Browser/Werbe popup, "AppsHat", MBAM Funde, nach "Schrift-Download"

schrauber · 20.08.2013, 12:32

Ja entfernen, dann bitte ein frisches FRST log.

tobias_x31 · 20.08.2013, 16:25

FRST-Log:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 20-08-2013 03
Ran by Lenovo_X200 (administrator) on 20-08-2013 17:19:53
Running from C:\Dokumente und Einstellungen\Lenovo_X200\Desktop
Microsoft Windows XP Professional Service Pack 3 (X86) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Lenovo.) C:\WINDOWS\system32\ibmpmsvc.exe
(Intel(R) Corporation) C:\Programme\Intel\WiFi\bin\S24EvMon.exe
(Avira Operations GmbH & Co. KG) D:\Programme\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) D:\Programme\Avira\AntiVir Desktop\avgnt.exe
(Lenovo Group Limited) C:\Programme\Gemeinsame Dateien\Lenovo\Scheduler\scheduler_proxy.exe
(Lenovo.) C:\WINDOWS\system32\TpShocks.exe
(Lenovo Group Limited) C:\Programme\Lenovo\NPDIRECT\TPFNF7SP.exe
(Intel Corporation) C:\WINDOWS\system32\igfxpers.exe
(Intel Corporation) C:\WINDOWS\system32\igfxsrvc.exe
(Intel Corporation) C:\WINDOWS\system32\igfxext.exe
(Edimax Technology Co., Ltd.) D:\Programme\MFP Server Utilities\MFPAgent.exe
(Lenovo Group Limited) C:\PROGRA~1\THINKV~1\PrdCtr\LPMGR.exe
(Lenovo Group Limited) C:\PROGRA~1\THINKV~1\PrdCtr\LPMLCHK.exe
(Lenovo Group Limited) C:\Programme\Lenovo\VIRTSCRL\virtscrl.exe
(Intel Corporation) C:\WINDOWS\system32\igfxtray.exe
(Intel Corporation) C:\WINDOWS\system32\hkcmd.exe
(Lenovo Group Ltd.) C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
(Avanquest Software ) C:\Programme\Digital Line Detect\DLG.exe
() C:\WINDOWS\system32\ServoApp.exe
(Lenovo Group Limited) C:\PROGRA~1\ThinkPad\UTILIT~1\SCHTASK.exe
(Lenovo Group Limited) C:\Programme\LENOVO\HOTKEY\TPHKLOAD.exe
(Lenovo Group Limited) C:\Programme\LENOVO\HOTKEY\TPHKSVC.exe
(Avira Operations GmbH & Co. KG) D:\Programme\Avira\AntiVir Desktop\avguard.exe
(Lenovo.) C:\Programme\ThinkPad\Utilities\DOZESVC.EXE
(Intel(R) Corporation) C:\Programme\Intel\WiFi\bin\EvtEng.exe
(Lenovo Group Limited) C:\Programme\Lenovo\Communications Utility\CAMMUTE.exe
(Intel(R) Corporation) C:\Programme\Gemeinsame Dateien\Intel\WirelessCommon\RegSrvc.exe
(Lenovo Group Limited) C:\Programme\LENOVO\HOTKEY\tposdsvc.exe
(Lenovo Group Limited) C:\Programme\Lenovo\HOTKEY\TPONSCR.exe
(Lenovo Group Limited) C:\Programme\Lenovo\Zoom\TpScrex.exe
(Lenovo Group Limited) C:\Programme\Lenovo\System Update\SUService.exe
(Lenovo Group Limited) C:\Programme\Gemeinsame Dateien\Lenovo\tvt_reg_monitor_svc.exe
() C:\Programme\Lenovo\Rescue and Recovery\rrpservice.exe
(Lenovo Group Limited) C:\Programme\Lenovo\Rescue and Recovery\rrservice.exe
(Microsoft Corporation) C:\WINDOWS\system32\wbem\unsecapp.exe
(Lenovo Group Limited) C:\Programme\Gemeinsame Dateien\Lenovo\Scheduler\tvtsched.exe
(Lenovo Group Limited) C:\Programme\Lenovo\Rescue and Recovery\UpdateMonitor.exe
() C:\Programme\ThinkPad\Utilities\PWMDBSVC.exe
(Lenovo Group Limited) C:\Programme\ThinkPad\Utilities\PWMEWSVC.exe
(Avira Operations GmbH & Co. KG) D:\Programme\Avira\AntiVir Desktop\avshadow.exe
(Mozilla Corporation) D:\Programme\Mozilla Firefox\firefox.exe
(Farbar) C:\Dokumente und Einstellungen\Lenovo_X200\Desktop\FRST(1).exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [CorelDRAW Graphics Suite 11b] - D:\Programme\Corel\Corel Graphics 11\Register\registration.exe [315392 2005-02-17] (Corel Corporation)
HKLM\...\Run: [avgnt] - D:\Programme\Avira\AntiVir Desktop\avgnt.exe [345144 2013-07-04] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [TVT Scheduler Proxy] - C:\Programme\Gemeinsame Dateien\Lenovo\Scheduler\scheduler_proxy.exe [487424 2008-05-14] (Lenovo Group Limited)
HKLM\...\Run: [TrackPointSrv] - %ProgramFiles%\Lenovo\TrackPoint\tp4serv.exe [x]
HKLM\...\Run: [TpShocks] - C:\Windows\system32\TpShocks.exe [180224 2012-06-21] (Lenovo.)
HKLM\...\Run: [TPFNF7] - C:\Programme\Lenovo\NPDIRECT\TPFNF7SP.exe [62312 2010-03-26] (Lenovo Group Limited)
HKLM\...\Run: [PWRMGRTR] - C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL [3662400 2012-04-12] (Lenovo Group Limited)
HKLM\...\Run: [MFP Manager] - D:\Programme\MFP Server Utilities\MFPAgent.exe [884736 2010-01-04] (Edimax Technology Co., Ltd.)
HKLM\...\Run: [LPManager] - C:\PROGRA~1\THINKV~1\PrdCtr\LPMGR.exe [185688 2009-07-23] (Lenovo Group Limited)
HKLM\...\Run: [LPMailChecker] - C:\PROGRA~1\THINKV~1\PrdCtr\LPMLCHK.exe [124248 2009-07-23] (Lenovo Group Limited)
HKLM\...\Run: [LenovoAutoScrollUtility] - C:\Programme\Lenovo\VIRTSCRL\virtscrl.exe [101440 2011-10-20] (Lenovo Group Limited)
HKLM\...\Run: [EZEJMNAP] - C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe [256576 2009-12-01] (Lenovo Group Ltd.)
HKLM\...\Run: [Adobe ARM] - C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKCU\...\Run: [EPSON Stylus SX400 Series] - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIEGE.EXE /FU "C:\WINDOWS\TEMP\E_S45.tmp" /EF "HKCU" [x]
Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Digital Line Detect.lnk
ShortcutTarget: Digital Line Detect.lnk -> C:\Programme\Digital Line Detect\DLG.exe (Avanquest Software )

