| |
| |||||||
Log-Analyse und Auswertung: Sicherheitscenterdienst ist verschwundenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
18.08.2013, 14:30
| #1 |
| |  Sicherheitscenterdienst ist verschwunden Hallo Leute, ich habe das Problem das ich mir nen Virus eingefangen habe, dieser hat den Dienst des Sicherheitscenters unter Windows entfernt oder zumindest versteckt. Auch Microsoft Security Essentials kann nicht mehr geöffnet werden weil ich angeblich nicht die erforderlichen Rechte habe. Nun habe ich schonmal Malwarebytes durchlaufen lassen, genauso wie hijackthis, beide haben nix gefunden. Antivir hat nen trojaner gefunden (hatte ich nur zum scannen installiert) diesen hab ich in Quarantäne verschoben. Nun habe ich als letzte möglichkeit bevor ich den Laptop neu mache noch nen Scan mit Combofix gemacht in der Hoffnung das mir irgendwer von euch helfen kann. Hier die Log-Datei: ComboFix 13-08-18.01 - Waxweazle2001 18.08.2013 14:50:57.1.2 - x64 Microsoft Windows 7 Professional 6.1.7601.1.1252.49.1031.18.2038.883 [GMT 2:00] ausgeführt von:: e:\downloads\ComboFix.exe AV: Microsoft Security Essentials *Enabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F} SP: Microsoft Security Essentials *Enabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Neuer Wiederherstellungspunkt wurde erstellt . . (((((((((((((((((((((((((((((((((((( Weitere Löschungen )))))))))))))))))))))))))))))))))))))))))))))))) . . c:\users\Waxweazle2001\AppData\Roaming\Xaypky c:\users\Waxweazle2001\AppData\Roaming\Xaypky\coxoo.buy c:\windows\PFRO.log c:\windows\wininit.ini . . ((((((((((((((((((((((( Dateien erstellt von 2013-07-18 bis 2013-08-18 )))))))))))))))))))))))))))))) . . 2013-08-18 12:59 . 2013-08-18 12:59 -------- d-----w- c:\users\Default\AppData\Local\temp 2013-08-18 10:10 . 2013-08-18 10:10 -------- d-----w- c:\programdata\AskPartnerNetwork 2013-08-18 10:10 . 2013-08-18 10:10 -------- d-----w- c:\program files (x86)\AskPartnerNetwork 2013-08-18 10:10 . 2013-08-18 10:10 -------- d-----w- c:\programdata\APN 2013-08-18 10:09 . 2013-08-18 12:33 -------- d-----w- c:\programdata\Avira 2013-08-17 16:25 . 2013-08-17 16:30 -------- d-----w- c:\programdata\Spybot - Search & Destroy 2013-08-17 16:24 . 2013-08-18 12:07 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy 2 2013-08-17 15:21 . 2013-08-17 15:21 -------- d-----w- c:\users\Waxweazle2001\AppData\Roaming\Malwarebytes 2013-08-17 15:21 . 2013-08-17 15:21 -------- d-----w- c:\programdata\Malwarebytes 2013-08-16 18:55 . 2013-08-16 18:55 76232 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{5EC98090-E9F8-405F-86CC-306EF39A5D57}\offreg.dll 2013-08-16 18:54 . 2013-08-16 18:54 -------- d-----w- c:\program files (x86)\Google 2013-08-16 18:54 . 2013-08-16 18:54 -------- d-----w- c:\users\Waxweazle2001\AppData\Local\Google 2013-08-16 15:37 . 2013-07-02 08:34 9460976 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{5EC98090-E9F8-405F-86CC-306EF39A5D57}\mpengine.dll 2013-08-16 15:33 . 2013-07-09 05:46 1472512 ----a-w- c:\windows\system32\crypt32.dll 2013-08-16 15:33 . 2013-07-09 04:46 1166848 ----a-w- c:\windows\SysWow64\crypt32.dll 2013-08-16 15:33 . 2013-07-09 05:52 224256 ----a-w- c:\windows\system32\wintrust.dll 2013-08-16 15:33 . 2013-07-09 04:52 175104 ----a-w- c:\windows\SysWow64\wintrust.dll 2013-08-16 15:33 . 2013-07-09 04:46 140288 ----a-w- c:\windows\SysWow64\cryptsvc.dll 2013-08-16 15:33 . 2013-07-09 05:46 184320 ----a-w- c:\windows\system32\cryptsvc.dll 2013-08-16 15:33 . 2013-07-09 05:46 139776 ----a-w- c:\windows\system32\cryptnet.dll 2013-08-16 15:33 . 2013-07-09 04:46 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll 2013-08-16 15:29 . 2013-07-19 01:58 2048 ----a-w- c:\windows\system32\tzres.dll 2013-08-16 15:29 . 2013-07-19 01:41 2048 ----a-w- c:\windows\SysWow64\tzres.dll 2013-08-16 15:29 . 2013-07-25 09:25 1888768 ----a-w- c:\windows\system32\WMVDECOD.DLL 2013-08-16 15:29 . 2013-07-25 08:57 1620992 ----a-w- c:\windows\SysWow64\WMVDECOD.DLL 2013-08-16 15:29 . 2013-07-09 05:51 1217024 ----a-w- c:\windows\system32\rpcrt4.dll 2013-08-16 15:29 . 2013-07-09 04:52 663552 ----a-w- c:\windows\SysWow64\rpcrt4.dll 2013-08-16 15:29 . 2013-06-15 04:32 39936 ----a-w- c:\windows\system32\drivers\tssecsrv.sys 2013-08-16 15:29 . 2013-07-06 06:03 1910208 ----a-w- c:\windows\system32\drivers\tcpip.sys 2013-08-13 08:31 . 2013-07-02 08:34 9460976 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2013-08-12 08:32 . 2013-08-12 08:32 -------- d-----w- c:\users\Waxweazle2001\.android 2013-08-12 08:27 . 2013-08-12 08:35 -------- d-----w- c:\users\Waxweazle2001\AppData\Roaming\MyPhoneExplorer 2013-08-04 17:40 . 2013-08-04 17:40 -------- d-----w- c:\programdata\Synology 2013-07-22 13:25 . 2013-07-22 13:25 -------- d-----w- C:\Drivers 2013-07-22 13:25 . 2006-11-01 19:59 7296 ----a-w- c:\windows\system32\drivers\fuj02e3.sys 2013-07-22 13:24 . 2013-07-22 13:24 -------- d-----w- c:\program files (x86)\SMSC 2013-07-22 13:24 . 2006-10-18 13:42 37376 ----a-w- c:\windows\system32\drivers\smscir64.sys 2013-07-22 13:23 . 2013-07-22 13:23 -------- d-----w- C:\dell 2013-07-22 13:21 . 2013-07-22 13:21 -------- d-----w- c:\program files (x86)\O2Micro International LTD 2013-07-22 13:21 . 2006-11-14 10:42 100480 ----a-w- c:\windows\SysWow64\drivers\OZSCRx64.sys 2013-07-22 13:21 . 2013-07-22 13:21 -------- d-----w- c:\users\Waxweazle2001\AppData\Roaming\InstallShield . . . (((((((((((((((((((((((((((((((((((( Find3M Bericht )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-08-16 21:52 . 2013-01-10 18:44 78161360 ----a-w- c:\windows\system32\MRT.exe 2013-07-17 08:06 . 2013-07-17 08:07 941720 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C5FE211F-AFF3-4F98-A1D9-3F8CA8207D0B}\gapaengine.dll 2013-07-14 09:35 . 2013-01-20 12:58 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2013-07-14 09:35 . 2013-01-20 12:45 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2013-06-22 12:15 . 2013-03-12 20:17 964552 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll 2013-06-21 13:10 . 2013-06-21 13:11 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll 2013-06-21 13:10 . 2013-01-10 21:19 789416 ----a-w- c:\windows\SysWow64\deployJava1.dll 2013-06-21 13:10 . 2013-01-10 21:19 867240 ----a-w- c:\windows\SysWow64\npDeployJava1.dll 2013-06-18 19:50 . 2013-06-18 19:50 247216 ----a-w- c:\windows\system32\drivers\MpFilter.sys 2013-06-18 19:50 . 2012-08-30 21:03 139616 ----a-w- c:\windows\system32\drivers\NisDrvWFP.sys 2013-06-12 16:57 . 2013-06-12 16:58 971680 ----a-w- c:\windows\system32\deployJava1.dll 2013-06-12 16:57 . 2013-06-12 16:58 1092512 ----a-w- c:\windows\system32\npDeployJava1.dll 2013-06-05 03:34 . 2013-07-11 15:40 3153920 ----a-w- c:\windows\system32\win32k.sys 2013-06-04 06:00 . 2013-07-11 15:40 624128 ----a-w- c:\windows\system32\qedit.dll 2013-06-04 04:53 . 2013-07-11 15:40 509440 ----a-w- c:\windows\SysWow64\qedit.dll 2013-05-26 16:37 . 2013-05-26 16:37 715038 ----a-w- c:\windows\unins000.exe . . (((((((((((((((((((((((((((( Autostartpunkte der Registrierung )))))))))))))))))))))))))))))))))))))))) . . *Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. REGEDIT4 . