a variant of Win32/Spy.Banker.YIL trojan mit ESET online scan endeckt

sepp1987 · 27.07.2013, 11:32

Hi habe heute ESET scanner durchlaufen lassen!!
dabei hat er folgenden Eintrag Gefunden:
variant of Win32/Spy.Banker.YIL trojan

Wie Kann ich mein System am geschicktesten von dem Übel befreien ??

Code:

ATTFilter

C:\Users\***\AppData\Roaming\5052\components\AcroFF0527.dll	a variant of Win32/Spy.Banker.YIL trojan

Anhang 58298

schrauber · 27.07.2013, 11:41

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

sepp1987 · 27.07.2013, 11:50

Zitat:

Zitat von schrauber

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Hi,
danke für die schnelle Antwort

First:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 27-07-2013
Ran by Sarah (administrator) on 27-07-2013 12:44:59
Running from C:\Users\Sarah\Downloads
Microsoft® Windows Vista™ Ultimate  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 7
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(ATI Technologies Inc.) C:\Windows\system32\Ati2evxx.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(ATI Technologies Inc.) C:\Windows\system32\Ati2evxx.exe
(Abbott Diabetes Care) C:\Program Files\Abbott Diabetes Care\FreeStyle Auto-Assist\adcmald.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Nalpeiron Ltd.) C:\Windows\system32\nlssrv32.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Event Service\VESMgrSub.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdSync.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
() C:\Program Files\Abbott Diabetes Care\FreeStyle Auto-Assist\adclaunchd.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
() C:\Program Files\VoIPdial\VoIPdial.exe
(Sony Corporation) C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
(Google) C:\Program Files\Google\Drive\googledrivesync.exe
(Samsung) C:\Program Files\Samsung\Kies\Kies.exe
(Dropbox, Inc.) C:\Users\Sarah\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Microsoft Corporation) C:\Windows\system32\wbem\unsecapp.exe
(Google) C:\Program Files\Google\Drive\googledrivesync.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VUAgent.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\swriter.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.bin
(Microsoft Corporation) C:\Windows\System32\calc.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe
(Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe
(Microsoft Corporation) C:\Windows\system32\FirewallControlPanel.exe
(ESET) C:\Program Files\ESET\ESET Online Scanner\OnlineScannerApp.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Google) C:\Users\Sarah\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [avast] - C:\Program Files\AVAST Software\Avast\avastUI.exe [4858968 2013-05-09] (AVAST Software)
HKLM\...\Run: [Windows Mobile-based device management] - C:\Windows\WindowsMobile\wmdSync.exe [215552 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [KiesTrayAgent] - C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [310640 2013-03-28] (Samsung Electronics Co., Ltd.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [FreeStyle AutoLaunch] - C:\Program Files\Abbott Diabetes Care\FreeStyle Auto-Assist\adclaunchd.exe [196960 2013-02-09] ()
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM\...\Runonce: [ Malwarebytes Anti-Malware  (cleanup)] - rundll32.exe "C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll",ProcessCleanupScript [x]
HKLM\...\Winlogon: [Userinit] c:\windows\system32\userinit.exe,userinit.exe,
Winlogon\Notify\!SASWinLogon: I:\System\Apps\7E5842E4-EF51-421A-8FB3-19F3ECB18E3C\Data\SASWINLO.DLL [X]
Winlogon\Notify\VESWinlogon: VESWinlogon.dll (Sony Corporation)
HKCU\...\Run: [VoIPdial] - C:\Program Files\VoIPdial\VoIPdial.exe [274039 2009-09-30] ()
HKCU\...\Run: [Facebook Update] - C:\Users\Sarah\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-07-12] (Facebook Inc.)
HKCU\...\Run: [GoogleDriveSync] - C:\Program Files\Google\Drive\googledrivesync.exe [19676256 2013-06-06] (Google)
HKCU\...\Run: [Google Update] - C:\Users\Sarah\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-02-22] (Google Inc.)
HKCU\...\Run: [KiesPreload] - C:\Program Files\Samsung\Kies\Kies.exe [1511792 2013-03-28] (Samsung)
HKCU\...\Run: [] - C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [1106288 2013-03-28] (Samsung)
HKCU\...\Run: [WMPNSCFG] - C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-21] (Microsoft Corporation)
MountPoints2: G - G:\LaunchU3.exe -a
MountPoints2: {1836f5ee-e5bf-11e0-94d8-001e3d3bc32e} - G:\LaunchU3.exe -a
MountPoints2: {7472dfd3-2f15-11e2-9f95-001e3d3bc32e} - G:\Windows\StartFreeStyle.exe
MountPoints2: {a48a3f4d-1205-11e2-b1fd-001e3d3bc32e} - RunClubSanDisk.exe
MountPoints2: {c2486bab-fca5-11e0-ad5c-001e3d3bc32e} - G:\LaunchU3.exe -a
HKU\Administrator\...\Run: [Sidebar] - C:\Program Files\Windows Sidebar\sidebar.exe [ 2008-01-21] (Microsoft Corporation)
HKU\Administrator\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2008-01-21] (Microsoft Corporation)
HKU\Default\...\Run: [Sidebar] - C:\Program Files\Windows Sidebar\Sidebar.exe [ 2008-01-21] (Microsoft Corporation)
HKU\Default\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2008-01-21] (Microsoft Corporation)
HKU\Default User\...\Run: [Sidebar] - C:\Program Files\Windows Sidebar\Sidebar.exe [ 2008-01-21] (Microsoft Corporation)
HKU\Default User\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2008-01-21] (Microsoft Corporation)
HKU\Sepp\...\Run: [Sidebar] - C:\Program Files\Windows Sidebar\sidebar.exe [ 2008-01-21] (Microsoft Corporation)
HKU\Sepp\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2008-01-21] (Microsoft Corporation)
HKU\Sepp\...\Run: [GoogleDriveSync] - C:\Program Files\Google\Drive\googledrivesync.exe [ 2013-06-06] (Google)
HKU\Sepp\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\system32\Macromed\Flash\FlashUtil32_11_7_700_224_Plugin.exe -update plugin [x]
Startup: C:\Users\Sarah\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Sarah\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Sarah\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
Startup: C:\Users\Sepp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
BootExecute: autocheck autochk /p \??\H:autocheck autochk * 

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKCU - {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL = 
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_07-windows-i586.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
ShellExecuteHooks: SABShellExecuteHook Class - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} -  No File [ ]
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Path=Profiles\iy8dzkv7.Sebastian
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @google.com/npPicasa3,version=3.0.0 - C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Sarah\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin - C:\Users\Sarah\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin HKCU: @talk.google.com/O1DPlugin - C:\Users\Sarah\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
FF Plugin HKCU: @talk.google.com/O3DPlugin - C:\Users\Sarah\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Sarah\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Sarah\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Extension: Default - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM\...\Firefox\Extensions: [{184AA5E6-741D-464a-820E-94B3ABC2F3B4}] C:\Users\Sarah\AppData\Roaming\5064
FF Extension: Java String Helper - C:\Users\Sarah\AppData\Roaming\5064
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF HKCU\...\Firefox\Extensions: [{184AA5E6-741D-464a-820E-94B3ABC2F3B4}] C:\Users\Sarah\AppData\Roaming\5064
FF Extension: Java String Helper - C:\Users\Sarah\AppData\Roaming\5064

Chrome: 
=======
CHR HomePage: hxxp://www.google.com

========================== Services (Whitelisted) =================

R2 adcmald; C:\Program Files\Abbott Diabetes Care\FreeStyle Auto-Assist\adcmald.exe [535896 2013-02-09] (Abbott Diabetes Care)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-05-09] (AVAST Software)
S4 SBSDWSCService; C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
R3 VUAgent; C:\Program Files\Sony\VAIO Update\VUAgent.exe [1013808 2013-03-26] (Sony Corporation)
S2 AntiVirSchedulerService; "C:\Program Files\Avira\AntiVir Desktop\sched.exe" [x]
S2 AntiVirService; "C:\Program Files\Avira\AntiVir Desktop\avguard.exe" [x]
S3 rpcapd; "%ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini" [x]

==================== Drivers (Whitelisted) ====================

R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [29816 2013-05-09] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [66336 2013-05-09] (AVAST Software)
R1 aswRdr; C:\Windows\System32\Drivers\aswRdr.sys [49760 2013-05-09] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [49376 2013-05-09] ()
R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [770344 2013-06-28] (AVAST Software)
R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [369584 2013-06-28] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [56080 2013-05-09] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [175176 2013-06-28] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [66616 2011-08-06] (Avira GmbH)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [138192 2011-08-06] (Avira GmbH)
S3 bdacap; C:\Windows\System32\drivers\bdacap.sys [217728 2006-02-14] (Genesys Logic, Inc.)
S3 cpudrv; C:\Program Files\SystemRequirementsLab\cpudrv.sys [11336 2011-06-02] ()
S3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2010-06-14] ()
S3 GLHIDKBFILTER; C:\Windows\System32\DRIVERS\GLKbFilter.sys [11264 2006-01-06] (Genesys Logic)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\mbamswissarmy.sys [40776 2013-07-27] (Malwarebytes Corporation)
R2 NPF; C:\Windows\System32\drivers\npf.sys [36600 2013-03-01] (Riverbed Technology, Inc.)
S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [15576 2013-01-11] ()
S3 pwdspio; C:\Windows\system32\pwdspio.sys [10200 2013-01-11] ()
R3 R5U870FLx86; C:\Windows\System32\Drivers\R5U870FLx86.sys [73472 2008-01-30] (Ricoh)
R3 R5U870FUx86; C:\Windows\System32\Drivers\R5U870FUx86.sys [43904 2008-01-30] (Ricoh)
R1 StarOpen; C:\Windows\System32\Drivers\StarOpen.sys [5632 2006-07-24] ()
S3 tap0901; C:\Windows\System32\DRIVERS\tap0901.sys [26624 2011-12-15] (The OpenVPN Project)
R3 ti21sony; C:\Windows\System32\drivers\ti21sony.sys [818688 2007-11-16] (Texas Instruments)
S3 UIUSys; C:\Windows\System32\DRIVERS\UIUSYS.SYS [6909 2008-01-30] (Conexant Systems, Inc)
U0 wpif; C:\Windows\System32\drivers\jxlyr.sys [54016 2013-07-27] ()
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
S1 SASDIFSV; \??\I:\System\Apps\7E5842E4-EF51-421A-8FB3-19F3ECB18E3C\Data\SASDIFSV.SYS [x]
S1 SASKUTIL; \??\I:\System\Apps\7E5842E4-EF51-421A-8FB3-19F3ECB18E3C\Data\SASKUTIL.SYS [x]
S3 USBAAPL; System32\Drivers\usbaapl.sys [x]
S3 WinRing0_1_2_0; \??\C:\Program Files\BatteryCare\WinRing0.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-27 12:44 - 2013-07-27 12:44 - 01220544 _____ (Farbar) C:\Users\Sarah\Downloads\FRST.exe
2013-07-27 12:44 - 2013-07-27 12:44 - 00000000 ____D C:\FRST
2013-07-27 12:33 - 2013-07-27 12:33 - 00054016 _____ C:\Windows\system32\Drivers\jxlyr.sys
2013-07-27 12:12 - 2013-07-27 12:14 - 00040776 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamswissarmy.sys
2013-07-27 10:41 - 2013-07-27 10:41 - 00000000 ____D C:\Program Files\ESET
2013-07-27 10:40 - 2013-07-27 10:40 - 02347384 _____ (ESET) C:\Users\Sarah\Downloads\esetsmartinstaller_enu.exe
2013-07-25 12:50 - 2013-07-25 12:50 - 00074445 _____ C:\Users\Sarah\Downloads\nummernkreise_flexiblenummernautomatik3.zip
2013-07-25 11:39 - 2013-07-25 11:39 - 00001868 _____ C:\Users\Sarah\Downloads\sg_backup_2013-07-25-1139.spg
2013-07-25 11:39 - 2013-07-25 11:39 - 00001868 _____ C:\Users\Sarah\Downloads\FirstBackup.spg
2013-07-25 11:36 - 2013-07-25 11:36 - 00659456 _____ (Speed Guide Inc.) C:\Users\Sarah\Downloads\TCP308Optimizer.exe
2013-07-24 19:21 - 2013-07-24 19:21 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\Wireshark
2013-07-24 19:20 - 2013-07-24 20:02 - 02775040 _____ C:\Users\Sarah\session.sqlite
2013-07-24 19:19 - 2013-07-24 19:19 - 00000000 ____D C:\Program Files\Wireshark
2013-07-24 19:17 - 2013-07-24 19:18 - 22238848 _____ (Wireshark development team) C:\Users\Sarah\Downloads\Wireshark-win32-1.10.0.exe
2013-07-24 19:15 - 2013-07-24 19:16 - 37099197 _____ C:\Users\Sarah\Downloads\CookieCadger-1.06.jar
2013-07-23 17:28 - 2013-07-23 17:29 - 37099197 _____ C:\Users\Sarah\Desktop\CookieCadger-1.06.jar
2013-07-23 17:18 - 2013-07-23 17:18 - 00678144 _____ C:\Users\Sarah\Downloads\FaceNiff-2.4.apk
2013-07-23 17:02 - 2013-07-23 17:03 - 00000000 ____D C:\Program Files\Safari
2013-07-23 17:00 - 2013-07-23 17:00 - 00000000 ____D C:\Program Files\Apple Software Update
2013-07-23 16:58 - 2013-07-23 16:58 - 38494576 _____ (Apple Inc.) C:\Users\Sarah\Downloads\SafariSetup-5.1.7.exe
2013-07-23 16:45 - 2013-07-23 16:45 - 00000000 ____D C:\Program Files\WinPcap
2013-07-23 16:44 - 2013-07-23 16:44 - 00915128 _____ (Riverbed Technology, Inc.) C:\Users\Sarah\Downloads\WinPcap_4_1_3.exe
2013-07-23 15:45 - 2013-07-23 15:50 - 00000077 _____ C:\wepkeys.txt
2013-07-23 15:44 - 2013-07-23 15:44 - 00000000 ____D C:\Aircrack
2013-07-23 15:40 - 2013-07-23 15:41 - 08287320 _____ C:\Users\Sarah\Downloads\aircrack-ng-1.2-beta1-win.zip
2013-07-23 14:59 - 2013-07-23 14:59 - 00000000 ____D C:\Users\Sarah\Documents\EasyBox Key Decrypter Logfile
2013-07-23 14:57 - 2013-07-23 14:57 - 00001106 _____ C:\Users\Sarah\Desktop\EasyBox Key Decrypter.lnk
2013-07-23 14:57 - 2013-07-23 14:57 - 00000000 ____D C:\Program Files\EasyBox Key Decrypter
2013-07-23 14:56 - 2013-07-23 14:56 - 01797880 _____ C:\Users\Sarah\Downloads\EasyBox_Key_Decrypter_v1.4_Setup.exe
2013-07-23 13:24 - 2013-07-23 13:24 - 00028833 _____ C:\Users\Sarah\Downloads\formular_aktuelle_modue.zip
2013-07-23 12:36 - 2013-07-23 12:37 - 77021736 _____ C:\Users\Sarah\Downloads\Cro_Sunny.zip
2013-07-19 18:35 - 2013-07-19 18:35 - 00630802 _____ C:\Users\Sarah\Downloads\Wave_Backgrounds_with_Grass_Elements.zip
2013-07-19 17:45 - 2013-07-19 17:45 - 00719586 _____ C:\Users\Sarah\Downloads\Stunning_Retro_Backgrounds.zip
2013-07-19 17:02 - 2013-07-19 17:02 - 01385419 _____ C:\Users\Sarah\Downloads\FreeVectorFlowerBackground.zip
2013-07-19 16:08 - 2013-07-19 16:08 - 01053864 _____ C:\Users\Sarah\Downloads\FloralDesignHeaders2-by-gfxcool.zip
2013-07-19 15:42 - 2013-07-19 15:42 - 04943043 _____ C:\Users\Sarah\Downloads\free_vector_fancy_headers.zip
2013-07-19 15:31 - 2013-07-19 15:31 - 00080868 _____ C:\Users\Sarah\Downloads\Newsletter_Main_Feature.zip
2013-07-19 13:19 - 2013-07-19 13:20 - 29584723 _____ C:\Users\Sarah\Downloads\sendblaster2.0.138.zip
2013-07-17 13:26 - 2013-07-17 13:27 - 00000000 ____D C:\Users\Sarah\www.apowersoft.com
2013-07-13 13:30 - 2013-07-13 13:30 - 00303308 _____ C:\Users\Sarah\Downloads\De Bauer.mp4
2013-07-13 13:04 - 2013-07-13 13:04 - 00446040 _____ C:\Users\Sarah\Downloads\JW.Player.v6.1.2972.Pro.incl.Keygen.FLASH.NULL-DGT.zip
2013-07-13 13:00 - 2013-07-13 13:00 - 00507325 _____ C:\Users\Sarah\Downloads\mediaplayer.zip
2013-07-13 11:40 - 2013-07-26 17:48 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\Skype
2013-07-13 11:39 - 2013-07-13 11:52 - 00002379 _____ C:\Users\Public\Desktop\Skype.lnk
2013-07-13 11:39 - 2013-07-13 11:40 - 00000000 ____D C:\ProgramData\Skype
2013-07-13 11:39 - 2013-07-13 11:39 - 00000000 ___RD C:\Program Files\Skype
2013-07-13 11:39 - 2013-07-13 11:39 - 00000000 ____D C:\Program Files\Common Files\Skype
2013-07-13 11:37 - 2013-07-13 11:37 - 01492584 _____ (Skype Technologies S.A.) C:\Users\Sarah\Downloads\SkypeSetup.exe
2013-07-12 19:46 - 2013-07-12 19:46 - 00969301 _____ C:\Users\Sarah\Downloads\wptouch.1.9.7.zip
2013-07-12 19:39 - 2013-07-12 19:39 - 00861291 _____ C:\Users\Sarah\Downloads\nextgen-gallery.zip
2013-07-12 19:36 - 2013-07-12 19:37 - 03786542 _____ C:\Users\Sarah\Downloads\jw-player-plugin-for-wordpress.2.1.1.zip
2013-07-12 19:35 - 2013-07-12 19:35 - 00521811 _____ C:\Users\Sarah\Downloads\contact-form-plugin.3.47.zip
2013-07-12 19:31 - 2013-07-12 19:31 - 00219355 _____ C:\Users\Sarah\Downloads\antispam-bee.zip
2013-07-12 18:33 - 2013-07-12 18:34 - 04815135 _____ (FileZilla Project) C:\Users\Sarah\Downloads\FileZilla_3.7.1_win32-setup.exe
2013-07-12 18:30 - 2013-07-12 19:14 - 04353459 _____ C:\Users\Sarah\Downloads\wordpress-3.5.2-de_DE.zip
2013-07-12 12:42 - 2013-07-12 12:42 - 00060912 _____ C:\Users\Sepp\AppData\Local\GDIPFONTCACHEV1.DAT
2013-07-12 12:30 - 2013-07-12 12:30 - 01940642 _____ C:\Users\Sepp\Downloads\vorlagen3de_opendoc.zip
2013-07-12 12:30 - 2013-07-12 12:30 - 00000000 ____D C:\Users\Sepp\AppData\Roaming\WinRAR
2013-07-12 12:25 - 2013-07-12 12:21 - 00000543 _____ C:\Users\Sepp\Documents\indexfile.txt
2013-07-12 12:02 - 2013-07-12 12:26 - 00000000 ___SD C:\Users\Sepp\Google Drive
2013-07-12 12:02 - 2013-07-12 12:02 - 00001547 _____ C:\Users\Sepp\Desktop\Google Drive.lnk
2013-07-12 11:42 - 2013-07-12 11:42 - 00000000 ____D C:\Users\Sepp\AppData\Roaming\OpenOffice.org
2013-07-09 16:00 - 2013-07-09 16:00 - 00179832 _____ C:\Users\Sarah\Desktop\Passwörter.txt
2013-07-09 15:51 - 2013-07-09 15:51 - 00024345 _____ C:\Users\Sarah\Desktop\password-export-2013-07-09.csv
2013-07-09 15:49 - 2013-07-09 15:49 - 00041249 _____ C:\Users\Sarah\Desktop\password-export-2013-07-09.xml
2013-07-04 08:41 - 2013-07-04 08:41 - 05706781 _____ C:\Users\Sarah\Desktop\Rising Sun - Epic Orchestra Film Instrumental Music.mp4
2013-07-02 13:16 - 2013-07-02 13:16 - 00698764 _____ C:\Users\Sarah\Downloads\Uhr.exe
2013-07-01 22:21 - 2013-07-01 22:16 - 07126244 _____ C:\Users\Sarah\Desktop\tobi-song-movie.wmv
2013-07-01 21:10 - 2013-07-13 12:18 - 00000955 _____ C:\Users\Public\Desktop\TeamViewer 8.lnk
2013-06-30 14:20 - 2013-06-30 14:20 - 00000000 ____D C:\Users\Sepp\AppData\Local\Macromedia
2013-06-30 14:11 - 2013-06-30 14:19 - 00000000 ____D C:\Users\Sepp\AppData\Roaming\Mozilla
2013-06-30 14:11 - 2013-06-30 14:11 - 00000000 ____D C:\Users\Sepp\AppData\Local\Mozilla
2013-06-28 11:32 - 2013-06-28 11:32 - 00000468 _____ C:\Users\Sarah\Desktop\hunday mobile.txt
2013-06-28 10:22 - 2013-06-28 10:22 - 00000175 _____ C:\Windows\system32\Drivers\aswVmm.sys.sum
2013-06-27 09:52 - 2013-06-28 10:22 - 00000175 _____ C:\Windows\system32\Drivers\aswSP.sys.sum
2013-06-27 09:52 - 2013-06-28 10:22 - 00000175 _____ C:\Windows\system32\Drivers\aswSnx.sys.sum