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
Handler: ipp - No CLSID Value - 
Handler: msdaipp - No CLSID Value - 
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Dokumente und Einstellungen\Lenovo_X200\Anwendungsdaten\Mozilla\Firefox\Profiles\jcfxls08.default
FF Homepage: www.google.de
FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin: @microsoft.com/WPF,version=3.5 - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.4 - D:\Programme\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader - C:\Programme\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Garmin Communicator - C:\Dokumente und Einstellungen\Lenovo_X200\Anwendungsdaten\Mozilla\Firefox\Profiles\jcfxls08.default\Extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF HKCU\...\Firefox\Extensions: [{9309FA47-1B48-4768-AFA4-9E0556F5DC81}] C:\Programme\LyricsPal\125.xpi
FF StartMenuInternet: FIREFOX.EXE - D:\Programme\Mozilla Firefox\firefox.exe

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; D:\Programme\Avira\AntiVir Desktop\sched.exe [84024 2013-07-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; D:\Programme\Avira\AntiVir Desktop\avguard.exe [108088 2013-07-04] (Avira Operations GmbH & Co. KG)
R2 DozeSvc; C:\Programme\ThinkPad\Utilities\DOZESVC.EXE [280640 2012-04-12] (Lenovo.)
R2 EvtEng; C:\Programme\Intel\WiFi\bin\EvtEng.exe [866576 2010-10-19] (Intel(R) Corporation)
R2 LENOVO.CAMMUTE; C:\Programme\Lenovo\Communications Utility\CAMMUTE.exe [50536 2010-07-27] (Lenovo Group Limited)
S2 LENOVO.MICMUTE; C:\Programme\LENOVO\HOTKEY\MICMUTE.exe [101736 2011-07-12] (Lenovo Group Limited)
S3 MozillaMaintenance; C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe [117656 2013-08-19] (Mozilla Foundation)
R2 Power Manager DBC Service; C:\Programme\ThinkPad\Utilities\PWMDBSVC.exe [1645568 2012-04-12] ()
R2 PwmEWSvc; C:\Programme\ThinkPad\Utilities\PWMEWSVC.exe [1664064 2012-04-12] (Lenovo Group Limited)
R2 RegSrvc; C:\Programme\Gemeinsame Dateien\Intel\WirelessCommon\RegSrvc.exe [477456 2010-10-19] (Intel(R) Corporation)
R2 S24EventMonitor; C:\Programme\Intel\WiFi\bin\S24EvMon.exe [966656 2010-10-19] (Intel(R) Corporation)
S3 Sony PC Companion; C:\Programme\Sony\Sony PC Companion\PCCService.exe [155824 2013-02-04] (Avanquest Software)
R2 SUService; C:\Programme\Lenovo\System Update\SUService.exe [28672 2011-07-25] (Lenovo Group Limited)
R2 ThinkVantage Registry Monitor Service; C:\Programme\Gemeinsame Dateien\Lenovo\tvt_reg_monitor_svc.exe [644408 2007-09-26] (Lenovo Group Limited)
R2 TPHKLOAD; C:\Programme\LENOVO\HOTKEY\TPHKLOAD.exe [131432 2011-07-12] (Lenovo Group Limited)
R2 TPHKSVC; C:\Programme\LENOVO\HOTKEY\TPHKSVC.exe [142696 2011-07-12] (Lenovo Group Limited)
R2 TVT Backup Protection Service; C:\Programme\Lenovo\Rescue and Recovery\rrpservice.exe [520192 2008-05-14] ()
R2 TVT Backup Service; C:\Programme\Lenovo\Rescue and Recovery\rrservice.exe [950272 2008-05-14] (Lenovo Group Limited)
R2 TVT Scheduler; C:\Programme\Gemeinsame Dateien\Lenovo\Scheduler\tvtsched.exe [1155072 2008-05-14] (Lenovo Group Limited)
R2 TVT_UpdateMonitor; C:\Programme\Lenovo\Rescue and Recovery\UpdateMonitor.exe [253952 2008-05-09] (Lenovo Group Limited)
S3 HidServ; %SystemRoot%\System32\hidserv.dll [x]