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{41564952-412D-5637-00A7-7A786E7484D7}] 2013-07-26 20:30 12240 ----a-w- c:\program files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar] "{41564952-412D-5637-00A7-7A786E7484D7}"= "c:\program files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll" [2013-07-26 12240] . [HKEY_CLASSES_ROOT\clsid\{41564952-412d-5637-00a7-7a786e7484d7}] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "HP Deskjet 3070 B611 series (NET)"="c:\program files\HP\HP Deskjet 3070 B611 series\Bin\ScanToPCActivationApp.exe" [2012-10-17 2573416] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2011-10-28 49208] "TRUUpdater"="c:\program files (x86)\Sierra Wireless Inc\WebUpdater\TRUUpdater.exe" [2009-06-26 558360] "WatcherHelper"="c:\program files (x86)\Sierra Wireless Inc\3G Watcher\WaHelper.exe" [2009-04-07 62744] "ApnTBMon"="c:\program files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe" [2013-07-26 1558480] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean64.exe . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x] R2 SystemStoreService;System Store;c:\program files (x86)\SoftwareUpdater\SystemStore.exe -displayname System Store -servicename SystemStoreService;c:\program files (x86)\SoftwareUpdater\SystemStore.exe -displayname System Store -servicename SystemStoreService [x] R3 HTCAND64;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys;c:\windows\SYSNATIVE\Drivers\ANDROIDUSB.sys [x] R3 htcnprot;HTC NDIS Protocol Driver;c:\windows\system32\DRIVERS\htcnprot.sys;c:\windows\SYSNATIVE\DRIVERS\htcnprot.sys [x] R3 NisSrv;NisSrv;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x] R3 SWNC8U32;Sierra Wireless MUX NDIS Driver (UMTS32);c:\windows\system32\DRIVERS\swnc8u32.sys;c:\windows\SYSNATIVE\DRIVERS\swnc8u32.sys [x] R3 SWUMX32;Sierra Wireless USB MUX Driver (UMTS32);c:\windows\system32\DRIVERS\swumx32.sys;c:\windows\SYSNATIVE\DRIVERS\swumx32.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x] S0 vmci;VMware VMCI Bus Driver;c:\windows\system32\DRIVERS\vmci.sys;c:\windows\SYSNATIVE\DRIVERS\vmci.sys [x] S0 vsock;vSockets Driver;c:\windows\system32\drivers\vsock.sys;c:\windows\SYSNATIVE\drivers\vsock.sys [x] S2 APNMCP;Ask Aktualisierungsdienst;c:\program files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe;c:\program files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [x] S2 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x] S2 PassThru Service;Internet Pass-Through Service;c:\program files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe;c:\program files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [x] S2 PDF Architect Helper Service;PDF Architect Helper Service;c:\program files (x86)\PDF Architect\HelperService.exe;c:\program files (x86)\PDF Architect\HelperService.exe [x] S2 PDF Architect Service;PDF Architect Service;c:\program files (x86)\PDF Architect\ConversionService.exe;c:\program files (x86)\PDF Architect\ConversionService.exe [x] S2 TomTomHOMEService;TomTomHOMEService;d:\programme\TomTom HOME 2\TomTomHOMEService.exe;d:\programme\TomTom HOME 2\TomTomHOMEService.exe [x] S2 UsbClientService;UsbClientService;d:\programme\Synology\Assistant\UsbClientService.exe;d:\programme\Synology\Assistant\UsbClientService.exe [x] S2 VMUSBArbService;VMware USB Arbitration Service;c:\program files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe;c:\program files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe [x] S3 busenum;Synology Virtual USB Hub;c:\windows\system32\DRIVERS\busenum.sys;c:\windows\SYSNATIVE\DRIVERS\busenum.sys [x] S3 FUJ02E3;Fujitsu FUJ02E3 Device Driver;c:\windows\system32\DRIVERS\FUJ02E3.sys;c:\windows\SYSNATIVE\DRIVERS\FUJ02E3.sys [x] S3 O2MDRDR;O2MDRDR;c:\windows\system32\DRIVERS\o2mdx64.sys;c:\windows\SYSNATIVE\DRIVERS\o2mdx64.sys [x] S3 O2SDRDR;O2SDRDR;c:\windows\system32\DRIVERS\o2sdx64.sys;c:\windows\SYSNATIVE\DRIVERS\o2sdx64.sys [x] S3 SMSCIRDA;SMSC Infrared Device Driver;c:\windows\system32\DRIVERS\SMSCir64.sys;c:\windows\SYSNATIVE\DRIVERS\SMSCir64.sys [x] S3 yukonw7;NDIS6.2-Miniporttreiber für Marvell Yukon-Ethernet-Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x] . . Inhalt des "geplante Tasks" Ordners . 2013-08-18 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-01-20 09:35] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-23 165912] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-23 385560] "Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-23 363544] "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-06-20 1356240] . ------- Zusätzlicher Suchlauf ------- . uLocal Page = c:\windows\system32\blank.htm mLocal Page = c:\windows\SysWOW64\blank.htm TCP: Interfaces\{CB83EE71-F22D-4466-8F04-EE9EACCB2BA3}: NameServer = 192.168.20.1 FF - ProfilePath - c:\users\Waxweazle2001\AppData\Roaming\Mozilla\Firefox\Profiles\pj0junss.default\ FF - prefs.js: browser.startup.homepage - about:home FF - prefs.js: network.proxy.http - 91.143.60.172 FF - prefs.js: network.proxy.http_port - 8080 FF - prefs.js: network.proxy.type - 0 FF - ExtSQL: 2013-07-26 22:31; toolbar_AVIRA-V7@apn.ask.com; c:\users\Waxweazle2001\AppData\Roaming\Mozilla\Firefox\Profiles\pj0junss.default\extensions\toolbar_AVIRA-V7@apn.ask.com.xpi FF - user.js: extensions.autoDisableScopes - 10 . - - - - Entfernte verwaiste Registrierungseinträge - - - - . Wow6432Node-HKLM-Run-<NO NAME> - (no file) HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe AddRemove-dBpoweramp AAC Encoder - c:\windows\system32\SpoonUninstall.exe AddRemove-dBpoweramp AIFF Codec - c:\windows\system32\SpoonUninstall.exe AddRemove-dBpoweramp Batch Ripper - c:\windows\system32\SpoonUninstall.exe AddRemove-dBpoweramp CD Writer - c:\windows\system32\SpoonUninstall.exe AddRemove-dBpoweramp CLI Encoder - c:\windows\system32\SpoonUninstall.exe AddRemove-dBpoweramp Dalet Codec - c:\windows\system32\SpoonUninstall.exe AddRemove-dBpoweramp DirectShow Decoder - c:\windows\system32\SpoonUninstall.exe AddRemove-dBpoweramp DSP Effects - c:\windows\system32\SpoonUninstall.exe AddRemove-dBpoweramp FLAC Codec - c:\windows\system32\SpoonUninstall.exe AddRemove-dBpoweramp m4a Codec - c:\windows\system32\SpoonUninstall.exe AddRemove-dBpoweramp m4a Nero AAC Encoder - c:\windows\system32\SpoonUninstall.exe AddRemove-dBpoweramp m4a Utilities - c:\windows\system32\SpoonUninstall.exe AddRemove-dBpoweramp m4b Audio book Encoder - c:\windows\system32\SpoonUninstall.exe AddRemove-dBpoweramp Midi Decoder - c:\windows\system32\SpoonUninstall.exe AddRemove-dBpoweramp Monkeys Audio Codec - c:\windows\system32\SpoonUninstall.exe AddRemove-dBPowerAMP Mp2 and BwfMp2 codec - c:\windows\system32\SpoonUninstall.exe AddRemove-dBpoweramp mp3 (Fraunhofer IIS) Codec - c:\windows\system32\SpoonUninstall.exe AddRemove-dBpoweramp Musepack Codec - c:\windows\system32\SpoonUninstall.exe AddRemove-dBpoweramp Music Converter - c:\windows\system32\SpoonUninstall.exe AddRemove-dBpoweramp Ogg Vorbis aoTuV Encoder - c:\windows\system32\SpoonUninstall.exe AddRemove-dBpoweramp Ogg Vorbis Codec - c:\windows\system32\SpoonUninstall.exe AddRemove-dBpoweramp OptimFROG Codec - c:\windows\system32\SpoonUninstall.exe AddRemove-dBpoweramp Shorten Codec - c:\windows\system32\SpoonUninstall.exe