==================== One Month Modified Files and Folders =======

2013-07-27 12:44 - 2013-07-27 12:44 - 01220544 _____ (Farbar) C:\Users\Sarah\Downloads\FRST.exe
2013-07-27 12:44 - 2013-07-27 12:44 - 00000000 ____D C:\FRST
2013-07-27 12:33 - 2013-07-27 12:33 - 00054016 _____ C:\Windows\system32\Drivers\jxlyr.sys
2013-07-27 12:33 - 2012-04-02 16:31 - 00000000 ____D C:\Windows\pss
2013-07-27 12:32 - 2013-02-22 16:11 - 00001120 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2257783777-1101859096-687163147-1000UA.job
2013-07-27 12:32 - 2013-02-06 10:32 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-27 12:32 - 2011-10-19 15:22 - 00001138 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2257783777-1101859096-687163147-1000UA.job
2013-07-27 12:32 - 2011-10-19 15:22 - 00001116 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2257783777-1101859096-687163147-1000Core.job
2013-07-27 12:18 - 2006-11-02 14:46 - 00003760 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-27 12:18 - 2006-11-02 14:46 - 00003760 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-27 12:14 - 2013-07-27 12:12 - 00040776 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamswissarmy.sys
2013-07-27 11:59 - 2012-03-30 14:21 - 00001096 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-27 11:59 - 2012-03-30 14:21 - 00001092 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-27 11:32 - 2013-02-22 16:11 - 00001068 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2257783777-1101859096-687163147-1000Core.job
2013-07-27 11:30 - 2012-07-14 11:42 - 00000000 ___SD C:\Users\Sarah\Google Drive
2013-07-27 11:10 - 2011-08-05 20:14 - 00000418 ____H C:\Windows\Tasks\User_Feed_Synchronization-{A9097228-7BF7-4646-B1F5-D5A7D9C4D20A}.job
2013-07-27 10:41 - 2013-07-27 10:41 - 00000000 ____D C:\Program Files\ESET
2013-07-27 10:40 - 2013-07-27 10:40 - 02347384 _____ (ESET) C:\Users\Sarah\Downloads\esetsmartinstaller_enu.exe
2013-07-26 20:27 - 2006-11-02 14:35 - 00000000 ____D C:\Windows\system32\FxsTmp
2013-07-26 17:48 - 2013-07-13 11:40 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\Skype
2013-07-25 23:01 - 2013-03-09 12:33 - 00476012 _____ C:\Windows\WindowsUpdate.log
2013-07-25 22:55 - 2013-04-22 22:16 - 00000000 ___RD C:\Users\Sarah\Dropbox
2013-07-25 22:55 - 2013-04-22 22:11 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\Dropbox
2013-07-25 22:32 - 2006-11-02 15:00 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-07-25 16:03 - 2011-08-05 12:41 - 00059904 _____ C:\Users\Sarah\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-07-25 15:44 - 2013-04-20 14:27 - 00001892 _____ C:\Users\Public\Desktop\Adobe Reader X.lnk
2013-07-25 15:43 - 2011-08-08 11:01 - 00000000 ____D C:\ProgramData\Adobe
2013-07-25 15:36 - 2011-08-08 11:09 - 00000000 ____D C:\Users\Sarah\AppData\Local\Adobe
2013-07-25 12:50 - 2013-07-25 12:50 - 00074445 _____ C:\Users\Sarah\Downloads\nummernkreise_flexiblenummernautomatik3.zip
2013-07-25 12:09 - 2011-08-05 12:50 - 00001660 _____ C:\Windows\bthservsdp.dat
2013-07-25 12:09 - 2006-11-02 15:00 - 00032626 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-07-25 11:42 - 2012-10-10 20:14 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-07-25 11:39 - 2013-07-25 11:39 - 00001868 _____ C:\Users\Sarah\Downloads\sg_backup_2013-07-25-1139.spg
2013-07-25 11:39 - 2013-07-25 11:39 - 00001868 _____ C:\Users\Sarah\Downloads\FirstBackup.spg
2013-07-25 11:36 - 2013-07-25 11:36 - 00659456 _____ (Speed Guide Inc.) C:\Users\Sarah\Downloads\TCP308Optimizer.exe
2013-07-24 20:02 - 2013-07-24 19:20 - 02775040 _____ C:\Users\Sarah\session.sqlite
2013-07-24 20:02 - 2011-08-05 12:35 - 00000000 ____D C:\Users\Sarah
2013-07-24 19:21 - 2013-07-24 19:21 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\Wireshark
2013-07-24 19:19 - 2013-07-24 19:19 - 00000000 ____D C:\Program Files\Wireshark
2013-07-24 19:18 - 2013-07-24 19:17 - 22238848 _____ (Wireshark development team) C:\Users\Sarah\Downloads\Wireshark-win32-1.10.0.exe
2013-07-24 19:16 - 2013-07-24 19:15 - 37099197 _____ C:\Users\Sarah\Downloads\CookieCadger-1.06.jar
2013-07-23 17:29 - 2013-07-23 17:28 - 37099197 _____ C:\Users\Sarah\Desktop\CookieCadger-1.06.jar
2013-07-23 17:18 - 2013-07-23 17:18 - 00678144 _____ C:\Users\Sarah\Downloads\FaceNiff-2.4.apk
2013-07-23 17:03 - 2013-07-23 17:02 - 00000000 ____D C:\Program Files\Safari
2013-07-23 17:03 - 2011-12-03 15:15 - 00000000 ____D C:\Users\Sarah\AppData\Local\Apple Computer
2013-07-23 17:03 - 2011-11-22 17:43 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\Apple Computer
2013-07-23 17:02 - 2012-03-09 21:06 - 00000000 ____D C:\ProgramData\Apple Computer
2013-07-23 17:00 - 2013-07-23 17:00 - 00000000 ____D C:\Program Files\Apple Software Update
2013-07-23 17:00 - 2011-11-10 12:44 - 00000000 ____D C:\ProgramData\Apple
2013-07-23 16:58 - 2013-07-23 16:58 - 38494576 _____ (Apple Inc.) C:\Users\Sarah\Downloads\SafariSetup-5.1.7.exe
2013-07-23 16:45 - 2013-07-23 16:45 - 00000000 ____D C:\Program Files\WinPcap
2013-07-23 16:44 - 2013-07-23 16:44 - 00915128 _____ (Riverbed Technology, Inc.) C:\Users\Sarah\Downloads\WinPcap_4_1_3.exe
2013-07-23 15:50 - 2013-07-23 15:45 - 00000077 _____ C:\wepkeys.txt
2013-07-23 15:44 - 2013-07-23 15:44 - 00000000 ____D C:\Aircrack
2013-07-23 15:41 - 2013-07-23 15:40 - 08287320 _____ C:\Users\Sarah\Downloads\aircrack-ng-1.2-beta1-win.zip
2013-07-23 14:59 - 2013-07-23 14:59 - 00000000 ____D C:\Users\Sarah\Documents\EasyBox Key Decrypter Logfile
2013-07-23 14:57 - 2013-07-23 14:57 - 00001106 _____ C:\Users\Sarah\Desktop\EasyBox Key Decrypter.lnk
2013-07-23 14:57 - 2013-07-23 14:57 - 00000000 ____D C:\Program Files\EasyBox Key Decrypter
2013-07-23 14:56 - 2013-07-23 14:56 - 01797880 _____ C:\Users\Sarah\Downloads\EasyBox_Key_Decrypter_v1.4_Setup.exe
2013-07-23 13:24 - 2013-07-23 13:24 - 00028833 _____ C:\Users\Sarah\Downloads\formular_aktuelle_modue.zip
2013-07-23 12:37 - 2013-07-23 12:36 - 77021736 _____ C:\Users\Sarah\Downloads\Cro_Sunny.zip
2013-07-19 19:10 - 2012-01-20 14:01 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\FileZilla
2013-07-19 18:35 - 2013-07-19 18:35 - 00630802 _____ C:\Users\Sarah\Downloads\Wave_Backgrounds_with_Grass_Elements.zip
2013-07-19 17:45 - 2013-07-19 17:45 - 00719586 _____ C:\Users\Sarah\Downloads\Stunning_Retro_Backgrounds.zip
2013-07-19 17:02 - 2013-07-19 17:02 - 01385419 _____ C:\Users\Sarah\Downloads\FreeVectorFlowerBackground.zip
2013-07-19 16:08 - 2013-07-19 16:08 - 01053864 _____ C:\Users\Sarah\Downloads\FloralDesignHeaders2-by-gfxcool.zip
2013-07-19 15:42 - 2013-07-19 15:42 - 04943043 _____ C:\Users\Sarah\Downloads\free_vector_fancy_headers.zip
2013-07-19 15:31 - 2013-07-19 15:31 - 00080868 _____ C:\Users\Sarah\Downloads\Newsletter_Main_Feature.zip
2013-07-19 13:20 - 2013-07-19 13:19 - 29584723 _____ C:\Users\Sarah\Downloads\sendblaster2.0.138.zip
2013-07-17 13:27 - 2013-07-17 13:26 - 00000000 ____D C:\Users\Sarah\www.apowersoft.com
2013-07-17 13:26 - 2012-04-06 19:06 - 00000000 ____D C:\Program Files\JDownloader
2013-07-15 22:43 - 2012-01-20 14:00 - 00000000 ____D C:\Program Files\FileZilla FTP Client
2013-07-14 11:52 - 2012-04-20 15:46 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-07-14 11:52 - 2011-08-05 15:20 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-07-13 13:30 - 2013-07-13 13:30 - 00303308 _____ C:\Users\Sarah\Downloads\De Bauer.mp4
2013-07-13 13:04 - 2013-07-13 13:04 - 00446040 _____ C:\Users\Sarah\Downloads\JW.Player.v6.1.2972.Pro.incl.Keygen.FLASH.NULL-DGT.zip
2013-07-13 13:00 - 2013-07-13 13:00 - 00507325 _____ C:\Users\Sarah\Downloads\mediaplayer.zip
2013-07-13 12:18 - 2013-07-01 21:10 - 00000955 _____ C:\Users\Public\Desktop\TeamViewer 8.lnk
2013-07-13 11:52 - 2013-07-13 11:39 - 00002379 _____ C:\Users\Public\Desktop\Skype.lnk
2013-07-13 11:40 - 2013-07-13 11:39 - 00000000 ____D C:\ProgramData\Skype
2013-07-13 11:39 - 2013-07-13 11:39 - 00000000 ___RD C:\Program Files\Skype
2013-07-13 11:39 - 2013-07-13 11:39 - 00000000 ____D C:\Program Files\Common Files\Skype
2013-07-13 11:37 - 2013-07-13 11:37 - 01492584 _____ (Skype Technologies S.A.) C:\Users\Sarah\Downloads\SkypeSetup.exe
2013-07-13 11:31 - 2006-11-02 14:46 - 03626288 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-13 11:28 - 2013-05-19 21:15 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-07-13 11:28 - 2013-05-18 10:26 - 00003428 _____ C:\Windows\PFRO.log
2013-07-13 11:28 - 2012-05-03 16:56 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-07-12 19:46 - 2013-07-12 19:46 - 00969301 _____ C:\Users\Sarah\Downloads\wptouch.1.9.7.zip
2013-07-12 19:39 - 2013-07-12 19:39 - 00861291 _____ C:\Users\Sarah\Downloads\nextgen-gallery.zip
2013-07-12 19:37 - 2013-07-12 19:36 - 03786542 _____ C:\Users\Sarah\Downloads\jw-player-plugin-for-wordpress.2.1.1.zip
2013-07-12 19:35 - 2013-07-12 19:35 - 00521811 _____ C:\Users\Sarah\Downloads\contact-form-plugin.3.47.zip
2013-07-12 19:31 - 2013-07-12 19:31 - 00219355 _____ C:\Users\Sarah\Downloads\antispam-bee.zip
2013-07-12 19:14 - 2013-07-12 18:30 - 04353459 _____ C:\Users\Sarah\Downloads\wordpress-3.5.2-de_DE.zip
2013-07-12 18:42 - 2013-02-07 11:36 - 00000000 ____D C:\Users\Sarah\Documents\Blockbackup
2013-07-12 18:34 - 2013-07-12 18:33 - 04815135 _____ (FileZilla Project) C:\Users\Sarah\Downloads\FileZilla_3.7.1_win32-setup.exe
2013-07-12 12:42 - 2013-07-12 12:42 - 00060912 _____ C:\Users\Sepp\AppData\Local\GDIPFONTCACHEV1.DAT
2013-07-12 12:30 - 2013-07-12 12:30 - 01940642 _____ C:\Users\Sepp\Downloads\vorlagen3de_opendoc.zip
2013-07-12 12:30 - 2013-07-12 12:30 - 00000000 ____D C:\Users\Sepp\AppData\Roaming\WinRAR
2013-07-12 12:26 - 2013-07-12 12:02 - 00000000 ___SD C:\Users\Sepp\Google Drive
2013-07-12 12:21 - 2013-07-12 12:25 - 00000543 _____ C:\Users\Sepp\Documents\indexfile.txt
2013-07-12 12:02 - 2013-07-12 12:02 - 00001547 _____ C:\Users\Sepp\Desktop\Google Drive.lnk
2013-07-12 12:02 - 2013-05-17 18:03 - 00000000 ____D C:\Users\Sepp
2013-07-12 11:42 - 2013-07-12 11:42 - 00000000 ____D C:\Users\Sepp\AppData\Roaming\OpenOffice.org
2013-07-11 17:26 - 2011-08-05 12:56 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\Mozilla
2013-07-09 16:00 - 2013-07-09 16:00 - 00179832 _____ C:\Users\Sarah\Desktop\Passwörter.txt
2013-07-09 15:51 - 2013-07-09 15:51 - 00024345 _____ C:\Users\Sarah\Desktop\password-export-2013-07-09.csv
2013-07-09 15:49 - 2013-07-09 15:49 - 00041249 _____ C:\Users\Sarah\Desktop\password-export-2013-07-09.xml
2013-07-08 15:15 - 2012-04-03 18:24 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\TeamViewer
2013-07-04 14:40 - 2011-08-05 12:36 - 00060912 _____ C:\Users\Sarah\AppData\Local\GDIPFONTCACHEV1.DAT
2013-07-04 08:41 - 2013-07-04 08:41 - 05706781 _____ C:\Users\Sarah\Desktop\Rising Sun - Epic Orchestra Film Instrumental Music.mp4
2013-07-04 08:33 - 2011-08-05 12:35 - 00000680 _____ C:\Users\Sarah\AppData\Local\d3d9caps.dat
2013-07-02 13:16 - 2013-07-02 13:16 - 00698764 _____ C:\Users\Sarah\Downloads\Uhr.exe
2013-07-01 22:16 - 2013-07-01 22:21 - 07126244 _____ C:\Users\Sarah\Desktop\tobi-song-movie.wmv
2013-07-01 21:10 - 2012-04-24 09:50 - 00000000 ____D C:\Program Files\TeamViewer
2013-06-30 14:20 - 2013-06-30 14:20 - 00000000 ____D C:\Users\Sepp\AppData\Local\Macromedia
2013-06-30 14:19 - 2013-06-30 14:11 - 00000000 ____D C:\Users\Sepp\AppData\Roaming\Mozilla
2013-06-30 14:11 - 2013-06-30 14:11 - 00000000 ____D C:\Users\Sepp\AppData\Local\Mozilla
2013-06-28 11:32 - 2013-06-28 11:32 - 00000468 _____ C:\Users\Sarah\Desktop\hunday mobile.txt
2013-06-28 10:22 - 2013-06-28 10:22 - 00000175 _____ C:\Windows\system32\Drivers\aswVmm.sys.sum
2013-06-28 10:22 - 2013-06-27 09:52 - 00000175 _____ C:\Windows\system32\Drivers\aswSP.sys.sum
2013-06-28 10:22 - 2013-06-27 09:52 - 00000175 _____ C:\Windows\system32\Drivers\aswSnx.sys.sum
2013-06-28 10:22 - 2013-03-21 11:42 - 00175176 _____ C:\Windows\system32\Drivers\aswVmm.sys
2013-06-28 10:22 - 2012-01-02 14:26 - 00770344 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2013-06-28 10:22 - 2012-01-02 14:26 - 00369584 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-07-27 10:56