==================== Drivers (Whitelisted) ====================

R2 ALIWEHCD; C:\Windows\System32\Drivers\mfpec.sys [34944 2007-05-06] (None)
S3 AliWGP; C:\Windows\System32\DRIVERS\mfpcomp.sys [10880 2007-01-09] (None)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [84744 2013-03-29] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135136 2013-03-29] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-03-29] (Avira Operations GmbH & Co. KG)
S3 CH341SER; C:\Windows\System32\Drivers\CH341SER.SYS [39696 2011-11-05] (www.winchiphead.com)
R3 CnxtHdAudService; C:\Windows\System32\drivers\CHDAU32.sys [822400 2011-09-20] (Conexant Systems Inc.)
R3 e1yexpress; C:\Windows\System32\DRIVERS\e1y5132.sys [250584 2011-10-20] (Intel Corporation)
S3 grmnusb; C:\Windows\System32\drivers\grmnusb.sys [15720 2012-04-18] (GARMIN Corp.)
R3 HSFHWAZL; C:\Windows\System32\DRIVERS\HSFHWAZL.sys [210304 2009-06-30] (Conexant Systems, Inc.)
R3 HSF_DPV; C:\Windows\System32\DRIVERS\HSF_DPV.sys [986240 2009-06-30] (Conexant Systems, Inc.)
R3 NETwNx32; C:\Windows\System32\DRIVERS\NETwNx32.sys [6913920 2010-10-18] (Intel Corporation)
R2 pmem; C:\WINDOWS\System32\drivers\pmemnt.sys [7012 2012-09-27] (Microsoft Corporation)
R2 s24trans; C:\Windows\System32\DRIVERS\s24trans.sys [13952 2010-05-19] (Intel Corporation)
S3 slUsb; C:\Windows\System32\Drivers\slusb.sys [11136 2009-02-03] (Beijing Senselock Corp.)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
R2 StarOpen; C:\Windows\System32\Drivers\StarOpen.sys [5504 2012-06-03] ()
R3 Tp4Track; C:\Windows\System32\DRIVERS\tp4track.sys [24872 2011-11-01] (Lenovo Group Limited)
R1 TPHKDRV; C:\Windows\System32\DRIVERS\TPHKDRV.sys [17844 2008-05-12] (Lenovo Group Limited)
R3 tpm; C:\Windows\System32\DRIVERS\tpm.sys [13824 2008-03-26] (Intel Corporation)
R1 TPPWRIF; C:\Windows\System32\drivers\Tppwrif.sys [13936 2012-04-12] (Lenovo Group Limited)
R1 TSMAPIP; C:\Windows\System32\drivers\TSMAPIP.SYS [4608 2010-03-26] ()
S3 TwoTrack; C:\Windows\System32\DRIVERS\TwoTrack.sys [11520 2001-08-17] (IBM Corporation)
S3 USBSER34; C:\Windows\System32\Drivers\USBSER34.SYS [37168 2007-06-12] ()
R3 WUSBVBus; C:\Windows\System32\DRIVERS\mfpvbus.sys [10240 2006-10-20] (None)
S4 IntelIde; No ImagePath
U1 WS2IFSL; 