AddRemove-dBpoweramp Speex Codec - c:\windows\system32\SpoonUninstall.exe AddRemove-dBPoweramp tooLame MP2 codec - c:\windows\system32\SpoonUninstall.exe AddRemove-dBpoweramp TTA Codec - c:\windows\system32\SpoonUninstall.exe AddRemove-dBpoweramp Wave64 Codec - c:\windows\system32\SpoonUninstall.exe AddRemove-dBpoweramp WavPack Codec - c:\windows\system32\SpoonUninstall.exe AddRemove-dBpoweramp Windows Media Audio 10 Codec - c:\windows\system32\SpoonUninstall.exe AddRemove-dBpoweramp [Arrange Audio] Codec - c:\windows\system32\SpoonUninstall.exe AddRemove-dBpoweramp [Audio Info] Codec - c:\windows\system32\SpoonUninstall.exe AddRemove-dBpoweramp [Calculate Audio CRC] Codec - c:\windows\system32\SpoonUninstall.exe AddRemove-dBpoweramp [Channel Split] Codec - c:\windows\system32\SpoonUninstall.exe AddRemove-dBpoweramp [ID Tag Update] Codec - c:\windows\system32\SpoonUninstall.exe AddRemove-dBpoweramp [Length Split] Codec - c:\windows\system32\SpoonUninstall.exe AddRemove-dBpoweramp [Multi Encoder] Codec - c:\windows\system32\SpoonUninstall.exe AddRemove-dBpoweramp [ReplayGain] Codec - c:\windows\system32\SpoonUninstall.exe AddRemove-dBpoweramp [Tag From Filename] Codec - c:\windows\system32\SpoonUninstall.exe AddRemove-MPEG Suite 2001r2 - c:\windows\system32\SpoonUninstall.exe AddRemove-Ogg Vorbis CLI - c:\windows\system32\SpoonUninstall.exe . . . --------------------- Gesperrte Registrierungsschluessel --------------------- . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 "MSCurrentCountry"=dword:000000b5 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ------------------------ Weitere laufende Prozesse ------------------------ . c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe c:\windows\SysWOW64\o2flash.exe c:\windows\SysWOW64\vmnat.exe c:\windows\SysWOW64\vmnetdhcp.exe d:\programme\VMWarePlayer\vmware-authd.exe . ************************************************************************** . Zeit der Fertigstellung: 2013-08-18 15:21:01 - PC wurde neu gestartet ComboFix-quarantined-files.txt 2013-08-18 13:20 . Vor Suchlauf: 8.310.218.752 Bytes frei Nach Suchlauf: 8.264.355.840 Bytes frei . - - End Of File - - A32599FA80D989D09D22E513ACFC66D0 A36C5E4F47E84449FF07ED3517B43A31 |
|
18.08.2013, 14:41
| #2 |
| /// the machine /// TB-Ausbilder    | Sicherheitscenterdienst ist verschwunden hi,
__________________Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
 So funktioniert es:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
|
18.08.2013, 14:56
| #3 |
| | Sicherheitscenterdienst ist verschwunden Hier die FRST-Log:
__________________FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-08-2013
Ran by Waxweazle2001 (administrator) on 18-08-2013 15:40:03
Running from E:\Downloads
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
(O2Micro International) C:\Windows\SysWOW64\o2flash.exe
() C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\ConversionService.exe
(TomTom) D:\Programme\TomTom HOME 2\TomTomHOMEService.exe
() D:\Programme\Synology\Assistant\UsbClientService.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe
(VMware, Inc.) D:\Programme\VMWarePlayer\vmware-authd.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3070 B611 series\Bin\ScanToPCActivationApp.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Sierra Wireless, Inc.) C:\Program Files (x86)\Sierra Wireless Inc\WebUpdater\TRUUpdater.exe
(Sierra Wireless Inc.) C:\Program Files (x86)\Sierra Wireless Inc\3G Watcher\WaHelper.exe
(APN) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
(Mozilla Corporation) D:\Programme\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [1356240 2013-06-20] (Microsoft Corporation)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1815848 2009-07-20] (Synaptics Incorporated)
HKCU\...\Run: [HP Deskjet 3070 B611 series (NET)] - C:\Program Files\HP\HP Deskjet 3070 B611 series\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [TRUUpdater] - C:\Program Files (x86)\Sierra Wireless Inc\WebUpdater\TRUUpdater.exe [558360 2009-06-26] (Sierra Wireless, Inc.)
HKLM-x32\...\Run: [WatcherHelper] - C:\Program Files (x86)\Sierra Wireless Inc\3G Watcher\WaHelper.exe [62744 2009-04-07] (Sierra Wireless Inc.)
HKLM-x32\...\Run: [ApnTBMon] - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1558480 2013-07-26] (APN)
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/search?q={searchTerms}&utf8in=1&fr=ietb
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GbR)
BHO-x32: Avira SearchFree Toolbar plus Web Protection - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Programme\Java\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Programme\Java\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - PDF Architect Toolbar - {25A3A431-30BB-47C8-AD6A-E1063801134F} - C:\Program Files (x86)\PDF Architect\PDFIEPlugin.dll (pdfforge GbR)
Toolbar: HKLM-x32 - Avira SearchFree Toolbar plus Web Protection - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
DPF: HKLM-x32 {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: HKLM-x32 {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} hxxp://www.fotokasten.de/javaapplet/ImageUploader5.cab
Handler: ipp - No CLSID Value -
Handler: msdaipp - No CLSID Value -
Handler-x32: ipp - No CLSID Value -
Handler-x32: msdaipp - No CLSID Value -
Tcpip\..\Interfaces\{CB83EE71-F22D-4466-8F04-EE9EACCB2BA3}: [NameServer]192.168.20.1
FireFox:
========
FF ProfilePath: C:\Users\Waxweazle2001\AppData\Roaming\Mozilla\Firefox\Profiles\pj0junss.default
FF user.js: detected! => C:\Users\Waxweazle2001\AppData\Roaming\Mozilla\Firefox\Profiles\pj0junss.default\user.js
FF Homepage: about:home
FF NetworkProxy: "http", "91.143.60.172"
FF NetworkProxy: "http_port", 8080
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @java.com/DTPlugin,version=10.21.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.)
FF Plugin-x32: @divx.com/DivX Plus Web Player Plug-In,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - D:\Programme\Java\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.7 - D:\Programme\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: No Name - C:\Users\Waxweazle2001\AppData\Roaming\Mozilla\Extensions\home2@tomtom.com
FF Extension: Flashlight - C:\Users\Waxweazle2001\AppData\Roaming\Mozilla\Firefox\Profiles\pj0junss.default\Extensions\flashlight@stephennolan.com.au
FF Extension: DownloadHelper - C:\Users\Waxweazle2001\AppData\Roaming\Mozilla\Firefox\Profiles\pj0junss.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF Extension: toolbar_AVIRA-V7 - C:\Users\Waxweazle2001\AppData\Roaming\Mozilla\Firefox\Profiles\pj0junss.default\Extensions\toolbar_AVIRA-V7@apn.ask.com.xpi
FF Extension: No Name - C:\Users\Waxweazle2001\AppData\Roaming\Mozilla\Firefox\Profiles\pj0junss.default\Extensions\{76C80A11-FAD4-406c-8246-F5ED4F9367B5}.xpi
FF Extension: No Name - C:\Users\Waxweazle2001\AppData\Roaming\Mozilla\Firefox\Profiles\pj0junss.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF StartMenuInternet: FIREFOX.EXE - D:\Programme\Mozilla Firefox\firefox.exe
==================== Services (Whitelisted) =================
R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [168400 2013-07-26] (APN LLC.)
