|
Log-Analyse und Auswertung: System Care Antivirus wirklich komplett entfernt?Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
05.07.2013, 07:49 | #1 |
| System Care Antivirus wirklich komplett entfernt? Hallo, Donnerstag nachmittag poppte bei mir das System Care Antivirus Fenster hoch und fing an zu 'scannen'. Ich war etwas irritiert, aber fuhr den Sony Laptop sofort runter und startete in abgesicherten Modus. Dann googelte ich übers iPad, und fand ein paar Foreneinträge, wo bechrieben war, was man tun könnte. Ich probierte einige der Tools aus, alles im abgesicherten Modus. Eins der Tools machte dann einen Neustart, darauf hin scannte ich den Computer noch mit Eset Online Scanner. Es schien dann alles ok. Nur Microsoft Security Essentials ließ sich nicht starten. Also dachte ich, ich gehe auf einen Wiederherstellungspunkt zurück, ich wählte den am weitesten zurückliegenden von Ende Mai. Beim nächsten Neustart lief MSE, ich aktualisierte die Virendefinition. Dabei merkte ich, daß im Reiter Verlauf stand: rogue win32/winwebsec, gefährlich, Aktion: zugelassen Das heißt, der Virus war immer noch da, und hatte sich automatisch im Virenscanner als 'zugelassen' aktiviert. Dies konnte ich auch nicht ändern. Während ich einen Scan mit Malwarebytes Anti-Malware machte, erkannte MSE dieses rogue win32... noch einmal, diesmal stellte es es aber in Quarantäne. Ebenso wie einen anderen Trojaner. Malware fand nichts. Danach ließ ich eine Rescue CD von Avira durchlaufen. (neu downgeloaded und gestern gebrannt) Diese fand auch nichts. Danach eine ebenso gestern downgeloadete Rescue CD von Kapersky mit Windows Unlocker. Windows Unlocker fand ein googleupdate.exe, das es entfernte. Der Scan danach mit der Rescue Disk fand nichts. Aber ist das jetzt sicher? Ist der Virus wirklich weg? Oder sollte ich doch lieber ein komplettes Restore mit der Recovery von Vaio machen? Bitte um Rat. gruß Andi |
05.07.2013, 08:57 | #2 |
/// the machine /// TB-Ausbilder | System Care Antivirus wirklich komplett entfernt? Hi,
__________________Systemscan mit FRST Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit (Wenn du nicht sicher bist: Start > Computer (Rechtsklick) > Eigenschaften)
__________________ |
05.07.2013, 09:18 | #3 |
| System Care Antivirus wirklich komplett entfernt? Hallo Schrauber,
__________________vielen Dank für deine schnelle Antwort und vielen Dank im Vorraus für die Hilfe. frst.txt FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-07-2013 Ran by trishohara (administrator) on 05-07-2013 10:14:59 Running from C:\Users\trishohara\Downloads Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 9 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe (Microsoft Corporation) c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe (Microsoft Corporation) C:\Windows\system32\WLANExt.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe (Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\adminservice.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSMonitorServicePDVD13.exe (CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSServerPDVD13.exe () C:\Program Files (x86)\Expat Shield\bin\openvpnas.exe () C:\Program Files (x86)\Expat Shield\bin\hsswd.exe (MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe (Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\VESMgr.exe (VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe (Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe (VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (Microsoft Corporation) c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe (Microsoft Corporation) C:\Windows\SysWOW64\DllHost.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe (Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Microsoft Corporation) C:\Windows\SysWOW64\DllHost.exe (Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3520 series\Bin\ScanToPCActivationApp.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Sony Corporation) C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe (Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe (Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNService.exe (Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMgr.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe () C:\Program Files (x86)\WISO\Steuersoftware 2013\mshaktuell.exe () C:\Program Files (x86)\BBC iPlayer Desktop\BBC iPlayer Desktop.exe (Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3520 series\Bin\HPNetworkCommunicatorCom.exe (Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Sony Corporation) C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (InterVideo) C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMService.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Sony Corporation) C:\Program Files\Sony\VAIO Update Common\VUAgent.exe (Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3520 series\Bin\HPNetworkCommunicator.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [13374568 2011-12-13] (Realtek Semiconductor) HKLM\...\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /SONYAPO [2277992 2011-11-15] (Realtek Semiconductor) HKLM\...\Run: [AtherosBtStack] "C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe" [947360 2011-07-05] (Atheros Communications) HKLM\...\Run: [AthBtTray] "C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe" [797344 2011-07-05] (Atheros Commnucations) HKLM\...\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2531624 2011-06-22] (Synaptics Incorporated) HKLM\...\Run: [Classic Start Menu] C:\Program Files\Classic Shell\ClassicStartMenu.exe [98304 2010-07-29] (IvoSoft) HKLM\...\Run: [IntelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2417032 2011-08-01] (Microsoft Corporation) HKLM\...\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey [1436736 2011-06-15] (Microsoft Corporation) HKLM\...\Run: [RtHDVBg_Dolby] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /FORPCEE4 [2277992 2011-11-15] (Realtek Semiconductor) HKLM\...\Run: [RtHDVBg_DTS] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /DTSU2P [2277992 2011-11-15] (Realtek Semiconductor) HKCU\...\Run: [HP Deskjet 3520 series (NET)] "C:\Program Files\HP\HP Deskjet 3520 series\Bin\ScanToPCActivationApp.exe" -deviceID "CN2AN112P705SY:NW" -scfn "HP Deskjet 3520 series (NET)" -AutoStart 1 [2573416 2012-10-17] (Hewlett-Packard Co.) HKCU\...\Run: [AnyDVD] C:\Program Files (x86)\SlySoft\AnyDVD\AnyDVDtray.exe [7032920 2013-04-10] (SlySoft, Inc.) HKLM-x32\...\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-12] (Intel Corporation) HKLM-x32\...\Run: [ISBMgr.exe] "C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe" [2801288 2011-05-31] (Sony Corporation) HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59280 2012-11-28] (Apple Inc.) HKLM-x32\...\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2012-10-25] (Apple Inc.) HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [151952 2012-11-29] (Apple Inc.) HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Aimersoft Helper Compact.exe] C:\Program Files (x86)\Common Files\Aimersoft\Aimersoft Helper Compact\ASHelper.exe [x] HKLM-x32\...\Run: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard) HKLM-x32\...\Run: [] [x] HKLM-x32\...\Run: [PowerDVD13Agent] "C:\Program Files (x86)\CyberLink\PowerDVD13\PowerDVD13Agent.exe" [513048 2013-03-20] (CyberLink Corp.) Startup: C:\ProgramData\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> C:\Program Files (x86)\WISO\Steuersoftware 2013\mshaktuell.exe () Startup: C:\Users\trishohara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BBC iPlayer Desktop.lnk ShortcutTarget: BBC iPlayer Desktop.lnk -> C:\Program Files (x86)\BBC iPlayer Desktop\BBC iPlayer Desktop.exe () Startup: C:\Users\trishohara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Deskjet 3520 series (Netzwerk).lnk ShortcutTarget: Tintenwarnungen überwachen - HP Deskjet 3520 series (Netzwerk).lnk -> C:\Program Files\HP\HP Deskjet 3520 series\bin\HPStatusBL.dll (Hewlett-Packard Co.) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://vaioportal.sony.eu HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://sony.msn.com HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://vaioportal.sony.eu HKCU SearchScopes: DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKCU - {41812E44-598A-401F-AB23-573502F38661} URL = hxxp://rover.ebay.com/rover/1/707-37276-16609-27/4?mpre=hxxp://shop.ebay.de/?oemInLn=ieSrch-Q311&_nkw={searchTerms} SearchScopes: HKCU - {DD40B60A-0114-4FB6-B335-1277870C1021} URL = hxxp://services.zinio.com/search?s={searchTerms}&rf=sonyslices BHO: Expat Shield Class - {3706EE7C-3CAD-445D-8A43-03EBC3B75908} - C:\Program Files (x86)\Expat Shield\HssIE\ExpatIE_64.dll (AnchorFree Inc.) BHO: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: Expat Shield Class - {3706EE7C-3CAD-445D-8A43-03EBC3B75908} - C:\Program Files (x86)\Expat Shield\HssIE\ExpatIE.dll (AnchorFree Inc.) BHO-x32: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft) BHO-x32: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations) BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft) Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft) Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) Handler: msdaipp - No CLSID Value - Handler-x32: msdaipp - No CLSID Value - Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - No File Winsock: Catalog9 12 C:\Program Files (x86)\VMware\VMware Workstation\vsocklib.dll [346736] (VMware, Inc.) Winsock: Catalog9 13 C:\Program Files (x86)\VMware\VMware Workstation\vsocklib.dll [346736] (VMware, Inc.) Winsock: Catalog9-x64 12 C:\Program Files (x86)\VMware\VMware Workstation\x64\vsocklib.dll [446576] (VMware, Inc.) Winsock: Catalog9-x64 13 C:\Program Files (x86)\VMware\VMware Workstation\x64\vsocklib.dll [446576] (VMware, Inc.) Tcpip\Parameters: [DhcpNameServer] 8.8.8.8 8.8.4.4 Tcpip\..\Interfaces\{E4AA3406-CA7C-4E4A-AD32-E3DDBB9ABD9C}: [NameServer]8.8.8.8 FireFox: ======== FF ProfilePath: C:\Users\trishohara\AppData\Roaming\Mozilla\Firefox\Profiles\pp3cugsz.default FF Homepage: https://twitter.com/|hxxp://www.angrybirdsnest.com/|https://www.facebook.com/|hxxp://www.flickr.com/photos/hansolo401/|hxxp://www.fbtb.net/forums/search.php?search_id=newposts|hxxp://www.1000steine.de/de/gemeinschaft/forum/?show=1&cat=a FF NetworkProxy: "http", "216.155.139.115" FF NetworkProxy: "http_port", 3128 FF NetworkProxy: "no_proxies_on", "localhost, 127.0.0.1, stealthy.co" FF NetworkProxy: "share_proxy_settings", true FF NetworkProxy: "type", 0 FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll () FF Plugin: @java.com/DTPlugin,version=10.2.1 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.2.1 - C:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\new_plugin\npjp2.dll (Oracle Corporation) FF Plugin: @microsoft.com/GENUINE - disabled No File FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll () FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF Plugin-x32: @microsoft.com/GENUINE - disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF Plugin-x32: @SonyCreativeSoftware.com/Media Go,version=1.0 - C:\Program Files (x86)\Sony\Media Go\npmediago.dll (Sony Network Entertainment International LLC) FF Plugin-x32: @videolan.org/vlc,version=2.0.6 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\trishohara\AppData\Local\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\trishohara\AppData\Local\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101721.dll (Amazon.com, Inc.) FF Extension: British English Dictionary - C:\Users\trishohara\AppData\Roaming\Mozilla\Firefox\Profiles\pp3cugsz.default\Extensions\en-GB@dictionaries.addons.mozilla.org FF Extension: Echofon - C:\Users\trishohara\AppData\Roaming\Mozilla\Firefox\Profiles\pp3cugsz.default\Extensions\twitternotifier@naan.net FF Extension: ColorZilla - C:\Users\trishohara\AppData\Roaming\Mozilla\Firefox\Profiles\pp3cugsz.default\Extensions\{6AC85730-7D0F-4de0-B3FA-21142DD85326} FF Extension: DownloadHelper - C:\Users\trishohara\AppData\Roaming\Mozilla\Firefox\Profiles\pp3cugsz.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} FF Extension: compatibility - C:\Users\trishohara\AppData\Roaming\Mozilla\Firefox\Profiles\pp3cugsz.default\Extensions\compatibility@addons.mozilla.org.xpi FF Extension: firebug - C:\Users\trishohara\AppData\Roaming\Mozilla\Firefox\Profiles\pp3cugsz.default\Extensions\firebug@software.joehewitt.com.xpi FF Extension: leethax - C:\Users\trishohara\AppData\Roaming\Mozilla\Firefox\Profiles\pp3cugsz.default\Extensions\leethax@leethax.net.xpi FF Extension: No Name - C:\Users\trishohara\AppData\Roaming\Mozilla\Firefox\Profiles\pp3cugsz.default\Extensions\{75CEEE46-9B64-46f8-94BF-54012DE155F0}.xpi FF Extension: No Name - C:\Users\trishohara\AppData\Roaming\Mozilla\Firefox\Profiles\pp3cugsz.