmart 10 Help (CHM) (Version: 1.0.10700) Nero Update (Version: 1.0.0017) Nero Vision 10 (Version: 7.0.11100.8.100) Nero Vision 10 Help (CHM) (Version: 1.0.10600) Nero WaveEditor 10 (Version: 5.6.10600.2.100) Nero WaveEditor 10 Help (CHM) (Version: 1.0.10600) NHL® 09 (Version: 2.0.1.0) Nokia Connectivity Cable Driver (Version: 7.1.41.0) Nokia Ovi Suite (Version: 3.1.0.91) Nokia Ovi Suite Software Updater (Version: 02.07.004.45780) NVIDIA Drivers (Version: 1.10) Ovi Desktop Sync Engine (Version: 1.5.257.0) OviMPlatform (Version: 2.7.66.0) PC Connectivity Solution (Version: 11.4.16.0) PDF24 Creator 5.4.0 Pro Evolution Soccer 2012 DEMO (Version: 1.00.0000) QuickTime (Version: 7.73.80.64) Ravensburger tiptoi RAW Image Task (Version: 0.9.0) Realtek High Definition Audio Driver (Version: 6.0.1.6003) REALTEK Wireless LAN Software (Version: 1.01.0088) RemoteCapture Task (Version: 0.9.0) Rossmann Fotoservice Rossmann Fotowelt Software 4.12.1 (Version: 4.12.1) Samsung Recovery Solution 4 (Version: 4.0.0.6) Samsung R-Series (Version: 1.0) Samsung Support Center (Version: 1.1.0) Samsung Update Plus (Version: 2.0) Skype™ 4.2 (Version: 4.2.169) Sweet Home 3D version 3.1 Synaptics Pointing Device Driver (Version: 14.0.10.0) Uninstall 1.0.0.1 Update for 2007 Microsoft Office System (KB967642) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1) Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2596802) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2817327) 32-Bit Edition Update für Microsoft Office Excel 2007 Help (KB963678) Update für Microsoft Office Outlook 2007 Help (KB963677) Update für Microsoft Office Powerpoint 2007 Help (KB963669) Update für Microsoft Office Word 2007 Help (KB963665) UseNeXT by Tangysoft User Guide (Version: 1.0) VLC media player 1.1.10 (Version: 1.1.10) Wajam (Version: 1.49) Windows Live Anmelde-Assistent (Version: 5.000.818.5) Windows Live Call (Version: 14.0.8064.0206) Windows Live Communications Platform (Version: 14.0.8064.206) Windows Live Essentials (Version: 14.0.8089.0726) Windows Live Essentials (Version: 14.0.8089.726) Windows Live Family Safety (Version: 14.0.8093.805) Windows Live Fotogalerie (Version: 14.0.8081.709) Windows Live Mail (Version: 14.0.8089.0726) Windows Live Movie Maker (Version: 14.0.8091.0730) Windows Live Sync (Version: 14.0.8089.726) Windows Live Writer (Version: 14.0.8089.0726) Windows Live-Uploadtool (Version: 14.0.8014.1029) Windows-Treiberpaket - Nokia pccsmcfd (08/22/2008 7.0.0.0) (Version: 08/22/2008 7.0.0.0) ==================== Restore Points ========================= 12-06-2013 23:03:11 Windows Update 21-06-2013 21:08:40 Windows Update 22-06-2013 12:43:19 Windows Modules Installer 23-06-2013 20:56:27 Windows Update ==================== Scheduled Tasks (whitelisted) ============= Task: {12C5F5C1-C4C7-44A1-B522-9AD231E7F4AB} - System32\Tasks\SUPBackground => C:\Program Files\Samsung\Samsung Update Plus\SUPBackground.exe [2010-04-20] () Task: {1A2770FB-B6FF-4723-A009-8BE4A3412CAE} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.) Task: {1B736917-C0C4-4E43-8F9C-8D749FD2B098} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3839526648-640461978-1128981970-1001UA => C:\Users\Raphael\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-12] (Facebook Inc.) Task: {374C6466-5DBB-497F-A760-8A2A459D8447} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-04-04] (Adobe Systems Incorporated) Task: {4D42266D-7054-4F29-A767-6775EB40AC87} - System32\Tasks\FinishInstall igdhbblpcellaljokkpfhcjlagemhgjl => C:\Users\Raphael\AppData\Roaming\igdhbblpcellaljokkpfhcjlagemhgjl\MinibarChrome.exe [2013-06-24] (Sien SA) Task: {650F9F79-3DF7-42A6-980F-DDFD2DE3D8C9} - System32\Tasks\APSchedulerC => C:\Program Files\AnyPC Client\APLanMgrC.exe [2009-11-20] (DoctorSoft) Task: {6D265A1D-3EC1-4DFF-87DE-4C2158267397} - System32\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv => C:\windows\TEMP\{DD96101A-2279-41EB-8307-66674E170510}.exe No File Task: {8545005C-250E-4836-893B-7A7115423A38} - System32\Tasks\Java Update Scheduler => C:\Program Files\Common Files\Java\Java Update\jusched.exe [2012-07-03] (Sun Microsystems, Inc.) Task: {8A7CA5BA-E199-4FCD-9B10-A324371FB42C} - System32\Tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv => C:\windows\TEMP\{34EA997F-4FC0-4A41-A193-9EADD4434688}.exe No File Task: {8DBE0805-ABA8-4AAD-9F23-806A7F26B353} - System32\Tasks\SamsungSupportCenter => C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe [2009-12-14] (SAMSUNG Electronics) Task: {99ADE344-ECFC-44CF-B845-44A00142D80B} - System32\Tasks\EasyBatteryManager => C:\Program Files\Samsung\EasyBatteryManager\EasyBatteryMgr4.exe [2009-10-16] (SAMSUNG Electronics co., LTD.) Task: {A7BA4B28-B6F0-4687-AFE9-A5C7BA357A2F} - System32\Tasks\EasySpeedUpManager => C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe [2009-10-13] (Samsung Electronics Co., Ltd.) Task: {AC59E984-D49A-4F02-B6E1-53F36E84486B} - System32\Tasks\Adobe Flash Player Updater => C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-11] (Adobe Systems Incorporated) Task: {AE6B8E6E-B9A9-4028-A16A-433909302101} - System32\Tasks\advSRS4 => C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe [2010-01-19] (SEC) Task: {BAD3EC66-B88E-47E7-9C33-62A2403A2E74} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3839526648-640461978-1128981970-1001Core => C:\Users\Raphael\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-12] (Facebook Inc.) Task: {C0A9BFE9-1585-43E9-AF85-4D251A6C7248} - System32\Tasks\BatteryLifeExtender => C:\Program Files\Samsung\BatteryLifeExtender\BatteryLifeExtender.exe [2009-11-19] (Samsung Electronics. Co. Ltd.) Task: {C254E142-2F4F-453A-AD2B-D243E9F83C19} - System32\Tasks\{DFBDD1DA-017D-4D0C-9E8B-ED1C37D4F0AE} => C:\Program Files\Skype\Phone\Skype.exe [2010-05-13] (Skype Technologies S.A.) Task: {C9BCC400-7045-4875-916F-4C6B65076B7A} - System32\Tasks\ROC_REG_JAN_DELETE => C:\ProgramData\AVG January 2013 Campaign\ROC.exe [2013-01-17] () Task: {ECA6FEB4-2878-4D58-A6BF-560AD475D0B1} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\windows\System32\lpksetup.exe [2010-11-20] (Microsoft Corporation) Task: {F886360C-8DE2-49D2-9A1B-DD5BABFD3811} - System32\Tasks\EasyDisplayMgr => C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe [2009-11-04] (Samsung Electronics Co., Ltd.) ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (06/24/2013 05:24:50 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1". Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". Error: (06/24/2013 05:23:49 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1". Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". Error: (06/15/2013 02:02:43 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1". Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". Error: (06/15/2013 02:01:42 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1". Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". Error: (06/13/2013 08:56:11 AM) (Source: Google Update) (User: Raphael-PC) Description: Network Request Error. Error: 0x80072ee7. Http status code: 0. Url=https://www.facebook.com/omaha/update.php Trying config: source=FireFox, direct connection. trying CUP:WinHTTP. Send request returned 0x80072ee7. Http status code 0. trying WinHTTP. Send request returned 0x80072ee7. Http status code 0. trying CUP:iexplore. Send request returned 0x80004005. Http status code 0. Trying config: source=auto, wpad=1, script=. trying CUP:WinHTTP. Send request returned 0x80072ee7. Http status code 0. trying WinHTTP. Send request returned 0x80072ee7. Http status code 0. trying CUP:iexplore. Send request returned 0x80004005. Http status code 0. Trying config: source=FireFox, direct connection. trying CUP:WinHTTP. Send request returned 0x80072ee7. Http status code 0. trying WinHTTP. Send request returned 0x80072ee7. Http status code 0. trying CUP:iexplore. Send request returned 0x80004005. Http status code 0. Trying config: source=auto, wpad=1, script=. trying CUP:WinHTTP. Send request returned Error: (06/12/2013 10:11:28 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1". Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". Error: (06/12/2013 10:10:32 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1". Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". Error: (06/11/2013 09:40:26 PM) (Source: Application Hang) (User: ) Description: Programm firefox.exe, Version 21.0.0.4879 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 12e4 Startzeit: 01ce66caa39446af Endzeit: 16 Anwendungspfad: C:\Program Files\Mozilla Firefox\firefox.exe Berichts-ID: c0fd1f3f-d2ce-11e2-8034-0024546416a4 Error: (06/11/2013 09:28:22 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1". Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". Error: (06/11/2013 09:27:14 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1". Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". System errors: ============= Error: (06/24/2013 09:51:58 PM) (Source: Service Control Manager) (User: ) Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen: %%5 Error: (06/24/2013 08:48:47 PM) (Source: Service Control Manager) (User: ) Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen: %%5 Error: (06/24/2013 08:39:04 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "SProtection" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren. Error: (06/24/2013 08:05:17 PM) (Source: Service Control Manager) (User: ) Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen: %%5 Error: (06/24/2013 04:15:24 PM) (Source: Service Control Manager) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst Rezip erreicht. Error: (06/24/2013 01:37:17 PM) (Source: Service Control Manager) (User: ) Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen: %%5 Error: (06/23/2013 10:57:53 PM) (Source: Service Control Manager) (User: ) Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen: %%5 Error: (06/22/2013 02:55:43 PM) (Source: Service Control Manager) (User: ) Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen: %%5 Error: (06/22/2013 02:47:12 PM) (Source: Service Control Manager) (User: ) Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen: %%5 Error: (06/20/2013 10:20:12 PM) (Source: Service Control Manager) (User: ) Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen: %%5 Microsoft Office Sessions: ========================= ==================== Memory info =========================== Percentage of memory in use: 49% Total physical RAM: 3060.55 MB Available physical RAM: 1541.23 MB Total Pagefile: 6119.39 MB Available Pagefile: 4244.33 MB Total Virtual: 2047.88 MB Available Virtual: 1897.64 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:148.72 GB) (Free:65.93 GB) NTFS Drive d: () (Fixed) (Total:301.95 GB) (Free:178.88 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 466 GB) (Disk ID: 9637C771) Partition 1: (Not Active) - (Size=15 GB) - (Type=27) Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=149 GB) - (Type=07 NTFS) Partition 4: (Not Active) - (Size=302 GB) - (Type=07 NTFS) ==================== End Of Log ============================ |
|
25.06.2013, 07:57
| #4 |
| /// the machine /// TB-Ausbilder | Infektion auf dem Notebook Inline-Hook Hi, Downloade dir bitte  Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
25.06.2013, 18:12
| #5 |
| | Infektion auf dem Notebook Inline-Hook Hallo Schrauber, besten Dank, scheint schon geholfen zu haben. Hatte heute beim Start keinen Fremdzugriff mehr; mbar hat auch nix gefunden.  Trotzdem hier noch die Log-Datei: Code:
ATTFilter ---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.06.0.1004
(c) Malwarebytes Corporation 2011-2012
OS version: 6.1.7601 Windows 7 Service Pack 1 x86
Account is Administrative
Internet Explorer version: 10.0.9200.16618
File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED
CPU speed: 2.128000 GHz
Memory total: 3209220096, free: 1687928832
Downloaded database version: v2013.06.25.07
Initializing...