==================== End Of Log ============================

--- --- ---

--- --- ---

Addition:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 27-07-2013
Ran by Sarah at 2013-07-27 12:46:03
Running from C:\Users\Sarah\Downloads
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

Adobe AIR (Version: 3.7.0.2090)
Adobe Flash Player 11 ActiveX (Version: 11.8.800.94)
Adobe Flash Player 11 Plugin (Version: 11.8.800.94)
Adobe Reader X (10.1.7) - Deutsch (Version: 10.1.7)
Apple Software Update (Version: 2.1.3.127)
avast! Free Antivirus (Version: 8.0.1489.0)
CCleaner (Version: 4.01)
Dropbox (HKCU Version: 2.0.22)
EasyBox Key Decrypter (Version: 1.4)
ESET Online Scanner v3
FileZilla Client 3.7.1 (Version: 3.7.1)
FOTOParadies (Version: 3.5.0.3)
Google Drive (Version: 1.10.4769.632)
Google Talk Plugin (Version: 4.2.1.14031)
Google Update Helper (Version: 1.3.21.153)
Java 7 Update 25 (Version: 7.0.250)
Java Auto Updater
Malwarebytes Anti-Malware Version 1.75.0.1300 (Version: 1.75.0.1300)
Microsoft Silverlight (Version: 5.1.20513.0)
Mozilla Firefox 22.0 (x86 de) (Version: 22.0)
Mozilla Maintenance Service (Version: 22.0)
Safari (Version: 5.34.57.2)
Skype™ 6.6 (Version: 6.6.106)
TeamViewer 8 (Version: 8.0.19617)
VAIO Update (Version: 6.2.1.03260)
WinPcap 4.1.3 (Version: 4.1.0.2980)
Wireshark 1.10.0 (32-bit) (Version: 1.10.0)
 

==================== Restore Points  =========================

17-07-2013 09:29:03 Geplanter Prüfpunkt
19-07-2013 17:45:21 Geplanter Prüfpunkt
21-07-2013 09:50:35 Geplanter Prüfpunkt
21-07-2013 22:00:04 Geplanter Prüfpunkt
22-07-2013 22:00:03 Geplanter Prüfpunkt
23-07-2013 15:00:35 Installed Safari
24-07-2013 19:47:37 Windows Update
25-07-2013 16:27:49 Geplanter Prüfpunkt
26-07-2013 22:00:05 Geplanter Prüfpunkt

==================== Hosts content: ==========================

2006-11-02 12:23 - 2012-04-18 21:53 - 00438758 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
127.0.0.1	www.007guard.com
127.0.0.1	007guard.com
127.0.0.1	008i.com
127.0.0.1	www.008k.com
127.0.0.1	008k.com
127.0.0.1	www.00hq.com
127.0.0.1	00hq.com
127.0.0.1	010402.com
127.0.0.1	www.032439.com
127.0.0.1	032439.com
127.0.0.1	www.0scan.com
127.0.0.1	0scan.com
127.0.0.1	1000gratisproben.com
127.0.0.1	www.1000gratisproben.com
127.0.0.1	1001namen.com
127.0.0.1	www.1001namen.com
127.0.0.1	100888290cs.com
127.0.0.1	www.100888290cs.com
127.0.0.1	www.100sexlinks.com
127.0.0.1	100sexlinks.com
127.0.0.1	10sek.com
127.0.0.1	www.10sek.com
127.0.0.1	www.1-2005-search.com
127.0.0.1	1-2005-search.com
127.0.0.1	123fporn.info
127.0.0.1	www.123fporn.info
127.0.0.1	123haustiereundmehr.com
127.0.0.1	www.123haustiereundmehr.com

There are 1000 more lines.


==================== Scheduled Tasks (whitelisted) =============

Task: {00272DB7-FCA0-4E94-8A30-6338DDED2971} - System32\Tasks\Microsoft\Windows\Defrag\ManualDefrag => C:\Windows\system32\defrag.exe [2008-01-21] (Microsoft Corp.)
Task: {075F7B0C-8858-426A-81EA-5161F4D13E82} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {154E98C1-C983-454D-BE7C-5FC880595600} - System32\Tasks\Sony Corporation\VAIO Update\VAIO Update => C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe [2013-03-26] (Sony Corporation)
Task: {18D486E1-F3D2-4F43-8F58-C05D739BEA65} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2257783777-1101859096-687163147-1000Core => C:\Users\Sarah\AppData\Local\Google\Update\GoogleUpdate.exe [2013-02-22] (Google Inc.)
Task: {255B5E03-25D0-4EEF-9991-E179DDA28A94} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2013-05-09] (AVAST Software)
Task: {2EF1A2C3-210D-4AFD-BEB7-E51E7FD69C0C} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {3A950610-5351-4CF3-89BD-526A7E64AA8B} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-21] ()
Task: {3C6DAF9D-24D6-4482-B7AE-753359DBB0B9} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2257783777-1101859096-687163147-1000UA => C:\Users\Sarah\AppData\Local\Google\Update\GoogleUpdate.exe [2013-02-22] (Google Inc.)
Task: {3ED41489-88D0-49CD-80B4-158FD317F193} - System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\OptinNotification => C:\Windows\System32\wsqmcons.exe [2008-01-21] (Microsoft Corporation)
Task: {44712EC5-B1EA-4281-A25E-FEA4E5C73C6E} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2257783777-1101859096-687163147-1000Core => C:\Users\Sarah\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-12] (Facebook Inc.)
Task: {58FC740B-0751-4F3B-A7B4-DF75B7D2D4DF} - System32\Tasks\SONY\WSSU\WSSU => C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe [2007-06-15] (Sony Corporation)
Task: {5A6D9831-D95C-4713-B4E9-F03D1644498F} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-21] (Microsoft Corporation)
Task: {6EECDFF2-88F8-46BA-AB01-401FF7BD3940} - System32\Tasks\Sony Corporation\VAIO Update\VAIO Update Self Repair => C:\Program Files\Sony\VAIO Update\VUSR.exe [2013-03-26] (Sony Corporation)
Task: {73243767-E976-4E3D-AA02-7B55243D2603} - System32\Tasks\BrowserProtect => C:\Windows\system32\sc.exe [2006-11-02] (Microsoft Corporation)
Task: {7D32B7AF-7F5C-4F29-A7EB-21B15D345113} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-04-23] (Piriform Ltd)
Task: {81A01513-DD65-4B04-9EB2-4EEED91CA405} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2008-01-21] (Microsoft Corporation)
Task: {9A36A669-7D50-4BEE-B948-7B00E58116CC} - System32\Tasks\User_Feed_Synchronization-{A9097228-7BF7-4646-B1F5-D5A7D9C4D20A} => C:\Windows\system32\msfeedssync.exe [2008-01-21] (Microsoft Corporation)
Task: {B25D4244-6254-4542-9A54-D5A933EC915A} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {BE8B5C1B-6716-4696-AD54-FD0942651A60} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-03-30] (Google Inc.)
Task: {BECFC2AB-F871-4B5F-9513-CD1273AEFD10} - System32\Tasks\Auslogics\Disk Defrag\Sheduled Defragmentation => C:\Program Files\Auslogics\Auslogics Disk Defrag\DiskDefrag.exe [2012-03-29] (Auslogics)
Task: {D3E97CFD-3982-4476-8100-C5DE0993FC4B} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-03-30] (Google Inc.)
Task: {D7159F95-121B-4CE4-AB4E-7D3C1A2F4FC3} - System32\Tasks\Microsoft\Windows\PLA\System\ConvertLogEntries => C:\Windows\system32\rundll32.exe [2006-11-02] (Microsoft Corporation)
Task: {DB75D7C8-1519-40F1-9724-97DCFC4D39EE} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-07-14] (Adobe Systems Incorporated)
Task: {FA2ED70C-D6F9-4766-8953-E74EDCF94495} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2257783777-1101859096-687163147-1000UA => C:\Users\Sarah\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-12] (Facebook Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2257783777-1101859096-687163147-1000Core.job => C:\Users\Sarah\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2257783777-1101859096-687163147-1000UA.job => C:\Users\Sarah\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2257783777-1101859096-687163147-1000Core.job => C:\Users\Sarah\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2257783777-1101859096-687163147-1000UA.job => C:\Users\Sarah\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\User_Feed_Synchronization-{A9097228-7BF7-4646-B1F5-D5A7D9C4D20A}.job => C:\Windows\system32\msfeedssync.exe

==================== Faulty Device Manager Devices =============

Name: 
Description: 
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: 
Service: 
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (07/25/2013 10:33:57 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/25/2013 05:58:22 PM) (Source: Application Error) (User: )
Description: Fehlerhafte Anwendung Explorer.EXE, Version 6.0.6001.18164, Zeitstempel 0x4907e242, fehlerhaftes Modul contextmenu32.dll, Version 1.0.0.1, Zeitstempel 0x5139308e, Ausnahmecode 0xc0000005, Fehleroffset 0x0000572b,
Prozess-ID 0x8bc, Anwendungsstartzeit Explorer.EXE0.

Error: (07/25/2013 05:22:44 PM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\CONFIG.MSI\BC92C0.RBS> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

Error: (07/25/2013 05:21:09 PM) (Source: Microsoft Fax) (User: )
Description: Fehler beim Senden des Faxes. Der Anschluss ist besetzt. Dieses Fax wird nicht gesendet, da die maximale Anzahl der Wiederholungsversuche erreicht wurde. Absender: Sebastian Fritz. Rechnungscode: . Firma des Absenders: . Abteilung des Absenders: . Gerätename: HDAUDIO SoftV92 Data Fax Modem with SmartCP. Auftrags-ID: 0x0201ce8949cba2b8. Benutzername: Sarah-PC\Sarah.
 Weitere Informationen erhalten Sie im Aktivitätsprotokoll.

Error: (07/25/2013 04:48:48 PM) (Source: Application Error) (User: )
Description: Fehlerhafte Anwendung WFS.exe, Version 6.0.6001.18000, Zeitstempel 0x47919551, fehlerhaftes Modul WFS.exe, Version 6.0.6001.18000, Zeitstempel 0x47919551, Ausnahmecode 0xc0000094, Fehleroffset 0x00052998,
Prozess-ID 0x684, Anwendungsstartzeit WFS.exe0.

Error: (07/25/2013 04:46:37 PM) (Source: Microsoft Fax) (User: )
Description: Die Datei mit der Erweiterung ".jpg" kann nicht per Fax gesendet werden, da die Datei dafür als TIF-Datei gerendert werden muss. Diese Datei kann nicht gerendert werden, weil die zugehörige Anwendung auf diesem Computer nicht vorhanden ist.

Error: (07/25/2013 04:46:29 PM) (Source: Microsoft Fax) (User: )
Description: Die Datei mit der Erweiterung ".jpg" kann nicht per Fax gesendet werden, da die Datei dafür als TIF-Datei gerendert werden muss. Diese Datei kann nicht gerendert werden, weil die zugehörige Anwendung auf diesem Computer nicht vorhanden ist.

Error: (07/25/2013 04:40:38 PM) (Source: Microsoft Fax) (User: )
Description: Die Datei mit der Erweiterung ".jpg" kann nicht per Fax gesendet werden, da die Datei dafür als TIF-Datei gerendert werden muss. Diese Datei kann nicht gerendert werden, weil die zugehörige Anwendung auf diesem Computer nicht vorhanden ist.

Error: (07/25/2013 04:40:38 PM) (Source: Microsoft Fax) (User: )
Description: Die Datei mit der Erweiterung ".jpg" kann nicht per Fax gesendet werden, da die Datei dafür als TIF-Datei gerendert werden muss. Diese Datei kann nicht gerendert werden, weil die zugehörige Anwendung auf diesem Computer nicht vorhanden ist.

Error: (07/25/2013 04:40:37 PM) (Source: Microsoft Fax) (User: )
Description: Die Datei mit der Erweiterung ".jpg" kann nicht per Fax gesendet werden, da die Datei dafür als TIF-Datei gerendert werden muss. Diese Datei kann nicht gerendert werden, weil die zugehörige Anwendung auf diesem Computer nicht vorhanden ist.


System errors:
=============

Microsoft Office Sessions:
=========================
Error: (07/25/2013 10:33:57 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/25/2013 05:58:22 PM) (Source: Application Error)(User: )
Description: Explorer.EXE6.0.6001.181644907e242contextmenu32.dll1.0.0.15139308ec00000050000572b8bc01ce891fa8161aa6

Error: (07/25/2013 05:22:44 PM) (Source: Windows Search Service)(User: )
Description: Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)
C:\CONFIG.MSI\BC92C0.RBS

Error: (07/25/2013 05:21:09 PM) (Source: Microsoft Fax)(User: )
Description: Sebastian FritzHDAUDIO SoftV92 Data Fax Modem with SmartCP0x0201ce8949cba2b8Sarah-PC\Sarah

Error: (07/25/2013 04:48:48 PM) (Source: Application Error)(User: )
Description: WFS.exe6.0.6001.1800047919551WFS.exe6.0.6001.1800047919551c00000940005299868401ce8945b5dad000

Error: (07/25/2013 04:46:37 PM) (Source: Microsoft Fax)(User: )
Description: .jpg

Error: (07/25/2013 04:46:29 PM) (Source: Microsoft Fax)(User: )
Description: .jpg

Error: (07/25/2013 04:40:38 PM) (Source: Microsoft Fax)(User: )
Description: .jpg

Error: (07/25/2013 04:40:38 PM) (Source: Microsoft Fax)(User: )
Description: .jpg

Error: (07/25/2013 04:40:37 PM) (Source: Microsoft Fax)(User: )
Description: .jpg


CodeIntegrity Errors:
===================================
  Date: 2013-07-27 12:45:17.656
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-07-27 12:45:17.563
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-07-27 12:45:17.469
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-07-27 12:45:17.377
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-07-27 12:45:17.272
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-07-27 12:45:17.180
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-07-27 12:45:17.083
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-07-27 12:45:16.989
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-07-27 12:26:49.082
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-07-27 12:26:49.034
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Percentage of memory in use: 68%
Total physical RAM: 2045.69 MB
Available physical RAM: 635.38 MB
Total Pagefile: 4330.38 MB
Available Pagefile: 2343.45 MB
Total Virtual: 2047.88 MB
Available Virtual: 1905.36 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:149.04 GB) (Free:60.33 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 149 GB) (Disk ID: 2A817B72)
Partition 1: (Active) - (Size=149 GB) - (Type=07 NTFS)

==================== End Of Log ============================

schrauber · 27.07.2013, 12:21

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

sepp1987 · 27.07.2013, 13:05

Ok habe ich gemacht hier sind die log´s:

Code:

ATTFilter

# AdwCleaner v2.306 - Datei am 27/07/2013 um 13:45:47 erstellt
# Aktualisiert am 19/07/2013 von Xplode
# Betriebssystem : Windows Vista (TM) Ultimate Service Pack 1 (32 bits)
# Benutzer : Sarah - SARAH-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Sarah\Desktop\Trojaner hilfe\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Datei Gelöscht : C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\iy8dzkv7.Sebastian\foxydeal.sqlite
Datei Gelöscht : C:\Users\Sepp\AppData\Roaming\Mozilla\Firefox\Profiles\f8r0muvv.default\foxydeal.sqlite
Ordner Gelöscht : C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\iy8dzkv7.Sebastian\jetpack

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\BabSolution

***** [Internet Browser] *****

-\\ Internet Explorer v7.0.6001.18000

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v22.0 (de)

Datei : C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\iy8dzkv7.Sebastian\prefs.js

Gelöscht : user_pref("extensions.ffxtlbr@delta.com.install-event-fired", true);

Datei : C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\wjv2k0u7.default\prefs.js

[OK] Die Datei ist sauber.