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi FF Extension: No Name - C:\Users\trishohara\AppData\Roaming\Mozilla\Firefox\Profiles\pp3cugsz.default\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\extensions\afurladvisor@anchorfree.com FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} Chrome: ======= CHR HomePage: hxxp://www.google.com/ CHR DefaultSearchURL: (Google) - {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms} CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms} CHR Plugin: (Remoting Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Users\trishohara\AppData\Local\Google\Chrome\Application\16.0.912.77\ppGoogleNaClPluginChrome.dll No File CHR Plugin: (Chrome PDF Viewer) - C:\Users\trishohara\AppData\Local\Google\Chrome\Application\16.0.912.77\pdf.dll No File CHR Plugin: (Shockwave Flash) - C:\Users\trishohara\AppData\Local\Google\Chrome\Application\16.0.912.77\gcswf32.dll No File CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll No File CHR Plugin: (Java Deployment Toolkit 6.0.260.3) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll (Sun Microsystems, Inc.) CHR Plugin: (Java(TM) Platform SE 6 U26) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) CHR Plugin: (Media Go Detector) - C:\Program Files (x86)\Sony\Media Go\npmediago.dll (Sony Network Entertainment International LLC) CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () CHR Plugin: (Google Update) - C:\Users\trishohara\AppData\Local\Google\Update\1.3.21.99\npGoogleUpdate3.dll No File CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll No File CHR Plugin: (Default Plug-in) - default_plugin No File CHR Extension: (Angry Birds) - C:\Users\trishohara\AppData\Local\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj\1.1.2.1_0 CHR Extension: (YouTube) - C:\Users\trishohara\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2_0 CHR Extension: (Google Search) - C:\Users\trishohara\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.14_0 CHR Extension: (Gmail) - C:\Users\trishohara\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\6.1.3_0 ==================== Services (Whitelisted) ================= S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.) R2 Atheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [138400 2011-07-05] (Atheros) R2 CyberLink PowerDVD 13 Media Server Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSMonitorServicePDVD13.exe [77576 2013-03-20] (CyberLink) R2 CyberLink PowerDVD 13 Media Server Service; C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSServerPDVD13.exe [323336 2013-03-20] (CyberLink) R2 ExpatShieldService; C:\Program Files (x86)\Expat Shield\bin\openvpnas.exe [331608 2011-12-29] () S4 ExpatTrayService; C:\Program Files (x86)\Expat Shield\bin\ExpatTrayService.EXE [77520 2012-01-06] () R2 ExpatWd; C:\Program Files (x86)\Expat Shield\bin\hsswd.exe [329544 2012-01-05] () R2 MsMpSvc; c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe [12784 2011-04-27] (Microsoft Corporation) R3 NisSrv; c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [288272 2011-04-27] (Microsoft Corporation) S4 uCamMonitor; C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [105024 2011-02-23] (ArcSoft, Inc.) S4 ufad-ws60; C:\Program Files (x86)\VMware\VMware Workstation\vmware-ufad.exe [191024 2010-08-19] (VMware, Inc.) S2 McAfee SiteAdvisor Service; c:\PROGRA~2\mcafee\SITEAD~1\mcsacore.exe [x] ==================== Drivers (Whitelisted) ==================== R3 AnyDVD; C:\Windows\System32\Drivers\AnyDVD.sys [142424 2013-03-18] (SlySoft, Inc.) R3 ArcSoftKsUFilter; C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys [19968 2009-05-26] (ArcSoft, Inc.) R1 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [189440 2011-04-18] (Microsoft Corporation) R3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [84864 2011-04-27] (Microsoft Corporation) S2 risdsnpe; C:\Windows\system32\drivers\risdsnxc64.sys [98816 2011-06-23] (REDC) R2 vstor2-ws60; C:\Program Files (x86)\VMware\VMware Workstation\vstor2-ws60.sys [32816 2010-08-19] (VMware, Inc.) R2 vstor2-ws60; C:\Program Files (x86)\VMware\VMware Workstation\vstor2-ws60.sys [32816 2010-08-19] (VMware, Inc.) R3 WsAudio_Device; C:\Windows\System32\drivers\VirtualAudio.sys [31080 2013-01-08] (Wondershare) R2 {09F57980-3432-4AFC-957D-27AC45FAE1F5}; C:\Program Files (x86)\CyberLink\PowerDVD13\Common\NavFilter\000.fcl [130320 2013-03-19] (CyberLink Corp.) R2 {09F57980-3432-4AFC-957D-27AC45FAE1F5}; C:\Program Files (x86)\CyberLink\PowerDVD13\Common\NavFilter\000.fcl [130320 2013-03-19] (CyberLink Corp.) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-07-05 10:10 - 2013-07-05 10:11 - 01934636 ____A (Farbar) C:\Users\trishohara\Downloads\FRST64.exe 2013-07-03 21:38 - 2013-07-03 21:41 - 109927703 ____A (Symantec Corporation) C:\Users\trishohara\Downloads\NAV-TW-30-20-3-0-36-GE.exe 2013-07-03 21:36 - 2013-07-03 21:36 - 00000041 ____A C:\Users\trishohara\AppData\Roaming\mbam.context.scan 2013-07-03 21:30 - 2013-07-03 21:35 - 172886528 ____A (Symantec Corporation) C:\Users\trishohara\Downloads\NAV-TW-30-20-3-0-36-GE.exe.part 2013-07-03 20:37 - 2013-07-03 20:38 - 00000000 ____D C:\67abfb933ea67e8babbc1c7dd37b9796 2013-07-03 20:23 - 2013-07-03 20:23 - 00000540 ____A C:\Users\trishohara\Downloads\virus.txt 2013-07-03 18:08 - 2013-07-03 18:08 - 00000000 ____D C:\Program Files (x86)\ESET 2013-07-03 18:07 - 2013-07-03 18:07 - 00001960 ____A C:\Users\trishohara\Desktop\RKreport[0]_S_07032013_180734.txt 2013-07-03 18:07 - 2013-07-03 18:07 - 00001209 ____A C:\Users\trishohara\Desktop\RKreport[0]_PR_07032013_180737.txt 2013-07-03 18:06 - 2013-07-03 18:06 - 00001896 ____A C:\Users\trishohara\Desktop\RKreport[0]_S_07032013_180623.txt 2013-07-03 18:06 - 2013-07-03 18:06 - 00001087 ____A C:\Users\trishohara\Desktop\RKreport[0]_H_07032013_180633.txt 2013-07-03 18:05 - 2013-07-03 18:05 - 00002061 ____A C:\Users\trishohara\Desktop\RKreport[0]_D_07032013_180527.txt 2013-07-03 18:05 - 2013-07-03 18:05 - 00001955 ____A C:\Users\trishohara\Desktop\RKreport[0]_S_07032013_180506.txt 2013-07-03 18:02 - 2013-07-03 18:02 - 00001452 ____A C:\Users\trishohara\Desktop\JRT.txt 2013-07-03 17:59 - 2013-07-03 17:59 - 00000000 ____D C:\Windows\ERUNT 2013-07-03 17:58 - 2013-07-03 21:14 - 00000000 ____D C:\JRT 2013-07-03 17:54 - 2013-07-03 17:55 - 00001601 ____A C:\AdwCleaner[S1].txt 2013-07-03 17:54 - 2013-07-03 17:54 - 00001539 ____A C:\AdwCleaner[R1].txt 2013-07-03 17:50 - 2013-07-03 17:50 - 00002962 ____A C:\Users\trishohara\Desktop\RKreport[0]_D_07032013_175047.txt 2013-07-03 17:50 - 2013-07-03 17:50 - 00002781 ____A C:\Users\trishohara\Desktop\RKreport[0]_S_07032013_175024.txt 2013-07-03 17:49 - 2013-07-03 21:13 - 00000000 ____D C:\Users\trishohara\Desktop\RK_Quarantine 2013-07-03 17:43 - 2013-07-03 17:43 - 00025107 ____A C:\ComboFix.txt 2013-07-03 17:20 - 2013-07-03 21:13 - 00000000 ____D C:\Windows\erdnt 2013-07-03 17:20 - 2013-07-03 17:43 - 00000000 ____D C:\Qoobox 2013-07-03 17:13 - 2013-07-03 17:13 - 00029531 ____A C:\Users\trishohara\Downloads\Addition.txt 2013-07-03 17:12 - 2013-07-03 17:12 - 00000000 ____D C:\FRST 2013-06-29 13:29 - 2013-06-29 13:29 - 02367452 ____A C:\Users\trishohara\Downloads\bewerbungsunterlagen.zip 2013-06-21 20:13 - 2013-06-21 20:13 - 00000000 ____D C:\Users\trishohara\restore 2013-06-21 15:59 - 2013-06-26 13:00 - 00000000 ____D C:\ProgramData\tmp 2013-06-21 15:59 - 2013-06-21 21:22 - 00000000 ____D C:\ProgramData\hps 2013-06-21 15:53 - 2013-06-21 15:53 - 00000000 ____D C:\Program Files (x86)\CEWE COLOR 2013-06-21 12:42 - 2013-06-21 14:31 - 00025088 ____A C:\Users\trishohara\Documents\Mama_Tabletten_Juni2013_2.xls 2013-06-10 16:15 - 2013-06-10 16:15 - 00019456 ____A C:\Users\trishohara\Documents\Mama_Tabletten_Juni2013.xls ==================== One Month Modified Files and Folders ======= 2013-07-05 10:14 - 2013-05-02 19:17 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-07-05 10:14 - 2009-07-14 06:45 - 00026112 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-07-05 10:14 - 2009-07-14 06:45 - 00026112 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-07-05 10:13 - 2011-12-06 19:44 - 01750609 ____A C:\Windows\WindowsUpdate.log 2013-07-05 10:12 - 2011-08-13 00:32 - 00705888 ____A C:\Windows\System32\perfh007.dat 2013-07-05 10:12 - 2011-08-13 00:32 - 00151918 ____A C:\Windows\System32\perfc007.dat 2013-07-05 10:12 - 2009-07-14 07:13 - 01638732 ____A C:\Windows\System32\PerfStringBackup.INI 2013-07-05 10:11 - 2013-07-05 10:10 - 01934636 ____A (Farbar) C:\Users\trishohara\Downloads\FRST64.exe 2013-07-05 10:10 - 2012-01-29 15:20 - 00000000 ____D C:\Users\trishohara\Documents\Mein Steuer-Sparbuch Heute 2013-07-05 10:07 - 2013-05-02 16:47 - 00000040 ___SH C:\ProgramData\.zreglib 2013-07-05 10:07 - 2011-12-06 20:23 - 00000000 ____D C:\Users\trishohara\Documents\Bluetooth Folder 2013-07-05 10:06 - 2011-12-07 19:50 - 00000000 ____D C:\ProgramData\VMware 2013-07-05 10:06 - 2011-08-12 14:52 - 00000000 ____D C:\ProgramData\NVIDIA 2013-07-05 10:06 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT 2013-07-05 10:06 - 2009-07-14 06:51 - 00055162 ____A C:\Windows\setupact.log 2013-07-05 10:06 - 2009-07-14 06:45 - 00446336 ____A C:\Windows\System32\FNTCACHE.DAT 2013-07-04 10:53 - 2012-02-05 21:23 - 00001140 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3351839369-2974415085-3751294646-1001UA.job 2013-07-04 10:41 - 2013-03-31 13:11 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-07-03 21:41 - 2013-07-03 21:38 - 109927703 ____A (Symantec Corporation) C:\Users\trishohara\Downloads\NAV-TW-30-20-3-0-36-GE.exe 2013-07-03 21:36 - 2013-07-03 21:36 - 00000041 ____A C:\Users\trishohara\AppData\Roaming\mbam.context.scan 2013-07-03 21:35 - 2013-07-03 21:30 - 172886528 ____A (Symantec Corporation) C:\Users\trishohara\Downloads\NAV-TW-30-20-3-0-36-GE.exe.part 2013-07-03 21:16 - 2011-12-06 19:45 - 00000000 ____D C:\users\trishohara 2013-07-03 21:14 - 2013-07-03 17:58 - 00000000 ____D C:\JRT 2013-07-03 21:14 - 2012-05-31 19:46 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-07-03 21:14 - 2012-05-03 21:39 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2013-07-03 21:14 - 2012-04-17 18:37 - 00000000 ____D C:\Program Files (x86)\Software4u 2013-07-03 21:14 - 2012-02-13 21:21 - 00000000 ____D C:\Windows\System32\Macromed 2013-07-03 21:14 - 2012-02-06 13:43 - 00000000 ____D C:\Program Files\Oracle 2013-07-03 21:14 - 2012-01-17 21:20 - 00000000 ____D C:\Users\trishohara\AppData\Roaming\vlc 2013-07-03 21:14 - 2011-12-10 15:20 - 00000000 ____D C:\Program Files (x86)\IrfanView 2013-07-03 21:14 - 2011-12-10 15:18 - 00000000 ____D C:\Users\trishohara\AppData\Roaming\Notepad++ 2013-07-03 21:14 - 2011-08-12 14:56 - 00000000 ____D C:\Program Files\Java 2013-07-03 21:14 - 2011-08-12 14:53 - 00000000 ____D C:\ProgramData\Atheros 2013-07-03 21:14 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\System32\NDF 2013-07-03 21:13 - 2013-07-03 17:49 - 00000000 ____D C:\Users\trishohara\Desktop\RK_Quarantine 2013-07-03 21:13 - 2013-07-03 17:20 - 00000000 ____D C:\Windows\erdnt 2013-07-03 21:13 - 2011-12-07 18:43 - 00000000 ____D C:\Users\trishohara\AppData\Local\Thunderbird 2013-07-03 21:13 - 2011-12-06 22:33 - 00000000 ____D C:\Users\trishohara\AppData\Roaming\Mozilla 2013-07-03 21:13 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration 2013-07-03 21:11 - 2012-02-19 12:14 - 00000000 ____D C:\ProgramData\CyberLink 2013-07-03 21:11 - 2012-02-05 21:23 - 00000000 ____D C:\Users\trishohara\AppData\Local\Google 2013-07-03 21:11 - 2011-08-12 15:01 - 00000000 ____D C:\ProgramData\Sony Corporation 2013-07-03 21:10 - 2011-08-12 14:57 - 00000000 ____D C:\Program Files (x86)\Java 2013-07-03 20:38 - 2013-07-03 20:37 - 00000000 ____D C:\67abfb933ea67e8babbc1c7dd37b9796 2013-07-03 20:23 - 2013-07-03 20:23 - 00000540 ____A C:\Users\trishohara\Downloads\virus.txt 2013-07-03 20:22 - 2012-05-05 18:46 - 00000000 ____D C:\Windows\System32\appmgmt 2013-07-03 18:08 - 2013-07-03 18:08 - 00000000 ____D C:\Program Files (x86)\ESET 2013-07-03 18:07 - 2013-07-03 18:07 - 00001960 ____A C:\Users\trishohara\Desktop\RKreport[0]_S_07032013_180734.txt 2013-07-03 18:07 - 2013-07-03 18:07 - 00001209 ____A C:\Users\trishohara\Desktop\RKreport[0]_PR_07032013_180737.txt 2013-07-03 18:06 - 2013-07-03 18:06 - 00001896 ____A C:\Users\trishohara\Desktop\RKreport[0]_S_07032013_180623.txt 2013-07-03 18:06 - 2013-07-03 18:06 - 00001087 ____A C:\Users\trishohara\Desktop\RKreport[0]_H_07032013_180633.txt 2013-07-03 18:05 - 2013-07-03 18:05 - 00002061 ____A C:\Users\trishohara\Desktop\RKreport[0]_D_07032013_180527.txt 2013-07-03 18:05 - 2013-07-03 18:05 - 00001955 ____A C:\Users\trishohara\Desktop\RKreport[0]_S_07032013_180506.txt 2013-07-03 18:02 - 2013-07-03 18:02 - 00001452 ____A C:\Users\trishohara\Desktop\JRT.txt 2013-07-03 17:59 - 2013-07-03 17:59 - 00000000 ____D C:\Windows\ERUNT 2013-07-03 17:55 - 2013-07-03 17:54 - 00001601 ____A C:\AdwCleaner[S1].txt 2013-07-03 17:54 - 2013-07-03 17:54 - 00001539 ____A C:\AdwCleaner[R1].txt 2013-07-03 17:50 - 2013-07-03 17:50 - 00002962 ____A C:\Users\trishohara\Desktop\RKreport[0]_D_07032013_175047.txt 2013-07-03 17:50 - 2013-07-03 17:50 - 00002781 ____A C:\Users\trishohara\Desktop\RKreport[0]_S_07032013_175024.txt 2013-07-03 17:43 - 2013-07-03 17:43 - 00025107 ____A C:\ComboFix.txt 2013-07-03 17:43 - 2013-07-03 17:20 - 00000000 ____D C:\Qoobox 2013-07-03 17:13 - 2013-07-03 17:13 - 00029531 ____A C:\Users\trishohara\Downloads\Addition.txt 2013-07-03 17:12 - 2013-07-03 17:12 - 00000000 ____D C:\FRST 2013-07-01 16:47 - 2012-01-12 13:29 - 00036352 ____A C:\Users\trishohara\Documents\monatlAusgaben.xls 2013-06-29 13:29 - 2013-06-29 13:29 - 02367452 ____A C:\Users\trishohara\Downloads\bewerbungsunterlagen.zip 2013-06-26 13:00 - 2013-06-21 15:59 - 00000000 ____D C:\ProgramData\tmp 2013-06-24 12:18 - 2011-12-10 15:05 - 00000000 ____D C:\Users\trishohara\Documents\Eigene PSP-Dateien 2013-06-22 21:21 - 2012-03-14 19:03 - 00000000 ____D C:\Users\trishohara\AppData\Local\CrashDumps 2013-06-21 21:22 - 2013-06-21 15:59 - 00000000 ____D C:\ProgramData\hps 2013-06-21 20:13 - 2013-06-21 20:13 - 00000000 ____D C:\Users\trishohara\restore 2013-06-21 15:53 - 2013-06-21 15:53 - 00000000 ____D C:\Program Files (x86)\CEWE COLOR 2013-06-21 14:31 - 2013-06-21 12:42 - 00025088 ____A C:\Users\trishohara\Documents\Mama_Tabletten_Juni2013_2.xls 2013-06-10 16:15 - 2013-06-10 16:15 - 00019456 ____A C:\Users\trishohara\Documents\Mama_Tabletten_Juni2013.xls 2013-06-10 16:13 - 2013-05-07 18:15 - 00025088 ____A C:\Users\trishohara\Documents\Mama_Tabletten_Mai2013.xls ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-07-04 10:00 ==================== End Of Log ============================ addition.txt Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 04-07-2013 Ran by trishohara at 2013-07-05 10:15:17 Running from C:\Users\trishohara\Downloads Boot Mode: Normal ========================================================== ==================== Installed Programs ======================= ?????? Windows Live (x32 Version: 15.4.3502.0922) ??????? ????????? Windows Live Mesh ActiveX ??? ?????????? ?????????? (x32 Version: 15.4.5722.2) ??????? ?????????? Windows Live Mesh ActiveX ??? ????????? ??????????? (x32 Version: 15.4.5722.2) ???????? ?????????? Windows Live (x32 Version: 15.4.3502.0922) ?????????? Windows Live (x32 Version: 15.4.3502.0922) ??????????? ?? Windows Live (x32 Version: 15.4.3502.0922) ???????????? Windows Live (x32 Version: 15.4.3502.0922) 7-Zip 9.20 (x32) Adobe AIR (x32 Version: 2.7.0.19460) Adobe Community Help (x32 Version: 3.2.1) Adobe Community Help (x32 Version: 3.2.1.650) Adobe Flash Player 11 ActiveX (x32 Version: 11.7.700.202) Adobe Flash Player 11 Plugin (x32 Version: 11.7.700.202) Adobe Photoshop Elements 9 (x32 Version: 9.0) Adobe Premiere Elements 9 (x32 Version: 9.0) Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03) Aimersoft Video Converter Ultimate(Build 5.0.1.0) (x32 Version: 5.0.1.0) Amazon MP3-Downloader 1.0.17 (x32 Version: 1.0.17) Android SDK Tools (x32 Version: 1.14) Angry Birds Seasons (x32 Version: 2.2.0) AnyDVD (x32 Version: 7.1.8.0) Apple Application Support (x32 Version: 2.3.2) Apple Mobile Device Support (Version: 6.0.1.3) Apple Software Update (x32 Version: 2.1.3.127) ArcSoft Magic-i Visual Effects 2 (x32 Version: 2.0.149) ArcSoft WebCam Companion 4 (x32 Version: 4.0.444) Atheros WiFi Driver Installation (x32 Version: 3.0) AVIcodec (remove only) (x32) BBC iPlayer Desktop (x32 Version: 3.2.15) Bing Bar (x32 Version: 7.0.850.0) Bluetooth Win7 Suite (64) (Version: 7.04.000.82) Bonjour (Version: 3.0.0.10) BrickStore (x32 Version: 1.1.16) Classic Shell (Version: 2.8.3) Compatibility Pack for the 2007 Office system (x32 Version: 12.0.6514.5001) Corel WinDVD (x32 Version: 10.0.6.108) Corel WinDVD (x32 Version: 11) Corel WinDVD Pro 11 (x32 Version: 11.0.0.342) CSS3 Menu (x32) CyberLink PowerDVD 13 (x32 Version: 13.0.2720.57) D3DX10 (x32 Version: 15.4.2368.0902) Dolby Home Theater v4 (x32 Version: 7.2.7000.6) DVD Shrink 3.2 (x32) Elements 9 Organizer (x32 Version: 9.0) Elements STI Installer (x32 Version: 1.0) Evernote v. 4.4 (x32 Version: 