S2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2013-06-20] (Microsoft Corporation)
S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [366600 2013-06-20] (Microsoft Corporation)
R2 O2Flash; C:\Windows\SysWOW64\o2flash.exe [65536 2007-02-12] (O2Micro International)
R2 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [167424 2012-12-07] ()
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1324104 2013-01-09] (pdfforge GbR)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [795208 2013-01-09] (pdfforge GbR)
S2 SystemStoreService; C:\Program Files (x86)\SoftwareUpdater\SystemStore.exe [278016 2013-07-08] ()
R2 TomTomHOMEService; D:\Programme\TomTom HOME 2\TomTomHOMEService.exe [93072 2013-03-22] (TomTom)
R2 UsbClientService; D:\Programme\Synology\Assistant\UsbClientService.exe [248704 2013-04-30] ()
R2 VMAuthdService; D:\Programme\VMWarePlayer\vmware-authd.exe [79872 2012-11-01] (VMware, Inc.)
==================== Drivers (Whitelisted) ====================
R3 FUJ02E3; C:\Windows\System32\DRIVERS\FUJ02E3.sys [7296 2006-11-01] (FUJITSU LIMITED)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [247216 2013-06-18] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [139616 2013-06-18] (Microsoft Corporation)
R3 O2MDRDR; C:\Windows\System32\DRIVERS\o2mdx64.sys [58400 2009-05-13] (O2Micro )
R3 O2SCBUS; C:\Windows\System32\DRIVERS\ozscrx64.sys [107808 2009-05-15] (O2Micro)
R3 SMSCIRDA; C:\Windows\System32\DRIVERS\SMSCir64.sys [37376 2006-10-18] (SMSC)
S3 SWNC8U32; C:\Windows\System32\DRIVERS\swnc8u32.sys [280064 2009-07-22] (Sierra Wireless Inc.)
S3 SWUMX32; C:\Windows\System32\DRIVERS\swumx32.sys [199552 2009-07-22] (Sierra Wireless Inc.)
R2 VMparport; C:\Windows\system32\drivers\VMparport.sys [31384 2012-11-01] (VMware, Inc.)
R0 vsock; C:\Windows\System32\drivers\vsock.sys [70296 2012-10-24] (VMware, Inc.)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 SWUMX20; system32\DRIVERS\swumx20.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-08-18 15:21 - 2013-08-18 15:21 - 00018188 _____ C:\ComboFix.txt
2013-08-18 14:44 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-08-18 14:44 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-08-18 14:44 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-08-18 14:44 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-08-18 14:44 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-08-18 14:44 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-08-18 14:44 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-08-18 14:44 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-08-18 14:43 - 2013-08-18 15:21 - 00000000 ____D C:\Qoobox
2013-08-18 14:43 - 2013-08-18 15:11 - 00000000 ____D C:\Windows\erdnt
2013-08-18 12:10 - 2013-08-18 12:10 - 00000000 ____D C:\ProgramData\AskPartnerNetwork
2013-08-18 12:10 - 2013-08-18 12:10 - 00000000 ____D C:\ProgramData\APN
2013-08-18 12:10 - 2013-08-18 12:10 - 00000000 ____D C:\Program Files (x86)\AskPartnerNetwork
2013-08-18 12:09 - 2013-08-18 14:33 - 00000000 ____D C:\ProgramData\Avira
2013-08-17 18:25 - 2013-08-17 18:30 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-08-17 18:25 - 2013-08-17 18:25 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking
2013-08-17 18:24 - 2013-08-18 14:07 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2013-08-17 17:21 - 2013-08-17 17:21 - 00000000 ____D C:\Users\Waxweazle2001\AppData\Roaming\Malwarebytes
2013-08-17 17:21 - 2013-08-17 17:21 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-17 00:02 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-17 00:02 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-17 00:02 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-17 00:02 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-17 00:02 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-17 00:02 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-17 00:02 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-17 00:02 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-17 00:02 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-17 00:02 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-17 00:02 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-17 00:02 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-17 00:02 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-17 00:02 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-17 00:02 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-17 00:02 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-17 00:02 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-17 00:02 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-17 00:02 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-17 00:02 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-17 00:02 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-17 00:02 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-17 00:02 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-17 00:02 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-17 00:02 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-17 00:02 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-17 00:02 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-17 00:02 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-17 00:02 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-17 00:02 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-17 00:02 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-16 20:54 - 2013-08-16 20:54 - 00000000 ____D C:\Users\WAXWEA~1\AppData\Local\Google
2013-08-16 20:54 - 2013-08-16 20:54 - 00000000 ____D C:\Program Files (x86)\Google
2013-08-16 20:51 - 2013-08-16 23:50 - 00000000 ____D C:\Users\Waxweazle2001\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Xilisoft
2013-08-16 17:33 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-16 17:33 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-16 17:33 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-16 17:33 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-16 17:33 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-16 17:33 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-16 17:33 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-16 17:33 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-16 17:29 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-16 17:29 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-16 17:29 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-16 17:29 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-16 17:29 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-16 17:29 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-16 17:29 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-16 17:29 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-12 10:32 - 2013-08-12 10:32 - 00000000 ____D C:\Users\Waxweazle2001\.android
2013-08-12 10:30 - 2013-08-12 10:30 - 00000060 _____ C:\settings.dat
2013-08-12 10:27 - 2013-08-12 10:35 - 00000000 ____D C:\Users\Waxweazle2001\AppData\Roaming\MyPhoneExplorer
2013-08-12 10:27 - 2013-08-12 10:27 - 00000896 _____ C:\Users\Public\Desktop\MyPhoneExplorer.lnk
2013-08-09 07:48 - 2013-08-09 07:49 - 00000484 __RSH C:\Users\Waxweazle2001\ntuser.pol
2013-08-04 19:40 - 2013-08-04 19:40 - 00000000 ____D C:\ProgramData\Synology
2013-08-04 19:39 - 2013-08-04 19:39 - 00000789 _____ C:\Users\Public\Desktop\Synology Assistant.lnk
2013-07-22 15:25 - 2006-11-01 21:59 - 00007296 _____ (FUJITSU LIMITED) C:\Windows\system32\Drivers\fuj02e3.sys
2013-07-22 15:24 - 2013-07-22 15:24 - 00000000 ____D C:\Program Files (x86)\SMSC
2013-07-22 15:24 - 2006-10-18 15:42 - 00037376 _____ (SMSC) C:\Windows\system32\Drivers\smscir64.sys
2013-07-22 15:23 - 2013-07-22 15:23 - 00000000 ____D C:\dell
2013-07-22 15:21 - 2013-07-22 15:21 - 00000000 ____D C:\Users\Waxweazle2001\AppData\Roaming\InstallShield
2013-07-22 15:21 - 2013-07-22 15:21 - 00000000 ____D C:\Program Files (x86)\O2Micro International LTD
2013-07-22 15:21 - 2006-11-14 12:42 - 00100480 _____ (O2Micro) C:\Windows\SysWOW64\Drivers\OZSCRx64.sys
==================== One Month Modified Files and Folders =======