Datei : C:\Users\Sepp\AppData\Roaming\Mozilla\Firefox\Profiles\f8r0muvv.default\prefs.js

[OK] Die Datei ist sauber.

Datei : C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\wjrh6fgf.default\prefs.js

[OK] Die Datei ist sauber.

-\\ Google Chrome v [Version kann nicht ermittelt werden]

Datei : C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Die Datei ist sauber.

*************************

AdwCleaner[S2].txt - [1714 octets] - [27/07/2013 13:45:47]

########## EOF - C:\AdwCleaner[S2].txt - [1774 octets] ##########

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.2.5 (07.26.2013:2)
OS: Windows Vista (TM) Ultimate x86
Ran by Sarah on 27.07.2013 at 13:55:38,51
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\DisplayName
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\URL



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\interface\{6f43fa77-c18f-4d0c-9c7e-958876fe2061}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\interface\{df948646-8bf4-450e-a059-cf8a4e0fe2be}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\interface\{e96b49b0-e11f-48fc-984a-eec29a4f57e1}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\anchorfree



~~~ Files

Successfully deleted: [File] C:\eula.1049.txt
Successfully deleted: [File] C:\install.res.1049.dll



~~~ Folders



~~~ FireFox

Successfully deleted: [File] C:\Users\Sarah\AppData\Roaming\mozilla\firefox\profiles\wjv2k0u7.default\invalidprefs.js
Successfully deleted: [Registry Value] HKEY_CURRENT_USER\Software\Mozilla\Firefox\Extensions\\{184aa5e6-741d-464a-820e-94b3abc2f3b4}
Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions\\{184aa5e6-741d-464a-820e-94b3abc2f3b4}
Successfully deleted the following from C:\Users\Sarah\AppData\Roaming\mozilla\firefox\profiles\wjv2k0u7.default\prefs.js

user_pref("browser.search.searchEnginesURL", "hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=. ");
user_pref("extensions.facetweak.addit.remoteInstallItems", "{ \"software\": {\"78\": {\"id\": \"78\",\"title\": \"Ciuvo\",\"type\": \"XPI\",\"url\": \"hxxps://addons.mozilla.o
user_pref("extensions.jid1-QpHD8URtZWJC2A@jetpack.status_cproxy", false);
user_pref("extensions.webbooster@iminent.com.install-event-fired", true);
user_pref("id_imbooster4web_v6.bubble_src", "hxxp%3A//toolbar.iminent.com/SocialNetworking/%3FvToolbar%3DIminent");
user_pref("iminent.webbooster.scripts.minibar.registerToolbarEvent109", "1313234032849");
user_pref("iminent.webbooster.scripts.minibar.registerToolbarEvent111", "1313234032834");
user_pref("iminent.webbooster.scripts.minibar.registerToolbarEvent112", "1313234032943");
Emptied folder: C:\Users\Sarah\AppData\Roaming\mozilla\firefox\profiles\wjv2k0u7.default\minidumps [44 files]
Emptied folder: C:\Users\Sarah\AppData\Roaming\mozilla\firefox\profiles\iy8dzkv7.Sebastian\minidumps [120 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 27.07.2013 at 13:58:36,22
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 27-07-2013
Ran by Sarah (administrator) on 27-07-2013 14:00:43
Running from C:\Users\Sarah\Desktop\Trojaner hilfe
Microsoft® Windows Vista™ Ultimate  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 7
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(ATI Technologies Inc.) C:\Windows\system32\Ati2evxx.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(ATI Technologies Inc.) C:\Windows\system32\Ati2evxx.exe
(Abbott Diabetes Care) C:\Program Files\Abbott Diabetes Care\FreeStyle Auto-Assist\adcmald.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Nalpeiron Ltd.) C:\Windows\system32\nlssrv32.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Event Service\VESMgrSub.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
(Sony Corporation) C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdSync.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
() C:\Program Files\Abbott Diabetes Care\FreeStyle Auto-Assist\adclaunchd.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
() C:\Program Files\VoIPdial\VoIPdial.exe
(Google) C:\Program Files\Google\Drive\googledrivesync.exe
(Samsung) C:\Program Files\Samsung\Kies\Kies.exe
(Samsung) C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
(Dropbox, Inc.) C:\Users\Sarah\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.bin
(Microsoft Corporation) C:\Windows\system32\wbem\unsecapp.exe
(Google) C:\Program Files\Google\Drive\googledrivesync.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VUAgent.exe
(Microsoft Corporation) C:\Windows\system32\prevhost.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [avast] - C:\Program Files\AVAST Software\Avast\avastUI.exe [4858968 2013-05-09] (AVAST Software)
HKLM\...\Run: [Windows Mobile-based device management] - C:\Windows\WindowsMobile\wmdSync.exe [215552 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [KiesTrayAgent] - C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [310640 2013-03-28] (Samsung Electronics Co., Ltd.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [FreeStyle AutoLaunch] - C:\Program Files\Abbott Diabetes Care\FreeStyle Auto-Assist\adclaunchd.exe [196960 2013-02-09] ()
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM\...\Winlogon: [Userinit] c:\windows\system32\userinit.exe,userinit.exe,
Winlogon\Notify\!SASWinLogon: I:\System\Apps\7E5842E4-EF51-421A-8FB3-19F3ECB18E3C\Data\SASWINLO.DLL [X]
Winlogon\Notify\VESWinlogon: VESWinlogon.dll (Sony Corporation)
HKCU\...\Run: [VoIPdial] - C:\Program Files\VoIPdial\VoIPdial.exe [274039 2009-09-30] ()
HKCU\...\Run: [Facebook Update] - C:\Users\Sarah\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-07-12] (Facebook Inc.)
HKCU\...\Run: [GoogleDriveSync] - C:\Program Files\Google\Drive\googledrivesync.exe [19676256 2013-06-06] (Google)
HKCU\...\Run: [Google Update] - C:\Users\Sarah\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-02-22] (Google Inc.)
HKCU\...\Run: [KiesPreload] - C:\Program Files\Samsung\Kies\Kies.exe [1511792 2013-03-28] (Samsung)
HKCU\...\Run: [] - C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [1106288 2013-03-28] (Samsung)
HKCU\...\Run: [WMPNSCFG] - C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-21] (Microsoft Corporation)
MountPoints2: G - G:\LaunchU3.exe -a
MountPoints2: {1836f5ee-e5bf-11e0-94d8-001e3d3bc32e} - G:\LaunchU3.exe -a
MountPoints2: {7472dfd3-2f15-11e2-9f95-001e3d3bc32e} - G:\Windows\StartFreeStyle.exe
MountPoints2: {a48a3f4d-1205-11e2-b1fd-001e3d3bc32e} - RunClubSanDisk.exe
MountPoints2: {c2486bab-fca5-11e0-ad5c-001e3d3bc32e} - G:\LaunchU3.exe -a
HKU\Administrator\...\Run: [Sidebar] - C:\Program Files\Windows Sidebar\sidebar.exe [ 2008-01-21] (Microsoft Corporation)
HKU\Administrator\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2008-01-21] (Microsoft Corporation)
HKU\Default\...\Run: [Sidebar] - C:\Program Files\Windows Sidebar\Sidebar.exe [ 2008-01-21] (Microsoft Corporation)
HKU\Default\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2008-01-21] (Microsoft Corporation)
HKU\Default User\...\Run: [Sidebar] - C:\Program Files\Windows Sidebar\Sidebar.exe [ 2008-01-21] (Microsoft Corporation)
HKU\Default User\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2008-01-21] (Microsoft Corporation)
HKU\Sepp\...\Run: [Sidebar] - C:\Program Files\Windows Sidebar\sidebar.exe [ 2008-01-21] (Microsoft Corporation)
HKU\Sepp\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2008-01-21] (Microsoft Corporation)
HKU\Sepp\...\Run: [GoogleDriveSync] - C:\Program Files\Google\Drive\googledrivesync.exe [ 2013-06-06] (Google)
HKU\Sepp\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\system32\Macromed\Flash\FlashUtil32_11_7_700_224_Plugin.exe -update plugin [x]
Startup: C:\Users\Sarah\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Sarah\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Sarah\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
Startup: C:\Users\Sepp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
BootExecute: autocheck autochk /p \??\H:autocheck autochk * 

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search
SearchScopes: HKCU - {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL = 
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_07-windows-i586.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
ShellExecuteHooks: SABShellExecuteHook Class - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} -  No File [ ]
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Path=Profiles\iy8dzkv7.Sebastian
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @google.com/npPicasa3,version=3.0.0 - C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Sarah\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin - C:\Users\Sarah\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin HKCU: @talk.google.com/O1DPlugin - C:\Users\Sarah\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
FF Plugin HKCU: @talk.google.com/O3DPlugin - C:\Users\Sarah\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Sarah\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Sarah\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Extension: Default - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF

Chrome: 
=======
CHR HomePage: hxxp://www.google.com

========================== Services (Whitelisted) =================

R2 adcmald; C:\Program Files\Abbott Diabetes Care\FreeStyle Auto-Assist\adcmald.exe [535896 2013-02-09] (Abbott Diabetes Care)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-05-09] (AVAST Software)
S4 SBSDWSCService; C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
R3 VUAgent; C:\Program Files\Sony\VAIO Update\VUAgent.exe [1013808 2013-03-26] (Sony Corporation)
S2 AntiVirSchedulerService; "C:\Program Files\Avira\AntiVir Desktop\sched.exe" [x]
S2 AntiVirService; "C:\Program Files\Avira\AntiVir Desktop\avguard.exe" [x]
S3 rpcapd; "%ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini" [x]

==================== Drivers (Whitelisted) ====================

R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [29816 2013-05-09] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [66336 2013-05-09] (AVAST Software)
R1 aswRdr; C:\Windows\System32\Drivers\aswRdr.sys [49760 2013-05-09] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [49376 2013-05-09] ()
R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [770344 2013-06-28] (AVAST Software)
R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [369584 2013-06-28] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [56080 2013-05-09] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [175176 2013-06-28] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [66616 2011-08-06] (Avira GmbH)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [138192 2011-08-06] (Avira GmbH)
S3 bdacap; C:\Windows\System32\drivers\bdacap.sys [217728 2006-02-14] (Genesys Logic, Inc.)
S3 cpudrv; C:\Program Files\SystemRequirementsLab\cpudrv.sys [11336 2011-06-02] ()
S3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2010-06-14] ()
S3 GLHIDKBFILTER; C:\Windows\System32\DRIVERS\GLKbFilter.sys [11264 2006-01-06] (Genesys Logic)
R2 NPF; C:\Windows\System32\drivers\npf.sys [36600 2013-03-01] (Riverbed Technology, Inc.)
S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [15576 2013-01-11] ()
S3 pwdspio; C:\Windows\system32\pwdspio.sys [10200 2013-01-11] ()
R3 R5U870FLx86; C:\Windows\System32\Drivers\R5U870FLx86.sys [73472 2008-01-30] (Ricoh)
R3 R5U870FUx86; C:\Windows\System32\Drivers\R5U870FUx86.sys [43904 2008-01-30] (Ricoh)
R1 StarOpen; C:\Windows\System32\Drivers\StarOpen.sys [5632 2006-07-24] ()
S3 tap0901; C:\Windows\System32\DRIVERS\tap0901.sys [26624 2011-12-15] (The OpenVPN Project)
R3 ti21sony; C:\Windows\System32\drivers\ti21sony.sys [818688 2007-11-16] (Texas Instruments)
S3 UIUSys; C:\Windows\System32\DRIVERS\UIUSYS.SYS [6909 2008-01-30] (Conexant Systems, Inc)
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
S1 SASDIFSV; \??\I:\System\Apps\7E5842E4-EF51-421A-8FB3-19F3ECB18E3C\Data\SASDIFSV.SYS [x]
S1 SASKUTIL; \??\I:\System\Apps\7E5842E4-EF51-421A-8FB3-19F3ECB18E3C\Data\SASKUTIL.SYS [x]
S3 USBAAPL; System32\Drivers\usbaapl.sys [x]
S3 WinRing0_1_2_0; \??\C:\Program Files\BatteryCare\WinRing0.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-27 13:55 - 2013-07-27 13:55 - 00000000 ____D C:\Windows\ERUNT
2013-07-27 13:43 - 2013-07-27 14:00 - 00000000 ____D C:\Users\Sarah\Desktop\Trojaner hilfe
2013-07-27 12:46 - 2013-07-27 12:46 - 00036679 _____ C:\Users\Sarah\Downloads\FRST.txt
2013-07-27 12:46 - 2013-07-27 12:46 - 00017049 _____ C:\Users\Sarah\Downloads\Addition.txt
2013-07-27 12:44 - 2013-07-27 12:44 - 00000000 ____D C:\FRST
2013-07-27 10:41 - 2013-07-27 10:41 - 00000000 ____D C:\Program Files\ESET
2013-07-27 10:40 - 2013-07-27 10:40 - 02347384 _____ (ESET) C:\Users\Sarah\Downloads\esetsmartinstaller_enu.exe
2013-07-25 12:50 - 2013-07-25 12:50 - 00074445 _____ C:\Users\Sarah\Downloads\nummernkreise_flexiblenummernautomatik3.zip
2013-07-25 11:39 - 2013-07-25 11:39 - 00001868 _____ C:\Users\Sarah\Downloads\sg_backup_2013-07-25-1139.spg
2013-07-25 11:39 - 2013-07-25 11:39 - 00001868 _____ C:\Users\Sarah\Downloads\FirstBackup.spg
2013-07-25 11:36 - 2013-07-25 11:36 - 00659456 _____ (Speed Guide Inc.) C:\Users\Sarah\Downloads\TCP308Optimizer.exe
2013-07-24 19:21 - 2013-07-24 19:21 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\Wireshark
2013-07-24 19:20 - 2013-07-24 20:02 - 02775040 _____ C:\Users\Sarah\session.sqlite
2013-07-24 19:19 - 2013-07-24 19:19 - 00000000 ____D C:\Program Files\Wireshark
2013-07-24 19:17 - 2013-07-24 19:18 - 22238848 _____ (Wireshark development team) C:\Users\Sarah\Downloads\Wireshark-win32-1.10.0.exe
2013-07-24 19:15 - 2013-07-24 19:16 - 37099197 _____ C:\Users\Sarah\Downloads\CookieCadger-1.06.jar
2013-07-23 17:28 - 2013-07-23 17:29 - 37099197 _____ C:\Users\Sarah\Desktop\CookieCadger-1.06.jar
2013-07-23 17:18 - 2013-07-23 17:18 - 00678144 _____ C:\Users\Sarah\Downloads\FaceNiff-2.4.apk
2013-07-23 17:02 - 2013-07-23 17:03 - 00000000 ____D C:\Program Files\Safari