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-20 17:19 - 2013-08-20 17:19 - 00000000 ____D C:\FRST
2013-08-20 17:18 - 2013-08-20 17:18 - 01070241 _____ (Farbar) C:\Dokumente und Einstellungen\Lenovo_X200\Desktop\FRST(1).exe
2013-08-19 07:00 - 2013-08-19 07:02 - 00012657 _____ C:\WINDOWS\KB2862772-IE8.log
2013-08-19 06:46 - 2013-08-19 06:47 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2850869$
2013-08-19 06:46 - 2013-08-19 06:46 - 00005390 _____ C:\WINDOWS\KB2863058.log
2013-08-19 06:46 - 2013-08-19 06:46 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2863058$
2013-08-19 06:46 - 2013-08-19 06:46 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2859537$
2013-08-19 06:45 - 2013-08-19 06:45 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2849470$
2013-08-18 09:22 - 2013-08-19 06:47 - 00010330 _____ C:\WINDOWS\KB2850869.log
2013-08-18 09:21 - 2013-08-19 06:46 - 00011282 _____ C:\WINDOWS\KB2859537.log
2013-08-10 11:48 - 2013-08-10 11:50 - 00000000 ____D C:\WINDOWS\pss
2013-08-10 10:57 - 2013-08-10 10:56 - 00448512 _____ (OldTimer Tools) C:\Dokumente und Einstellungen\Lenovo_X200\Desktop\TFC.exe
2013-08-10 10:42 - 2013-08-10 10:43 - 00005174 _____ C:\WINDOWS\bitssetup.log
2013-08-10 10:41 - 2013-08-10 10:41 - 00001911 _____ C:\WINDOWS\system32\reset.log
2013-08-10 10:41 - 2013-08-10 10:41 - 00000000 ____D C:\Dokumente und Einstellungen\LocalService\Startmenü
2013-08-10 10:14 - 2013-08-10 10:14 - 00000000 ____D C:\RegBackup
2013-08-10 09:54 - 2013-08-10 11:10 - 00181064 _____ (Sysinternals) C:\WINDOWS\PSEXESVC.EXE
2013-08-08 16:27 - 2013-08-08 16:27 - 00003914 _____ C:\Dokumente und Einstellungen\Lenovo_X200\Desktop\DelFix.txt
2013-08-08 16:26 - 2013-08-08 16:27 - 00003914 _____ C:\DelFix.txt
2013-08-08 16:26 - 2013-08-08 16:26 - 00000000 ____D C:\WINDOWS\ERUNT
2013-08-03 17:46 - 2013-08-03 17:46 - 00002093 _____ C:\Dokumente und Einstellungen\Lenovo_X200\Desktop\GMER_log_20130803.log
2013-07-30 18:22 - 2013-07-30 17:52 - 00377856 _____ C:\Dokumente und Einstellungen\Lenovo_X200\Desktop\gmer_2.1.19163.exe
2013-07-30 18:10 - 2013-07-30 18:10 - 00000000 ____D C:\Dokumente und Einstellungen\Lenovo_X200\Anwendungsdaten\Malwarebytes
2013-07-30 18:09 - 2013-07-30 18:09 - 00000630 _____ C:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk
2013-07-30 18:09 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2013-07-29 22:10 - 2013-08-19 22:00 - 00000346 _____ C:\WINDOWS\Tasks\Lyrics-Pal Update.job
2013-07-29 22:10 - 2013-07-29 22:10 - 00015226 _____ C:\Dokumente und Einstellungen\Lenovo_X200\Desktop\Hyrule.zip
2013-07-28 11:46 - 2013-07-30 18:07 - 00000000 ____D C:\WINDOWS\system32\NtmsData
2013-07-28 11:42 - 2013-07-28 11:42 - 00000626 _____ C:\Dokumente und Einstellungen\Lenovo_X200\Desktop\PicaJet Photo Recovery.lnk
2013-07-28 11:42 - 2013-07-28 11:42 - 00000000 ____D C:\Dokumente und Einstellungen\Lenovo_X200\Startmenü\Programme\PicaJet Photo Recovery
2013-07-28 11:42 - 2013-07-28 11:42 - 00000000 ____D C:\Dokumente und Einstellungen\Lenovo_X200\Anwendungsdaten\picajet.com
2013-07-28 11:27 - 2013-07-28 11:27 - 00000639 _____ C:\Dokumente und Einstellungen\All Users\Desktop\PC Inspector smart recovery.lnk
2013-07-28 11:27 - 2003-07-18 13:58 - 00516784 ____R (Xceed Software Inc        (450) 442-2626        support@xceedsoft.com        www.xceedsoft.com) C:\WINDOWS\system32\XceedCry.dll
2013-07-28 11:27 - 2002-04-12 13:19 - 00028672 _____ C:\WINDOWS\system32\DartWeb.oca
2013-07-28 11:27 - 2002-02-28 09:46 - 00217088 _____ (Dart Communications) C:\WINDOWS\system32\DartSock.dll
2013-07-28 11:27 - 2002-02-21 10:12 - 00118784 _____ (Dart Communications) C:\WINDOWS\system32\DartWeb.dll
2013-07-28 11:27 - 1998-06-18 00:00 - 00089360 _____ (Microsoft Corporation) C:\WINDOWS\system32\VB5DB.DLL
2013-07-28 11:27 - 1998-06-13 22:53 - 00044544 _____ () C:\WINDOWS\system32\Gif89.dll
2013-07-28 11:23 - 2013-07-28 11:23 - 00000791 _____ C:\Dokumente und Einstellungen\Lenovo_X200\Desktop\PC Inspector File Recovery.lnk
2013-07-28 11:23 - 2013-07-28 11:23 - 00000000 ____D C:\Dokumente und Einstellungen\Lenovo_X200\Startmenü\Programme\Convar
2013-07-27 10:07 - 2013-07-28 11:34 - 00000000 ____D C:\Programme\Recuva
2013-07-27 10:07 - 2013-07-27 10:07 - 00001476 _____ C:\Dokumente und Einstellungen\All Users\Desktop\Recuva.lnk