2013-08-18 15:39 - 2013-08-18 15:39 - 00000000 ____D C:\FRST
2013-08-18 15:21 - 2013-08-18 15:21 - 00018188 _____ C:\ComboFix.txt
2013-08-18 15:21 - 2013-08-18 14:43 - 00000000 ____D C:\Qoobox
2013-08-18 15:21 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2013-08-18 15:18 - 2013-01-20 14:58 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-18 15:11 - 2013-08-18 14:43 - 00000000 ____D C:\Windows\erdnt
2013-08-18 15:10 - 2009-07-14 06:45 - 00015504 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-18 15:10 - 2009-07-14 06:45 - 00015504 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-18 15:07 - 2013-01-10 18:33 - 01795034 _____ C:\Windows\WindowsUpdate.log
2013-08-18 15:03 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2013-08-18 15:02 - 2013-01-20 14:02 - 00000000 ____D C:\ProgramData\VMware
2013-08-18 15:02 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-18 15:02 - 2009-07-14 06:51 - 00042259 _____ C:\Windows\setupact.log
2013-08-18 14:43 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-08-18 14:39 - 2013-02-05 15:59 - 00004124 _____ C:\Windows\System32\Tasks\Software Updater Ui
2013-08-18 14:39 - 2013-02-05 15:58 - 00004130 _____ C:\Windows\System32\Tasks\Software Updater
2013-08-18 14:33 - 2013-08-18 12:09 - 00000000 ____D C:\ProgramData\Avira
2013-08-18 14:07 - 2013-08-17 18:24 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2013-08-18 13:47 - 2013-05-05 10:48 - 00000000 ____D C:\Users\Waxweazle2001\AppData\Roaming\Zeigih
2013-08-18 12:10 - 2013-08-18 12:10 - 00000000 ____D C:\ProgramData\AskPartnerNetwork
2013-08-18 12:10 - 2013-08-18 12:10 - 00000000 ____D C:\ProgramData\APN
2013-08-18 12:10 - 2013-08-18 12:10 - 00000000 ____D C:\Program Files (x86)\AskPartnerNetwork
2013-08-18 11:27 - 2013-01-10 23:17 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-17 18:30 - 2013-08-17 18:25 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-08-17 18:25 - 2013-08-17 18:25 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking
2013-08-17 17:21 - 2013-08-17 17:21 - 00000000 ____D C:\Users\Waxweazle2001\AppData\Roaming\Malwarebytes
2013-08-17 17:21 - 2013-08-17 17:21 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-16 23:58 - 2009-07-14 19:58 - 00657012 _____ C:\Windows\system32\perfh007.dat
2013-08-16 23:58 - 2009-07-14 19:58 - 00131378 _____ C:\Windows\system32\perfc007.dat
2013-08-16 23:58 - 2009-07-14 07:13 - 01528370 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-16 23:55 - 2013-07-18 19:21 - 00000000 ____D C:\Windows\system32\MRT
2013-08-16 23:52 - 2013-01-10 20:44 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-16 23:50 - 2013-08-16 20:51 - 00000000 ____D C:\Users\Waxweazle2001\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Xilisoft
2013-08-16 20:54 - 2013-08-16 20:54 - 00000000 ____D C:\Users\WAXWEA~1\AppData\Local\Google
2013-08-16 20:54 - 2013-08-16 20:54 - 00000000 ____D C:\Program Files (x86)\Google
2013-08-13 19:58 - 2013-01-10 23:38 - 00000000 ____D C:\Users\Waxweazle2001\AppData\Roaming\HpUpdate
2013-08-12 13:27 - 2013-06-18 21:50 - 00000000 ____D C:\Users\Waxweazle2001\AppData\Roaming\vlc
2013-08-12 10:35 - 2013-08-12 10:27 - 00000000 ____D C:\Users\Waxweazle2001\AppData\Roaming\MyPhoneExplorer
2013-08-12 10:32 - 2013-08-12 10:32 - 00000000 ____D C:\Users\Waxweazle2001\.android
2013-08-12 10:32 - 2013-01-10 18:44 - 00000000 ____D C:\Users\Waxweazle2001
2013-08-12 10:30 - 2013-08-12 10:30 - 00000060 _____ C:\settings.dat
2013-08-12 10:27 - 2013-08-12 10:27 - 00000896 _____ C:\Users\Public\Desktop\MyPhoneExplorer.lnk
2013-08-09 07:49 - 2013-08-09 07:48 - 00000484 __RSH C:\Users\Waxweazle2001\ntuser.pol
2013-08-09 07:47 - 2009-07-14 05:20 - 00000000 ___HD C:\Windows\system32\GroupPolicy
2013-08-04 19:40 - 2013-08-04 19:40 - 00000000 ____D C:\ProgramData\Synology
2013-08-04 19:39 - 2013-08-04 19:39 - 00000789 _____ C:\Users\Public\Desktop\Synology Assistant.lnk
2013-07-26 11:55 - 2013-05-16 20:51 - 00000000 ____D C:\Users\Waxweazle2001\AppData\Roaming\dBpoweramp
2013-07-26 11:55 - 2013-05-16 20:42 - 00000000 ____D C:\Users\Waxweazle2001\AppData\Roaming\AccurateRip
2013-07-26 07:13 - 2013-08-17 00:02 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-26 07:13 - 2013-08-17 00:02 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-26 07:13 - 2013-08-17 00:02 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-07-26 07:12 - 2013-08-17 00:02 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-26 07:12 - 2013-08-17 00:02 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-26 07:12 - 2013-08-17 00:02 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-26 07:12 - 2013-08-17 00:02 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-26 07:12 - 2013-08-17 00:02 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-26 07:12 - 2013-08-17 00:02 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-26 07:12 - 2013-08-17 00:02 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-26 07:12 - 2013-08-17 00:02 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-07-26 07:12 - 2013-08-17 00:02 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-07-26 07:12 - 2013-08-17 00:02 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-26 07:12 - 2013-08-17 00:02 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-07-26 05:35 - 2013-08-17 00:02 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-26 05:13 - 2013-08-17 00:02 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-26 05:13 - 2013-08-17 00:02 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-26 05:12 - 2013-08-17 00:02 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-26 05:12 - 2013-08-17 00:02 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-26 05:12 - 2013-08-17 00:02 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-26 05:12 - 2013-08-17 00:02 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-26 05:12 - 2013-08-17 00:02 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-26 05:12 - 2013-08-17 00:02 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-26 05:12 - 2013-08-17 00:02 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-07-26 05:12 - 2013-08-17 00:02 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-07-26 05:12 - 2013-08-17 00:02 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-26 05:11 - 2013-08-17 00:02 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-26 05:11 - 2013-08-17 00:02 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-07-26 04:49 - 2013-08-17 00:02 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-26 04:39 - 2013-08-17 00:02 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-07-26 03:59 - 2013-08-17 00:02 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-07-25 11:25 - 2013-08-16 17:29 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-25 10:57 - 2013-08-16 17:29 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-22 15:24 - 2013-07-22 15:24 - 00000000 ____D C:\Program Files (x86)\SMSC
2013-07-22 15:24 - 2013-05-12 14:04 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-07-22 15:23 - 2013-07-22 15:23 - 00000000 ____D C:\dell
2013-07-22 15:21 - 2013-07-22 15:21 - 00000000 ____D C:\Users\Waxweazle2001\AppData\Roaming\InstallShield
2013-07-22 15:21 - 2013-07-22 15:21 - 00000000 ____D C:\Program Files (x86)\O2Micro International LTD
2013-07-22 15:19 - 2013-02-28 09:29 - 00001912 _____ C:\Windows\epplauncher.mif
2013-07-22 15:19 - 2013-01-10 22:33 - 00000000 ____D C:\Program Files\Microsoft Security Client
2013-07-22 15:19 - 2013-01-10 22:33 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2013-07-22 13:03 - 2013-04-11 22:05 - 00000000 ____D C:\Users\WAXWEA~1\AppData\Local\Htc
2013-07-19 03:58 - 2013-08-16 17:29 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-07-19 03:41 - 2013-08-16 17:29 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
Files to move or delete:
====================
ZeroAccess:
C:\Users\WAXWEA~1\AppData\Local\Google\Desktop\Install\{a7d7ca63-a464-60ab-a9cd-88fda9fa91af}
ZeroAccess:
C:\Program Files (x86)\Google\Desktop\Install\{a7d7ca63-a464-60ab-a9cd-88fda9fa91af}
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-08-12 09:19