2013-07-23 17:00 - 2013-07-23 17:00 - 00000000 ____D C:\Program Files\Apple Software Update
2013-07-23 16:58 - 2013-07-23 16:58 - 38494576 _____ (Apple Inc.) C:\Users\Sarah\Downloads\SafariSetup-5.1.7.exe
2013-07-23 16:45 - 2013-07-23 16:45 - 00000000 ____D C:\Program Files\WinPcap
2013-07-23 16:44 - 2013-07-23 16:44 - 00915128 _____ (Riverbed Technology, Inc.) C:\Users\Sarah\Downloads\WinPcap_4_1_3.exe
2013-07-23 15:45 - 2013-07-23 15:50 - 00000077 _____ C:\wepkeys.txt
2013-07-23 15:44 - 2013-07-23 15:44 - 00000000 ____D C:\Aircrack
2013-07-23 15:40 - 2013-07-23 15:41 - 08287320 _____ C:\Users\Sarah\Downloads\aircrack-ng-1.2-beta1-win.zip
2013-07-23 14:59 - 2013-07-23 14:59 - 00000000 ____D C:\Users\Sarah\Documents\EasyBox Key Decrypter Logfile
2013-07-23 14:57 - 2013-07-23 14:57 - 00001106 _____ C:\Users\Sarah\Desktop\EasyBox Key Decrypter.lnk
2013-07-23 14:57 - 2013-07-23 14:57 - 00000000 ____D C:\Program Files\EasyBox Key Decrypter
2013-07-23 14:56 - 2013-07-23 14:56 - 01797880 _____ C:\Users\Sarah\Downloads\EasyBox_Key_Decrypter_v1.4_Setup.exe
2013-07-23 13:24 - 2013-07-23 13:24 - 00028833 _____ C:\Users\Sarah\Downloads\formular_aktuelle_modue.zip
2013-07-23 12:36 - 2013-07-23 12:37 - 77021736 _____ C:\Users\Sarah\Downloads\Cro_Sunny.zip
2013-07-19 18:35 - 2013-07-19 18:35 - 00630802 _____ C:\Users\Sarah\Downloads\Wave_Backgrounds_with_Grass_Elements.zip
2013-07-19 17:45 - 2013-07-19 17:45 - 00719586 _____ C:\Users\Sarah\Downloads\Stunning_Retro_Backgrounds.zip
2013-07-19 17:02 - 2013-07-19 17:02 - 01385419 _____ C:\Users\Sarah\Downloads\FreeVectorFlowerBackground.zip
2013-07-19 16:08 - 2013-07-19 16:08 - 01053864 _____ C:\Users\Sarah\Downloads\FloralDesignHeaders2-by-gfxcool.zip
2013-07-19 15:42 - 2013-07-19 15:42 - 04943043 _____ C:\Users\Sarah\Downloads\free_vector_fancy_headers.zip
2013-07-19 15:31 - 2013-07-19 15:31 - 00080868 _____ C:\Users\Sarah\Downloads\Newsletter_Main_Feature.zip
2013-07-19 13:19 - 2013-07-19 13:20 - 29584723 _____ C:\Users\Sarah\Downloads\sendblaster2.0.138.zip
2013-07-17 13:26 - 2013-07-17 13:27 - 00000000 ____D C:\Users\Sarah\www.apowersoft.com
2013-07-13 13:30 - 2013-07-13 13:30 - 00303308 _____ C:\Users\Sarah\Downloads\De Bauer.mp4
2013-07-13 13:04 - 2013-07-13 13:04 - 00446040 _____ C:\Users\Sarah\Downloads\JW.Player.v6.1.2972.Pro.incl.Keygen.FLASH.NULL-DGT.zip
2013-07-13 13:00 - 2013-07-13 13:00 - 00507325 _____ C:\Users\Sarah\Downloads\mediaplayer.zip
2013-07-13 11:40 - 2013-07-26 17:48 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\Skype
2013-07-13 11:39 - 2013-07-13 11:52 - 00002379 _____ C:\Users\Public\Desktop\Skype.lnk
2013-07-13 11:39 - 2013-07-13 11:40 - 00000000 ____D C:\ProgramData\Skype
2013-07-13 11:39 - 2013-07-13 11:39 - 00000000 ___RD C:\Program Files\Skype
2013-07-13 11:39 - 2013-07-13 11:39 - 00000000 ____D C:\Program Files\Common Files\Skype
2013-07-13 11:37 - 2013-07-13 11:37 - 01492584 _____ (Skype Technologies S.A.) C:\Users\Sarah\Downloads\SkypeSetup.exe
2013-07-12 19:46 - 2013-07-12 19:46 - 00969301 _____ C:\Users\Sarah\Downloads\wptouch.1.9.7.zip
2013-07-12 19:39 - 2013-07-12 19:39 - 00861291 _____ C:\Users\Sarah\Downloads\nextgen-gallery.zip
2013-07-12 19:36 - 2013-07-12 19:37 - 03786542 _____ C:\Users\Sarah\Downloads\jw-player-plugin-for-wordpress.2.1.1.zip
2013-07-12 19:35 - 2013-07-12 19:35 - 00521811 _____ C:\Users\Sarah\Downloads\contact-form-plugin.3.47.zip
2013-07-12 19:31 - 2013-07-12 19:31 - 00219355 _____ C:\Users\Sarah\Downloads\antispam-bee.zip
2013-07-12 18:33 - 2013-07-12 18:34 - 04815135 _____ (FileZilla Project) C:\Users\Sarah\Downloads\FileZilla_3.7.1_win32-setup.exe
2013-07-12 18:30 - 2013-07-12 19:14 - 04353459 _____ C:\Users\Sarah\Downloads\wordpress-3.5.2-de_DE.zip
2013-07-12 12:42 - 2013-07-12 12:42 - 00060912 _____ C:\Users\Sepp\AppData\Local\GDIPFONTCACHEV1.DAT
2013-07-12 12:30 - 2013-07-12 12:30 - 01940642 _____ C:\Users\Sepp\Downloads\vorlagen3de_opendoc.zip
2013-07-12 12:30 - 2013-07-12 12:30 - 00000000 ____D C:\Users\Sepp\AppData\Roaming\WinRAR
2013-07-12 12:25 - 2013-07-12 12:21 - 00000543 _____ C:\Users\Sepp\Documents\indexfile.txt
2013-07-12 12:02 - 2013-07-12 12:26 - 00000000 ___SD C:\Users\Sepp\Google Drive
2013-07-12 12:02 - 2013-07-12 12:02 - 00001547 _____ C:\Users\Sepp\Desktop\Google Drive.lnk
2013-07-12 11:42 - 2013-07-12 11:42 - 00000000 ____D C:\Users\Sepp\AppData\Roaming\OpenOffice.org
2013-07-09 16:00 - 2013-07-09 16:00 - 00179832 _____ C:\Users\Sarah\Desktop\Passwörter.txt
2013-07-09 15:51 - 2013-07-09 15:51 - 00024345 _____ C:\Users\Sarah\Desktop\password-export-2013-07-09.csv
2013-07-09 15:49 - 2013-07-09 15:49 - 00041249 _____ C:\Users\Sarah\Desktop\password-export-2013-07-09.xml
2013-07-04 08:41 - 2013-07-04 08:41 - 05706781 _____ C:\Users\Sarah\Desktop\Rising Sun - Epic Orchestra Film Instrumental Music.mp4
2013-07-02 13:16 - 2013-07-02 13:16 - 00698764 _____ C:\Users\Sarah\Downloads\Uhr.exe
2013-07-01 22:21 - 2013-07-01 22:16 - 07126244 _____ C:\Users\Sarah\Desktop\tobi-song-movie.wmv
2013-07-01 21:10 - 2013-07-13 12:18 - 00000955 _____ C:\Users\Public\Desktop\TeamViewer 8.lnk
2013-06-30 14:20 - 2013-06-30 14:20 - 00000000 ____D C:\Users\Sepp\AppData\Local\Macromedia
2013-06-30 14:11 - 2013-06-30 14:19 - 00000000 ____D C:\Users\Sepp\AppData\Roaming\Mozilla
2013-06-30 14:11 - 2013-06-30 14:11 - 00000000 ____D C:\Users\Sepp\AppData\Local\Mozilla
2013-06-28 11:32 - 2013-06-28 11:32 - 00000468 _____ C:\Users\Sarah\Desktop\hunday mobile.txt
2013-06-28 10:22 - 2013-06-28 10:22 - 00000175 _____ C:\Windows\system32\Drivers\aswVmm.sys.sum
2013-06-27 09:52 - 2013-06-28 10:22 - 00000175 _____ C:\Windows\system32\Drivers\aswSP.sys.sum
2013-06-27 09:52 - 2013-06-28 10:22 - 00000175 _____ C:\Windows\system32\Drivers\aswSnx.sys.sum

==================== One Month Modified Files and Folders =======

2013-07-27 14:00 - 2013-07-27 13:43 - 00000000 ____D C:\Users\Sarah\Desktop\Trojaner hilfe
2013-07-27 13:59 - 2012-03-30 14:21 - 00001096 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-27 13:55 - 2013-07-27 13:55 - 00000000 ____D C:\Windows\ERUNT
2013-07-27 13:53 - 2013-04-22 22:16 - 00000000 ___RD C:\Users\Sarah\Dropbox
2013-07-27 13:53 - 2013-04-22 22:11 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\Dropbox
2013-07-27 13:53 - 2012-07-14 11:42 - 00000000 ___SD C:\Users\Sarah\Google Drive
2013-07-27 13:51 - 2012-03-30 14:21 - 00001092 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-27 13:49 - 2006-11-02 14:46 - 00003760 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-27 13:49 - 2006-11-02 14:46 - 00003760 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-27 13:48 - 2013-05-18 10:26 - 00004002 _____ C:\Windows\PFRO.log
2013-07-27 13:48 - 2012-04-02 16:31 - 00000000 ____D C:\Windows\pss
2013-07-27 13:48 - 2006-11-02 15:00 - 00032564 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-07-27 13:48 - 2006-11-02 15:00 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-07-27 13:47 - 2013-03-09 12:33 - 00478741 _____ C:\Windows\WindowsUpdate.log
2013-07-27 13:47 - 2011-08-05 12:50 - 00001660 _____ C:\Windows\bthservsdp.dat
2013-07-27 13:32 - 2013-02-22 16:11 - 00001120 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2257783777-1101859096-687163147-1000UA.job
2013-07-27 13:32 - 2013-02-06 10:32 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-27 12:46 - 2013-07-27 12:46 - 00036679 _____ C:\Users\Sarah\Downloads\FRST.txt
2013-07-27 12:46 - 2013-07-27 12:46 - 00017049 _____ C:\Users\Sarah\Downloads\Addition.txt
2013-07-27 12:44 - 2013-07-27 12:44 - 00000000 ____D C:\FRST
2013-07-27 12:32 - 2011-10-19 15:22 - 00001138 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2257783777-1101859096-687163147-1000UA.job
2013-07-27 12:32 - 2011-10-19 15:22 - 00001116 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2257783777-1101859096-687163147-1000Core.job
2013-07-27 11:32 - 2013-02-22 16:11 - 00001068 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2257783777-1101859096-687163147-1000Core.job
2013-07-27 11:10 - 2011-08-05 20:14 - 00000418 ____H C:\Windows\Tasks\User_Feed_Synchronization-{A9097228-7BF7-4646-B1F5-D5A7D9C4D20A}.job
2013-07-27 10:41 - 2013-07-27 10:41 - 00000000 ____D C:\Program Files\ESET
2013-07-27 10:40 - 2013-07-27 10:40 - 02347384 _____ (ESET) C:\Users\Sarah\Downloads\esetsmartinstaller_enu.exe
2013-07-26 20:27 - 2006-11-02 14:35 - 00000000 ____D C:\Windows\system32\FxsTmp
2013-07-26 17:48 - 2013-07-13 11:40 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\Skype
2013-07-25 16:03 - 2011-08-05 12:41 - 00059904 _____ C:\Users\Sarah\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-07-25 15:44 - 2013-04-20 14:27 - 00001892 _____ C:\Users\Public\Desktop\Adobe Reader X.lnk
2013-07-25 15:43 - 2011-08-08 11:01 - 00000000 ____D C:\ProgramData\Adobe
2013-07-25 15:36 - 2011-08-08 11:09 - 00000000 ____D C:\Users\Sarah\AppData\Local\Adobe
2013-07-25 12:50 - 2013-07-25 12:50 - 00074445 _____ C:\Users\Sarah\Downloads\nummernkreise_flexiblenummernautomatik3.zip
2013-07-25 11:42 - 2012-10-10 20:14 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-07-25 11:39 - 2013-07-25 11:39 - 00001868 _____ C:\Users\Sarah\Downloads\sg_backup_2013-07-25-1139.spg
2013-07-25 11:39 - 2013-07-25 11:39 - 00001868 _____ C:\Users\Sarah\Downloads\FirstBackup.spg
2013-07-25 11:36 - 2013-07-25 11:36 - 00659456 _____ (Speed Guide Inc.) C:\Users\Sarah\Downloads\TCP308Optimizer.exe
2013-07-24 20:02 - 2013-07-24 19:20 - 02775040 _____ C:\Users\Sarah\session.sqlite
2013-07-24 20:02 - 2011-08-05 12:35 - 00000000 ____D C:\Users\Sarah
2013-07-24 19:21 - 2013-07-24 19:21 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\Wireshark
2013-07-24 19:19 - 2013-07-24 19:19 - 00000000 ____D C:\Program Files\Wireshark
2013-07-24 19:18 - 2013-07-24 19:17 - 22238848 _____ (Wireshark development team) C:\Users\Sarah\Downloads\Wireshark-win32-1.10.0.exe
2013-07-24 19:16 - 2013-07-24 19:15 - 37099197 _____ C:\Users\Sarah\Downloads\CookieCadger-1.06.jar
2013-07-23 17:29 - 2013-07-23 17:28 - 37099197 _____ C:\Users\Sarah\Desktop\CookieCadger-1.06.jar
2013-07-23 17:18 - 2013-07-23 17:18 - 00678144 _____ C:\Users\Sarah\Downloads\FaceNiff-2.4.apk
2013-07-23 17:03 - 2013-07-23 17:02 - 00000000 ____D C:\Program Files\Safari
2013-07-23 17:03 - 2011-12-03 15:15 - 00000000 ____D C:\Users\Sarah\AppData\Local\Apple Computer
2013-07-23 17:03 - 2011-11-22 17:43 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\Apple Computer
2013-07-23 17:02 - 2012-03-09 21:06 - 00000000 ____D C:\ProgramData\Apple Computer
2013-07-23 17:00 - 2013-07-23 17:00 - 00000000 ____D C:\Program Files\Apple Software Update
2013-07-23 17:00 - 2011-11-10 12:44 - 00000000 ____D C:\ProgramData\Apple
2013-07-23 16:58 - 2013-07-23 16:58 - 38494576 _____ (Apple Inc.) C:\Users\Sarah\Downloads\SafariSetup-5.1.7.exe
2013-07-23 16:45 - 2013-07-23 16:45 - 00000000 ____D C:\Program Files\WinPcap
2013-07-23 16:44 - 2013-07-23 16:44 - 00915128 _____ (Riverbed Technology, Inc.) C:\Users\Sarah\Downloads\WinPcap_4_1_3.exe
2013-07-23 15:50 - 2013-07-23 15:45 - 00000077 _____ C:\wepkeys.txt
2013-07-23 15:44 - 2013-07-23 15:44 - 00000000 ____D C:\Aircrack
2013-07-23 15:41 - 2013-07-23 15:40 - 08287320 _____ C:\Users\Sarah\Downloads\aircrack-ng-1.2-beta1-win.zip
2013-07-23 14:59 - 2013-07-23 14:59 - 00000000 ____D C:\Users\Sarah\Documents\EasyBox Key Decrypter Logfile
2013-07-23 14:57 - 2013-07-23 14:57 - 00001106 _____ C:\Users\Sarah\Desktop\EasyBox Key Decrypter.lnk
2013-07-23 14:57 - 2013-07-23 14:57 - 00000000 ____D C:\Program Files\EasyBox Key Decrypter
2013-07-23 14:56 - 2013-07-23 14:56 - 01797880 _____ C:\Users\Sarah\Downloads\EasyBox_Key_Decrypter_v1.4_Setup.exe
2013-07-23 13:24 - 2013-07-23 13:24 - 00028833 _____ C:\Users\Sarah\Downloads\formular_aktuelle_modue.zip
2013-07-23 12:37 - 2013-07-23 12:36 - 77021736 _____ C:\Users\Sarah\Downloads\Cro_Sunny.zip
2013-07-19 19:10 - 2012-01-20 14:01 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\FileZilla
2013-07-19 18:35 - 2013-07-19 18:35 - 00630802 _____ C:\Users\Sarah\Downloads\Wave_Backgrounds_with_Grass_Elements.zip
2013-07-19 17:45 - 2013-07-19 17:45 - 00719586 _____ C:\Users\Sarah\Downloads\Stunning_Retro_Backgrounds.zip
2013-07-19 17:02 - 2013-07-19 17:02 - 01385419 _____ C:\Users\Sarah\Downloads\FreeVectorFlowerBackground.zip
2013-07-19 16:08 - 2013-07-19 16:08 - 01053864 _____ C:\Users\Sarah\Downloads\FloralDesignHeaders2-by-gfxcool.zip
2013-07-19 15:42 - 2013-07-19 15:42 - 04943043 _____ C:\Users\Sarah\Downloads\free_vector_fancy_headers.zip
2013-07-19 15:31 - 2013-07-19 15:31 - 00080868 _____ C:\Users\Sarah\Downloads\Newsletter_Main_Feature.zip
2013-07-19 13:20 - 2013-07-19 13:19 - 29584723 _____ C:\Users\Sarah\Downloads\sendblaster2.0.138.zip
2013-07-17 13:27 - 2013-07-17 13:26 - 00000000 ____D C:\Users\Sarah\www.apowersoft.com
2013-07-17 13:26 - 2012-04-06 19:06 - 00000000 ____D C:\Program Files\JDownloader
2013-07-15 22:43 - 2012-01-20 14:00 - 00000000 ____D C:\Program Files\FileZilla FTP Client
2013-07-14 11:52 - 2012-04-20 15:46 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-07-14 11:52 - 2011-08-05 15:20 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-07-13 13:30 - 2013-07-13 13:30 - 00303308 _____ C:\Users\Sarah\Downloads\De Bauer.mp4
2013-07-13 13:04 - 2013-07-13 13:04 - 00446040 _____ C:\Users\Sarah\Downloads\JW.Player.v6.1.2972.Pro.incl.Keygen.FLASH.NULL-DGT.zip
2013-07-13 13:00 - 2013-07-13 13:00 - 00507325 _____ C:\Users\Sarah\Downloads\mediaplayer.zip
2013-07-13 12:18 - 2013-07-01 21:10 - 00000955 _____ C:\Users\Public\Desktop\TeamViewer 8.lnk
2013-07-13 11:52 - 2013-07-13 11:39 - 00002379 _____ C:\Users\Public\Desktop\Skype.lnk
2013-07-13 11:40 - 2013-07-13 11:39 - 00000000 ____D C:\ProgramData\Skype
2013-07-13 11:39 - 2013-07-13 11:39 - 00000000 ___RD C:\Program Files\Skype
2013-07-13 11:39 - 2013-07-13 11:39 - 00000000 ____D C:\Program Files\Common Files\Skype
2013-07-13 11:37 - 2013-07-13 11:37 - 01492584 _____ (Skype Technologies S.A.) C:\Users\Sarah\Downloads\SkypeSetup.exe