------------ Kernel report ------------
06/25/2013 18:51:36
------------ Loaded modules -----------
\SystemRoot\system32\ntkrnlpa.exe
\SystemRoot\system32\halmacpi.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\BOOTVID.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\System32\Drivers\spgj.sys
\SystemRoot\System32\Drivers\WMILIB.SYS
\SystemRoot\System32\Drivers\SCSIPORT.SYS
\SystemRoot\system32\drivers\ACPI.sys
\SystemRoot\system32\drivers\msisadrv.sys
\SystemRoot\system32\drivers\vdrvroot.sys
\SystemRoot\system32\drivers\pci.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\DRIVERS\compbatt.sys
\SystemRoot\system32\DRIVERS\BATTC.SYS
\SystemRoot\system32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\system32\DRIVERS\iaStor.sys
\SystemRoot\system32\drivers\atapi.sys
\SystemRoot\system32\drivers\ataport.SYS
\SystemRoot\system32\drivers\msahci.sys
\SystemRoot\system32\drivers\PCIIDEX.SYS
\SystemRoot\system32\drivers\amdxata.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\System32\Drivers\msrpc.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\drivers\volsnap.sys
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\hwpolicy.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\system32\DRIVERS\disk.sys
\SystemRoot\system32\DRIVERS\CLASSPNP.SYS
\SystemRoot\system32\DRIVERS\avgrkx86.sys
\SystemRoot\system32\DRIVERS\avglogx.sys
\SystemRoot\system32\DRIVERS\avgmfx86.sys
\SystemRoot\system32\DRIVERS\avgidshx.sys
\SystemRoot\system32\drivers\cdrom.sys
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\??\C:\windows\system32\drivers\avgtpx86.sys
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\system32\drivers\rdprefmp.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\DRIVERS\avgtdix.sys
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\system32\DRIVERS\wfplwf.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\vwififlt.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\drivers\termdd.sys
\??\C:\windows\system32\Drivers\SABI.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\system32\drivers\mssmbios.sys
\SystemRoot\System32\drivers\discache.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\blbdrive.sys
\SystemRoot\system32\DRIVERS\avgldx86.sys
\SystemRoot\system32\DRIVERS\avgidsshimx.sys
\SystemRoot\system32\DRIVERS\avgidsdriverx.sys
\SystemRoot\system32\DRIVERS\tunnel.sys
\SystemRoot\system32\DRIVERS\nvlddmkm.sys
\SystemRoot\system32\DRIVERS\nvBridge.kmd
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\dxgmms1.sys
\SystemRoot\system32\drivers\HDAudBus.sys
\SystemRoot\system32\drivers\usbehci.sys
\SystemRoot\system32\drivers\USBPORT.SYS
\SystemRoot\system32\DRIVERS\athr.sys
\SystemRoot\system32\DRIVERS\vwifibus.sys
\SystemRoot\system32\DRIVERS\yk62x86.sys
\SystemRoot\system32\DRIVERS\CmBatt.sys
\SystemRoot\system32\drivers\i8042prt.sys
\SystemRoot\system32\drivers\kbdclass.sys
\SystemRoot\system32\DRIVERS\SynTP.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\System32\Drivers\aofh8fqy.SYS
\SystemRoot\system32\DRIVERS\intelppm.sys
\SystemRoot\system32\drivers\CompositeBus.sys
\SystemRoot\system32\DRIVERS\CryptOSD.sys
\SystemRoot\system32\DRIVERS\AgileVpn.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\drivers\swenum.sys
\SystemRoot\system32\drivers\ks.sys
\SystemRoot\system32\drivers\umbus.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\drivers\nvhda32v.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\drivers\RTKVHDA.sys
\SystemRoot\system32\DRIVERS\usbccgp.sys
\SystemRoot\System32\Drivers\usbvideo.sys
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_iaStor.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\system32\DRIVERS\monitor.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\system32\drivers\luafv.sys
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\nwifi.sys
\SystemRoot\system32\DRIVERS\ndisuio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\System32\Drivers\secdrv.SYS
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\??\C:\windows\system32\drivers\mbamchameleon.sys
\??\C:\windows\system32\drivers\mbamswissarmy.sys
\Windows\System32\ntdll.dll
\Windows\System32\smss.exe
\Windows\System32\apisetschema.dll
\Program Files\DAEMON Tools Lite\Engine.dll
----------- End -----------
Done!