==================== End Of Log ============================
--- --- --- --- --- --- Und die Addition-Log:FRST Additions Logfile: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 17-08-2013
Ran by Waxweazle2001 at 2013-08-18 15:40:37
Running from E:\Downloads
Boot Mode: Normal
==========================================================
==================== Installed Programs =======================
7-Zip 9.20 (x64 edition) (Version: 9.20.00.0)
Adobe AIR (x32 Version: 3.5.0.880)
Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.94)
Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03)
Adobe Shockwave Player 12.0 (x32 Version: 12.0.2.122)
Any Video Converter 5 5.0.4 (x32)
Ashampoo Burning Studio 2013 v.11.0.5 (x32 Version: 11.0.5)
Avira SearchFree Toolbar plus Web Protection (x32 Version: 12.2.2.663)
Biet-O-Matic v2.14.12 (x32 Version: 2.14.12)
Cardbus Smartcard Reader Driver (x64) (x32 Version: 1.00)
dBpoweramp [Arrange Audio] Codec (x32 Version: Release 3)
dBpoweramp [Audio Info] Codec (x32 Version: Release 1)
dBpoweramp [Calculate Audio CRC] Codec (x32 Version: Release 1)
dBpoweramp [Channel Split] Codec (x32)
dBpoweramp [ID Tag Update] Codec (x32 Version: Release 3)
dBpoweramp [Length Split] Codec (x32)
dBpoweramp [Multi Encoder] Codec (x32 Version: Release 4)
dBpoweramp [ReplayGain] Codec (x32 Version: Release 2)
dBpoweramp [Tag From Filename] Codec (x32 Version: Release 1)
dBpoweramp AAC Encoder (x32)
dBpoweramp AIFF Codec (x32 Version: Release 11)
dBpoweramp Batch Ripper (x32 Version: Release 1.3)
dBpoweramp CD Writer (x32 Version: Release 3.1)
dBpoweramp CLI Encoder (x32 Version: Release 4)
dBpoweramp Dalet Codec (x32 Version: Release 4)
dBpoweramp DirectShow Decoder (x32 Version: Release 2)
dBpoweramp DSP Effects (x32 Version: Release 7)
dBpoweramp FLAC Codec (x32 Version: Release 14 (FLAC 1.2.1))
dBpoweramp m4a Codec (x32 Version: Release 14)
dBpoweramp m4a Nero AAC Encoder (x32 Version: Release 1)
dBpoweramp m4a Utilities (x32)
dBpoweramp m4b Audio book Encoder (x32)
dBpoweramp Midi Decoder (x32)
dBpoweramp Monkeys Audio Codec (x32 Version: Release 10 (Monkeys v4.06))
dBPowerAMP Mp2 and BwfMp2 codec (x32 Version: Release 6)
dBpoweramp mp3 (Fraunhofer IIS) Codec (x32 Version: Release 2a (v4.0.3))
dBpoweramp Musepack Codec (x32)
dBpoweramp Music Converter (x32 Version: Release 14.2)
dBpoweramp Ogg Vorbis aoTuV Encoder (x32 Version: R5 aoTuV b6.02)
dBpoweramp Ogg Vorbis Codec (x32 Version: Release 21 (Vorbis v1.3.2))
dBpoweramp OptimFROG Codec (x32)
dBpoweramp Shorten Codec (x32)
dBpoweramp Speex Codec (x32)
dBPoweramp tooLame MP2 codec (x32)
dBpoweramp TTA Codec (x32)
dBpoweramp Wave64 Codec (x32)
dBpoweramp WavPack Codec (x32 Version: Release 8 (WavPack v4.60))
dBpoweramp Windows Media Audio 10 Codec (x32 Version: Release 7)
DC-Bass Source 1.3.0 (x32)
DEUTSCHLAND SPIELT GAME CENTER (x32)
DirectVobSub 2.40.4209 (x32 Version: 2.40.4209)
DivX-Setup (x32 Version: 2.6.1.8)
el(R) Graphics Media Accelerator Driver (Version: 8.15.10.1930)
ffdshow v1.1.4399 [2012-03-22] (x32 Version: 1.1.4399.0)
GoldWave v4.26 (x32)
Haali Media Splitter (x32)
HP Deskjet 3070 B611 series - Grundlegende Software für das Gerät (Version: 28.0.1315.0)
HP Update (x32 Version: 5.003.003.001)
HPDiagnosticAlert (x32 Version: 1.00.0000)
HTC BMP USB Driver (x32 Version: 1.0.5375)
HTC Driver Installer (x32 Version: 4.0.1.001)
HTC Sync (x32 Version: 3.3.21)
ICQ 8.0 (build 5981, für aktuellen Benutzer) (HKCU Version: 8.0.5981.0)
In 80 Tagen um die Welt (x32)
IPTInstaller (x32 Version: 4.0.8)
IrfanView (remove only) (x32 Version: 4.35)
IsoBuster 3.1 (x32 Version: 3.1)
Java 7 Update 21 (64-bit) (Version: 7.0.210)
Java 7 Update 25 (x32 Version: 7.0.250)
Java Auto Updater (x32 Version: 2.1.9.5)
JDownloader 0.9 (x32 Version: 0.9)
K-Lite Codec Pack 9.8.0 (Full) (x32 Version: 9.8.0)
Lagarith Lossless Codec (1.3.27) (x32)
LAME v3.99.3 (for Windows) (x32)
Medieval CUE Splitter (x32 Version: 1.2.0)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Office 2000 SR-1 Professional (x32 Version: 9.00.3821)
Microsoft Security Client (Version: 4.3.0215.0)
Microsoft Security Essentials (Version: 4.3.215.0)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Mozilla Firefox 23.0.1 (x86 de) (x32 Version: 23.0.1)
Mozilla Maintenance Service (x32 Version: 23.0.1)
Mozilla Thunderbird 17.0.8 (x86 de) (x32 Version: 17.0.8)
MPEG Suite 2001r2 (x32)
MSXML 4.0 SP3 Parser (KB2758694) (x32 Version: 4.30.2117.0)
MSXML 4.0 SP3 Parser (x32 Version: 4.30.2100.0)
MyPhoneExplorer (x32 Version: 1.8.4)
NAVIGON Fresh 3.4.1 (x32 Version: 3.4.1)
NewsLeecher v5.0 Final (x32)
Notepad++ (x32 Version: 6.3.2)
O2Micro Flash Memory Card Windows Driver (Version: 3.00.0006)
O2Micro Flash Memory Card Windows Driver (x32 Version: 3.00.0006)
Ogg Vorbis CLI (x32)
OpenSource Flash Video Splitter 1.0.0.5 (x32 Version: 1.0.0.5)
OZ711 SCR Driver (x64) (Version: 3.0.1.6D)
OZ711 SCR Driver (x64) (x32 Version: 3.0.1.6D)
Paint.NET v3.5.10 (Version: 3.60.0)
PDF Architect (x32 Version: 1.0.52.8917)
PDFCreator (x32 Version: 1.6.2)
Sierra Wireless 3G Watcher (x32 Version: 5.0.2267.1601)
SMSC Fast Infrared Driver (x32 Version: 1.01.0000)
swMSM (x32 Version: 12.0.0.1)
Synaptics Pointing Device Driver (Version: 13.2.6.1)
Synology Assistant (remove only) (x32)
TomTom HOME (x32 Version: 2.9.5)
TomTom HOME Visual Studio Merge Modules (x32 Version: 1.0.2)
tools-windows (x32 Version: 9.2.2.894247)
TubeBox (x32 Version: 4.3.0.21)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0)
VirtualDJ Home FREE (x32 Version: 7.3)
VLC media player 2.0.7 (x32 Version: 2.0.7)
VMware Player (Version: 5.0.1)
VMware Player (x32 Version: 5.0.1)
Winamp (x32 Version: 5.63 )
Winamp Erkennungs-Plug-in (HKCU Version: 1.0.0.1)
==================== Restore Points =========================
18-08-2013 12:48:42 ComboFix created restore point
==================== Hosts content: ==========================
2009-07-14 04:34 - 2013-08-18 15:03 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
Task: {0C88663F-E6AC-48C3-811C-00CF95930EF3} - System32\Tasks\Software Updater => C:\Program Files (x86)\SoftwareUpdater\SoftwareUpdater.Bootstrapper.exe [2013-07-05] ()
Task: {317DF8BF-F487-45CD-AECB-4F962159DCBD} - System32\Tasks\Microsoft\Microsoft Antimalware\MpIdleTask => C:\Program Files\Microsoft Security Client\MpCmdRun.exe [2013-06-20] (Microsoft Corporation)
Task: {4E2213CC-B222-46CC-A0E6-210590D76889} - System32\Tasks\Software Updater Ui => C:\Program Files (x86)\SoftwareUpdater\SoftwareUpdater.Ui.exe [2013-07-08] ()
Task: {63043F63-D981-4C69-A56C-303A96A69A34} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-23] (Microsoft Corporation)
Task: {BFEE36CB-EC38-453A-A150-A9CFBEEF3D03} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-07-14] (Adobe Systems Incorporated)
Task: {C4BBEE66-27B6-4548-82D2-07ED56C27C18} - System32\Tasks\Launch HTC Sync Loader => D:\Programme\HTC\HTC Sync 3.0\htcUPCTLoader.exe [2012-12-12] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Faulty Device Manager Devices =============
Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (08/18/2013 00:22:44 PM) (Source: Customer Experience Improvement Program) (User: )
Description: 80004005
Error: (08/17/2013 06:34:07 PM) (Source: Application Hang) (User: )
Description: Programm SDFiles.exe, Version 2.1.18.135 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: e94
Startzeit: 01ce9b66d02d8677
Endzeit: 16
Anwendungspfad: C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFiles.exe
Berichts-ID: d33a4b30-075a-11e3-a92b-005056c00008
Error: (08/17/2013 06:25:39 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: SDTray.exe, Version: 2.1.21.129, Zeitstempel: 0x51f0ed9e
Name des fehlerhaften Moduls: rasadhlp.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x4a5bdad6
Ausnahmecode: 0xc0000005
Fehleroffset: 0x730011b0
ID des fehlerhaften Prozesses: 0x164
Startzeit der fehlerhaften Anwendung: 0xSDTray.exe0
Pfad der fehlerhaften Anwendung: SDTray.exe1
Pfad des fehlerhaften Moduls: SDTray.exe2
Berichtskennung: SDTray.exe3
Error: (08/16/2013 11:51:57 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".