4.4.0.4848) Expat Shield 2.24 (x32 Version: 2.24) FileZilla Client 3.5.3 (x32 Version: 3.5.3) Firebird SQL Server - MAGIX Edition (x32 Version: 2.1.27.0) Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922) Galeria fotografii uslugi Windows Live (x32 Version: 15.4.3502.0922) Galerie de photos Windows Live (x32 Version: 15.4.3502.0922) Galerie foto Windows Live (x32 Version: 15.4.3502.0922) Google Chrome (HKCU Version: 26.0.1410.64) HP Deskjet 3520 series - Grundlegende Software für das Gerät (Version: 28.0.1315.0) HP Deskjet 3520 series Hilfe (x32 Version: 27.0.0) HP Deskjet 3520 series Setup Guide (x32 Version: 27.0.0) HP FWUpdateEDO2 (x32 Version: 1.2.0.0) HP Photo Creations (x32 Version: 1.0.0.7702) HP Update (x32 Version: 5.003.003.001) HPDiagnosticAlert (x32 Version: 1.00.0000) ICA (x32 Version: 1.0) iDevice Manager (x32 Version: 1.2.1.0) iExplorer 2.2.1.3 (x32) Intel(R) Management Engine Components (x32 Version: 7.0.0.1144) Intel(R) Rapid Storage Technology (x32 Version: 10.1.2.1004) IPM (x32 Version: 1.00.0000) IrfanView (remove only) (x32) iTunes (Version: 11.0.0.163) Jasc Paint Shop Pro 9 (x32 Version: 9.00.0000) Java Auto Updater (x32 Version: 2.0.5.1) Java(TM) 6 Update 26 (64-bit) (Version: 6.0.260) Java(TM) 6 Update 26 (x32 Version: 6.0.260) Java(TM) 7 Update 2 (64-bit) (Version: 7.0.20) Java(TM) SE Development Kit 7 Update 2 (64-bit) (Version: 1.7.0.20) JavaFX 2.0.2 (64-bit) (Version: 2.0.2) JavaFX 2.0.2 SDK (64-bit) (Version: 2.0.2) Junk Mail filter update (x32 Version: 15.4.3502.0922) LEGO® Star Wars™: Die Komplette Saga (x32 Version: 1.00.0000) LEGO® Star Wars™: The Complete Saga (x32 Version: 1.00.0000) MAGIX Screenshare (x32 Version: 4.3.6.1987) MAGIX Speed burnR (MSI) (x32 Version: 7.0.2.6) MAGIX Video deluxe MX Premium (x32 Version: 11.0.0.42) Malwarebytes Anti-Malware Version 1.61.0.1400 (x32 Version: 1.61.0.1400) Media Gallery (Version: 1.5.0.17250) Media Go (x32 Version: 1.7.254) Mesh Runtime (x32 Version: 15.4.5722.2) Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319) Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319) Microsoft .NET Framework 4.5 (Version: 4.5.50709) Microsoft Antimalware (Version: 3.0.8402.2) Microsoft Antimalware Service DE-DE Language Pack (Version: 3.0.8402.2) Microsoft Application Error Reporting (Version: 12.0.6015.5000) Microsoft IntelliPoint 8.2 (Version: 8.20.468.0) Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003) Microsoft Office Professional Edition 2003 (x32 Version: 11.0.8173.0) Microsoft Security Client (Version: 2.1.1116.0) Microsoft Security Client DE-DE Language Pack (Version: 2.1.1116.0) Microsoft Security Essentials (Version: 2.1.1116.0) Microsoft Silverlight (x32 Version: 4.1.10329.0) Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219) Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053) Microsoft_VC80_MFC_x86 (x32 Version: 8.0.50727.4053) Microsoft_VC80_MFCLOC_x86 (x32 Version: 8.0.50727.4053) Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000) Mozilla Firefox 20.0.1 (x86 de) (x32 Version: 20.0.1) Mozilla Maintenance Service (x32 Version: 20.0.1) Mozilla Thunderbird 9.0.1 (x86 de) (x32 Version: 9.0.1) MSVCRT (x32 Version: 15.4.2862.0708) MSVCRT_amd64 (x32 Version: 15.4.2862.0708) MSXML 4.0 SP3 Parser (KB973685) (x32 Version: 4.30.2107.0) MSXML 4.0 SP3 Parser (x32 Version: 4.30.2100.0) Notepad++ (x32 Version: 5.9.6.2) NVIDIA 3D Vision Treiber 268.93 (Version: 268.93) NVIDIA 3D Vision Video Player (x32 Version: 1.6.9) NVIDIA Grafiktreiber 268.93 (Version: 268.93) NVIDIA HD-Audiotreiber 1.2.22.1 (Version: 1.2.22.1) NVIDIA Install Application (Version: 2.265.42.0) NVIDIA PhysX (x32 Version: 9.10.0514) NVIDIA PhysX-Systemsoftware 9.10.0514 (Version: 9.10.0514) NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.12.6893) NVIDIA Systemsteuerung 268.93 (Version: 268.93) Ovládací prvek ActiveX platformy Windows Live Mesh pro vzdálená pripojení (x32 Version: 15.4.5722.2) Ovládací prvok ActiveX programu Windows Live Mesh pre vzdialené pripojenia (x32 Version: 15.4.5722.2) Pazera Free MP4 to AVI Converter 1.6 (x32 Version: 1.6) PlayStation(R)Network Downloader (x32 Version: 2.05.00710) PlayStation(R)Store (x32 Version: 4.1.8.11883) PMB (x32 Version: 5.6.01.03300) PMB VAIO Edition Plug-in (Version: 1.5.10.05300) PMB VAIO Edition Plug-in (x32 Version: 1.6.00.06010) Poczta uslugi Windows Live (x32 Version: 15.4.3502.0922) Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922) Portal (x32) Portal 2 (x32) PowerDVD (x32) Quick Web Access (x32 Version: 1.4.6.10) QuickTime (x32 Version: 7.73.80.64) Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922) Realtek High Definition Audio Driver (x32 Version: 6.0.1.6526) Remote Keyboard (x32 Version: 1.1.1.07060) Remote Play with PlayStation 3 (x32 Version: 1.1.0.15072) Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.32.0) S?????? f?t???af??? t?? Windows Live (x32 Version: 15.4.3502.0922) Setup (x32 Version: 11.0) Skype™ 5.1 (x32 Version: 5.1.104) SmartSound Quicktracks for Premiere Elements 9.0 (x32 Version: 3.12.3090) Sony Corporation (Version: 1.0.0) SourceTree (HKCU Version: 0.9.1.0) SSLx64 (Version: 1.0.0) SSLx86 (x32 Version: 1.0.0) St???e?? e?????? ActiveX t?? Windows Live Mesh ??a ap?µa???sµ??e? s??d?se?? (x32 Version: 15.4.5722.2) Star Wars Knights of the Old Republic (x32 Version: 1.0) Steam (x32 Version: 1.0.0.0) StreamTransport version: 1.0.2.2171 (x32) Studie zur Verbesserung von HP Deskjet 3520 series Produkten (Version: 28.0.1315.0) SUPER © v2011.build.49 (July 1st, 2011) Version v2011.build.49 (x32 Version: v2011.build.49) Synaptics Pointing Device Driver (Version: 15.2.6.0) tools-freebsd (x32 Version: 8.4.6.16648) tools-linux (x32 Version: 8.4.6.16648) tools-netware (x32 Version: 8.4.6.16648) tools-solaris (x32 Version: 8.4.6.16648) tools-windows (x32 Version: 8.4.6.16648) tools-winPre2k (x32 Version: 8.4.6.16648) TVO version 3.7 (x32 Version: 3.7) TweetDeck (x32 Version: 1.0.0) Uzak Baglantilar Için Windows Live Mesh ActiveX Denetimi (x32 Version: 15.4.5722.2) V3DPX86 (x32 Version: 1.0.0) VAIO - Media Gallery (x32 Version: 1.5.0.18100) VAIO - PMB VAIO Edition Guide (x32 Version: 1.6.00.06030) VAIO - PMB VAIO Edition Plug-in (x32 Version: 1.6.00.06140) VAIO - Remote Play mit PlayStation®3 (x32 Version: 1.1.0.15072) VAIO - Remote-Tastatur (x32 Version: 1.1.0.07060) VAIO 3D Portal (x32 Version: 1.1.0.06232) VAIO Control Center (x32 Version: 5.0.0.07070) VAIO Data Restore Tool (x32 Version: 1.7.0.05270) VAIO Easy Connect (x32 Version: 1.0.0.03050) VAIO Gate (x32 Version: 2.4.0.06210) VAIO Gate Default (x32 Version: 2.5.0.07080) VAIO Hero Screensaver - Fall 2011 Screensaver (x32) VAIO Improvement (x32 Version: 1.1.0.06030) VAIO Improvement Validation (Version: 1.0.4.01190) VAIO Sample Contents (x32 Version: 1.4.2.09010) VAIO Smart Network (x32 Version: 3.7.0.07150) VAIO Update (x32 Version: 5.5.0.06290) VAIO Update Merge Module x64 (Version: 5.5.06290) VAIO-Handbuch (x32 Version: 1.4.0.05310) VAIO-Support für Übertragungen (x32 Version: 1.4.0.14230) VCCx64 (Version: 1.0.0) VCCx86 (x32 Version: 1.0.0) VHD (x32 Version: 1.0.0) VIx64 (Version: 1.0.0) VIx86 (x32 Version: 1.0.0) VLC media player 2.0.6 (x32 Version: 2.0.6) VMware Workstation (x32 Version: 7.1.4.16648) VPMx64 (Version: 1.0.0) VSNx64 (Version: 1.0.0) VSNx86 (x32 Version: 1.0.0) VWSTx86 (x32 Version: 1.0.0) Winamp (Remove Only) (x32) Windows Live Communications Platform (x32 Version: 15.4.3502.0922) Windows Live Essentials (x32 Version: 15.4.3502.0922) Windows Live Essentials (x32 Version: 15.4.3508.1109) Windows Live Fotogaléria (x32 Version: 15.4.3502.0922) Windows Live Fotogalerie (x32 Version: 15.4.3502.0922) Windows Live Fotogalleri (x32 Version: 15.4.3502.0922) Windows Live Fotograf Galerisi (x32 Version: 15.4.3502.0922) Windows Live Fotótár (x32 Version: 15.4.3502.0922) Windows Live ID Sign-in Assistant (Version: 7.250.4225.0) Windows Live Installer (x32 Version: 15.4.3502.0922) Windows Live Language Selector (Version: 15.4.3508.1109) Windows Live Mail (x32 Version: 15.4.3502.0922) Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen (x32 Version: 15.4.5722.2) Windows Live Mesh (x32 Version: 15.4.3502.0922) Windows Live Mesh ActiveX control for remote connections (x32 Version: 15.4.5722.2) Windows Live Mesh ActiveX Control for Remote Connections (x32 Version: 15.4.5722.2) Windows Live Mesh ActiveX-kontroll for eksterne tilkoblinger (x32 Version: 15.4.5722.2) Windows Live Mesh ActiveX-objekt til fjernforbindelser (x32 Version: 15.4.5722.2) Windows Live Mesh ActiveX-vezérlo távoli kapcsolatokhoz (x32 Version: 15.4.5722.2) Windows Live Meshin etäyhteyksien ActiveX-komponentti (x32 Version: 15.4.5722.2) Windows Live Messenger (x32 Version: 15.4.3502.0922) Windows Live MIME IFilter (Version: 15.4.3502.0922) Windows Live Movie Maker (x32 Version: 15.4.3502.0922) Windows Live Photo Common (x32 Version: 15.4.3502.0922) Windows Live Photo Gallery (x32 Version: 15.4.3502.0922) Windows Live PIMT Platform (x32 Version: 15.4.3508.1109) Windows Live Remote Client (Version: 15.4.5722.2) Windows Live Remote Client Resources (Version: 15.4.5722.2) Windows Live Remote Service (Version: 15.4.5722.2) Windows Live Remote Service Resources (Version: 15.4.5722.2) Windows Live SOXE (x32 Version: 15.4.3502.0922) Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922) Windows Live Temel Parçalar (x32 Version: 15.4.3502.0922) Windows Live UX Platform (x32 Version: 15.4.3502.0922) Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109) Windows Live Writer (x32 Version: 15.4.3502.0922) Windows Live Writer Resources (x32 Version: 15.4.3502.0922) Windows Liven asennustyökalu (x32 Version: 15.4.3502.0922) Windows Liven sähköposti (x32 Version: 15.4.3502.0922) Windows Liven valokuvavalikoima (x32 Version: 15.4.3502.0922) WinSCP 4.3.8 (x32 Version: 4.3.8) WISO Steuer-Sparbuch 2012 (x32 Version: 19.00.7303) WISO Steuer-Sparbuch 2013 (x32 Version: 20.00.8137) XAMPP 1.8.1-0 (x32 Version: 1.8.1-0) Xvid 1.2.2 final uninstall (x32 Version: 1.2) ==================== Restore Points ========================= 01-06-2013 20:56:06 Windows Update 05-06-2013 16:20:26 Windows Update 09-06-2013 09:24:31 Windows Update 20-06-2013 08:12:54 Windows Update 23-06-2013 14:28:04 Windows Update 28-06-2013 14:49:48 Windows Update 03-07-2013 18:21:20 Removed JavaFX 2.0.2 SDK (64-bit) 03-07-2013 18:22:44 Removed Java(TM) 6 Update 26 03-07-2013 18:24:01 Removed Java(TM) 6 Update 26 (64-bit) 03-07-2013 18:24:43 Removed Java(TM) 7 Update 2 (64-bit) 03-07-2013 18:25:19 Removed Java(TM) SE Development Kit 7 Update 2 (64-bit) 03-07-2013 18:26:01 Removed JavaFX 2.0.2 (64-bit) 03-07-2013 18:37:10 Windows Update 03-07-2013 19:07:33 Wiederherstellungsvorgang 03-07-2013 19:20:29 Windows Update ==================== Hosts content: ========================== 2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: {0F4AB92F-E05D-4A8F-9E77-55DDAC553141} - System32\Tasks\Sony Corporation\VAIO Improvement\VAIOImprovementUploader => C:\Program Files\Sony\VAIO Improvement\viuploader.exe [2011-06-03] (Sony Corporation) Task: {1466E89D-C2CC-49AE-A4D8-6764E7FA65B4} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task Task: {1D983A4E-E1DB-4085-A2E8-75F279F16B1C} - System32\Tasks\Sony Corporation\VAIO Control Center\Level4Daily => C:\Program Files (x86)\Sony\VAIO Control Center\WBCBatteryCare.exe [2011-07-07] (Sony Corporation) Task: {1F36B366-6BA0-470A-8E08-16076FD91E8A} - System32\Tasks\Sony Corporation\VAIO Gate\VAIO Gate => C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe [2011-06-21] (Sony Corporation) Task: {27D1261B-2559-4EE7-99DC-0BDC4BFF1528} - System32\Tasks\{9FCEF174-62CC-4642-B14F-3A2DF8501B8A} => C:\Program Files (x86)\CyberLink\PowerDVD\PowerDVD.exe [2003-08-05] (CyberLink Corp.) Task: {337C50B5-B503-4C7E-8D3E-A630C0C40C6B} - System32\Tasks\Sony Corporation\VAIO Power Management\VPM Unlock => C:\Program Files\Sony\VAIO Power Management\SPMgr.exe [2011-05-31] (Sony Corporation) Task: {3D37C76C-BA73-4084-B316-CBC83ADEDBBD} - System32\Tasks\Sony Corporation\VAIO Update\VAIO Update 5 => C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe [2011-06-30] (Sony Corporation) Task: {433AB431-E3FC-4B78-A7C8-053CBF353BF8} - System32\Tasks\Sony Corporation\VAIO Care\VCCheckIcon => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe No File Task: {44FADF11-9AB6-46DD-9816-5F965A440DBB} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-03-31] (Adobe Systems Incorporated) Task: {479102CF-47D9-4E1B-9E27-77563BA3B8A7} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.) Task: {4B8E085B-F53F-4C27-BDCD-0A4B4B5A7E16} - System32\Tasks\HPCustParticipation HP Deskjet 3520 series => C:\Program Files\HP\HP Deskjet 3520 series\Bin\HPCustPartic.exe [2012-10-17] (Hewlett-Packard Co.) Task: {542A311B-52F0-4D32-A452-47105714073F} - System32\Tasks\Microsoft_Hardware_Launch_IPoint_exe => C:\Program Files\Microsoft IntelliPoint\IPoint.exe [2011-08-01] (Microsoft Corporation) Task: {618ADA85-A135-4D81-8A4E-87CE17798D3D} - System32\Tasks\Sony Corporation\VAIO Control Center\Level4Month => C:\Program Files (x86)\Sony\VAIO Control Center\WBCBatteryCare.exe [2011-07-07] (Sony Corporation) Task: {7127EFC9-ED61-42E9-B823-C6F4BA2A3F61} - System32\Tasks\Sony Corporation\VAIO Smart Network\VSN Logon Start => C:\Program Files\Sony\VAIO Smart Network\VSNClient No File Task: {7692B3EA-121B-4ECF-87A6-CC6AD35746F6} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3351839369-2974415085-3751294646-1001Core => C:\Users\trishohara\AppData\Local\Google\Update\GoogleUpdate.exe [2012-02-05] (Google Inc.) Task: {814A056C-ED62-4262-ADFA-9DB0B6A028BC} - System32\Tasks\Sony Corporation\VAIO Gate\StartExecuteProxy => C:\Program Files\Sony\VAIO Gate\ExecutionProxy.exe [2011-06-21] (Sony Corporation) Task: {91D0B37E-238F-473D-B7CD-02CAD0C04B5F} - System32\Tasks\Microsoft\Microsoft Antimalware\MpIdleTask => C:\Program Files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2011-04-27] (Microsoft Corporation) Task: {A19FD96A-A3A7-48E1-915A-F04F8BFA8C75} - System32\Tasks\Sony Corporation\VAIO Power Management\VPM Logon Start => C:\Program Files\Sony\VAIO Power Management\SPMgr.exe [2011-05-31] (Sony Corporation) Task: {A7E245A6-921F-4EEE-B4A3-A00F1861B897} - System32\Tasks\Sony Corporation\VAIO Care\VCUpdateLearn => C:\Program Files\Sony\VAIO Care\VCsystray.exe No File Task: {B7EADB6F-BC45-43A0-8E38-2D57816D7331} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3351839369-2974415085-3751294646-1001UA => C:\Users\trishohara\AppData\Local\Google\Update\GoogleUpdate.exe [2012-02-05] (Google Inc.) Task: {D42077B3-CA2B-4ADF-B38A-049AF9C70FEA} - System32\Tasks\Microsoft\Microsoft Antimalware\MP Scheduled Scan => C:\Program Files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2011-04-27] (Microsoft Corporation) Task: {DC14E697-3EC4-486F-8C12-CA347690845D} - System32\Tasks\Sony Corporation\VAIO Power Management\VPM Session Change => C:\Program Files\Sony\VAIO Power Management\SPMgr.exe [2011-05-31] (Sony Corporation) Task: {DC21B924-5D92-4393-A11B-AB883C4661C4} - System32\Tasks\{35CEFC5E-F302-42EB-91C9-A97F243584F9} => C:\Program Files (x86)\iPhone Explorer\iExplorer.exe [2011-12-06] (Macroplant) Task: {FC50458D-C82F-44AE-B805-1D07EDF4BCCA} - System32\Tasks\AdobeAAMUpdater-1.0-trishohara-VAIO-trishohara => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2010-07-29] (Adobe Systems Incorporated) Task: {FCBAAC13-FEC3-441D-91B9-ACE445E4C9E0} - System32\Tasks\Sony Corporation\VAIO Improvement Validation\VAIO Improvement Validation => C:\Program Files\Sony\VAIO Improvement Validation\viv.exe [2011-01-20] (Sony Corporation) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3351839369-2974415085-3751294646-1001Core.job => C:\Users\trishohara\AppData\Local\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3351839369-2974415085-3751294646-1001UA.job => C:\Users\trishohara\AppData\Local\Google\Update\GoogleUpdate.exe ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (07/05/2013 10:07:41 AM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (07/04/2013 10:02:51 AM) (Source: Software Protection Platform Service) (User: ) Description: Fehler bei der Erfassung des authentischen Tickets (hr=0x80072EE7) für die Vorlagen-ID 66c92734-d682-4d71-983e-d6ec3f16059f. Error: (07/04/2013 10:02:51 AM) (Source: Software Protection Platform Service) (User: ) Description: Lizenzerwerb-Fehlerdetails. hr=0x80072EE7 Error: (07/04/2013 10:02:38 AM) (Source: Microsoft-Windows-CAPI2) (User: ) Description: Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>. Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei. . Error: (07/04/2013 07:51:27 AM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (07/03/2013 09:17:36 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (07/03/2013 08:33:02 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (07/03/2013 08:26:33 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3. Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion. In Konflikt stehende Komponenten:. Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest. Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest. System errors: ============= Error: (07/05/2013 10:06:50 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "risdsnpe" wurde aufgrund folgenden Fehlers nicht gestartet: %%1058 Error: (07/05/2013 10:06:50 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (07/04/2013 07:50:04 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (07/03/2013 09:16:28 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (07/03/2013 09:16:14 PM) (Source: Microsoft Antimalware) (User: ) Description: Fehler in %60 beim Laden von Signaturen. Es wird versucht, einen bekannten Signatursatz wiederherzustellen. Versuchte Signaturen: %24 Fehlercode: 0x80070002 Fehlerbeschreibung: Das System kann die angegebene Datei nicht finden. Signaturversion: 0.0.0.0;0.0.0.0 Modulversion: %600 Error: (07/03/2013 08:31:35 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (07/03/2013 06:17:20 PM) (Source: DCOM) (User: ) Description: {995C996E-D918-4A8C-A302-45719A6F4EA7} Microsoft Office Sessions: ========================= Error: (07/05/2013 10:07:41 AM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (07/04/2013 10:02:51 AM) (Source: Software Protection Platform Service)(User: ) Description: hr=0x80072EE766c92734-d682-4d71-983e-d6ec3f16059f Error: (07/04/2013 10:02:51 AM) (Source: Software Protection Platform Service)(User: ) Description: hr=0x80072EE700010001(0x00000000, 10:02:44:501 - hxxp://go.microsoft.com/fwlink/?LinkId=151642) 00020001(0x00000000, 10:02:44:501) 00030001(0x00000000, 10:02:44:501 - hxxp://go.microsoft.com) 00030002(0x00000000, 10:02:44:501 - 0) 00040001(0x00000000, 10:02:44:501 - hxxp://go.microsoft.com) 00040002(0x00000000, 10:02:44:501 - 1, <NULL>, <NULL>, <NULL>) 00040004(0x80072F94, 10:02:51:677 - <NULL>) 00040006(0x00000000, 10:02:51:677 - 1, hxxp://go.microsoft.com, <NULL>, <local>) 00020005(0x00000000, 10:02:51:677 - 0) 00020007(0x80072EE7, 10:02:51:677) 00010002(0x80072EE7, 10:02:51:677 - <NULL>) 00010003(0x80072EE7, 10:02:51:677) Error: (07/04/2013 10:02:38 AM) (Source: Microsoft-Windows-CAPI2)(User: ) Description: hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabEin erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei. Error: (07/04/2013 07:51:27 AM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (07/03/2013 09:17:36 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (07/03/2013 08:33:02 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (07/03/2013 08:26:33 PM) (Source: SideBySide)(User: ) Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\trishohara\Downloads\esetsmartinstaller_enu.exe CodeIntegrity Errors: =================================== Date: 2013-07-03 17:36:19.853 Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert. Date: 2013-07-03 17:36:19.853 Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert. Date: 2012-05-06 13:19:45.182 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2012-05-06 13:19:45.161 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2012-05-06 13:19:45.105 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2012-05-06 13:19:45.025 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2012-05-06 13:19:44.979 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2012-05-06 13:19:44.826 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2012-05-06 13:19:44.747 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2012-05-06 13:19:44.211 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. ==================== Memory info =========================== Percentage of memory in use: 31% Total physical RAM: 8173.22 MB Available physical RAM: 5606.23 MB Total Pagefile: 16344.63 MB Available Pagefile: 13652.77 MB Total Virtual: 8192 MB Available Virtual: 8191.83 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:328.45 GB) (Free:161.01 GB) NTFS (Disk=0 Partition=3) Drive g: (Volume) (Fixed) (Total:249.23 GB) (Free:35.84 GB) NTFS (Disk=0 Partition=4) ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 596 GB) (Disk ID: 7FA122EA) Partition 1: (Not Active) - (Size=18 GB) - (Type=27) Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=328 GB) - (Type=07 NTFS) Partition 4: (Not Active) - (Size=249 GB) - (Type=OF Extended) ==================== End Of Log ============================ |
05.07.2013, 09:42 | #4 | |
/// the machine /// TB-Ausbilder | System Care Antivirus wirklich komplett entfernt?Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!Downloade dir bitte Combofix vom folgenden Downloadspiegel Link 1 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
05.07.2013, 10:10 | #5 |
| System Care Antivirus wirklich komplett entfernt? Wieso hat Combofix den BBC iPlayer gelöscht? Kann der infiziert gewesen sein? Code:
ATTFilter ComboFix 13-07-04.01 - trishohara 05.07.2013 10:55:44.1.4 - x64 Microsoft Windows 7 Professional 6.1.7601.1.1252.49.1031.18.8173.6415 [GMT 2:00] ausgeführt von:: c:\users\trishohara\Downloads\ComboFix.exe AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160} SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Neuer Wiederherstellungspunkt wurde erstellt . . (((((((((((((((((((((((((((((((((((( Weitere Löschungen )))))))))))))))))))))))))))))))))))))))))))))))) . . c:\program files (x86)\BBC iPlayer Desktop\BBC iPlayer Desktop.exe . . ((((((((((((((((((((((( Dateien erstellt von 2013-06-05 bis 2013-07-05 )))))))))))))))))))))))))))))) . . 2013-07-05 09:04 . 2013-07-05 09:04 -------- d-----w- c:\users\Default\AppData\Local\temp 2013-07-03 15:12 . 2013-07-03 15:12 -------- d-----w- C:\FRST 2013-06-21 18:13 . 2013-06-21 18:13 -------- d-----w- c:\users\trishohara\restore 2013-06-21 13:59 . 2013-06-26 11:00 -------- d-----w- c:\programdata\tmp 2013-06-21 13:59 . 2013-06-21 19:22 -------- d-----w- c:\programdata\hps 2013-06-21 13:53 . 2013-06-21 13:53 -------- d-----w- c:\program files (x86)\CEWE COLOR . . . (((((((((((((((((((((((((((((((((((( Find3M Bericht )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-07-05 08:41 . 2013-03-31 11:11 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2013-07-05 08:41 . 2011-08-12 13:06 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2013-07-05 08:41 . 2013-03-31 11:41 17018248 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe 2013-07-05 08:07 . 2010-06-24 09:33 22240 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll 2013-06-12 03:08 . 2011-12-07 17:52 9552976 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2013-05-02 15:29 . 2010-11-21 03:27 278800 ------w- c:\windows\system32\MpSigStub.exe 2006-05-03 11:06 163328 --sha-r- c:\windows\SysWOW64\flvDX.dll 2007-02-21 12:47 31232 --sha-r- c:\windows\SysWOW64\msfDX.dll 2008-03-16 14:30 216064 --sha-r- c:\windows\SysWOW64\nbDX.dll 2010-01-06 23:00 107520 --sha-r- c:\windows\SysWOW64\TAKDSDecoder.dll . . (((((((((((((((((((((((((((( Autostartpunkte der Registrierung )))))))))))))))))))))))))))))))))))))))) . . *Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. REGEDIT4 . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{3706EE7C-3CAD-445D-8A43-03EBC3B75908}] 2012-01-04 23:02 233288 ----a-w- c:\program files (x86)\Expat Shield\HssIE\ExpatIE.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ShareOverlay] @="{594D4122-1F87-41E2-96C7-825FB4796516}" [HKEY_CLASSES_ROOT\CLSID\{594D4122-1F87-41E2-96C7-825FB4796516}] 2010-07-29 06:15 316416 ----a-w- c:\program files\Classic Shell\ClassicExplorer32.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "HP Deskjet 3520 series (NET)"="c:\program files\HP\HP Deskjet 3520 series\Bin\ScanToPCActivationApp.exe" [2012-10-17 2573416] "AnyDVD"="c:\program files (x86)\SlySoft\AnyDVD\AnyDVDtray.exe" [2013-04-10 7032920] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-01-12 283160] "ISBMgr.exe"="c:\program files (x86)\Sony\ISB Utility\ISBMgr.exe" [2011-05-31 2801288] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-11-28 59280] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-10-25 421888] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-11-28 151952] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576] "Aimersoft Helper Compact.exe"="c:\program files (x86)\Common Files\Aimersoft\Aimersoft Helper Compact\ASHelper.exe" [BU] "HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2011-10-28 49208] "PowerDVD13Agent"="c:\program files (x86)\CyberLink\PowerDVD13\PowerDVD13Agent.exe" [2013-03-20 513048] . c:\users\trishohara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Tintenwarnungen überwachen - HP Deskjet 3520 series (Netzwerk).lnk - c:\windows\system32\RunDll32.exe "c:\program files\HP\HP Deskjet 3520 series\bin\HPStatusBL.dll",RunDLLEntry SERIALNUMBER=CN2AN112P705SY;CONNECTION=NW;MONITOR=1; [2009-7-14 45568] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ WISO Mein Steuer-Sparbuch heute.lnk - c:\program files (x86)\WISO\Steuersoftware 2013\mshaktuell.exe [2013-1-5 1397840] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "mixer6"=wdmaud.drv . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x] R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~2\mcafee\SITEAD~1\mcsacore.exe;c:\progra~2\mcafee\SITEAD~1\mcsacore.exe [x] R2 risdsnpe;risdsnpe;c:\windows\system32\drivers\risdsnxc64.sys;c:\windows\SYSNATIVE\drivers\risdsnxc64.sys [x] R3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_flt.sys [x] R3 ATHDFU;Atheros Valkyrie USB BootROM;c:\windows\System32\Drivers\AthDfu.sys;c:\windows\SYSNATIVE\Drivers\AthDfu.sys [x] R3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys;c:\windows\SYSNATIVE\drivers\btath_a2dp.sys [x] R3 btath_avdt;Atheros Bluetooth AVDT Service;c:\windows\system32\drivers\btath_avdt.sys;c:\windows\SYSNATIVE\drivers\btath_avdt.sys [x] R3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\drivers\btath_hcrp.sys;c:\windows\SYSNATIVE\drivers\btath_hcrp.sys [x] R3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_lwflt.sys [x] R3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\drivers\btath_rcp.sys;c:\windows\SYSNATIVE\drivers\btath_rcp.sys [x] R3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys;c:\windows\SYSNATIVE\DRIVERS\btfilter.sys [x] R3 e1yexpress;Intel(R) Gigabit Network Connections Driver;c:\windows\system32\DRIVERS\e1y60x64.sys;c:\windows\SYSNATIVE\DRIVERS\e1y60x64.sys [x] R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x] R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [x] R3 SOHCImp;VAIO Content Importer;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe [x] R3 SOHDs;VAIO Device Searcher;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe [x] R3 SpfService;VAIO Entertainment Common Service;c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe;c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x] R3 TsUsbGD;%TsUsbGD.DeviceDesc.Generic%;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x] R3 VCFw;VAIO Content Folder Watcher;c:\program files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe;c:\program files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [x] R3 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [x] R3 VcmINSMgr;VAIO Content Metadata Intelligent Network Service Manager;c:\program files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe;c:\program files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe [x] R3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe [x] R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x] R4 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [x] R4 ExpatSrv;Expat Shield Routing Service;c:\program files (x86)\Expat Shield\HssWPR\hsssrv.exe;c:\program files (x86)\Expat Shield\HssWPR\hsssrv.exe [x] R4 ExpatTrayService;Expat Shield Tray Service;c:\program files (x86)\Expat Shield\bin\ExpatTrayService.EXE;c:\program files (x86)\Expat Shield\bin\ExpatTrayService.EXE [x] R4 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [x] R4 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe;c:\program files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe [x] R4 uCamMonitor;CamMonitor;c:\program files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe;c:\program files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [x] R4 VMUSBArbService;VMware USB Arbitration Service;c:\program files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe;c:\program files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe [x] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x] S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x] S2 {09F57980-3432-4AFC-957D-27AC45FAE1F5};Power Control [2013/05/02 17:36];c:\program files (x86)\CyberLink\PowerDVD13\Common\NavFilter\000.fcl;c:\program files (x86)\CyberLink\PowerDVD13\Common\NavFilter\000.fcl [x] S2 AdobeActiveFileMonitor9.0;Adobe Active File Monitor V9;c:\program files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe;c:\program files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe [x] S2 Atheros Bt&Wlan Coex Agent;Atheros Bt&Wlan Coex Agent;c:\program