2013-07-13 11:31 - 2006-11-02 14:46 - 03626288 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-13 11:28 - 2013-05-19 21:15 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-07-13 11:28 - 2012-05-03 16:56 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-07-12 19:46 - 2013-07-12 19:46 - 00969301 _____ C:\Users\Sarah\Downloads\wptouch.1.9.7.zip
2013-07-12 19:39 - 2013-07-12 19:39 - 00861291 _____ C:\Users\Sarah\Downloads\nextgen-gallery.zip
2013-07-12 19:37 - 2013-07-12 19:36 - 03786542 _____ C:\Users\Sarah\Downloads\jw-player-plugin-for-wordpress.2.1.1.zip
2013-07-12 19:35 - 2013-07-12 19:35 - 00521811 _____ C:\Users\Sarah\Downloads\contact-form-plugin.3.47.zip
2013-07-12 19:31 - 2013-07-12 19:31 - 00219355 _____ C:\Users\Sarah\Downloads\antispam-bee.zip
2013-07-12 19:14 - 2013-07-12 18:30 - 04353459 _____ C:\Users\Sarah\Downloads\wordpress-3.5.2-de_DE.zip
2013-07-12 18:42 - 2013-02-07 11:36 - 00000000 ____D C:\Users\Sarah\Documents\Blockbackup
2013-07-12 18:34 - 2013-07-12 18:33 - 04815135 _____ (FileZilla Project) C:\Users\Sarah\Downloads\FileZilla_3.7.1_win32-setup.exe
2013-07-12 12:42 - 2013-07-12 12:42 - 00060912 _____ C:\Users\Sepp\AppData\Local\GDIPFONTCACHEV1.DAT
2013-07-12 12:30 - 2013-07-12 12:30 - 01940642 _____ C:\Users\Sepp\Downloads\vorlagen3de_opendoc.zip
2013-07-12 12:30 - 2013-07-12 12:30 - 00000000 ____D C:\Users\Sepp\AppData\Roaming\WinRAR
2013-07-12 12:26 - 2013-07-12 12:02 - 00000000 ___SD C:\Users\Sepp\Google Drive
2013-07-12 12:21 - 2013-07-12 12:25 - 00000543 _____ C:\Users\Sepp\Documents\indexfile.txt
2013-07-12 12:02 - 2013-07-12 12:02 - 00001547 _____ C:\Users\Sepp\Desktop\Google Drive.lnk
2013-07-12 12:02 - 2013-05-17 18:03 - 00000000 ____D C:\Users\Sepp
2013-07-12 11:42 - 2013-07-12 11:42 - 00000000 ____D C:\Users\Sepp\AppData\Roaming\OpenOffice.org
2013-07-11 17:26 - 2011-08-05 12:56 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\Mozilla
2013-07-09 16:00 - 2013-07-09 16:00 - 00179832 _____ C:\Users\Sarah\Desktop\Passwörter.txt
2013-07-09 15:51 - 2013-07-09 15:51 - 00024345 _____ C:\Users\Sarah\Desktop\password-export-2013-07-09.csv
2013-07-09 15:49 - 2013-07-09 15:49 - 00041249 _____ C:\Users\Sarah\Desktop\password-export-2013-07-09.xml
2013-07-08 15:15 - 2012-04-03 18:24 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\TeamViewer
2013-07-04 14:40 - 2011-08-05 12:36 - 00060912 _____ C:\Users\Sarah\AppData\Local\GDIPFONTCACHEV1.DAT
2013-07-04 08:41 - 2013-07-04 08:41 - 05706781 _____ C:\Users\Sarah\Desktop\Rising Sun - Epic Orchestra Film Instrumental Music.mp4
2013-07-04 08:33 - 2011-08-05 12:35 - 00000680 _____ C:\Users\Sarah\AppData\Local\d3d9caps.dat
2013-07-02 13:16 - 2013-07-02 13:16 - 00698764 _____ C:\Users\Sarah\Downloads\Uhr.exe
2013-07-01 22:16 - 2013-07-01 22:21 - 07126244 _____ C:\Users\Sarah\Desktop\tobi-song-movie.wmv
2013-07-01 21:10 - 2012-04-24 09:50 - 00000000 ____D C:\Program Files\TeamViewer
2013-06-30 14:20 - 2013-06-30 14:20 - 00000000 ____D C:\Users\Sepp\AppData\Local\Macromedia
2013-06-30 14:19 - 2013-06-30 14:11 - 00000000 ____D C:\Users\Sepp\AppData\Roaming\Mozilla
2013-06-30 14:11 - 2013-06-30 14:11 - 00000000 ____D C:\Users\Sepp\AppData\Local\Mozilla
2013-06-28 11:32 - 2013-06-28 11:32 - 00000468 _____ C:\Users\Sarah\Desktop\hunday mobile.txt
2013-06-28 10:22 - 2013-06-28 10:22 - 00000175 _____ C:\Windows\system32\Drivers\aswVmm.sys.sum
2013-06-28 10:22 - 2013-06-27 09:52 - 00000175 _____ C:\Windows\system32\Drivers\aswSP.sys.sum
2013-06-28 10:22 - 2013-06-27 09:52 - 00000175 _____ C:\Windows\system32\Drivers\aswSnx.sys.sum
2013-06-28 10:22 - 2013-03-21 11:42 - 00175176 _____ C:\Windows\system32\Drivers\aswVmm.sys
2013-06-28 10:22 - 2012-01-02 14:26 - 00770344 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2013-06-28 10:22 - 2012-01-02 14:26 - 00369584 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-07-27 13:56

==================== End Of Log ============================

--- --- ---

schrauber · 27.07.2013, 17:40

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

sepp1987 · 28.07.2013, 15:40

Hey,
schon mal vielen vielen dank im voraus echt super wie du mir hilfst

iss ja doch schon recht viel Arbeit für dich

!!!

hat der Trojaner irgendetwas mit online banking zu tun?? oder woher der Name Spy.banker

Hier sind die neuen Log´s

ESET-

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=b1f653d01e59a7409799b6a48171d179
# engine=14545
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-07-27 10:00:36
# local_time=2013-07-27 12:00:36 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6001 NT Service Pack 1
# compatibility_mode=774 16777213 85 94 1945255 151625508 0 0
# compatibility_mode=5892 16776573 100 95 174036417 212452091 0 0
# scanned=177804
# found=1
# cleaned=0
# scan_time=4616
sh=1903427E210D38475454E4F9CEDFC9C2B3DDCD33 ft=1 fh=c7ebdbe6db765fe8 vn="a variant of Win32/Spy.Banker.YIL trojan" ac=I fn="C:\Users\Sarah\AppData\Roaming\5052\components\AcroFF0527.dll"
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=b1f653d01e59a7409799b6a48171d179
# engine=14551
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-07-27 04:28:11
# local_time=2013-07-27 06:28:11 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6001 NT Service Pack 1
# compatibility_mode=774 16777213 85 94 1968510 151648763 0 0
# compatibility_mode=5892 16776573 100 95 174059672 212475346 0 0
# scanned=177310
# found=1
# cleaned=0
# scan_time=4783
sh=1903427E210D38475454E4F9CEDFC9C2B3DDCD33 ft=1 fh=c7ebdbe6db765fe8 vn="a variant of Win32/Spy.Banker.YIL trojan" ac=I fn="C:\Users\Sarah\AppData\Roaming\5052\components\AcroFF0527.dll"
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=b1f653d01e59a7409799b6a48171d179
# engine=14554
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-07-27 08:30:23
# local_time=2013-07-27 10:30:23 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6001 NT Service Pack 1
# compatibility_mode=774 16777213 85 94 1983042 151663295 0 0
# compatibility_mode=5892 16776573 100 95 174074204 212489878 0 0
# scanned=177443
# found=3
# cleaned=0
# scan_time=7920
sh=1903427E210D38475454E4F9CEDFC9C2B3DDCD33 ft=1 fh=c7ebdbe6db765fe8 vn="a variant of Win32/Spy.Banker.YIL trojan" ac=I fn="C:\Users\Sarah\AppData\Roaming\5052\components\AcroFF0527.dll"
sh=8A14F8BF5B8689FFA9DF13C93DD732F0FBED0142 ft=0 fh=0000000000000000 vn="a variant of Android/Adware.Youmi.B application" ac=I fn="C:\Users\Sarah\Documents\Galaxy ace\SD Alt\TitaniumBackup\com.outfit7.talkingpierrefree-ee67057286cd2b9d54fe79e3c937010b.apk.gz"
sh=1A58C9B7B436CAA05DA3BFB4F954DB59547D4786 ft=0 fh=0000000000000000 vn="probably a variant of Android/Adware.Youmi.B application" ac=I fn="C:\Users\Sarah\Documents\Galaxy ace\SD Alt\TitaniumBackup\com.outfit7.talkingtom-6323b39201e377151c75b0e122aa16f7.apk.gz"

Security Check

Code:

ATTFilter

 Results of screen317's Security Check version 0.99.70  
 Windows Vista Service Pack 1 x86 (UAC is disabled!)  
 Out of date service pack!! 
 Internet Explorer 7 Out of date! 
``````````````Antivirus/Firewall Check:`````````````` 
 Windows Security Center service is not running! This report may not be accurate! 
 WMI entry may not exist for antivirus; attempting automatic update. 
`````````Anti-malware/Other Utilities Check:````````` 
 MVPS Hosts File  
 Malwarebytes Anti-Malware Version 1.75.0.1300  
 CCleaner     
 Java 7 Update 25  
 Adobe Flash Player 	11.8.800.94  
 Adobe Reader 10.1.7 Adobe Reader out of Date!  
 Mozilla Firefox (22.0) 
````````Process Check: objlist.exe by Laurent````````  
 ESET ESET Online Scanner OnlineScannerApp.exe  
 Abbott Diabetes Care FreeStyle Auto-Assist adcmald.exe  
 AVAST Software Avast AvastSvc.exe  
 AVAST Software Avast AvastUI.exe  
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  % 
````````````````````End of Log``````````````````````

FRST

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 27-07-2013
Ran by Sarah (administrator) on 28-07-2013 16:29:14
Running from C:\Users\Sarah\Desktop\Trojaner hilfe
Microsoft® Windows Vista™ Ultimate  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 7
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(ATI Technologies Inc.) C:\Windows\system32\Ati2evxx.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(ATI Technologies Inc.) C:\Windows\system32\Ati2evxx.exe
(Abbott Diabetes Care) C:\Program Files\Abbott Diabetes Care\FreeStyle Auto-Assist\adcmald.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Nalpeiron Ltd.) C:\Windows\system32\nlssrv32.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe
(Sony Corporation) C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdSync.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
() C:\Program Files\Abbott Diabetes Care\FreeStyle Auto-Assist\adclaunchd.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
() C:\Program Files\VoIPdial\VoIPdial.exe
(Google) C:\Program Files\Google\Drive\googledrivesync.exe
(Samsung) C:\Program Files\Samsung\Kies\Kies.exe
(Samsung) C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
(Dropbox, Inc.) C:\Users\Sarah\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Microsoft Corporation) C:\Windows\system32\wbem\unsecapp.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.bin
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe
(Google) C:\Program Files\Google\Drive\googledrivesync.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Event Service\VESMgrSub.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VUAgent.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Google) C:\Users\Sarah\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe
(Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe
() C:\Users\Sarah\Downloads\SecurityCheck.exe
(Microsoft Corporation) C:\Windows\system32\cmd.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [avast] - C:\Program Files\AVAST Software\Avast\avastUI.exe [4858968 2013-05-09] (AVAST Software)
HKLM\...\Run: [Windows Mobile-based device management] - C:\Windows\WindowsMobile\wmdSync.exe [215552 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [KiesTrayAgent] - C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [310640 2013-03-28] (Samsung Electronics Co., Ltd.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [FreeStyle AutoLaunch] - C:\Program Files\Abbott Diabetes Care\FreeStyle Auto-Assist\adclaunchd.exe [196960 2013-02-09] ()
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM\...\Winlogon: [Userinit] c:\windows\system32\userinit.exe,userinit.exe,
Winlogon\Notify\!SASWinLogon: I:\System\Apps\7E5842E4-EF51-421A-8FB3-19F3ECB18E3C\Data\SASWINLO.DLL [X]
Winlogon\Notify\VESWinlogon: VESWinlogon.dll (Sony Corporation)
HKCU\...\Run: [VoIPdial] - C:\Program Files\VoIPdial\VoIPdial.exe [274039 2009-09-30] ()
HKCU\...\Run: [Facebook Update] - C:\Users\Sarah\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-07-12] (Facebook Inc.)
HKCU\...\Run: [GoogleDriveSync] - C:\Program Files\Google\Drive\googledrivesync.exe [19676256 2013-06-06] (Google)
HKCU\...\Run: [Google Update] - C:\Users\Sarah\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-02-22] (Google Inc.)
HKCU\...\Run: [KiesPreload] - C:\Program Files\Samsung\Kies\Kies.exe [1511792 2013-03-28] (Samsung)
HKCU\...\Run: [] - C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [1106288 2013-03-28] (Samsung)
HKCU\...\Run: [WMPNSCFG] - C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-21] (Microsoft Corporation)
MountPoints2: G - G:\LaunchU3.exe -a
MountPoints2: {1836f5ee-e5bf-11e0-94d8-001e3d3bc32e} - G:\LaunchU3.exe -a
MountPoints2: {7472dfd3-2f15-11e2-9f95-001e3d3bc32e} - G:\Windows\StartFreeStyle.exe
MountPoints2: {a48a3f4d-1205-11e2-b1fd-001e3d3bc32e} - RunClubSanDisk.exe
MountPoints2: {c2486bab-fca5-11e0-ad5c-001e3d3bc32e} - G:\LaunchU3.exe -a
HKU\Administrator\...\Run: [Sidebar] - C:\Program Files\Windows Sidebar\sidebar.exe [ 2008-01-21] (Microsoft Corporation)
HKU\Administrator\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2008-01-21] (Microsoft Corporation)
HKU\Default\...\Run: [Sidebar] - C:\Program Files\Windows Sidebar\Sidebar.exe [ 2008-01-21] (Microsoft Corporation)
HKU\Default\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2008-01-21] (Microsoft Corporation)
HKU\Default User\...\Run: [Sidebar] - C:\Program Files\Windows Sidebar\Sidebar.exe [ 2008-01-21] (Microsoft Corporation)
HKU\Default User\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2008-01-21] (Microsoft Corporation)
HKU\Sepp\...\Run: [Sidebar] - C:\Program Files\Windows Sidebar\sidebar.exe [ 2008-01-21] (Microsoft Corporation)
HKU\Sepp\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2008-01-21] (Microsoft Corporation)
HKU\Sepp\...\Run: [GoogleDriveSync] - C:\Program Files\Google\Drive\googledrivesync.exe [ 2013-06-06] (Google)
HKU\Sepp\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\system32\Macromed\Flash\FlashUtil32_11_7_700_224_Plugin.exe -update plugin [x]
Startup: C:\Users\Sarah\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Sarah\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Sarah\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
Startup: C:\Users\Sepp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
BootExecute: autocheck autochk /p \??\H:autocheck autochk * 

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search
SearchScopes: HKCU - {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL = 
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_07-windows-i586.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
ShellExecuteHooks: SABShellExecuteHook Class - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} -  No File [ ]
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Path=Profiles\iy8dzkv7.Sebastian
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @google.com/npPicasa3,version=3.0.0 - C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Sarah\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin - C:\Users\Sarah\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin HKCU: @talk.google.com/O1DPlugin - C:\Users\Sarah\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