Details:
AddWin32ServiceFiles: Unable to back up image of service Windows Defender since QueryServiceConfig API failed
System Error:
Das System kann die angegebene Datei nicht finden.
.
Error: (08/16/2013 08:56:08 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".
Details:
AddWin32ServiceFiles: Unable to back up image of service Windows Defender since QueryServiceConfig API failed
System Error:
Das System kann die angegebene Datei nicht finden.
.
Error: (08/16/2013 08:55:54 PM) (Source: VSS) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.
Vorgang:
Generatordaten werden gesammelt
Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {4cbf2dbd-f868-4eca-b28e-daa9a62bcd74}
Error: (08/16/2013 06:23:31 PM) (Source: Customer Experience Improvement Program) (User: )
Description: 80004005
Error: (08/13/2013 09:12:11 PM) (Source: Customer Experience Improvement Program) (User: )
Description: 90080108
Error: (08/13/2013 08:28:21 PM) (Source: Customer Experience Improvement Program) (User: )
Description: 80004005
Error: (08/13/2013 07:58:03 PM) (Source: MsiInstaller) (User: Wax2001)
Description: Produkt: HP Update -- Auf Ihrem System wurde eine neuere Version von HP Update gefunden. Setup wird beendet.
System errors:
=============
Error: (08/18/2013 03:02:57 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "WinDefend" wurde mit folgendem Fehler beendet:
%%5
Error: (08/18/2013 03:02:33 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Microsoft Antimalware Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%5
Error: (08/18/2013 03:01:17 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
Error: (08/18/2013 02:57:14 PM) (Source: Application Popup) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\ComboFix\catchme.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
Error: (08/18/2013 02:54:18 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
Error: (08/18/2013 02:48:41 PM) (Source: Service Control Manager) (User: )
Description: Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden des Dienstes "Windows-Verwaltungsinstrumentation" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen, ist fehlgeschlagen. Fehler:
%%1056
Error: (08/18/2013 02:45:40 PM) (Source: Service Control Manager) (User: )
Description: Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden des Dienstes "Windows-Verwaltungsinstrumentation" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen, ist fehlgeschlagen. Fehler:
%%1056
Error: (08/18/2013 02:45:40 PM) (Source: Service Control Manager) (User: )
Description: Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden des Dienstes "Multimediaklassenplaner" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen, ist fehlgeschlagen. Fehler:
%%1056
Error: (08/18/2013 02:44:40 PM) (Source: Service Control Manager) (User: )
Description: Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden des Dienstes "Anwendungserfahrung" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen, ist fehlgeschlagen. Fehler:
%%1056
Error: (08/18/2013 02:43:41 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows-Verwaltungsinstrumentation" wurde unerwartet beendet. Dies ist bereits 2 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 300000 Millisekunden durchgeführt: Neustart des Diensts.
Microsoft Office Sessions:
=========================
Error: (08/18/2013 00:22:44 PM) (Source: Customer Experience Improvement Program)(User: )
Description: 80004005
Error: (08/17/2013 06:34:07 PM) (Source: Application Hang)(User: )
Description: SDFiles.exe2.1.18.135e9401ce9b66d02d867716C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFiles.exed33a4b30-075a-11e3-a92b-005056c00008
Error: (08/17/2013 06:25:39 PM) (Source: Application Error)(User: )
Description: SDTray.exe2.1.21.12951f0ed9erasadhlp.dll_unloaded0.0.0.04a5bdad6c0000005730011b016401ce9b6657cd2fdcC:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exerasadhlp.dlla6c79b9a-0759-11e3-a92b-005056c00008
Error: (08/16/2013 11:51:57 PM) (Source: Microsoft-Windows-CAPI2)(User: )
Description:
Details:
AddWin32ServiceFiles: Unable to back up image of service Windows Defender since QueryServiceConfig API failed
System Error:
Das System kann die angegebene Datei nicht finden.
Error: (08/16/2013 08:56:08 PM) (Source: Microsoft-Windows-CAPI2)(User: )
Description:
Details:
AddWin32ServiceFiles: Unable to back up image of service Windows Defender since QueryServiceConfig API failed
System Error:
Das System kann die angegebene Datei nicht finden.
Error: (08/16/2013 08:55:54 PM) (Source: VSS)(User: )
Description: 0x80070005, Zugriff verweigert
Vorgang:
Generatordaten werden gesammelt
Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {4cbf2dbd-f868-4eca-b28e-daa9a62bcd74}
Error: (08/16/2013 06:23:31 PM) (Source: Customer Experience Improvement Program)(User: )
Description: 80004005
Error: (08/13/2013 09:12:11 PM) (Source: Customer Experience Improvement Program)(User: )
Description: 90080108
Error: (08/13/2013 08:28:21 PM) (Source: Customer Experience Improvement Program)(User: )
Description: 80004005
Error: (08/13/2013 07:58:03 PM) (Source: MsiInstaller)(User: Wax2001)
Description: Produkt: HP Update -- Auf Ihrem System wurde eine neuere Version von HP Update gefunden. Setup wird beendet.(NULL)(NULL)(NULL)(NULL)(NULL)
CodeIntegrity Errors:
===================================
Date: 2013-08-18 14:57:14.643
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume4\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-08-18 14:57:14.538
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume4\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Percentage of memory in use: 59%
Total physical RAM: 2038.3 MB
Available physical RAM: 831.35 MB
Total Pagefile: 4076.6 MB
Available Pagefile: 2750.03 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:33.57 GB) (Free:7.7 GB) NTFS
Drive d: () (Fixed) (Total:58.59 GB) (Free:22.62 GB) NTFS
Drive e: () (Fixed) (Total:19.53 GB) (Free:16.53 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 112 GB) (Disk ID: C5FBC5FB)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=59 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=20 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=34 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Und GMER habe ich auch mal durchlaufen lassen: GMER Logfile: Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-08-18 15:52:39
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-4 ST9120822AS rev.3.ALB 111,79GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\WAXWEA~1\AppData\Local\Temp\fxddqpob.sys
---- User code sections - GMER 2.1 ----
.text D:\Programme\Synology\Assistant\UsbClientService.exe[2268] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076f61465 2 bytes [F6, 76]
.text D:\Programme\Synology\Assistant\UsbClientService.exe[2268] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076f614bb 2 bytes [F6, 76]
.text ... * 2
.text D:\Programme\VMWarePlayer\vmware-authd.exe[2536] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076f61465 2 bytes [F6, 76]
.text D:\Programme\VMWarePlayer\vmware-authd.exe[2536] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076f614bb 2 bytes [F6, 76]
.text ... * 2
.text C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe[3036] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076f61465 2 bytes [F6, 76]
.text C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe[3036] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076f614bb 2 bytes [F6, 76]
.text ... * 2
---- Threads - GMER 2.1 ----
Thread C:\Windows\system32\svchost.exe [1252:2792] 000007fef29b2888
Thread C:\Windows\system32\svchost.exe [1252:2760] 000007fef29b2a40
Thread C:\Windows\System32\spoolsv.exe [1324:1916] 000007fef89110c8
Thread C:\Windows\System32\spoolsv.exe [1324:1920] 000007fef88d6144
Thread C:\Windows\System32\spoolsv.exe [1324:1924] 000007fef9025fd0
Thread C:\Windows\System32\spoolsv.exe [1324:1928] 000007fef88b3438
Thread C:\Windows\System32\spoolsv.exe [1324:1932] 000007fef90263ec
Thread C:\Windows\System32\spoolsv.exe [1324:1940] 000007fef8be5e5c
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\00037ac74d67
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\00037ac74d67 (not active ControlSet)
---- EOF - GMER 2.1 ----
|
|
18.08.2013, 16:54
| #4 | |
| /// the machine /// TB-Ausbilder | Sicherheitscenterdienst ist verschwunden Combofix löschen. Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!Downloade dir bitte Combofix vom folgenden Downloadspiegel Link 1 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
18.08.2013, 17:37
| #5 |
| | Sicherheitscenterdienst ist verschwunden Hallo nochmal, hier nochmal meine combofix: Code:
ATTFilter ComboFix 13-08-18.01 - Waxweazle2001 18.08.2013 18:08:20.2.2 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1252.49.1031.18.2038.632 [GMT 2:00]
ausgeführt von:: c:\users\Waxweazle2001\Desktop\ComboFix.exe
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-07-18 bis 2013-08-18 ))))))))))))))))))))))))))))))
.