==================== One Month Modified Files and Folders =======

2013-08-20 17:19 - 2013-08-20 17:19 - 00000000 __SHD C:\Dokumente und Einstellungen\Lenovo_X200\PrivacIE
2013-08-20 17:19 - 2013-08-20 17:19 - 00000000 ____D C:\FRST
2013-08-20 17:19 - 2012-02-19 13:42 - 00000000 ____D C:\Dokumente und Einstellungen\Lenovo_X200
2013-08-20 17:18 - 2013-08-20 17:18 - 01070241 _____ (Farbar) C:\Dokumente und Einstellungen\Lenovo_X200\Desktop\FRST(1).exe
2013-08-20 17:15 - 2012-02-19 13:36 - 01496947 _____ C:\WINDOWS\WindowsUpdate.log
2013-08-19 22:00 - 2013-07-29 22:10 - 00000346 _____ C:\WINDOWS\Tasks\Lyrics-Pal Update.job
2013-08-19 21:46 - 2012-12-28 23:31 - 00000000 ____D C:\Programme\Mozilla Maintenance Service
2013-08-19 21:41 - 2013-02-16 09:14 - 00000000 ____D C:\Programme\HeloCut
2013-08-19 21:40 - 2012-02-19 13:24 - 01211416 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2013-08-19 21:33 - 2012-09-27 21:04 - 00000312 _____ C:\WINDOWS\Tasks\PMTask.job
2013-08-19 21:33 - 2012-09-27 20:05 - 00002080 _____ C:\WINDOWS\system32\ICAutoUpdate.log.bak
2013-08-19 21:33 - 2012-02-19 13:40 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2013-08-19 21:33 - 2012-02-19 13:26 - 00000159 _____ C:\WINDOWS\wiadebug.log
2013-08-19 21:33 - 2012-02-19 13:26 - 00000050 _____ C:\WINDOWS\wiaservc.log
2013-08-19 21:30 - 2012-02-19 13:42 - 00000190 ___SH C:\Dokumente und Einstellungen\Lenovo_X200\ntuser.ini
2013-08-19 21:30 - 2012-02-19 13:40 - 00032598 _____ C:\WINDOWS\SchedLgU.Txt
2013-08-19 21:26 - 2013-07-18 19:05 - 00000000 ____D C:\WINDOWS\system32\MRT
2013-08-19 21:18 - 2012-09-27 19:34 - 75778376 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2013-08-19 20:27 - 2012-02-19 13:23 - 00829332 _____ C:\WINDOWS\setupapi.log
2013-08-19 07:19 - 2008-04-14 14:00 - 00002422 _____ C:\WINDOWS\system32\wpa.dbl
2013-08-19 07:15 - 2012-09-25 17:48 - 00000000 ____D C:\WINDOWS\Microsoft.NET
2013-08-19 07:02 - 2013-08-19 07:00 - 00012657 _____ C:\WINDOWS\KB2862772-IE8.log
2013-08-19 07:02 - 2012-02-19 13:24 - 01242743 _____ C:\WINDOWS\iis6.log
2013-08-19 07:02 - 2012-02-19 13:24 - 01079809 _____ C:\WINDOWS\FaxSetup.log
2013-08-19 07:02 - 2012-02-19 13:24 - 00534626 _____ C:\WINDOWS\ocgen.log
2013-08-19 07:02 - 2012-02-19 13:24 - 00501352 _____ C:\WINDOWS\tsoc.log
2013-08-19 07:02 - 2012-02-19 13:24 - 00371892 _____ C:\WINDOWS\comsetup.log
2013-08-19 07:02 - 2012-02-19 13:24 - 00343576 _____ C:\WINDOWS\msmqinst.log
2013-08-19 07:02 - 2012-02-19 13:24 - 00224333 _____ C:\WINDOWS\ntdtcsetup.log
2013-08-19 07:02 - 2012-02-19 13:24 - 00190144 _____ C:\WINDOWS\netfxocm.log
2013-08-19 07:02 - 2012-02-19 13:24 - 00075380 _____ C:\WINDOWS\MedCtrOC.log
2013-08-19 07:02 - 2012-02-19 13:24 - 00060252 _____ C:\WINDOWS\ocmsn.log
2013-08-19 07:02 - 2012-02-19 13:24 - 00054786 _____ C:\WINDOWS\tabletoc.log
2013-08-19 07:02 - 2012-02-19 13:24 - 00054587 _____ C:\WINDOWS\msgsocm.log
2013-08-19 07:02 - 2012-02-19 13:24 - 00001374 _____ C:\WINDOWS\imsins.log
2013-08-19 07:01 - 2012-09-27 19:41 - 00000000 ____D C:\WINDOWS\ie8updates
2013-08-19 07:01 - 2012-09-25 18:24 - 00080888 _____ C:\WINDOWS\updspapi.log
2013-08-19 06:47 - 2013-08-19 06:46 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2850869$
2013-08-19 06:47 - 2013-08-18 09:22 - 00010330 _____ C:\WINDOWS\KB2850869.log
2013-08-19 06:47 - 2012-02-19 13:24 - 00001374 _____ C:\WINDOWS\imsins.BAK
2013-08-19 06:46 - 2013-08-19 06:46 - 00005390 _____ C:\WINDOWS\KB2863058.log
2013-08-19 06:46 - 2013-08-19 06:46 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2863058$
2013-08-19 06:46 - 2013-08-19 06:46 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2859537$
2013-08-19 06:46 - 2013-08-18 09:21 - 00011282 _____ C:\WINDOWS\KB2859537.log
2013-08-19 06:46 - 2012-09-27 19:21 - 00023964 _____ C:\WINDOWS\system32\TZLog.log
2013-08-19 06:45 - 2013-08-19 06:45 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2849470$
2013-08-12 21:09 - 2013-05-16 21:22 - 00000000 ____D C:\WINDOWS\system32\LogFiles
2013-08-10 11:56 - 2012-02-19 14:21 - 00000211 ___SH C:\boot.ini