files (x86)\Bluetooth Suite\Ath_CoexAgent.exe;c:\program files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [x] S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Bluetooth Suite\adminservice.exe;c:\program files (x86)\Bluetooth Suite\adminservice.exe [x] S2 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE;c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE [x] S2 CyberLink PowerDVD 13 Media Server Monitor Service;CyberLink PowerDVD 13 Media Server Monitor Service;c:\program files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSMonitorServicePDVD13.exe;c:\program files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSMonitorServicePDVD13.exe [x] S2 CyberLink PowerDVD 13 Media Server Service;CyberLink PowerDVD 13 Media Server Service;c:\program files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSServerPDVD13.exe;c:\program files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSServerPDVD13.exe [x] S2 ExpatShieldService;Expat Shield Service;c:\program files (x86)\Expat Shield\bin\openvpnas.exe;c:\program files (x86)\Expat Shield\bin\openvpnas.exe [x] S2 ExpatWd;Expat Shield Monitoring Service;c:\program files (x86)\Expat Shield\bin\hsswd.exe;c:\program files (x86)\Expat Shield\bin\hsswd.exe [x] S2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [x] S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x] S2 regi;regi;c:\windows\system32\drivers\regi.sys;c:\windows\SYSNATIVE\drivers\regi.sys [x] S2 rimspci;rimspci;c:\windows\system32\drivers\rimssne64.sys;c:\windows\SYSNATIVE\drivers\rimssne64.sys [x] S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x] S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x] S2 VAIO Power Management;VAIO Power Management;c:\program files\Sony\VAIO Power Management\SPMService.exe;c:\program files\Sony\VAIO Power Management\SPMService.exe [x] S2 vmci;VMware vmci;c:\windows\system32\drivers\vmci.sys;c:\windows\SYSNATIVE\drivers\vmci.sys [x] S2 VSNService;VSNService;c:\program files\Sony\VAIO Smart Network\VSNService.exe;c:\program files\Sony\VAIO Smart Network\VSNService.exe [x] S3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys;c:\windows\SYSNATIVE\DRIVERS\ArcSoftKsUFilter.sys [x] S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\drivers\btath_bus.sys;c:\windows\SYSNATIVE\drivers\btath_bus.sys [x] S3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys;c:\windows\SYSNATIVE\DRIVERS\dc3d.sys [x] S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys;c:\windows\SYSNATIVE\DRIVERS\MpNWMon.sys [x] S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x] S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\drivers\nusb3xhc.sys;c:\windows\SYSNATIVE\drivers\nusb3xhc.sys [x] S3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys;c:\windows\SYSNATIVE\DRIVERS\point64.sys [x] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x] S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\drivers\SFEP.sys;c:\windows\SYSNATIVE\drivers\SFEP.sys [x] S3 VUAgent;VUAgent;c:\program files\Sony\VAIO Update Common\VUAgent.exe;c:\program files\Sony\VAIO Update Common\VUAgent.exe [x] S3 WsAudio_Device;WsAudio_Device;c:\windows\system32\drivers\VirtualAudio.sys;c:\windows\SYSNATIVE\drivers\VirtualAudio.sys [x] . . Inhalt des "geplante Tasks" Ordners . 2013-07-05 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-03-31 11:11] . 2013-05-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3351839369-2974415085-3751294646-1001Core.job - c:\users\trishohara\AppData\Local\Google\Update\GoogleUpdate.exe [2012-02-05 19:23] . 2013-07-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3351839369-2974415085-3751294646-1001UA.job - c:\users\trishohara\AppData\Local\Google\Update\GoogleUpdate.exe [2012-02-05 19:23] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3706EE7C-3CAD-445D-8A43-03EBC3B75908}] 2012-01-04 23:02 287048 ----a-w- c:\program files (x86)\Expat Shield\HssIE\ExpatIE_64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ShareOverlay] @="{594D4122-1F87-41E2-96C7-825FB4796516}" [HKEY_CLASSES_ROOT\CLSID\{594D4122-1F87-41E2-96C7-825FB4796516}] 2010-07-29 06:15 378368 ----a-w- c:\program files\Classic Shell\ClassicExplorer64.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-12-13 13374568] "RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-11-15 2277992] "AtherosBtStack"="c:\program files (x86)\Bluetooth Suite\BtvStack.exe" [2011-07-05 947360] "AthBtTray"="c:\program files (x86)\Bluetooth Suite\AthBtTray.exe" [2011-07-05 797344] "SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU] "Classic Start Menu"="c:\program files\Classic Shell\ClassicStartMenu.exe" [2010-07-29 98304] "IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-08-01 2417032] "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 1436736] "RtHDVBg_Dolby"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-11-15 2277992] "RtHDVBg_DTS"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-11-15 2277992] . ------- Zusätzlicher Suchlauf ------- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://vaioportal.sony.eu mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = <local>;*.local IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\OFFICE11\EXCEL.EXE/3000 LSP: c:\program files (x86)\VMware\VMware Workstation\vsocklib.dll TCP: Interfaces\{E4AA3406-CA7C-4E4A-AD32-E3DDBB9ABD9C}: NameServer = 8.8.8.8 FF - ProfilePath - c:\users\trishohara\AppData\Roaming\Mozilla\Firefox\Profiles\pp3cugsz.default\ FF - prefs.js: browser.startup.homepage - hxxps://twitter.com/|hxxp://www.angrybirdsnest.com/|https://www.facebook.com/|hxxp://www.flickr.com/photos/hansolo401/|hxxp://www.fbtb.net/forums/search.php?search_id=newposts|hxxp://www.1000steine.de/de/gemeinschaft/forum/?show=1&cat=a FF - prefs.js: network.proxy.http - 216.155.139.115 FF - prefs.js: network.proxy.http_port - 3128 FF - prefs.js: network.proxy.type - 0 FF - ExtSQL: 2013-05-24 17:04; {e4a8a97b-f2ed-450b-b12d-ee082ba24781}; c:\users\trishohara\AppData\Roaming\Mozilla\Firefox\Profiles\pp3cugsz.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi . - - - - Entfernte verwaiste Registrierungseinträge - - - - . Wow6432Node-HKLM-Run-<NO NAME> - (no file) c:\users\trishohara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BBC iPlayer Desktop.lnk - c:\program files (x86)\BBC iPlayer Desktop\BBC iPlayer Desktop.exe . . . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{09F57980-3432-4AFC-957D-27AC45FAE1F5}] "ImagePath"="\??\c:\program files (x86)\CyberLink\PowerDVD13\Common\NavFilter\000.fcl" . --------------------- Gesperrte Registrierungsschluessel --------------------- . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\McAfee] "SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79, 00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\ . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Zeit der Fertigstellung: 2013-07-05 11:06:17 ComboFix-quarantined-files.txt 2013-07-05 09:06 ComboFix2.txt 2013-07-03 15:43 . Vor Suchlauf: 21 Verzeichnis(se), 172.261.580.800 Bytes frei Nach Suchlauf: 26 Verzeichnis(se), 172.899.737.600 Bytes frei . - - End Of File - - E14CE2A3B5D37E3040F533E17D93617F D41D8CD98F00B204E9800998ECF8427E |
05.07.2013, 16:56 | #6 |
/// the machine /// TB-Ausbilder | System Care Antivirus wirklich komplett entfernt? Das war ne Fehlerkennung. Einfach neu installieren Downloade Dir bitte AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ --> System Care Antivirus wirklich komplett entfernt? |
05.07.2013, 17:56 | #7 |
| System Care Antivirus wirklich komplett entfernt? Sorry, hat ein bisschen gedauert. Code:
ATTFilter # AdwCleaner v2.304 - Datei am 03/07/2013 um 17:54:28 erstellt # Aktualisiert am 03/07/2013 von Xplode # Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits) # Benutzer : trishohara - TRISHOHARA-VAIO # Bootmodus : Abgesicherter Modus mit Netzwerkunterstützung # Ausgeführt unter : C:\Users\trishohara\Downloads\adwcleaner.exe # Option [Suche] **** [Dienste] **** ***** [Dateien / Ordner] ***** Ordner Gefunden : C:\Program Files (x86)\Mozilla Firefox\Extensions\afurladvisor@anchorfree.com Ordner Gefunden : C:\Program Files (x86)\software4u Ordner Gefunden : C:\Users\trishohara\AppData\Roaming\Mozilla\Firefox\Profiles\pp3cugsz.default\jetpack Ordner Gefunden : C:\Users\trishohara\AppData\Roaming\software4u ***** [Registrierungsdatenbank] ***** Schlüssel Gefunden : HKLM\Software\DeviceVM Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{7D86A08B-0A8F-4BE0-B693-F05E6947E780} ***** [Internet Browser] ***** -\\ Internet Explorer v9.0.8112.16421 [OK] Die Registrierungsdatenbank ist sauber. -\\ Mozilla Firefox v21.0 (de) Datei : C:\Users\trishohara\AppData\Roaming\Mozilla\Firefox\Profiles\pp3cugsz.default\prefs.js [OK] Die Datei ist sauber. -\\ Google Chrome v27.0.1453.116 Datei : C:\Users\trishohara\AppData\Local\Google\Chrome\User Data\Default\Preferences [OK] Die Datei ist sauber. ************************* AdwCleaner[R1].txt - [1410 octets] - [03/07/2013 17:54:28] ########## EOF - C:\AdwCleaner[R1].txt - [1470 octets] ########## Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 4.9.4 (05.06.2013:1) OS: Windows 7 Professional x64 Ran by trishohara on 05.07.2013 at 18:49:28,32 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys ~~~ Files ~~~ Folders ~~~ FireFox Emptied folder: C:\Users\trishohara\AppData\Roaming\mozilla\firefox\profiles\pp3cugsz.default\minidumps [2 files] ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 05.07.2013 at 18:52:32,18 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-07-2013 Ran by trishohara (administrator) on 05-07-2013 18:53:28 Running from C:\Users\trishohara\Downloads Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 9 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe (Microsoft Corporation) c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation) C:\Windows\system32\WLANExt.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe (Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\adminservice.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSMonitorServicePDVD13.exe (CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSServerPDVD13.exe () C:\Program Files (x86)\Expat Shield\bin\openvpnas.exe () C:\Program Files (x86)\Expat Shield\bin\hsswd.exe (MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe (Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\VESMgr.exe (VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe (Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe (VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe (Microsoft Corporation) C:\Windows\SysWOW64\DllHost.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (Microsoft Corporation) c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe (Microsoft Corporation) C:\Windows\SysWOW64\DllHost.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe (Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe (Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3520 series\Bin\ScanToPCActivationApp.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe () C:\Program Files (x86)\WISO\Steuersoftware 2013\mshaktuell.exe (Sony Corporation) C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe (Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe (Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3520 series\Bin\HPNetworkCommunicatorCom.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMgr.exe (Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNService.exe (Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (InterVideo) C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMService.exe (Sony Corporation) C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe (Sony Corporation) C:\Program Files\Sony\VAIO Update Common\VUAgent.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe (Google Inc.) C:\Users\trishohara\AppData\Local\Google\Update\GoogleUpdate.exe (Google Inc.) C:\Users\trishohara\AppData\Local\Google\Update\GoogleUpdate.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [13374568 2011-12-13] (Realtek Semiconductor) HKLM\...\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /SONYAPO [2277992 2011-11-15] (Realtek Semiconductor) HKLM\...\Run: [AtherosBtStack] "C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe" [947360 2011-07-05] (Atheros Communications) HKLM\...\Run: [AthBtTray] "C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe" [797344 2011-07-05] (Atheros Commnucations) HKLM\...\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2531624 2011-06-22] (Synaptics Incorporated) HKLM\...\Run: [Classic Start Menu] C:\Program Files\Classic Shell\ClassicStartMenu.exe [98304 2010-07-29] (IvoSoft) HKLM\...\Run: [IntelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2417032 2011-08-01] (Microsoft Corporation) HKLM\...\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey [1436736 2011-06-15] (Microsoft Corporation) HKLM\...\Run: [RtHDVBg_Dolby] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /FORPCEE4 [2277992 2011-11-15] (Realtek Semiconductor) HKLM\...\Run: [RtHDVBg_DTS] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /DTSU2P [2277992 2011-11-15] (Realtek Semiconductor) HKCU\...\Run: [HP Deskjet 3520 series (NET)] "C:\Program Files\HP\HP Deskjet 3520 series\Bin\ScanToPCActivationApp.exe" -deviceID "CN2AN112P705SY:NW" -scfn "HP Deskjet 3520 series (NET)" -AutoStart 1 [2573416 2012-10-17] (Hewlett-Packard Co.) HKCU\...\Run: [AnyDVD] C:\Program Files (x86)\SlySoft\AnyDVD\AnyDVDtray.exe [7032920 2013-04-10] (SlySoft, Inc.) HKCU\...\Policies\system: [DisableRegistryTools] 0 HKCU\...\Policies\system: [DisableTaskMgr] 0 HKLM-x32\...\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-12] (Intel Corporation) HKLM-x32\...\Run: [ISBMgr.exe] "C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe" [2801288 2011-05-31] (Sony Corporation) HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59280 2012-11-28] (Apple Inc.) HKLM-x32\...\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2012-10-25] (Apple Inc.) HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [151952 2012-11-29] (Apple Inc.) HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Aimersoft Helper Compact.exe] C:\Program Files (x86)\Common Files\Aimersoft\Aimersoft Helper Compact\ASHelper.exe [x] HKLM-x32\...\Run: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard) HKLM-x32\...\Run: [] [x] HKLM-x32\...\Run: [PowerDVD13Agent] "C:\Program Files (x86)\CyberLink\PowerDVD13\PowerDVD13Agent.exe" [513048 2013-03-20] (CyberLink Corp.) Startup: C:\ProgramData\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> C:\Program Files (x86)\WISO\Steuersoftware 2013\mshaktuell.exe () Startup: C:\Users\trishohara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Deskjet 3520 series (Netzwerk).lnk ShortcutTarget: Tintenwarnungen überwachen - HP Deskjet 3520 series (Netzwerk).lnk -> C:\Program Files\HP\HP Deskjet 3520 series\bin\HPStatusBL.dll (Hewlett-Packard Co.) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://vaioportal.sony.eu HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch SearchScopes: HKCU - {41812E44-598A-401F-AB23-573502F38661} URL = hxxp://rover.ebay.com/rover/1/707-37276-16609-27/4?mpre=hxxp://shop.ebay.de/?oemInLn=ieSrch-Q311&_nkw={searchTerms} SearchScopes: HKCU - {DD40B60A-0114-4FB6-B335-1277870C1021} URL = hxxp://services.zinio.com/search?s={searchTerms}&rf=sonyslices BHO: Expat Shield Class - {3706EE7C-3CAD-445D-8A43-03EBC3B75908} - C:\Program Files (x86)\Expat Shield\HssIE\ExpatIE_64.dll (AnchorFree Inc.) BHO: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: Expat Shield Class - {3706EE7C-3CAD-445D-8A43-03EBC3B75908} - C:\Program Files (x86)\Expat Shield\HssIE\ExpatIE.dll (AnchorFree Inc.) BHO-x32: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft) BHO-x32: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations) BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft) Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft) Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) Handler: msdaipp - No CLSID Value - Handler-x32: msdaipp - No CLSID Value - Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - No File Winsock: Catalog9 12 C:\Program Files (x86)\VMware\VMware Workstation\vsocklib.dll [346736] (VMware, Inc.) Winsock: Catalog9 13 C:\Program Files (x86)\VMware\VMware Workstation\vsocklib.dll [346736] (VMware, Inc.) Winsock: Catalog9-x64 12 C:\Program Files (x86)\VMware\VMware Workstation\x64\vsocklib.dll [446576] (VMware, Inc.) Winsock: Catalog9-x64 13 C:\Program Files (x86)\VMware\VMware Workstation\x64\vsocklib.dll [446576] (VMware, Inc.) Tcpip\Parameters: [DhcpNameServer] 192.168.135.1 Tcpip\..\Interfaces\{E4AA3406-CA7C-4E4A-AD32-E3DDBB9ABD9C}: [NameServer]8.8.8.8 FireFox: ======== FF ProfilePath: C:\Users\trishohara\AppData\Roaming\Mozilla\Firefox\Profiles\pp3cugsz.default FF Homepage: https://twitter.com/|hxxp://www.angrybirdsnest.com/|https://www.facebook.com/|hxxp://www.flickr.com/photos/hansolo401/|hxxp://www.fbtb.net/forums/search.php?search_id=newposts|hxxp://www.1000steine.de/de/gemeinschaft/forum/?show=1&cat=a FF NetworkProxy: "http", "216.155.139.115" FF NetworkProxy: "http_port", 3128 FF NetworkProxy: "no_proxies_on", "localhost, 127.0.0.1, stealthy.co" FF NetworkProxy: "share_proxy_settings", true FF NetworkProxy: "type", 0 FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll () FF Plugin: @java.com/DTPlugin,version=10.2.1 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.2.1 - C:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\new_plugin\npjp2.dll (Oracle Corporation) FF Plugin: @microsoft.com/GENUINE - disabled No File FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll () FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF Plugin-x32: @microsoft.com/GENUINE - disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF Plugin-x32: @SonyCreativeSoftware.com/Media Go,version=1.0 - C:\Program Files (x86)\Sony\Media Go\npmediago.dll (Sony Network Entertainment International LLC) FF Plugin-x32: @videolan.org/vlc,version=2.0.6 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\trishohara\AppData\Local\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\trishohara\AppData\Local\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101721.dll (Amazon.com, Inc.) FF Extension: British English Dictionary - C:\Users\trishohara\AppData\Roaming\Mozilla\Firefox\Profiles\pp3cugsz.default\Extensions\en-GB@dictionaries.addons.mozilla.org FF Extension: Echofon - C:\Users\trishohara\AppData\Roaming\Mozilla\Firefox\Profiles\pp3cugsz.default\Extensions\twitternotifier@naan.net FF Extension: ColorZilla - C:\Users\trishohara\AppData\Roaming\Mozilla\Firefox\Profiles\pp3cugsz.default\Extensions\{6AC85730-7D0F-4de0-B3FA-21142DD85326} FF Extension: DownloadHelper - C:\Users\trishohara\AppData\Roaming\Mozilla\Firefox\Profiles\pp3cugsz.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} FF Extension: compatibility - C:\Users\trishohara\AppData\Roaming\Mozilla\Firefox\Profiles\pp3cugsz.default\Extensions\compatibility@addons.mozilla.org.xpi FF Extension: firebug - C:\Users\trishohara\AppData\Roaming\Mozilla\Firefox\Profiles\pp3cugsz.default\Extensions\firebug@software.joehewitt.com.xpi FF Extension: No Name - C:\Users\trishohara\AppData\Roaming\Mozilla\Firefox\Profiles\pp3cugsz.default\Extensions\{75CEEE46-9B64-46f8-94BF-54012DE155F0}.xpi FF Extension: No Name - C:\Users\trishohara\AppData\Roaming\Mozilla\Firefox\Profiles\pp3cugsz.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi FF Extension: No Name - C:\Users\trishohara\AppData\Roaming\Mozilla\Firefox\Profiles\pp3cugsz.default\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} Chrome: ======= CHR HomePage: hxxp://www.google.com/ CHR DefaultSearchURL: (Google) - {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms} CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms} CHR Plugin: (Remoting Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Users\trishohara\AppData\Local\Google\Chrome\Application\16.0.912.77\ppGoogleNaClPluginChrome.dll No File CHR Plugin: (Chrome PDF Viewer) - C:\Users\trishohara\AppData\Local\Google\Chrome\Application\16.0.912.77\pdf.dll No File CHR Plugin: (Shockwave Flash) - C:\Users\trishohara\AppData\Local\Google\Chrome\Application\16.0.912.77\gcswf32.dll No File CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll No File CHR Plugin: (Java Deployment Toolkit 6.0.260.3) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll (Sun Microsystems, Inc.) CHR Plugin: (Java(TM) Platform SE 6 U26) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) CHR Plugin: (Media Go Detector) - C:\Program Files (x86)\Sony\Media Go\npmediago.dll (Sony Network Entertainment International LLC) CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () CHR Plugin: (Google Update) - C:\Users\trishohara\AppData\Local\Google\Update\1.3.21.99\npGoogleUpdate3.dll No File CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll No File CHR Plugin: (Default Plug-in) - default_plugin No File CHR Extension: (Angry Birds) - C:\Users\trishohara\AppData\Local\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj\1.1.2.1_0 CHR Extension: (YouTube) - C:\Users\trishohara\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2_0 CHR Extension: (Google Search) - C:\Users\trishohara\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.14_0 CHR Extension: (Gmail) - C:\Users\trishohara\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\6.1.3_0 ==================== Services (Whitelisted) ================= S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.) R2 Atheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [138400 2011-07-05] (Atheros) R2 CyberLink PowerDVD 13 Media Server Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSMonitorServicePDVD13.exe [77576 2013-03-20] (CyberLink) R2 CyberLink PowerDVD 13 Media Server Service; C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSServerPDVD13.exe [323336 2013-03-20] (CyberLink) R2 ExpatShieldService; C:\Program Files (x86)\Expat Shield\bin\openvpnas.exe [331608 2011-12-29] () S4 ExpatTrayService; C:\Program Files (x86)\Expat Shield\bin\ExpatTrayService.EXE [77520 2012-01-06] () R2 ExpatWd; C:\Program Files (x86)\Expat Shield\bin\hsswd.exe [329544 2012-01-05] () R2 MsMpSvc; c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe [12784 2011-04-27] (Microsoft Corporation) R3 NisSrv; c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [288272 2011-04-27] (Microsoft Corporation) S4 uCamMonitor; C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [105024 2011-02-23] (ArcSoft, Inc.) S4 ufad-ws60; C:\Program Files (x86)\VMware\VMware Workstation\vmware-ufad.exe [191024 2010-08-19] (VMware, Inc.) S2 McAfee SiteAdvisor Service; c:\PROGRA~2\mcafee\SITEAD~1\mcsacore.exe [x] ==================== Drivers (Whitelisted) ==================== R3 AnyDVD; C:\Windows\System32\Drivers\AnyDVD.sys [142424 2013-03-18] (SlySoft, Inc.) R3 ArcSoftKsUFilter; C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys [19968 2009-05-26] (ArcSoft, Inc.) R1 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [189440 2011-04-18] (Microsoft Corporation) R3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [84864 2011-04-27] (Microsoft Corporation) R2 risdsnpe; C:\Windows\system32\drivers\risdsnxc64.sys [98816 2011-06-23] (REDC) R2 vstor2-ws60; C:\Program Files (x86)\VMware\VMware Workstation\vstor2-ws60.sys [32816 2010-08-19] (VMware, Inc.) R2 vstor2-ws60; C:\Program Files (x86)\VMware\VMware Workstation\vstor2-ws60.sys [32816 2010-08-19] (VMware, Inc.) R3 WsAudio_Device; C:\Windows\System32\drivers\VirtualAudio.sys [31080 2013-01-08] (Wondershare) R2 {09F57980-3432-4AFC-957D-27AC45FAE1F5}; C:\Program Files (x86)\CyberLink\PowerDVD13\Common\NavFilter\000.fcl [130320 2013-03-19] (CyberLink Corp.) R2 {09F57980-3432-4AFC-957D-27AC45FAE1F5}; C:\Program Files (x86)\CyberLink\PowerDVD13\Common\NavFilter\000.fcl [130320 2013-03-19] (CyberLink Corp.) S3 catchme; \??\C:\ComboFix\catchme.sys [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-07-05 18:52 - 2013-07-05 18:52 - 00000766 ____A C:\Users\trishohara\Desktop\JRT.txt 2013-07-05 18:07 - 2013-07-05 18:07 - 00650027 ____A C:\Users\trishohara\Downloads\adwcleaner.exe 2013-07-05 18:07 - 2013-07-05 18:07 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\trishohara\Downloads\JRT.exe 2013-07-05 11:06 - 2013-07-05 11:06 - 00024607 ____A C:\ComboFix.txt 2013-07-05 10:54 - 2013-07-05 11:08 - 00000000 ____D C:\ComboFix 2013-07-05 10:54 - 2011-06-26 08:45 - 00256000 ____A C:\Windows\PEV.exe 2013-07-05 10:54 - 2010-11-07 19:20 - 00208896 ____A C:\Windows\MBR.exe 2013-07-05 10:54 - 2009-04-20 06:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe 2013-07-05 10:54 - 2000-08-31 02:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe 2013-07-05 10:54 - 2000-08-31 02:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe 2013-07-05 10:54 - 2000-08-31 02:00 - 00098816 ____A C:\Windows\sed.exe 2013-07-05 10:54 - 2000-08-31 02:00 - 00080412 ____A C:\Windows\grep.exe 2013-07-05 10:54 - 2000-08-31 02:00 - 00068096 ____A C:\Windows\zip.exe 2013-07-05 10:45 - 2013-07-05 10:45 - 05085494 ____R (Swearware) C:\Users\trishohara\Downloads\ComboFix.exe 2013-07-05 10:31 - 2013-07-05 10:34 - 156721576 ____N (Symantec Corporation) C:\Users\trishohara\Downloads\NIS-TW-30-20-3-0-36-GE.exe 2013-07-05 10:10 - 2013-07-05 10:11 - 01934636 ____A (Farbar) C:\Users\trishohara\Downloads\FRST64.exe 2013-07-03 21:38 - 2013-07-03 21:41 - 109927703 ____A (Symantec Corporation) C:\Users\trishohara\Downloads\NAV-TW-30-20-3-0-36-GE.exe 2013-07-03 21:36 - 2013-07-03 21:36 - 00000041 ____A C:\Users\trishohara\AppData\Roaming\mbam.context.scan 2013-07-03 21:30 - 2013-07-03 21:35 - 172886528 ____A (Symantec Corporation) C:\Users\trishohara\Downloads\NAV-TW-30-20-3-0-36-GE.exe.part 2013-07-03 20:37 - 2013-07-03 20:38 - 00000000 ____D C:\67abfb933ea67e8babbc1c7dd37b9796 2013-07-03 20:23 - 2013-07-03 20:23 - 00000540 ____A C:\Users\trishohara\Downloads\virus.txt 2013-07-03 18:08 - 2013-07-03 18:08 - 00000000 ____D C:\Program Files (x86)\ESET 2013-07-03 18:07 - 2013-07-03 18:07 - 00001960 ____A C:\Users\trishohara\Desktop\RKreport[0]_S_07032013_180734.txt 2013-07-03 18:07 - 2013-07-03 18:07 - 00001209 ____A C:\Users\trishohara\Desktop\RKreport[0]_PR_07032013_180737.txt 2013-07-03 18:06 - 2013-07-03 18:06 - 00001896 ____A C:\Users\trishohara\Desktop\RKreport[0]_S_07032013_180623.txt 2013-07-03 18:06 - 2013-07-03 18:06 - 00001087 ____A C:\Users\trishohara\Desktop\RKreport[0]_H_07032013_180633.txt 2013-07-03 18:05 - 2013-07-03 18:05 - 00002061 ____A C:\Users\trishohara\Desktop\RKreport[0]_D_07032013_180527.txt 2013-07-03 18:05 - 2013-07-03 18:05 - 00001955 ____A C:\Users\trishohara\Desktop\RKreport[0]_S_07032013_180506.txt 2013-07-03 17:59 - 2013-07-03 17:59 - 00000000 ____D C:\Windows\ERUNT 2013-07-03 17:58 - 2013-07-05 18:48 - 00000000 ____D C:\JRT 2013-07-03 17:54 - 2013-07-03 17:54 - 00001539 ____A C:\AdwCleaner[R1].txt 2013-07-03 17:50 - 2013-07-03 17:50 - 00002962 ____A C:\Users\trishohara\Desktop\RKreport[0]_D_07032013_175047.txt 2013-07-03 17:50 - 2013-07-03 17:50 - 00002781 ____A C:\Users\trishohara\Desktop\RKreport[0]_S_07032013_175024.txt 2013-07-03 17:49 - 2013-07-03 21:13 - 00000000 ____D C:\Users\trishohara\Desktop\RK_Quarantine 2013-07-03 17:20 - 2013-07-05 11:06 - 00000000 ____D C:\Qoobox 2013-07-03 17:20 - 2013-07-05 11:05 - 00000000 ____D C:\Windows\erdnt 2013-07-03 17:13 - 2013-07-05 18:03 - 00032883 ____A C:\Users\trishohara\Downloads\Addition.txt 2013-07-03 17:12 - 2013-07-03 17:12 - 00000000 ____D C:\FRST 2013-06-29 13:29 - 2013-06-29 13:29 - 02367452 ____A C:\Users\trishohara\Downloads\bewerbungsunterlagen.zip 2013-06-21 20:13 - 2013-06-21 20:13 - 00000000 ____D C:\Users\trishohara\restore 2013-06-21 15:59 - 2013-06-26 13:00 - 00000000 ____D C:\ProgramData\tmp 2013-06-21 15:59 - 2013-06-21 21:22 - 00000000 ____D C:\ProgramData\hps 2013-06-21 15:53 - 2013-06-21 15:53 - 00000000 ____D C:\Program Files (x86)\CEWE COLOR 2013-06-21 12:42 - 2013-06-21 14:31 - 00025088 ____A C:\Users\trishohara\Documents\Mama_Tabletten_Juni2013_2.xls 2013-06-10 16:15 - 2013-06-10 16:15 - 00019456 ____A C:\Users\trishohara\Documents\Mama_Tabletten_Juni2013.xls ==================== One Month Modified Files and Folders ======= 2013-07-05 18:53 - 2012-02-05 21:23 - 00001140 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3351839369-2974415085-3751294646-1001UA.job 2013-07-05 18:52 - 2013-07-05 18:52 - 00000766 ____A C:\Users\trishohara\Desktop\JRT.txt 2013-07-05 18:49 - 2009-07-14 06:45 - 00026112 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-07-05 18:49 - 2009-07-14 06:45 - 00026112 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-07-05 18:48 - 2013-07-03 17:58 - 00000000 ____D C:\JRT 2013-07-05 18:46 - 2011-12-06 19:44 - 01836735 ____A C:\Windows\WindowsUpdate.log 2013-07-05 18:46 - 2011-08-13 00:32 - 00705888 ____A C:\Windows\System32\perfh007.dat 2013-07-05 18:46 - 2011-08-13 00:32 - 00151918 ____A C:\Windows\System32\perfc007.dat 2013-07-05 18:46 - 2009-07-14 07:13 - 01638732 ____A C:\Windows\System32\PerfStringBackup.INI 2013-07-05 18:43 - 2012-01-29 15:20 - 00000000 ____D C:\Users\trishohara\Documents\Mein Steuer-Sparbuch Heute 2013-07-05 18:42 - 2013-05-02 16:47 - 00000040 ___SH C:\ProgramData\.zreglib 2013-07-05 18:42 - 2013-04-23 18:03 - 00000000 ____D C:\Users\trishohara\AppData\Local\Apps\2.0 2013-07-05 18:41 - 2011-12-07 19:50 - 00000000 ____D C:\ProgramData\VMware 2013-07-05 18:41 - 2011-08-12 14:52 - 00000000 ____D C:\ProgramData\NVIDIA 2013-07-05 18:41 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT 2013-07-05 18:41 - 2009-07-14 06:51 - 00056013 ____A C:\Windows\setupact.log 2013-07-05 18:40 - 2010-11-21 05:47 - 00215536 ____A C:\Windows\PFRO.log 2013-07-05 18:07 - 2013-07-05 18:07 - 00650027 ____A C:\Users\trishohara\Downloads\adwcleaner.exe 2013-07-05 18:07 - 2013-07-05 18:07 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\trishohara\Downloads\JRT.exe 