FF Plugin HKCU: @talk.google.com/O3DPlugin - C:\Users\Sarah\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Sarah\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Sarah\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Extension: Default - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF

Chrome: 
=======
CHR HomePage: hxxp://www.google.com

========================== Services (Whitelisted) =================

R2 adcmald; C:\Program Files\Abbott Diabetes Care\FreeStyle Auto-Assist\adcmald.exe [535896 2013-02-09] (Abbott Diabetes Care)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-05-09] (AVAST Software)
S4 SBSDWSCService; C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
R3 VUAgent; C:\Program Files\Sony\VAIO Update\VUAgent.exe [1013808 2013-03-26] (Sony Corporation)
S2 AntiVirSchedulerService; "C:\Program Files\Avira\AntiVir Desktop\sched.exe" [x]
S2 AntiVirService; "C:\Program Files\Avira\AntiVir Desktop\avguard.exe" [x]
S3 rpcapd; "%ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini" [x]

==================== Drivers (Whitelisted) ====================

R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [29816 2013-05-09] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [66336 2013-05-09] (AVAST Software)
R1 aswRdr; C:\Windows\System32\Drivers\aswRdr.sys [49760 2013-05-09] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [49376 2013-05-09] ()
R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [770344 2013-06-28] (AVAST Software)
R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [369584 2013-06-28] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [56080 2013-05-09] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [175176 2013-06-28] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [66616 2011-08-06] (Avira GmbH)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [138192 2011-08-06] (Avira GmbH)
S3 bdacap; C:\Windows\System32\drivers\bdacap.sys [217728 2006-02-14] (Genesys Logic, Inc.)
S3 cpudrv; C:\Program Files\SystemRequirementsLab\cpudrv.sys [11336 2011-06-02] ()
S3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2010-06-14] ()
S3 GLHIDKBFILTER; C:\Windows\System32\DRIVERS\GLKbFilter.sys [11264 2006-01-06] (Genesys Logic)
R2 NPF; C:\Windows\System32\drivers\npf.sys [36600 2013-03-01] (Riverbed Technology, Inc.)
S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [15576 2013-01-11] ()
S3 pwdspio; C:\Windows\system32\pwdspio.sys [10200 2013-01-11] ()
R3 R5U870FLx86; C:\Windows\System32\Drivers\R5U870FLx86.sys [73472 2008-01-30] (Ricoh)
R3 R5U870FUx86; C:\Windows\System32\Drivers\R5U870FUx86.sys [43904 2008-01-30] (Ricoh)
R1 StarOpen; C:\Windows\System32\Drivers\StarOpen.sys [5632 2006-07-24] ()
S3 tap0901; C:\Windows\System32\DRIVERS\tap0901.sys [26624 2011-12-15] (The OpenVPN Project)
R3 ti21sony; C:\Windows\System32\drivers\ti21sony.sys [818688 2007-11-16] (Texas Instruments)
S3 UIUSys; C:\Windows\System32\DRIVERS\UIUSYS.SYS [6909 2008-01-30] (Conexant Systems, Inc)
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
S1 SASDIFSV; \??\I:\System\Apps\7E5842E4-EF51-421A-8FB3-19F3ECB18E3C\Data\SASDIFSV.SYS [x]
S1 SASKUTIL; \??\I:\System\Apps\7E5842E4-EF51-421A-8FB3-19F3ECB18E3C\Data\SASKUTIL.SYS [x]
S3 USBAAPL; System32\Drivers\usbaapl.sys [x]
S3 WinRing0_1_2_0; \??\C:\Program Files\BatteryCare\WinRing0.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-27 20:16 - 2013-07-27 20:16 - 00891062 _____ C:\Users\Sarah\Downloads\SecurityCheck.exe
2013-07-27 20:06 - 2013-07-27 20:06 - 02347384 _____ (ESET) C:\Users\Sarah\Downloads\esetsmartinstaller_enu(1).exe
2013-07-27 13:55 - 2013-07-27 13:55 - 00000000 ____D C:\Windows\ERUNT
2013-07-27 13:43 - 2013-07-27 14:13 - 00000000 ____D C:\Users\Sarah\Desktop\Trojaner hilfe
2013-07-27 12:46 - 2013-07-27 12:46 - 00036679 _____ C:\Users\Sarah\Downloads\FRST.txt
2013-07-27 12:46 - 2013-07-27 12:46 - 00017049 _____ C:\Users\Sarah\Downloads\Addition.txt
2013-07-27 12:44 - 2013-07-27 12:44 - 00000000 ____D C:\FRST
2013-07-27 10:41 - 2013-07-27 10:41 - 00000000 ____D C:\Program Files\ESET
2013-07-27 10:40 - 2013-07-27 10:40 - 02347384 _____ (ESET) C:\Users\Sarah\Downloads\esetsmartinstaller_enu.exe
2013-07-25 12:50 - 2013-07-25 12:50 - 00074445 _____ C:\Users\Sarah\Downloads\nummernkreise_flexiblenummernautomatik3.zip
2013-07-25 11:39 - 2013-07-25 11:39 - 00001868 _____ C:\Users\Sarah\Downloads\sg_backup_2013-07-25-1139.spg
2013-07-25 11:39 - 2013-07-25 11:39 - 00001868 _____ C:\Users\Sarah\Downloads\FirstBackup.spg
2013-07-25 11:36 - 2013-07-25 11:36 - 00659456 _____ (Speed Guide Inc.) C:\Users\Sarah\Downloads\TCP308Optimizer.exe
2013-07-24 19:21 - 2013-07-24 19:21 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\Wireshark
2013-07-24 19:20 - 2013-07-24 20:02 - 02775040 _____ C:\Users\Sarah\session.sqlite
2013-07-24 19:19 - 2013-07-24 19:19 - 00000000 ____D C:\Program Files\Wireshark
2013-07-24 19:17 - 2013-07-24 19:18 - 22238848 _____ (Wireshark development team) C:\Users\Sarah\Downloads\Wireshark-win32-1.10.0.exe
2013-07-24 19:15 - 2013-07-24 19:16 - 37099197 _____ C:\Users\Sarah\Downloads\CookieCadger-1.06.jar
2013-07-23 17:28 - 2013-07-23 17:29 - 37099197 _____ C:\Users\Sarah\Desktop\CookieCadger-1.06.jar
2013-07-23 17:18 - 2013-07-23 17:18 - 00678144 _____ C:\Users\Sarah\Downloads\FaceNiff-2.4.apk
2013-07-23 17:02 - 2013-07-23 17:03 - 00000000 ____D C:\Program Files\Safari
2013-07-23 17:00 - 2013-07-23 17:00 - 00000000 ____D C:\Program Files\Apple Software Update
2013-07-23 16:58 - 2013-07-23 16:58 - 38494576 _____ (Apple Inc.) C:\Users\Sarah\Downloads\SafariSetup-5.1.7.exe
2013-07-23 16:45 - 2013-07-23 16:45 - 00000000 ____D C:\Program Files\WinPcap
2013-07-23 16:44 - 2013-07-23 16:44 - 00915128 _____ (Riverbed Technology, Inc.) C:\Users\Sarah\Downloads\WinPcap_4_1_3.exe
2013-07-23 15:45 - 2013-07-23 15:50 - 00000077 _____ C:\wepkeys.txt
2013-07-23 15:44 - 2013-07-23 15:44 - 00000000 ____D C:\Aircrack
2013-07-23 15:40 - 2013-07-23 15:41 - 08287320 _____ C:\Users\Sarah\Downloads\aircrack-ng-1.2-beta1-win.zip
2013-07-23 14:59 - 2013-07-23 14:59 - 00000000 ____D C:\Users\Sarah\Documents\EasyBox Key Decrypter Logfile
2013-07-23 14:57 - 2013-07-23 14:57 - 00001106 _____ C:\Users\Sarah\Desktop\EasyBox Key Decrypter.lnk
2013-07-23 14:57 - 2013-07-23 14:57 - 00000000 ____D C:\Program Files\EasyBox Key Decrypter
2013-07-23 14:56 - 2013-07-23 14:56 - 01797880 _____ C:\Users\Sarah\Downloads\EasyBox_Key_Decrypter_v1.4_Setup.exe
2013-07-23 13:24 - 2013-07-23 13:24 - 00028833 _____ C:\Users\Sarah\Downloads\formular_aktuelle_modue.zip
2013-07-23 12:36 - 2013-07-23 12:37 - 77021736 _____ C:\Users\Sarah\Downloads\Cro_Sunny.zip
2013-07-19 18:35 - 2013-07-19 18:35 - 00630802 _____ C:\Users\Sarah\Downloads\Wave_Backgrounds_with_Grass_Elements.zip
2013-07-19 17:45 - 2013-07-19 17:45 - 00719586 _____ C:\Users\Sarah\Downloads\Stunning_Retro_Backgrounds.zip
2013-07-19 17:02 - 2013-07-19 17:02 - 01385419 _____ C:\Users\Sarah\Downloads\FreeVectorFlowerBackground.zip
2013-07-19 16:08 - 2013-07-19 16:08 - 01053864 _____ C:\Users\Sarah\Downloads\FloralDesignHeaders2-by-gfxcool.zip
2013-07-19 15:42 - 2013-07-19 15:42 - 04943043 _____ C:\Users\Sarah\Downloads\free_vector_fancy_headers.zip
2013-07-19 15:31 - 2013-07-19 15:31 - 00080868 _____ C:\Users\Sarah\Downloads\Newsletter_Main_Feature.zip
2013-07-19 13:19 - 2013-07-19 13:20 - 29584723 _____ C:\Users\Sarah\Downloads\sendblaster2.0.138.zip
2013-07-17 13:26 - 2013-07-17 13:27 - 00000000 ____D C:\Users\Sarah\www.apowersoft.com
2013-07-13 13:30 - 2013-07-13 13:30 - 00303308 _____ C:\Users\Sarah\Downloads\De Bauer.mp4
2013-07-13 13:04 - 2013-07-13 13:04 - 00446040 _____ C:\Users\Sarah\Downloads\JW.Player.v6.1.2972.Pro.incl.Keygen.FLASH.NULL-DGT.zip
2013-07-13 13:00 - 2013-07-13 13:00 - 00507325 _____ C:\Users\Sarah\Downloads\mediaplayer.zip
2013-07-13 11:40 - 2013-07-26 17:48 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\Skype
2013-07-13 11:39 - 2013-07-13 11:52 - 00002379 _____ C:\Users\Public\Desktop\Skype.lnk
2013-07-13 11:39 - 2013-07-13 11:40 - 00000000 ____D C:\ProgramData\Skype
2013-07-13 11:39 - 2013-07-13 11:39 - 00000000 ___RD C:\Program Files\Skype
2013-07-13 11:39 - 2013-07-13 11:39 - 00000000 ____D C:\Program Files\Common Files\Skype
2013-07-13 11:37 - 2013-07-13 11:37 - 01492584 _____ (Skype Technologies S.A.) C:\Users\Sarah\Downloads\SkypeSetup.exe
2013-07-12 19:46 - 2013-07-12 19:46 - 00969301 _____ C:\Users\Sarah\Downloads\wptouch.1.9.7.zip
2013-07-12 19:39 - 2013-07-12 19:39 - 00861291 _____ C:\Users\Sarah\Downloads\nextgen-gallery.zip
2013-07-12 19:36 - 2013-07-12 19:37 - 03786542 _____ C:\Users\Sarah\Downloads\jw-player-plugin-for-wordpress.2.1.1.zip
2013-07-12 19:35 - 2013-07-12 19:35 - 00521811 _____ C:\Users\Sarah\Downloads\contact-form-plugin.3.47.zip
2013-07-12 19:31 - 2013-07-12 19:31 - 00219355 _____ C:\Users\Sarah\Downloads\antispam-bee.zip
2013-07-12 18:33 - 2013-07-12 18:34 - 04815135 _____ (FileZilla Project) C:\Users\Sarah\Downloads\FileZilla_3.7.1_win32-setup.exe
2013-07-12 18:30 - 2013-07-12 19:14 - 04353459 _____ C:\Users\Sarah\Downloads\wordpress-3.5.2-de_DE.zip
2013-07-12 12:42 - 2013-07-12 12:42 - 00060912 _____ C:\Users\Sepp\AppData\Local\GDIPFONTCACHEV1.DAT
2013-07-12 12:30 - 2013-07-12 12:30 - 01940642 _____ C:\Users\Sepp\Downloads\vorlagen3de_opendoc.zip
2013-07-12 12:30 - 2013-07-12 12:30 - 00000000 ____D C:\Users\Sepp\AppData\Roaming\WinRAR
2013-07-12 12:25 - 2013-07-12 12:21 - 00000543 _____ C:\Users\Sepp\Documents\indexfile.txt
2013-07-12 12:02 - 2013-07-12 12:26 - 00000000 ___SD C:\Users\Sepp\Google Drive
2013-07-12 12:02 - 2013-07-12 12:02 - 00001547 _____ C:\Users\Sepp\Desktop\Google Drive.lnk
2013-07-12 11:42 - 2013-07-12 11:42 - 00000000 ____D C:\Users\Sepp\AppData\Roaming\OpenOffice.org
2013-07-09 16:00 - 2013-07-09 16:00 - 00179832 _____ C:\Users\Sarah\Desktop\Passwörter.txt
2013-07-09 15:51 - 2013-07-09 15:51 - 00024345 _____ C:\Users\Sarah\Desktop\password-export-2013-07-09.csv
2013-07-09 15:49 - 2013-07-09 15:49 - 00041249 _____ C:\Users\Sarah\Desktop\password-export-2013-07-09.xml
2013-07-04 08:41 - 2013-07-04 08:41 - 05706781 _____ C:\Users\Sarah\Desktop\Rising Sun - Epic Orchestra Film Instrumental Music.mp4
2013-07-02 13:16 - 2013-07-02 13:16 - 00698764 _____ C:\Users\Sarah\Downloads\Uhr.exe
2013-07-01 22:21 - 2013-07-01 22:16 - 07126244 _____ C:\Users\Sarah\Desktop\tobi-song-movie.wmv
2013-07-01 21:10 - 2013-07-13 12:18 - 00000955 _____ C:\Users\Public\Desktop\TeamViewer 8.lnk
2013-06-30 14:20 - 2013-06-30 14:20 - 00000000 ____D C:\Users\Sepp\AppData\Local\Macromedia
2013-06-30 14:11 - 2013-06-30 14:19 - 00000000 ____D C:\Users\Sepp\AppData\Roaming\Mozilla
2013-06-30 14:11 - 2013-06-30 14:11 - 00000000 ____D C:\Users\Sepp\AppData\Local\Mozilla
2013-06-28 11:32 - 2013-06-28 11:32 - 00000468 _____ C:\Users\Sarah\Desktop\hunday mobile.txt
2013-06-28 10:22 - 2013-06-28 10:22 - 00000175 _____ C:\Windows\system32\Drivers\aswVmm.sys.sum

==================== One Month Modified Files and Folders =======

2013-07-28 15:59 - 2012-03-30 14:21 - 00001096 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-28 15:32 - 2013-02-22 16:11 - 00001120 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2257783777-1101859096-687163147-1000UA.job
2013-07-28 15:32 - 2013-02-06 10:32 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-28 15:32 - 2011-10-19 15:22 - 00001138 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2257783777-1101859096-687163147-1000UA.job
2013-07-28 15:31 - 2011-08-05 20:14 - 00000418 ____H C:\Windows\Tasks\User_Feed_Synchronization-{A9097228-7BF7-4646-B1F5-D5A7D9C4D20A}.job
2013-07-28 15:30 - 2006-11-02 14:46 - 00003760 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-28 15:30 - 2006-11-02 14:46 - 00003760 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-28 12:32 - 2011-10-19 15:22 - 00001116 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2257783777-1101859096-687163147-1000Core.job
2013-07-28 12:02 - 2011-08-06 21:01 - 00000000 ____D C:\Program Files\Google
2013-07-28 11:59 - 2012-03-30 14:21 - 00001092 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-28 11:49 - 2013-04-22 22:11 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\Dropbox
2013-07-28 11:32 - 2013-02-22 16:11 - 00001068 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2257783777-1101859096-687163147-1000Core.job
2013-07-27 20:16 - 2013-07-27 20:16 - 00891062 _____ C:\Users\Sarah\Downloads\SecurityCheck.exe
2013-07-27 20:06 - 2013-07-27 20:06 - 02347384 _____ (ESET) C:\Users\Sarah\Downloads\esetsmartinstaller_enu(1).exe
2013-07-27 16:52 - 2013-03-09 12:33 - 00481448 _____ C:\Windows\WindowsUpdate.log
2013-07-27 16:47 - 2012-07-14 11:42 - 00000000 ___SD C:\Users\Sarah\Google Drive
2013-07-27 16:46 - 2013-04-22 22:16 - 00000000 ___RD C:\Users\Sarah\Dropbox
2013-07-27 16:44 - 2006-11-02 15:00 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-07-27 16:42 - 2011-08-05 12:50 - 00001660 _____ C:\Windows\bthservsdp.dat
2013-07-27 16:42 - 2006-11-02 15:00 - 00032564 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-07-27 14:13 - 2013-07-27 13:43 - 00000000 ____D C:\Users\Sarah\Desktop\Trojaner hilfe
2013-07-27 13:55 - 2013-07-27 13:55 - 00000000 ____D C:\Windows\ERUNT
2013-07-27 13:48 - 2013-05-18 10:26 - 00004002 _____ C:\Windows\PFRO.log
2013-07-27 13:48 - 2012-04-02 16:31 - 00000000 ____D C:\Windows\pss
2013-07-27 12:46 - 2013-07-27 12:46 - 00036679 _____ C:\Users\Sarah\Downloads\FRST.txt
2013-07-27 12:46 - 2013-07-27 12:46 - 00017049 _____ C:\Users\Sarah\Downloads\Addition.txt
2013-07-27 12:44 - 2013-07-27 12:44 - 00000000 ____D C:\FRST
2013-07-27 10:41 - 2013-07-27 10:41 - 00000000 ____D C:\Program Files\ESET
2013-07-27 10:40 - 2013-07-27 10:40 - 02347384 _____ (ESET) C:\Users\Sarah\Downloads\esetsmartinstaller_enu.exe
2013-07-26 20:27 - 2006-11-02 14:35 - 00000000 ____D C:\Windows\system32\FxsTmp
2013-07-26 17:48 - 2013-07-13 11:40 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\Skype