2013-08-10 11:56 - 2008-04-14 14:00 - 00000477 _____ C:\WINDOWS\win.ini
2013-08-10 11:56 - 2008-04-14 14:00 - 00000227 _____ C:\WINDOWS\system.ini
2013-08-10 11:50 - 2013-08-10 11:48 - 00000000 ____D C:\WINDOWS\pss
2013-08-10 11:10 - 2013-08-10 09:54 - 00181064 _____ (Sysinternals) C:\WINDOWS\PSEXESVC.EXE
2013-08-10 11:08 - 2012-02-19 14:13 - 00000000 ____D C:\WINDOWS\repair
2013-08-10 11:08 - 2012-02-19 13:34 - 00000000 ____D C:\WINDOWS\Registration
2013-08-10 11:06 - 2012-02-19 13:42 - 00000000 ___RD C:\Dokumente und Einstellungen\Lenovo_X200\Startmenü\Programme\Autostart
2013-08-10 10:56 - 2013-08-10 10:57 - 00448512 _____ (OldTimer Tools) C:\Dokumente und Einstellungen\Lenovo_X200\Desktop\TFC.exe
2013-08-10 10:45 - 2012-02-19 13:23 - 00195056 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2013-08-10 10:43 - 2013-08-10 10:42 - 00005174 _____ C:\WINDOWS\bitssetup.log
2013-08-10 10:41 - 2013-08-10 10:41 - 00001911 _____ C:\WINDOWS\system32\reset.log
2013-08-10 10:41 - 2013-08-10 10:41 - 00000000 ____D C:\Dokumente und Einstellungen\LocalService\Startmenü
2013-08-10 10:41 - 2012-02-19 13:40 - 00000000 __SHD C:\Dokumente und Einstellungen\LocalService
2013-08-10 10:41 - 2012-02-19 13:37 - 00023392 _____ C:\WINDOWS\system32\nscompat.tlb
2013-08-10 10:41 - 2012-02-19 13:37 - 00016832 _____ C:\WINDOWS\system32\amcompat.tlb
2013-08-10 10:14 - 2013-08-10 10:14 - 00000000 ____D C:\RegBackup
2013-08-08 16:27 - 2013-08-08 16:27 - 00003914 _____ C:\Dokumente und Einstellungen\Lenovo_X200\Desktop\DelFix.txt
2013-08-08 16:27 - 2013-08-08 16:26 - 00003914 _____ C:\DelFix.txt
2013-08-08 16:26 - 2013-08-08 16:26 - 00000000 ____D C:\WINDOWS\ERUNT
2013-08-04 18:52 - 2012-02-19 13:24 - 00000000 ___RD C:\Programme
2013-08-04 18:52 - 2012-02-19 13:23 - 00195809 _____ C:\WINDOWS\setupact.log
2013-08-03 17:46 - 2013-08-03 17:46 - 00002093 _____ C:\Dokumente und Einstellungen\Lenovo_X200\Desktop\GMER_log_20130803.log
2013-08-03 17:05 - 2012-09-27 19:49 - 20157852 _____ C:\sysiclog.txt.bak
2013-07-30 18:10 - 2013-07-30 18:10 - 00000000 ____D C:\Dokumente und Einstellungen\Lenovo_X200\Anwendungsdaten\Malwarebytes
2013-07-30 18:09 - 2013-07-30 18:09 - 00000630 _____ C:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk
2013-07-30 18:07 - 2013-07-28 11:46 - 00000000 ____D C:\WINDOWS\system32\NtmsData
2013-07-30 17:52 - 2013-07-30 18:22 - 00377856 _____ C:\Dokumente und Einstellungen\Lenovo_X200\Desktop\gmer_2.1.19163.exe
2013-07-29 22:11 - 2012-02-19 13:42 - 00000000 ___RD C:\Dokumente und Einstellungen\Lenovo_X200\Startmenü\Programme
2013-07-29 22:10 - 2013-07-29 22:10 - 00015226 _____ C:\Dokumente und Einstellungen\Lenovo_X200\Desktop\Hyrule.zip
2013-07-28 11:42 - 2013-07-28 11:42 - 00000626 _____ C:\Dokumente und Einstellungen\Lenovo_X200\Desktop\PicaJet Photo Recovery.lnk
2013-07-28 11:42 - 2013-07-28 11:42 - 00000000 ____D C:\Dokumente und Einstellungen\Lenovo_X200\Startmenü\Programme\PicaJet Photo Recovery
2013-07-28 11:42 - 2013-07-28 11:42 - 00000000 ____D C:\Dokumente und Einstellungen\Lenovo_X200\Anwendungsdaten\picajet.com
2013-07-28 11:34 - 2013-07-27 10:07 - 00000000 ____D C:\Programme\Recuva
2013-07-28 11:27 - 2013-07-28 11:27 - 00000639 _____ C:\Dokumente und Einstellungen\All Users\Desktop\PC Inspector smart recovery.lnk
2013-07-28 11:27 - 2012-09-25 18:10 - 00000000 ___HD C:\Programme\InstallShield Installation Information
2013-07-28 11:27 - 2012-09-25 18:10 - 00000000 ____D C:\Programme\Gemeinsame Dateien\InstallShield
2013-07-28 11:23 - 2013-07-28 11:23 - 00000791 _____ C:\Dokumente und Einstellungen\Lenovo_X200\Desktop\PC Inspector File Recovery.lnk
2013-07-28 11:23 - 2013-07-28 11:23 - 00000000 ____D C:\Dokumente und Einstellungen\Lenovo_X200\Startmenü\Programme\Convar
2013-07-27 10:07 - 2013-07-27 10:07 - 00001476 _____ C:\Dokumente und Einstellungen\All Users\Desktop\Recuva.lnk
2013-07-26 04:47 - 2012-09-27 19:43 - 00522240 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\jsdbgui.dll
2013-07-26 04:47 - 2012-09-27 19:41 - 02005504 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\iertutil.dll