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xffffffff88cbf030
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IAAStorageDevice-1\
Lower Device Object: 0xffffffff87102028
Lower Device Driver Name: \Driver\iaStor\
IRP handler 0 of \Driver\iaStor is hooked
IRP handler 2 of \Driver\iaStor is hooked
IRP handler 14 of \Driver\iaStor is hooked
IRP handler 15 of \Driver\iaStor is hooked
IRP handler 16 of \Driver\iaStor is hooked
IRP handler 22 of \Driver\iaStor is hooked
IRP handler 23 of \Driver\iaStor is hooked
IRP handler 27 of \Driver\iaStor is hooked
Unhooking enabled.
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xffffffff88cbf030
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IAAStorageDevice-1\
Lower Device Object: 0xffffffff87102028
Lower Device Driver Name: \Driver\iaStor\
Driver name found: iaStor
Initialization returned 0x0
Load Function returned 0x0
<<<2>>>
Device number: 0, partition: 3
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xffffffff88cbf030, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff88cbe1d0, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffffff88cbf030, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xffffffff87102028, DeviceName: \Device\Ide\IAAStorageDevice-1\, DriverName: \Driver\iaStor\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
Upper DeviceData: 0xffffffffbaec6718, 0xffffffff88cbf030, 0xffffffff86784048
Lower DeviceData: 0xffffffffc5e20f08, 0xffffffff87102028, 0xffffffff8666ec18
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
Device number: 0, partition: 3
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning drivers directory: C:\windows\system32\drivers...
<<<2>>>
Device number: 0, partition: 3
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
File user open failed: C:\windows\system32\drivers\sptd.sys (0x00000020)
Done!
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 9637C771
Partition information:
Partition 0 type is Other (0x27)
Partition is NOT ACTIVE.
Partition starts at LBA: 2048 Numsec = 31457280
Partition 1 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 31459328 Numsec = 204800
Partition file system is NTFS
Partition is bootable
Partition 2 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 31664128 Numsec = 311881728
Partition 3 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 343545856 Numsec = 633225216
Disk Size: 500107862016 bytes
Sector size: 512 bytes
Scanning physical sectors of unpartitioned space on drive 0 (1-2047-976753168-976773168)...
Done!
Scan finished
Wenn sich nochmal was findet, rufe ich wieder ;-) Viele Grüße ... voller Freude die falsche kopiert... Eben wars die Sytem-Log, nun die korrekte: Code:
ATTFilter Malwarebytes Anti-Rootkit BETA 1.06.0.1004
www.malwarebytes.org
Database version: v2013.06.25.07
Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 10.0.9200.16618
Raphael :: RAPHAEL-PC [administrator]
25.06.2013 18:51:40
mbar-log-2013-06-25 (18-51-40).txt
Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUM | P2P
Scan options disabled: PUP
Kernel memory modifications detected. Deep Anti-Rootkit Scan engaged.
Objects scanned: 235632
Time elapsed: 13 minute(s), 46 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
Physical Sectors Detected: 0
(No malicious items detected)
(end)
|
|
25.06.2013, 19:21
| #6 |
| /// the machine /// TB-Ausbilder | Infektion auf dem Notebook Inline-Hook Ehm, wir haben doch bis jetzt nur gescannt  Beobachte mal und melde dich wieder.
__________________ --> Infektion auf dem Notebook Inline-Hook |
|
| Themen zu Infektion auf dem Notebook Inline-Hook |
| arbeit, automatisch, avg, bericht, c:\windows, durchgeführt, ergebnis, gemein, guten, heute, infektion, infiziert, inline-hook, interne, internet, neustart, notebook, scan, seite, seiten, status, system, system32, virenscan, windows, zusammen |
Linear-Darstellung