2013-07-05 18:05 - 2011-12-06 20:23 - 00000000 ____D C:\Users\trishohara\Documents\Bluetooth Folder 2013-07-05 18:03 - 2013-07-03 17:13 - 00032883 ____A C:\Users\trishohara\Downloads\Addition.txt 2013-07-05 17:49 - 2012-02-05 21:23 - 00001088 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3351839369-2974415085-3751294646-1001Core.job 2013-07-05 17:41 - 2013-03-31 13:11 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-07-05 11:08 - 2013-07-05 10:54 - 00000000 ____D C:\ComboFix 2013-07-05 11:08 - 2013-05-02 19:17 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-07-05 11:06 - 2013-07-05 11:06 - 00024607 ____A C:\ComboFix.txt 2013-07-05 11:06 - 2013-07-03 17:20 - 00000000 ____D C:\Qoobox 2013-07-05 11:05 - 2013-07-03 17:20 - 00000000 ____D C:\Windows\erdnt 2013-07-05 11:04 - 2009-07-14 04:34 - 00000215 ____A C:\Windows\system.ini 2013-07-05 10:45 - 2013-07-05 10:45 - 05085494 ____R (Swearware) C:\Users\trishohara\Downloads\ComboFix.exe 2013-07-05 10:41 - 2013-03-31 13:41 - 17018248 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe 2013-07-05 10:41 - 2013-03-31 13:11 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2013-07-05 10:41 - 2011-08-12 15:06 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2013-07-05 10:34 - 2013-07-05 10:31 - 156721576 ____N (Symantec Corporation) C:\Users\trishohara\Downloads\NIS-TW-30-20-3-0-36-GE.exe 2013-07-05 10:11 - 2013-07-05 10:10 - 01934636 ____A (Farbar) C:\Users\trishohara\Downloads\FRST64.exe 2013-07-05 10:06 - 2009-07-14 06:45 - 00446336 ____A C:\Windows\System32\FNTCACHE.DAT 2013-07-03 21:41 - 2013-07-03 21:38 - 109927703 ____A (Symantec Corporation) C:\Users\trishohara\Downloads\NAV-TW-30-20-3-0-36-GE.exe 2013-07-03 21:36 - 2013-07-03 21:36 - 00000041 ____A C:\Users\trishohara\AppData\Roaming\mbam.context.scan 2013-07-03 21:35 - 2013-07-03 21:30 - 172886528 ____A (Symantec Corporation) C:\Users\trishohara\Downloads\NAV-TW-30-20-3-0-36-GE.exe.part 2013-07-03 21:16 - 2011-12-06 19:45 - 00000000 ____D C:\users\trishohara 2013-07-03 21:14 - 2012-05-31 19:46 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-07-03 21:14 - 2012-05-03 21:39 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2013-07-03 21:14 - 2012-02-13 21:21 - 00000000 ____D C:\Windows\System32\Macromed 2013-07-03 21:14 - 2012-02-06 13:43 - 00000000 ____D C:\Program Files\Oracle 2013-07-03 21:14 - 2012-01-17 21:20 - 00000000 ____D C:\Users\trishohara\AppData\Roaming\vlc 2013-07-03 21:14 - 2011-12-10 15:20 - 00000000 ____D C:\Program Files (x86)\IrfanView 2013-07-03 21:14 - 2011-12-10 15:18 - 00000000 ____D C:\Users\trishohara\AppData\Roaming\Notepad++ 2013-07-03 21:14 - 2011-08-12 14:56 - 00000000 ____D C:\Program Files\Java 2013-07-03 21:14 - 2011-08-12 14:53 - 00000000 ____D C:\ProgramData\Atheros 2013-07-03 21:14 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\System32\NDF 2013-07-03 21:13 - 2013-07-03 17:49 - 00000000 ____D C:\Users\trishohara\Desktop\RK_Quarantine 2013-07-03 21:13 - 2011-12-07 18:43 - 00000000 ____D C:\Users\trishohara\AppData\Local\Thunderbird 2013-07-03 21:13 - 2011-12-06 22:33 - 00000000 ____D C:\Users\trishohara\AppData\Roaming\Mozilla 2013-07-03 21:13 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration 2013-07-03 21:11 - 2012-02-19 12:14 - 00000000 ____D C:\ProgramData\CyberLink 2013-07-03 21:11 - 2012-02-05 21:23 - 00000000 ____D C:\Users\trishohara\AppData\Local\Google 2013-07-03 21:11 - 2011-08-12 15:01 - 00000000 ____D C:\ProgramData\Sony Corporation 2013-07-03 21:10 - 2011-08-12 14:57 - 00000000 ____D C:\Program Files (x86)\Java 2013-07-03 20:38 - 2013-07-03 20:37 - 00000000 ____D C:\67abfb933ea67e8babbc1c7dd37b9796 2013-07-03 20:23 - 2013-07-03 20:23 - 00000540 ____A C:\Users\trishohara\Downloads\virus.txt 2013-07-03 20:22 - 2012-05-05 18:46 - 00000000 ____D C:\Windows\System32\appmgmt 2013-07-03 18:08 - 2013-07-03 18:08 - 00000000 ____D C:\Program Files (x86)\ESET 2013-07-03 18:07 - 2013-07-03 18:07 - 00001960 ____A C:\Users\trishohara\Desktop\RKreport[0]_S_07032013_180734.txt 2013-07-03 18:07 - 2013-07-03 18:07 - 00001209 ____A C:\Users\trishohara\Desktop\RKreport[0]_PR_07032013_180737.txt 2013-07-03 18:06 - 2013-07-03 18:06 - 00001896 ____A C:\Users\trishohara\Desktop\RKreport[0]_S_07032013_180623.txt 2013-07-03 18:06 - 2013-07-03 18:06 - 00001087 ____A C:\Users\trishohara\Desktop\RKreport[0]_H_07032013_180633.txt 2013-07-03 18:05 - 2013-07-03 18:05 - 00002061 ____A C:\Users\trishohara\Desktop\RKreport[0]_D_07032013_180527.txt 2013-07-03 18:05 - 2013-07-03 18:05 - 00001955 ____A C:\Users\trishohara\Desktop\RKreport[0]_S_07032013_180506.txt 2013-07-03 17:59 - 2013-07-03 17:59 - 00000000 ____D C:\Windows\ERUNT 2013-07-03 17:54 - 2013-07-03 17:54 - 00001539 ____A C:\AdwCleaner[R1].txt 2013-07-03 17:50 - 2013-07-03 17:50 - 00002962 ____A C:\Users\trishohara\Desktop\RKreport[0]_D_07032013_175047.txt 2013-07-03 17:50 - 2013-07-03 17:50 - 00002781 ____A C:\Users\trishohara\Desktop\RKreport[0]_S_07032013_175024.txt 2013-07-03 17:12 - 2013-07-03 17:12 - 00000000 ____D C:\FRST 2013-07-01 16:47 - 2012-01-12 13:29 - 00036352 ____A C:\Users\trishohara\Documents\monatlAusgaben.xls 2013-06-29 13:29 - 2013-06-29 13:29 - 02367452 ____A C:\Users\trishohara\Downloads\bewerbungsunterlagen.zip 2013-06-26 13:00 - 2013-06-21 15:59 - 00000000 ____D C:\ProgramData\tmp 2013-06-24 12:18 - 2011-12-10 15:05 - 00000000 ____D C:\Users\trishohara\Documents\Eigene PSP-Dateien 2013-06-22 21:21 - 2012-03-14 19:03 - 00000000 ____D C:\Users\trishohara\AppData\Local\CrashDumps 2013-06-21 21:22 - 2013-06-21 15:59 - 00000000 ____D C:\ProgramData\hps 2013-06-21 20:13 - 2013-06-21 20:13 - 00000000 ____D C:\Users\trishohara\restore 2013-06-21 15:53 - 2013-06-21 15:53 - 00000000 ____D C:\Program Files (x86)\CEWE COLOR 2013-06-21 14:31 - 2013-06-21 12:42 - 00025088 ____A C:\Users\trishohara\Documents\Mama_Tabletten_Juni2013_2.xls 2013-06-10 16:15 - 2013-06-10 16:15 - 00019456 ____A C:\Users\trishohara\Documents\Mama_Tabletten_Juni2013.xls 2013-06-10 16:13 - 2013-05-07 18:15 - 00025088 ____A C:\Users\trishohara\Documents\Mama_Tabletten_Mai2013.xls ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-07-04 10:00 ==================== End Of Log ============================ Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 04-07-2013 Ran by trishohara at 2013-07-05 18:53:53 Running from C:\Users\trishohara\Downloads Boot Mode: Normal ========================================================== ==================== Installed Programs ======================= ?????? Windows Live (x32 Version: 15.4.3502.0922) ??????? ????????? Windows Live Mesh ActiveX ??? ?????????? ?????????? (x32 Version: 15.4.5722.2) ??????? ?????????? Windows Live Mesh ActiveX ??? ????????? ??????????? (x32 Version: 15.4.5722.2) ???????? ?????????? Windows Live (x32 Version: 15.4.3502.0922) ?????????? Windows Live (x32 Version: 15.4.3502.0922) ??????????? ?? Windows Live (x32 Version: 15.4.3502.0922) ???????????? Windows Live (x32 Version: 15.4.3502.0922) 7-Zip 9.20 (x32) Adobe AIR (x32 Version: 2.7.0.19460) Adobe Community Help (x32 Version: 3.2.1) Adobe Community Help (x32 Version: 3.2.1.650) Adobe Flash Player 11 ActiveX (x32 Version: 11.7.700.224) Adobe Flash Player 11 Plugin (x32 Version: 11.7.700.202) Adobe Photoshop Elements 9 (x32 Version: 9.0) Adobe Premiere Elements 9 (x32 Version: 9.0) Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03) Aimersoft Video Converter Ultimate(Build 5.0.1.0) (x32 Version: 5.0.1.0) Amazon MP3-Downloader 1.0.17 (x32 Version: 1.0.17) Android SDK Tools (x32 Version: 1.14) Angry Birds Seasons (x32 Version: 2.2.0) AnyDVD (x32 Version: 7.1.8.0) Apple Application Support (x32 Version: 2.3.2) Apple Mobile Device Support (Version: 6.0.1.3) Apple Software Update (x32 Version: 2.1.3.127) ArcSoft Magic-i Visual Effects 2 (x32 Version: 2.0.149) ArcSoft WebCam Companion 4 (x32 Version: 4.0.444) Atheros WiFi Driver Installation (x32 Version: 3.0) AVIcodec (remove only) (x32) BBC iPlayer Desktop (x32 Version: 3.2.15) Bing Bar (x32 Version: 7.0.850.0) Bluetooth Win7 Suite (64) (Version: 7.04.000.82) Bonjour (Version: 3.0.0.10) BrickStore (x32 Version: 1.1.16) Classic Shell (Version: 2.8.3) Compatibility Pack for the 2007 Office system (x32 Version: 12.0.6514.5001) Corel WinDVD (x32 Version: 10.0.6.108) Corel WinDVD (x32 Version: 11) Corel WinDVD Pro 11 (x32 Version: 11.0.0.342) CSS3 Menu (x32) CyberLink PowerDVD 13 (x32 Version: 13.0.2720.57) D3DX10 (x32 Version: 15.4.2368.0902) Dolby Home Theater v4 (x32 Version: 7.2.7000.6) DVD Shrink 3.2 (x32) Elements 9 Organizer (x32 Version: 9.0) Elements STI Installer (x32 Version: 1.0) Evernote v. 4.4 (x32 Version: 4.4.0.4848) Expat Shield 2.24 (x32 Version: 2.24) FileZilla Client 3.5.3 (x32 Version: 3.5.3) Firebird SQL Server - MAGIX Edition (x32 Version: 2.1.27.0) Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922) Galeria fotografii uslugi Windows Live (x32 Version: 15.4.3502.0922) Galerie de photos Windows Live (x32 Version: 15.4.3502.0922) Galerie foto Windows Live (x32 Version: 15.4.3502.0922) Google Chrome (HKCU Version: 26.0.1410.64) HP Deskjet 3520 series - Grundlegende Software für das Gerät (Version: 28.0.1315.0) HP Deskjet 3520 series Hilfe (x32 Version: 27.0.0) HP Deskjet 3520 series Setup Guide (x32 Version: 27.0.0) HP FWUpdateEDO2 (x32 Version: 1.2.0.0) HP Photo Creations (x32 Version: 1.0.0.7702) HP Update (x32 Version: 5.003.003.001) HPDiagnosticAlert (x32 Version: 1.00.0000) ICA (x32 Version: 1.0) iDevice Manager (x32 Version: 1.2.1.0) iExplorer 2.2.1.3 (x32) Intel(R) Management Engine Components (x32 Version: 7.0.0.1144) Intel(R) Rapid Storage Technology (x32 Version: 10.1.2.1004) IPM (x32 Version: 1.00.0000) IrfanView (remove only) (x32) iTunes (Version: 11.0.0.163) Jasc Paint Shop Pro 9 (x32 Version: 9.00.0000) Java Auto Updater (x32 Version: 2.0.5.1) Java(TM) 6 Update 26 (64-bit) (Version: 6.0.260) Java(TM) 6 Update 26 (x32 Version: 6.0.260) Java(TM) 7 Update 2 (64-bit) (Version: 7.0.20) Java(TM) SE Development Kit 7 Update 2 (64-bit) (Version: 1.7.0.20) JavaFX 2.0.2 (64-bit) (Version: 2.0.2) JavaFX 2.0.2 SDK (64-bit) (Version: 2.0.2) Junk Mail filter update (x32 Version: 15.4.3502.0922) LEGO® Star Wars™: Die Komplette Saga (x32 Version: 1.00.0000) LEGO® Star Wars™: The Complete Saga (x32 Version: 1.00.0000) MAGIX Screenshare (x32 Version: 4.3.6.1987) MAGIX Speed burnR (MSI) (x32 Version: 7.0.2.6) MAGIX Video deluxe MX Premium (x32 Version: 11.0.0.42) Malwarebytes Anti-Malware Version 1.61.0.1400 (x32 Version: 1.61.0.1400) Media Gallery (Version: 1.5.0.17250) Media Go (x32 Version: 1.7.254) Mesh Runtime (x32 Version: 15.4.5722.2) Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319) Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319) Microsoft .NET Framework 4.5 (Version: 4.5.50709) Microsoft Antimalware (Version: 3.0.8402.2) Microsoft Antimalware Service DE-DE Language Pack (Version: 3.0.8402.2) Microsoft Application Error Reporting (Version: 12.0.6015.5000) Microsoft IntelliPoint 8.2 (Version: 8.20.468.0) Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003) Microsoft Office Professional Edition 2003 (x32 Version: 11.0.8173.0) Microsoft Security Client (Version: 2.1.1116.0) Microsoft Security Client DE-DE Language Pack (Version: 2.1.1116.0) Microsoft Security Essentials (Version: 2.1.1116.0) Microsoft Silverlight (x32 Version: 4.1.10329.0) Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219) Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053) Microsoft_VC80_MFC_x86 (x32 Version: 8.0.50727.4053) Microsoft_VC80_MFCLOC_x86 (x32 Version: 8.0.50727.4053) Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000) Mozilla Firefox 20.0.1 (x86 de) (x32 Version: 20.0.1) Mozilla Maintenance Service (x32 Version: 20.0.1) Mozilla Thunderbird 9.0.1 (x86 de) (x32 Version: 9.0.1) MSVCRT (x32 Version: 15.4.2862.0708) MSVCRT_amd64 (x32 Version: 15.4.2862.0708) MSXML 4.0 SP3 Parser (KB973685) (x32 Version: 4.30.2107.0) MSXML 4.0 SP3 Parser (x32 Version: 4.30.2100.0) Notepad++ (x32 Version: 5.9.6.2) NVIDIA 3D Vision Treiber 268.93 (Version: 268.93) NVIDIA 3D Vision Video Player (x32 Version: 1.6.9) NVIDIA Grafiktreiber 268.93 (Version: 268.93) NVIDIA HD-Audiotreiber 1.2.22.1 (Version: 1.2.22.1) NVIDIA Install Application (Version: 2.265.42.0) NVIDIA PhysX (x32 Version: 9.10.0514) NVIDIA PhysX-Systemsoftware 9.10.0514 (Version: 9.10.0514) NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.12.6893) NVIDIA Systemsteuerung 268.93 (Version: 268.93) Ovládací prvek ActiveX platformy Windows Live Mesh pro vzdálená pripojení (x32 Version: 15.4.5722.2) Ovládací prvok ActiveX programu Windows Live Mesh pre vzdialené pripojenia (x32 Version: 15.4.5722.2) Pazera Free MP4 to AVI Converter 1.6 (x32 Version: 1.6) PlayStation(R)Network Downloader (x32 Version: 2.05.00710) PlayStation(R)Store (x32 Version: 4.1.8.11883) PMB (x32 Version: 5.6.01.03300) PMB VAIO Edition Plug-in (Version: 1.5.10.05300) PMB VAIO Edition Plug-in (x32 Version: 1.6.00.06010) Poczta uslugi Windows Live (x32 Version: 15.4.3502.0922) Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922) Portal (x32) Portal 2 (x32) PowerDVD (x32) Quick Web Access (x32 Version: 1.4.6.10) QuickTime (x32 Version: 7.73.80.64) Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922) Realtek High Definition Audio Driver (x32 Version: 6.0.1.6526) Remote Keyboard (x32 Version: 1.1.1.07060) Remote Play with PlayStation 3 (x32 Version: 1.1.0.15072) Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.32.0) S?????? f?t???af??? t?? Windows Live (x32 Version: 15.4.3502.0922) Setup (x32 Version: 11.0) Skype™ 5.1 (x32 Version: 5.1.104) SmartSound Quicktracks for Premiere Elements 9.0 (x32 Version: 3.12.3090) Sony Corporation (Version: 1.0.0) SourceTree (HKCU Version: 0.9.1.0) SSLx64 (Version: 1.0.0) SSLx86 (x32 Version: 1.0.0) St???e?? e?????? ActiveX t?? Windows Live Mesh ??a ap?