2013-07-25 16:03 - 2011-08-05 12:41 - 00059904 _____ C:\Users\Sarah\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-07-25 15:44 - 2013-04-20 14:27 - 00001892 _____ C:\Users\Public\Desktop\Adobe Reader X.lnk
2013-07-25 15:43 - 2011-08-08 11:01 - 00000000 ____D C:\ProgramData\Adobe
2013-07-25 15:36 - 2011-08-08 11:09 - 00000000 ____D C:\Users\Sarah\AppData\Local\Adobe
2013-07-25 12:50 - 2013-07-25 12:50 - 00074445 _____ C:\Users\Sarah\Downloads\nummernkreise_flexiblenummernautomatik3.zip
2013-07-25 11:42 - 2012-10-10 20:14 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-07-25 11:39 - 2013-07-25 11:39 - 00001868 _____ C:\Users\Sarah\Downloads\sg_backup_2013-07-25-1139.spg
2013-07-25 11:39 - 2013-07-25 11:39 - 00001868 _____ C:\Users\Sarah\Downloads\FirstBackup.spg
2013-07-25 11:36 - 2013-07-25 11:36 - 00659456 _____ (Speed Guide Inc.) C:\Users\Sarah\Downloads\TCP308Optimizer.exe
2013-07-24 20:02 - 2013-07-24 19:20 - 02775040 _____ C:\Users\Sarah\session.sqlite
2013-07-24 20:02 - 2011-08-05 12:35 - 00000000 ____D C:\Users\Sarah
2013-07-24 19:21 - 2013-07-24 19:21 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\Wireshark
2013-07-24 19:19 - 2013-07-24 19:19 - 00000000 ____D C:\Program Files\Wireshark
2013-07-24 19:18 - 2013-07-24 19:17 - 22238848 _____ (Wireshark development team) C:\Users\Sarah\Downloads\Wireshark-win32-1.10.0.exe
2013-07-24 19:16 - 2013-07-24 19:15 - 37099197 _____ C:\Users\Sarah\Downloads\CookieCadger-1.06.jar
2013-07-23 17:29 - 2013-07-23 17:28 - 37099197 _____ C:\Users\Sarah\Desktop\CookieCadger-1.06.jar
2013-07-23 17:18 - 2013-07-23 17:18 - 00678144 _____ C:\Users\Sarah\Downloads\FaceNiff-2.4.apk
2013-07-23 17:03 - 2013-07-23 17:02 - 00000000 ____D C:\Program Files\Safari
2013-07-23 17:03 - 2011-12-03 15:15 - 00000000 ____D C:\Users\Sarah\AppData\Local\Apple Computer
2013-07-23 17:03 - 2011-11-22 17:43 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\Apple Computer
2013-07-23 17:02 - 2012-03-09 21:06 - 00000000 ____D C:\ProgramData\Apple Computer
2013-07-23 17:00 - 2013-07-23 17:00 - 00000000 ____D C:\Program Files\Apple Software Update
2013-07-23 17:00 - 2011-11-10 12:44 - 00000000 ____D C:\ProgramData\Apple
2013-07-23 16:58 - 2013-07-23 16:58 - 38494576 _____ (Apple Inc.) C:\Users\Sarah\Downloads\SafariSetup-5.1.7.exe
2013-07-23 16:45 - 2013-07-23 16:45 - 00000000 ____D C:\Program Files\WinPcap
2013-07-23 16:44 - 2013-07-23 16:44 - 00915128 _____ (Riverbed Technology, Inc.) C:\Users\Sarah\Downloads\WinPcap_4_1_3.exe
2013-07-23 15:50 - 2013-07-23 15:45 - 00000077 _____ C:\wepkeys.txt
2013-07-23 15:44 - 2013-07-23 15:44 - 00000000 ____D C:\Aircrack
2013-07-23 15:41 - 2013-07-23 15:40 - 08287320 _____ C:\Users\Sarah\Downloads\aircrack-ng-1.2-beta1-win.zip
2013-07-23 14:59 - 2013-07-23 14:59 - 00000000 ____D C:\Users\Sarah\Documents\EasyBox Key Decrypter Logfile
2013-07-23 14:57 - 2013-07-23 14:57 - 00001106 _____ C:\Users\Sarah\Desktop\EasyBox Key Decrypter.lnk
2013-07-23 14:57 - 2013-07-23 14:57 - 00000000 ____D C:\Program Files\EasyBox Key Decrypter
2013-07-23 14:56 - 2013-07-23 14:56 - 01797880 _____ C:\Users\Sarah\Downloads\EasyBox_Key_Decrypter_v1.4_Setup.exe
2013-07-23 13:24 - 2013-07-23 13:24 - 00028833 _____ C:\Users\Sarah\Downloads\formular_aktuelle_modue.zip
2013-07-23 12:37 - 2013-07-23 12:36 - 77021736 _____ C:\Users\Sarah\Downloads\Cro_Sunny.zip
2013-07-19 19:10 - 2012-01-20 14:01 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\FileZilla
2013-07-19 18:35 - 2013-07-19 18:35 - 00630802 _____ C:\Users\Sarah\Downloads\Wave_Backgrounds_with_Grass_Elements.zip
2013-07-19 17:45 - 2013-07-19 17:45 - 00719586 _____ C:\Users\Sarah\Downloads\Stunning_Retro_Backgrounds.zip
2013-07-19 17:02 - 2013-07-19 17:02 - 01385419 _____ C:\Users\Sarah\Downloads\FreeVectorFlowerBackground.zip
2013-07-19 16:08 - 2013-07-19 16:08 - 01053864 _____ C:\Users\Sarah\Downloads\FloralDesignHeaders2-by-gfxcool.zip
2013-07-19 15:42 - 2013-07-19 15:42 - 04943043 _____ C:\Users\Sarah\Downloads\free_vector_fancy_headers.zip
2013-07-19 15:31 - 2013-07-19 15:31 - 00080868 _____ C:\Users\Sarah\Downloads\Newsletter_Main_Feature.zip
2013-07-19 13:20 - 2013-07-19 13:19 - 29584723 _____ C:\Users\Sarah\Downloads\sendblaster2.0.138.zip
2013-07-17 13:27 - 2013-07-17 13:26 - 00000000 ____D C:\Users\Sarah\www.apowersoft.com
2013-07-17 13:26 - 2012-04-06 19:06 - 00000000 ____D C:\Program Files\JDownloader
2013-07-15 22:43 - 2012-01-20 14:00 - 00000000 ____D C:\Program Files\FileZilla FTP Client
2013-07-14 11:52 - 2012-04-20 15:46 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-07-14 11:52 - 2011-08-05 15:20 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-07-13 13:30 - 2013-07-13 13:30 - 00303308 _____ C:\Users\Sarah\Downloads\De Bauer.mp4
2013-07-13 13:04 - 2013-07-13 13:04 - 00446040 _____ C:\Users\Sarah\Downloads\JW.Player.v6.1.2972.Pro.incl.Keygen.FLASH.NULL-DGT.zip
2013-07-13 13:00 - 2013-07-13 13:00 - 00507325 _____ C:\Users\Sarah\Downloads\mediaplayer.zip
2013-07-13 12:18 - 2013-07-01 21:10 - 00000955 _____ C:\Users\Public\Desktop\TeamViewer 8.lnk
2013-07-13 11:52 - 2013-07-13 11:39 - 00002379 _____ C:\Users\Public\Desktop\Skype.lnk
2013-07-13 11:40 - 2013-07-13 11:39 - 00000000 ____D C:\ProgramData\Skype
2013-07-13 11:39 - 2013-07-13 11:39 - 00000000 ___RD C:\Program Files\Skype
2013-07-13 11:39 - 2013-07-13 11:39 - 00000000 ____D C:\Program Files\Common Files\Skype
2013-07-13 11:37 - 2013-07-13 11:37 - 01492584 _____ (Skype Technologies S.A.) C:\Users\Sarah\Downloads\SkypeSetup.exe
2013-07-13 11:31 - 2006-11-02 14:46 - 03626288 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-13 11:28 - 2013-05-19 21:15 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-07-13 11:28 - 2012-05-03 16:56 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-07-12 19:46 - 2013-07-12 19:46 - 00969301 _____ C:\Users\Sarah\Downloads\wptouch.1.9.7.zip
2013-07-12 19:39 - 2013-07-12 19:39 - 00861291 _____ C:\Users\Sarah\Downloads\nextgen-gallery.zip
2013-07-12 19:37 - 2013-07-12 19:36 - 03786542 _____ C:\Users\Sarah\Downloads\jw-player-plugin-for-wordpress.2.1.1.zip
2013-07-12 19:35 - 2013-07-12 19:35 - 00521811 _____ C:\Users\Sarah\Downloads\contact-form-plugin.3.47.zip
2013-07-12 19:31 - 2013-07-12 19:31 - 00219355 _____ C:\Users\Sarah\Downloads\antispam-bee.zip
2013-07-12 19:14 - 2013-07-12 18:30 - 04353459 _____ C:\Users\Sarah\Downloads\wordpress-3.5.2-de_DE.zip
2013-07-12 18:42 - 2013-02-07 11:36 - 00000000 ____D C:\Users\Sarah\Documents\Blockbackup
2013-07-12 18:34 - 2013-07-12 18:33 - 04815135 _____ (FileZilla Project) C:\Users\Sarah\Downloads\FileZilla_3.7.1_win32-setup.exe
2013-07-12 12:42 - 2013-07-12 12:42 - 00060912 _____ C:\Users\Sepp\AppData\Local\GDIPFONTCACHEV1.DAT
2013-07-12 12:30 - 2013-07-12 12:30 - 01940642 _____ C:\Users\Sepp\Downloads\vorlagen3de_opendoc.zip
2013-07-12 12:30 - 2013-07-12 12:30 - 00000000 ____D C:\Users\Sepp\AppData\Roaming\WinRAR
2013-07-12 12:26 - 2013-07-12 12:02 - 00000000 ___SD C:\Users\Sepp\Google Drive
2013-07-12 12:21 - 2013-07-12 12:25 - 00000543 _____ C:\Users\Sepp\Documents\indexfile.txt
2013-07-12 12:02 - 2013-07-12 12:02 - 00001547 _____ C:\Users\Sepp\Desktop\Google Drive.lnk
2013-07-12 12:02 - 2013-05-17 18:03 - 00000000 ____D C:\Users\Sepp
2013-07-12 11:42 - 2013-07-12 11:42 - 00000000 ____D C:\Users\Sepp\AppData\Roaming\OpenOffice.org
2013-07-11 17:26 - 2011-08-05 12:56 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\Mozilla
2013-07-09 16:00 - 2013-07-09 16:00 - 00179832 _____ C:\Users\Sarah\Desktop\Passwörter.txt
2013-07-09 15:51 - 2013-07-09 15:51 - 00024345 _____ C:\Users\Sarah\Desktop\password-export-2013-07-09.csv
2013-07-09 15:49 - 2013-07-09 15:49 - 00041249 _____ C:\Users\Sarah\Desktop\password-export-2013-07-09.xml
2013-07-08 15:15 - 2012-04-03 18:24 - 00000000 ____D C:\Users\Sarah\AppData\Roaming\TeamViewer
2013-07-04 14:40 - 2011-08-05 12:36 - 00060912 _____ C:\Users\Sarah\AppData\Local\GDIPFONTCACHEV1.DAT
2013-07-04 08:41 - 2013-07-04 08:41 - 05706781 _____ C:\Users\Sarah\Desktop\Rising Sun - Epic Orchestra Film Instrumental Music.mp4
2013-07-04 08:33 - 2011-08-05 12:35 - 00000680 _____ C:\Users\Sarah\AppData\Local\d3d9caps.dat
2013-07-02 13:16 - 2013-07-02 13:16 - 00698764 _____ C:\Users\Sarah\Downloads\Uhr.exe
2013-07-01 22:16 - 2013-07-01 22:21 - 07126244 _____ C:\Users\Sarah\Desktop\tobi-song-movie.wmv
2013-07-01 21:10 - 2012-04-24 09:50 - 00000000 ____D C:\Program Files\TeamViewer
2013-06-30 14:20 - 2013-06-30 14:20 - 00000000 ____D C:\Users\Sepp\AppData\Local\Macromedia
2013-06-30 14:19 - 2013-06-30 14:11 - 00000000 ____D C:\Users\Sepp\AppData\Roaming\Mozilla
2013-06-30 14:11 - 2013-06-30 14:11 - 00000000 ____D C:\Users\Sepp\AppData\Local\Mozilla
2013-06-28 11:32 - 2013-06-28 11:32 - 00000468 _____ C:\Users\Sarah\Desktop\hunday mobile.txt
2013-06-28 10:22 - 2013-06-28 10:22 - 00000175 _____ C:\Windows\system32\Drivers\aswVmm.sys.sum
2013-06-28 10:22 - 2013-06-27 09:52 - 00000175 _____ C:\Windows\system32\Drivers\aswSP.sys.sum
2013-06-28 10:22 - 2013-06-27 09:52 - 00000175 _____ C:\Windows\system32\Drivers\aswSnx.sys.sum
2013-06-28 10:22 - 2013-03-21 11:42 - 00175176 _____ C:\Windows\system32\Drivers\aswVmm.sys
2013-06-28 10:22 - 2012-01-02 14:26 - 00770344 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2013-06-28 10:22 - 2012-01-02 14:26 - 00369584 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-07-27 16:50

==================== End Of Log ============================

--- --- ---

schrauber · 28.07.2013, 16:57

Windows und Adobe updaten.

Ja, Bankdaten für Onlinebanking sowie Passwörter ändern ist Pflicht.

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

C:\Users\Sarah\AppData\Roaming\5052

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Downloade dir bitte

Farbar Service Scanner

Starte das Tool mit Doppelklick auf die FSS.exe
Gehe sicher, dass folgende Optionen angehakt sind.
- Internet Services
- Windows Firewall
- System Restore
- Security Center/Action Center
- Windows Update
- Windows Defender
- Other Services
Klicke auf Scan.
Wenn das Tool fertig ist, wird es eine FSS.txt in dem Verzeichnis erstellen, wo das Tool gelaufen ist.

Poste bitte den Inhalt hier.

sepp1987 · 28.07.2013, 19:07

Die neuen Logs

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 27-07-2013
Ran by Sarah at 2013-07-28 20:02:01 Run:1
Running from C:\Users\Sarah\Desktop\Trojaner hilfe
Boot Mode: Normal

==============================================

C:\Users\Sarah\AppData\Roaming\5052 => Moved successfully.

==== End of Fixlog ====

Code:

ATTFilter

Farbar Service Scanner Version: 26-07-2013
Ran by Sarah (administrator) on 28-07-2013 at 20:07:31
Running from "C:\Users\Sarah\Desktop\Trojaner hilfe"
Microsoft® Windows Vista™ Ultimate  Service Pack 1 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy: 
==================
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall"=DWORD:0


System Restore:
============

System Restore Disabled Policy: 
========================


Security Center:
============

wscsvc Service is not running. Checking service configuration:
The start type of wscsvc service is set to Disabled. The default start type is Auto.
The ImagePath of wscsvc service is OK.
The ServiceDll of wscsvc service is OK.
Checking LEGACY_wscsvc: ATTENTION!=====> Unable to open LEGACY_wscsvc\0000 registry key. The key does not exist.


Windows Update:
============

Windows Autoupdate Disabled Policy: 
============================


Windows Defender:
==============

Other Services:
==============


File Check:
========
C:\Windows\system32\nsisvc.dll => MD5 is legit
C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit
C:\Windows\system32\dhcpcsvc.dll => MD5 is legit
C:\Windows\system32\Drivers\afd.sys => MD5 is legit
C:\Windows\system32\Drivers\tdx.sys => MD5 is legit
C:\Windows\system32\Drivers\tcpip.sys
[2008-07-09 21:56] - [2008-07-09 21:56] - 0891448 ____A (Microsoft Corporation) 82E266BEE5F0167E41C6ECFDD2A79C02

C:\Windows\system32\dnsrslvr.dll => MD5 is legit
C:\Windows\system32\mpssvc.dll
[2008-01-21 04:22] - [2008-01-21 04:22] - 0393216 ____A (Microsoft Corporation) D1639BA315B0D79DEC49A4B0E1FB929B

C:\Windows\system32\bfe.dll
[2008-01-21 04:22] - [2008-01-21 04:22] - 0328704 ____A (Microsoft Corporation) 8582E233C346AEFE759833E8A30DD697

C:\Windows\system32\Drivers\mpsdrv.sys => MD5 is legit
C:\Windows\system32\SDRSVC.dll => MD5 is legit
C:\Windows\system32\vssvc.exe
[2008-01-21 04:21] - [2008-01-21 04:21] - 1054720 ____A (Microsoft Corporation) D5FB73D19C46ADE183F968E13F186B23

C:\Windows\system32\wscsvc.dll
[2008-01-21 04:21] - [2008-01-21 04:21] - 0061440 ____A (Microsoft Corporation) 683DD16B590372F2C9661D277F35E49C

C:\Windows\system32\wbem\WMIsvc.dll
[2008-01-21 04:23] - [2008-01-21 04:23] - 0161792 ____A (Microsoft Corporation) 00B79A7C984678F24CF052E5BEB3A2F5

C:\Windows\system32\wuaueng.dll
[2008-01-21 04:23] - [2008-01-21 04:23] - 1695232 ____A (Microsoft Corporation) D79538B67FA641E986855DEF651E78FE

C:\Windows\system32\qmgr.dll
[2008-01-21 04:23] - [2008-01-21 04:23] - 0758272 ____A (Microsoft Corporation) 02ED7B4DBC2A3232A389106DA7515C3D

C:\Windows\system32\es.dll
[2008-08-13 16:26] - [2008-08-13 16:26] - 0269312 ____A (Microsoft Corporation) 3CB3343D720168B575133A0A20DC2465

C:\Windows\system32\cryptsvc.dll
[2008-01-21 04:22] - [2008-01-21 04:22] - 0128000 ____A (Microsoft Corporation) 6DE363F9F99334514C46AEC02D3E3678

C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\system32\ipnathlp.dll => MD5 is legit
C:\Windows\system32\iphlpsvc.dll => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit


**** End of log ****

Gruß Sepp

schrauber · 29.07.2013, 08:01

http://download.bleepingcomputer.com...sta/wscsvc.reg

laden uns ausführen, erlauben. Reboot und frisches FSS log bitte. Noch Probleme?

a variant of Win32/Spy.Banker.YIL trojan mit ESET online scan endeckt

Log-Analyse und Auswertung: a variant of Win32/Spy.Banker.YIL trojan mit ESET online scan endeckt