2013-07-26 04:47 - 2012-09-27 19:41 - 00630272 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\msfeeds.dll
2013-07-26 04:47 - 2012-09-27 19:41 - 00247808 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\ieproxy.dll
2013-07-26 04:47 - 2012-09-27 19:41 - 00055296 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2013-07-26 04:47 - 2012-09-27 19:41 - 00012800 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\xpshims.dll
2013-07-26 04:47 - 2012-02-19 13:36 - 00759296 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\vgx.dll
2013-07-26 04:47 - 2009-03-08 04:32 - 02005504 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2013-07-26 04:47 - 2009-03-08 04:32 - 00630272 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2013-07-26 04:47 - 2009-03-08 04:31 - 00055296 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeedsbs.dll
2013-07-26 04:47 - 2008-04-14 14:00 - 06017536 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\mshtml.dll
2013-07-26 04:47 - 2008-04-14 14:00 - 06017536 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2013-07-26 04:47 - 2008-04-14 14:00 - 01469440 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\inetcpl.cpl
2013-07-26 04:47 - 2008-04-14 14:00 - 01469440 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2013-07-26 04:47 - 2008-04-14 14:00 - 01215488 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\urlmon.dll
2013-07-26 04:47 - 2008-04-14 14:00 - 01215488 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2013-07-26 04:47 - 2008-04-14 14:00 - 00920064 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\wininet.dll
2013-07-26 04:47 - 2008-04-14 14:00 - 00920064 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2013-07-26 04:47 - 2008-04-14 14:00 - 00611840 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\mstime.dll
2013-07-26 04:47 - 2008-04-14 14:00 - 00611840 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstime.dll
2013-07-26 04:47 - 2008-04-14 14:00 - 00206848 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\occache.dll
2013-07-26 04:47 - 2008-04-14 14:00 - 00206848 _____ (Microsoft Corporation) C:\WINDOWS\system32\occache.dll
2013-07-26 04:47 - 2008-04-14 14:00 - 00184320 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\iepeers.dll
2013-07-26 04:47 - 2008-04-14 14:00 - 00184320 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2013-07-26 04:47 - 2008-04-14 14:00 - 00105984 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\url.dll
2013-07-26 04:47 - 2008-04-14 14:00 - 00105984 _____ (Microsoft Corporation) C:\WINDOWS\system32\url.dll
2013-07-26 04:47 - 2008-04-14 14:00 - 00067072 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\mshtmled.dll
2013-07-26 04:47 - 2008-04-14 14:00 - 00067072 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2013-07-26 04:47 - 2008-04-14 14:00 - 00043520 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\licmgr10.dll
2013-07-26 04:47 - 2008-04-14 14:00 - 00043520 _____ (Microsoft Corporation) C:\WINDOWS\system32\licmgr10.dll
2013-07-26 04:47 - 2008-04-14 14:00 - 00025600 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\jsproxy.dll
2013-07-26 04:47 - 2008-04-14 14:00 - 00025600 _____ (Microsoft Corporation) C:\WINDOWS\system32\jsproxy.dll
2013-07-26 04:46 - 2012-09-27 19:41 - 11113472 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\ieframe.dll
2013-07-26 04:46 - 2012-09-27 19:41 - 00743424 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\iedvtool.dll
2013-07-26 04:46 - 2009-03-08 04:39 - 11113472 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2013-07-26 04:46 - 2008-04-14 14:00 - 00387584 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\iedkcs32.dll
2013-07-26 04:46 - 2008-04-14 14:00 - 00387584 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2013-07-25 21:23 - 2008-04-14 14:00 - 00174592 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\ie4uinit.exe
2013-07-25 21:23 - 2008-04-14 14:00 - 00174592 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2013-07-25 17:52 - 2008-04-14 14:00 - 00385024 _____ (Microsoft Corporation) C:\WINDOWS\system32\html.iec