µa???sµ??e? s??d?se?? (x32 Version: 15.4.5722.2) Star Wars Knights of the Old Republic (x32 Version: 1.0) Steam (x32 Version: 1.0.0.0) StreamTransport version: 1.0.2.2171 (x32) Studie zur Verbesserung von HP Deskjet 3520 series Produkten (Version: 28.0.1315.0) SUPER © v2011.build.49 (July 1st, 2011) Version v2011.build.49 (x32 Version: v2011.build.49) Synaptics Pointing Device Driver (Version: 15.2.6.0) tools-freebsd (x32 Version: 8.4.6.16648) tools-linux (x32 Version: 8.4.6.16648) tools-netware (x32 Version: 8.4.6.16648) tools-solaris (x32 Version: 8.4.6.16648) tools-windows (x32 Version: 8.4.6.16648) tools-winPre2k (x32 Version: 8.4.6.16648) TVO version 3.7 (x32 Version: 3.7) TweetDeck (x32 Version: 1.0.0) Uzak Baglantilar Için Windows Live Mesh ActiveX Denetimi (x32 Version: 15.4.5722.2) V3DPX86 (x32 Version: 1.0.0) VAIO - Media Gallery (x32 Version: 1.5.0.18100) VAIO - PMB VAIO Edition Guide (x32 Version: 1.6.00.06030) VAIO - PMB VAIO Edition Plug-in (x32 Version: 1.6.00.06140) VAIO - Remote Play mit PlayStation®3 (x32 Version: 1.1.0.15072) VAIO - Remote-Tastatur (x32 Version: 1.1.0.07060) VAIO 3D Portal (x32 Version: 1.1.0.06232) VAIO Control Center (x32 Version: 5.0.0.07070) VAIO Data Restore Tool (x32 Version: 1.7.0.05270) VAIO Easy Connect (x32 Version: 1.0.0.03050) VAIO Gate (x32 Version: 2.4.0.06210) VAIO Gate Default (x32 Version: 2.5.0.07080) VAIO Hero Screensaver - Fall 2011 Screensaver (x32) VAIO Improvement (x32 Version: 1.1.0.06030) VAIO Improvement Validation (Version: 1.0.4.01190) VAIO Sample Contents (x32 Version: 1.4.2.09010) VAIO Smart Network (x32 Version: 3.7.0.07150) VAIO Update (x32 Version: 5.5.0.06290) VAIO Update Merge Module x64 (Version: 5.5.06290) VAIO-Handbuch (x32 Version: 1.4.0.05310) VAIO-Support für Übertragungen (x32 Version: 1.4.0.14230) VCCx64 (Version: 1.0.0) VCCx86 (x32 Version: 1.0.0) VHD (x32 Version: 1.0.0) VIx64 (Version: 1.0.0) VIx86 (x32 Version: 1.0.0) VLC media player 2.0.6 (x32 Version: 2.0.6) VMware Workstation (x32 Version: 7.1.4.16648) VPMx64 (Version: 1.0.0) VSNx64 (Version: 1.0.0) VSNx86 (x32 Version: 1.0.0) VWSTx86 (x32 Version: 1.0.0) Winamp (Remove Only) (x32) Windows Live Communications Platform (x32 Version: 15.4.3502.0922) Windows Live Essentials (x32 Version: 15.4.3502.0922) Windows Live Essentials (x32 Version: 15.4.3508.1109) Windows Live Fotogaléria (x32 Version: 15.4.3502.0922) Windows Live Fotogalerie (x32 Version: 15.4.3502.0922) Windows Live Fotogalleri (x32 Version: 15.4.3502.0922) Windows Live Fotograf Galerisi (x32 Version: 15.4.3502.0922) Windows Live Fotótár (x32 Version: 15.4.3502.0922) Windows Live ID Sign-in Assistant (Version: 7.250.4225.0) Windows Live Installer (x32 Version: 15.4.3502.0922) Windows Live Language Selector (Version: 15.4.3508.1109) Windows Live Mail (x32 Version: 15.4.3502.0922) Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen (x32 Version: 15.4.5722.2) Windows Live Mesh (x32 Version: 15.4.3502.0922) Windows Live Mesh ActiveX control for remote connections (x32 Version: 15.4.5722.2) Windows Live Mesh ActiveX Control for Remote Connections (x32 Version: 15.4.5722.2) Windows Live Mesh ActiveX-kontroll for eksterne tilkoblinger (x32 Version: 15.4.5722.2) Windows Live Mesh ActiveX-objekt til fjernforbindelser (x32 Version: 15.4.5722.2) Windows Live Mesh ActiveX-vezérlo távoli kapcsolatokhoz (x32 Version: 15.4.5722.2) Windows Live Meshin etäyhteyksien ActiveX-komponentti (x32 Version: 15.4.5722.2) Windows Live Messenger (x32 Version: 15.4.3502.0922) Windows Live MIME IFilter (Version: 15.4.3502.0922) Windows Live Movie Maker (x32 Version: 15.4.3502.0922) Windows Live Photo Common (x32 Version: 15.4.3502.0922) Windows Live Photo Gallery (x32 Version: 15.4.3502.0922) Windows Live PIMT Platform (x32 Version: 15.4.3508.1109) Windows Live Remote Client (Version: 15.4.5722.2) Windows Live Remote Client Resources (Version: 15.4.5722.2) Windows Live Remote Service (Version: 15.4.5722.2) Windows Live Remote Service Resources (Version: 15.4.5722.2) Windows Live SOXE (x32 Version: 15.4.3502.0922) Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922) Windows Live Temel Parçalar (x32 Version: 15.4.3502.0922) Windows Live UX Platform (x32 Version: 15.4.3502.0922) Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109) Windows Live Writer (x32 Version: 15.4.3502.0922) Windows Live Writer Resources (x32 Version: 15.4.3502.0922) Windows Liven asennustyökalu (x32 Version: 15.4.3502.0922) Windows Liven sähköposti (x32 Version: 15.4.3502.0922) Windows Liven valokuvavalikoima (x32 Version: 15.4.3502.0922) WinSCP 4.3.8 (x32 Version: 4.3.8) WISO Steuer-Sparbuch 2012 (x32 Version: 19.00.7303) WISO Steuer-Sparbuch 2013 (x32 Version: 20.00.8137) XAMPP 1.8.1-0 (x32 Version: 1.8.1-0) Xvid 1.2.2 final uninstall (x32 Version: 1.2) ==================== Restore Points ========================= 09-06-2013 09:24:31 Windows Update 20-06-2013 08:12:54 Windows Update 23-06-2013 14:28:04 Windows Update 28-06-2013 14:49:48 Windows Update 03-07-2013 18:21:20 Removed JavaFX 2.0.2 SDK (64-bit) 03-07-2013 18:22:44 Removed Java(TM) 6 Update 26 03-07-2013 18:24:01 Removed Java(TM) 6 Update 26 (64-bit) 03-07-2013 18:24:43 Removed Java(TM) 7 Update 2 (64-bit) 03-07-2013 18:25:19 Removed Java(TM) SE Development Kit 7 Update 2 (64-bit) 03-07-2013 18:26:01 Removed JavaFX 2.0.2 (64-bit) 03-07-2013 18:37:10 Windows Update 03-07-2013 19:07:33 Wiederherstellungsvorgang 03-07-2013 19:20:29 Windows Update 05-07-2013 08:54:54 ComboFix created restore point ==================== Hosts content: ========================== 2009-07-14 04:34 - 2013-07-05 11:04 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts 127.0.0.1 localhost ==================== Scheduled Tasks (whitelisted) ============= Task: {0881E3A4-1947-405E-A120-7036242BDB04} - System32\Tasks\Sony Corporation\VAIO Update\VAIO Update 5 => C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe [2011-06-30] (Sony Corporation) Task: {0F4AB92F-E05D-4A8F-9E77-55DDAC553141} - System32\Tasks\Sony Corporation\VAIO Improvement\VAIOImprovementUploader => C:\Program Files\Sony\VAIO Improvement\viuploader.exe [2011-06-03] (Sony Corporation) Task: {1466E89D-C2CC-49AE-A4D8-6764E7FA65B4} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task Task: {1D983A4E-E1DB-4085-A2E8-75F279F16B1C} - System32\Tasks\Sony Corporation\VAIO Control Center\Level4Daily => C:\Program Files (x86)\Sony\VAIO Control Center\WBCBatteryCare.exe [2011-07-07] (Sony Corporation) Task: {1F36B366-6BA0-470A-8E08-16076FD91E8A} - System32\Tasks\Sony Corporation\VAIO Gate\VAIO Gate => C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe [2011-06-21] (Sony Corporation) Task: {27D1261B-2559-4EE7-99DC-0BDC4BFF1528} - System32\Tasks\{9FCEF174-62CC-4642-B14F-3A2DF8501B8A} => C:\Program Files (x86)\CyberLink\PowerDVD\PowerDVD.exe [2003-08-05] (CyberLink Corp.) Task: {337C50B5-B503-4C7E-8D3E-A630C0C40C6B} - System32\Tasks\Sony Corporation\VAIO Power Management\VPM Unlock => C:\Program Files\Sony\VAIO Power Management\SPMgr.exe [2011-05-31] (Sony Corporation) Task: {433AB431-E3FC-4B78-A7C8-053CBF353BF8} - System32\Tasks\Sony Corporation\VAIO Care\VCCheckIcon => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe No File Task: {44FADF11-9AB6-46DD-9816-5F965A440DBB} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-03-31] (Adobe Systems Incorporated) Task: {479102CF-47D9-4E1B-9E27-77563BA3B8A7} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.) Task: {4B8E085B-F53F-4C27-BDCD-0A4B4B5A7E16} - System32\Tasks\HPCustParticipation HP Deskjet 3520 series => C:\Program Files\HP\HP Deskjet 3520 series\Bin\HPCustPartic.exe [2012-10-17] (Hewlett-Packard Co.) Task: {542A311B-52F0-4D32-A452-47105714073F} - System32\Tasks\Microsoft_Hardware_Launch_IPoint_exe => C:\Program Files\Microsoft IntelliPoint\IPoint.exe [2011-08-01] (Microsoft Corporation) Task: {618ADA85-A135-4D81-8A4E-87CE17798D3D} - System32\Tasks\Sony Corporation\VAIO Control Center\Level4Month => C:\Program Files (x86)\Sony\VAIO Control Center\WBCBatteryCare.exe [2011-07-07] (Sony Corporation) Task: {7127EFC9-ED61-42E9-B823-C6F4BA2A3F61} - System32\Tasks\Sony Corporation\VAIO Smart Network\VSN Logon Start => C:\Program Files\Sony\VAIO Smart Network\VSNClient No File Task: {71F13F70-73E0-41BE-8B15-EB972D15C9D7} - System32\Tasks\Microsoft\Microsoft Antimalware\MP Scheduled Scan => C:\Program Files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2011-04-27] (Microsoft Corporation) Task: {7692B3EA-121B-4ECF-87A6-CC6AD35746F6} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3351839369-2974415085-3751294646-1001Core => C:\Users\trishohara\AppData\Local\Google\Update\GoogleUpdate.exe [2012-02-05] (Google Inc.) Task: {814A056C-ED62-4262-ADFA-9DB0B6A028BC} - System32\Tasks\Sony Corporation\VAIO Gate\StartExecuteProxy => C:\Program Files\Sony\VAIO Gate\ExecutionProxy.exe [2011-06-21] (Sony Corporation) Task: {A19FD96A-A3A7-48E1-915A-F04F8BFA8C75} - System32\Tasks\Sony Corporation\VAIO Power Management\VPM Logon Start => C:\Program Files\Sony\VAIO Power Management\SPMgr.exe [2011-05-31] (Sony Corporation) Task: {A7E245A6-921F-4EEE-B4A3-A00F1861B897} - System32\Tasks\Sony Corporation\VAIO Care\VCUpdateLearn => C:\Program Files\Sony\VAIO Care\VCsystray.exe No File Task: {B7EADB6F-BC45-43A0-8E38-2D57816D7331} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3351839369-2974415085-3751294646-1001UA => C:\Users\trishohara\AppData\Local\Google\Update\GoogleUpdate.exe [2012-02-05] (Google Inc.) Task: {DC14E697-3EC4-486F-8C12-CA347690845D} - System32\Tasks\Sony Corporation\VAIO Power Management\VPM Session Change => C:\Program Files\Sony\VAIO Power Management\SPMgr.exe [2011-05-31] (Sony Corporation) Task: {DC21B924-5D92-4393-A11B-AB883C4661C4} - System32\Tasks\{35CEFC5E-F302-42EB-91C9-A97F243584F9} => C:\Program Files (x86)\iPhone Explorer\iExplorer.exe [2011-12-06] (Macroplant) Task: {FC50458D-C82F-44AE-B805-1D07EDF4BCCA} - System32\Tasks\AdobeAAMUpdater-1.0-trishohara-VAIO-trishohara => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2010-07-29] (Adobe Systems Incorporated) Task: {FCBAAC13-FEC3-441D-91B9-ACE445E4C9E0} - System32\Tasks\Sony Corporation\VAIO Improvement Validation\VAIO Improvement Validation => C:\Program Files\Sony\VAIO Improvement Validation\viv.exe [2011-01-20] (Sony Corporation) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3351839369-2974415085-3751294646-1001Core.job => C:\Users\trishohara\AppData\Local\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3351839369-2974415085-3751294646-1001UA.job => C:\Users\trishohara\AppData\Local\Google\Update\GoogleUpdate.exe ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== System errors: ============= Microsoft Office Sessions: ========================= CodeIntegrity Errors: =================================== Date: 2013-07-05 11:04:24.093 Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert. Date: 2013-07-05 11:04:24.093 Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert. Date: 2013-07-03 17:36:19.853 Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert. Date: 2013-07-03 17:36:19.853 Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert. Date: 2012-05-06 13:19:45.182 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2012-05-06 13:19:45.161 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2012-05-06 13:19:45.105 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2012-05-06 13:19:45.025 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2012-05-06 13:19:44.979 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2012-05-06 13:19:44.826 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. ==================== Memory info =========================== Percentage of memory in use: 20% Total physical RAM: 8173.22 MB Available physical RAM: 6508.46 MB Total Pagefile: 16344.63 MB Available Pagefile: 14569.09 MB Total Virtual: 8192 MB Available Virtual: 8191.83 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:328.45 GB) (Free:161.11 GB) NTFS (Disk=0 Partition=3) Drive d: (KRD10) (CDROM) (Total:0.31 GB) (Free:0 GB) CDFS Drive e: () (Removable) (Total:29.8 GB) (Free:22.64 GB) FAT32 (Disk=1 Partition=1) Drive g: (Volume) (Fixed) (Total:249.23 GB) (Free:35.84 GB) NTFS (Disk=0 Partition=4) ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 596 GB) (Disk ID: 7FA122EA) Partition 1: (Not Active) - (Size=18 GB) - (Type=27) Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=328 GB) - (Type=07 NTFS) Partition 4: (Not Active) - (Size=249 GB) - (Type=OF Extended) ======================================================== Disk: 1 (Size: 30 GB) (Disk ID: 00000000) Partition 1: (Not Active) - (Size=30 GB) - (Type=0C) ==================== End Of Log ============================ |
05.07.2013, 18:00 | #8 |
/// the machine /// TB-Ausbilder | System Care Antivirus wirklich komplett entfernt?ESET Online Scanner
Downloade Dir bitte SecurityCheck und:
und ein frisches FRST Log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
05.07.2013, 21:27 | #9 |
| System Care Antivirus wirklich komplett entfernt? ESET ist endlich fertig, hat zwei Threats gefunden. Code:
ATTFilter ESETSmartInstaller@High as downloader log: all ok # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6920 # api_version=3.0.2 # EOSSerial=7b378ef894330443a894433b151b21cc # engine=14256 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2013-07-03 06:14:19 # local_time=2013-07-03 08:14:19 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=5892 16777213 100 100 49595365 69746129 0 0 # scanned=399880 # found=5 # cleaned=0 # scan_time=7375 sh=5D37A014DFBF23C6BD9472475806611E7E3367E9 ft=1 fh=673693b06d190801 vn="a variant of Win32/Kryptik.BEWO trojan" ac=I fn="C:\Qoobox\Quarantine\C\ProgramData\A6D355FB7DBFE66B0000A6D2AF32F08D\A6D355FB7DBFE66B0000A6D2AF32F08D.exe.vir" sh=F9F9525705D7097D69FAE20BE7BD6FEB168665C7 ft=1 fh=5ce88cf60f53c1ed vn="a variant of Win32/Injector.AIXM trojan" ac=I fn="C:\Users\trishohara\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17\346bb111-6c7f6c29" sh=431C3C88B0BD65AF49F43C06CA712C3E18EDFADB ft=1 fh=28585be5f68f22b8 vn="Win32/InstallMonetizer.AF application" ac=I fn="C:\Users\trishohara\Downloads\Pazera_Free_MP4_to_AVI_Converter.exe" sh=D34C3EE54383C1834BBDFAE67239AAF3DC75AB5F ft=0 fh=0000000000000000 vn="Win32/PSWTool.ProductKey.126 application" ac=I fn="C:\Users\trishohara\Downloads\USB_MultiBoot_10.zip" sh=38CCEB47628D4C73344595B1FAF505F874B86EB0 ft=1 fh=8c018257833e8034 vn="Win32/OpenCandy application" ac=I fn="G:\Install-Dateien\SUPERsetup.exe" ESETSmartInstaller@High as downloader log: all ok # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6920 # api_version=3.0.2 # EOSSerial=b243d68e6a5ba3449c9752d1a6a9a71e # engine=14283 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2013-07-05 08:23:28 # local_time=2013-07-05 10:23:28 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=5892 16777213 100 100 49775914 69926678 0 0 # scanned=400458 # found=2 # cleaned=0 # scan_time=10149 sh=431C3C88B0BD65AF49F43C06CA712C3E18EDFADB ft=1 fh=28585be5f68f22b8 vn="Win32/InstallMonetizer.AF application" ac=I fn="C:\Users\trishohara\Downloads\Pazera_Free_MP4_to_AVI_Converter.exe" sh=38CCEB47628D4C73344595B1FAF505F874B86EB0 ft=1 fh=8c018257833e8034 vn="Win32/OpenCandy application" ac=I fn="G:\Install-Dateien\SUPERsetup.exe" UNSUPPORTED OPERATING SYSTEM! ABORTED! Läuft wohl nicht in Windows 7? Ich danke dir für deine Hilfe. Das Topic kann geschlossen werden. Ich werde den Computer heute auf Werkszustand zurücksetzen. Ich habe gestern abend ein Macbook gekauft. |
06.07.2013, 08:51 | #10 | |
/// the machine /// TB-Ausbilder | System Care Antivirus wirklich komplett entfernt?Zitat:
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
Themen zu System Care Antivirus wirklich komplett entfernt? |
abgesicherten, anti-malware, antivirus, automatisch, computer, einträge, gefährlich, malwarebytes, microsoft, neustart, recovery, security, sich automatisch, system care, tools, virenscanner, win32/injector.aixm, win32/installmonetizer.af, win32/kryptik.bewo, win32/pswtool.productkey.126 |