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe
[2008-04-14 14:00] - [2008-04-14 14:00] - 1036800 ____A (Microsoft Corporation) 418045a93cd87a352098ab7dabe1b53e 

C:\Windows\System32\winlogon.exe
[2008-04-14 14:00] - [2008-04-14 14:00] - 0513024 ____A (Microsoft Corporation) f09a527b422e25c478e38caa0e44417a 

C:\Windows\System32\svchost.exe
[2008-04-14 14:00] - [2008-04-14 14:00] - 0014336 ____A (Microsoft Corporation) 4fbc75b74479c7a6f829e0ca19df3366 

C:\Windows\System32\services.exe
[2008-04-14 14:00] - [2009-02-09 13:21] - 0111104 ____A (Microsoft Corporation) a3edbe9053889fb24ab22492472b39dc 

C:\Windows\System32\User32.dll
[2008-04-14 14:00] - [2008-04-14 14:00] - 0580096 ____A (Microsoft Corporation) b0050cc5340e3a0760dd8b417ff7aebd 

C:\Windows\System32\userinit.exe
[2008-04-14 14:00] - [2008-04-14 14:00] - 0026624 ____A (Microsoft Corporation) 788f95312e26389d596c0fa55834e106 

C:\Windows\System32\Drivers\volsnap.sys
[2008-04-14 14:00] - [2008-04-14 14:00] - 0053760 ____A (Microsoft Corporation) a5a712f4e880874a477af790b5186e1d 


==================== End Of Log ============================

--- --- ---

20.08.2013, 12:32	#1
schrauber /// the machine /// TB-Ausbilder	Browser/Werbe popup, "AppsHat", MBAM Funde, nach "Schrift-Download" Ja entfernen, dann bitte ein frisches FRST log. __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Browser/Werbe popup, "AppsHat", MBAM Funde, nach "Schrift-Download"

Plagegeister aller Art und deren Bekämpfung: Browser/Werbe popup, "AppsHat", MBAM Funde, nach "Schrift-Download"

Browser/Werbe popup, "AppsHat", MBAM Funde, nach "Schrift-Download"

Browser/Werbe popup, "AppsHat", MBAM Funde, nach "Schrift-Download"

Ähnliche Themen: Browser/Werbe popup, "AppsHat", MBAM Funde, nach "Schrift-Download"