.
2013-08-18 16:17 . 2013-08-18 16:17 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-08-18 13:39 . 2013-08-18 13:39 -------- d-----w- C:\FRST
2013-08-18 10:10 . 2013-08-18 10:10 -------- d-----w- c:\programdata\AskPartnerNetwork
2013-08-18 10:10 . 2013-08-18 10:10 -------- d-----w- c:\program files (x86)\AskPartnerNetwork
2013-08-18 10:10 . 2013-08-18 10:10 -------- d-----w- c:\programdata\APN
2013-08-18 10:09 . 2013-08-18 12:33 -------- d-----w- c:\programdata\Avira
2013-08-17 16:25 . 2013-08-17 16:30 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2013-08-17 16:24 . 2013-08-18 12:07 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy 2
2013-08-17 15:21 . 2013-08-17 15:21 -------- d-----w- c:\users\Waxweazle2001\AppData\Roaming\Malwarebytes
2013-08-17 15:21 . 2013-08-17 15:21 -------- d-----w- c:\programdata\Malwarebytes
2013-08-16 18:55 . 2013-08-16 18:55 76232 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{5EC98090-E9F8-405F-86CC-306EF39A5D57}\offreg.dll
2013-08-16 18:54 . 2013-08-16 18:54 -------- d-----w- c:\program files (x86)\Google
2013-08-16 18:54 . 2013-08-16 18:54 -------- d-----w- c:\users\Waxweazle2001\AppData\Local\Google
2013-08-16 15:37 . 2013-07-02 08:34 9460976 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{5EC98090-E9F8-405F-86CC-306EF39A5D57}\mpengine.dll
2013-08-16 15:33 . 2013-07-09 05:46 1472512 ----a-w- c:\windows\system32\crypt32.dll
2013-08-16 15:33 . 2013-07-09 04:46 1166848 ----a-w- c:\windows\SysWow64\crypt32.dll
2013-08-16 15:33 . 2013-07-09 05:52 224256 ----a-w- c:\windows\system32\wintrust.dll
2013-08-16 15:33 . 2013-07-09 04:52 175104 ----a-w- c:\windows\SysWow64\wintrust.dll
2013-08-16 15:33 . 2013-07-09 04:46 140288 ----a-w- c:\windows\SysWow64\cryptsvc.dll
2013-08-16 15:33 . 2013-07-09 05:46 184320 ----a-w- c:\windows\system32\cryptsvc.dll
2013-08-16 15:33 . 2013-07-09 05:46 139776 ----a-w- c:\windows\system32\cryptnet.dll
2013-08-16 15:33 . 2013-07-09 04:46 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll
2013-08-16 15:29 . 2013-07-19 01:58 2048 ----a-w- c:\windows\system32\tzres.dll
2013-08-16 15:29 . 2013-07-19 01:41 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2013-08-16 15:29 . 2013-07-25 09:25 1888768 ----a-w- c:\windows\system32\WMVDECOD.DLL
2013-08-16 15:29 . 2013-07-25 08:57 1620992 ----a-w- c:\windows\SysWow64\WMVDECOD.DLL
2013-08-16 15:29 . 2013-07-09 05:51 1217024 ----a-w- c:\windows\system32\rpcrt4.dll
2013-08-16 15:29 . 2013-07-09 04:52 663552 ----a-w- c:\windows\SysWow64\rpcrt4.dll
2013-08-16 15:29 . 2013-06-15 04:32 39936 ----a-w- c:\windows\system32\drivers\tssecsrv.sys
2013-08-16 15:29 . 2013-07-06 06:03 1910208 ----a-w- c:\windows\system32\drivers\tcpip.sys
2013-08-13 08:31 . 2013-07-02 08:34 9460976 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-08-12 08:32 . 2013-08-12 08:32 -------- d-----w- c:\users\Waxweazle2001\.android
2013-08-12 08:27 . 2013-08-12 08:35 -------- d-----w- c:\users\Waxweazle2001\AppData\Roaming\MyPhoneExplorer
2013-08-04 17:40 . 2013-08-04 17:40 -------- d-----w- c:\programdata\Synology
2013-07-22 13:25 . 2013-07-22 13:25 -------- d-----w- C:\Drivers
2013-07-22 13:25 . 2006-11-01 19:59 7296 ----a-w- c:\windows\system32\drivers\fuj02e3.sys
2013-07-22 13:24 . 2013-07-22 13:24 -------- d-----w- c:\program files (x86)\SMSC
2013-07-22 13:24 . 2006-10-18 13:42 37376 ----a-w- c:\windows\system32\drivers\smscir64.sys
2013-07-22 13:23 . 2013-07-22 13:23 -------- d-----w- C:\dell
2013-07-22 13:21 . 2013-07-22 13:21 -------- d-----w- c:\program files (x86)\O2Micro International LTD
2013-07-22 13:21 . 2006-11-14 10:42 100480 ----a-w- c:\windows\SysWow64\drivers\OZSCRx64.sys
2013-07-22 13:21 . 2013-07-22 13:21 -------- d-----w- c:\users\Waxweazle2001\AppData\Roaming\InstallShield
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-08-16 21:52 . 2013-01-10 18:44 78161360 ----a-w- c:\windows\system32\MRT.exe
2013-07-17 08:06 . 2013-07-17 08:07 941720 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C5FE211F-AFF3-4F98-A1D9-3F8CA8207D0B}\gapaengine.dll
2013-07-14 09:35 . 2013-01-20 12:58 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-07-14 09:35 . 2013-01-20 12:45 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-06-22 12:15 . 2013-03-12 20:17 964552 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2013-06-21 13:10 . 2013-06-21 13:11 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-06-21 13:10 . 2013-01-10 21:19 789416 ----a-w- c:\windows\SysWow64\deployJava1.dll
2013-06-21 13:10 . 2013-01-10 21:19 867240 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
2013-06-18 19:50 . 2013-06-18 19:50 247216 ----a-w- c:\windows\system32\drivers\MpFilter.sys
2013-06-18 19:50 . 2012-08-30 21:03 139616 ----a-w- c:\windows\system32\drivers\NisDrvWFP.sys
2013-06-12 16:57 . 2013-06-12 16:58 971680 ----a-w- c:\windows\system32\deployJava1.dll
2013-06-12 16:57 . 2013-06-12 16:58 1092512 ----a-w- c:\windows\system32\npDeployJava1.dll
2013-06-05 03:34 . 2013-07-11 15:40 3153920 ----a-w- c:\windows\system32\win32k.sys
2013-06-04 06:00 . 2013-07-11 15:40 624128 ----a-w- c:\windows\system32\qedit.dll
2013-06-04 04:53 . 2013-07-11 15:40 509440 ----a-w- c:\windows\SysWow64\qedit.dll
2013-05-26 16:37 . 2013-05-26 16:37 715038 ----a-w- c:\windows\unins000.exe
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{41564952-412D-5637-00A7-7A786E7484D7}]
2013-07-26 20:30 12240 ----a-w- c:\program files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{41564952-412D-5637-00A7-7A786E7484D7}"= "c:\program files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll" [2013-07-26 12240]
.
[HKEY_CLASSES_ROOT\clsid\{41564952-412d-5637-00a7-7a786e7484d7}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HP Deskjet 3070 B611 series (NET)"="c:\program files\HP\HP Deskjet 3070 B611 series\Bin\ScanToPCActivationApp.exe" [2012-10-17 2573416]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2011-10-28 49208]
"TRUUpdater"="c:\program files (x86)\Sierra Wireless Inc\WebUpdater\TRUUpdater.exe" [2009-06-26 558360]
"WatcherHelper"="c:\program files (x86)\Sierra Wireless Inc\3G Watcher\WaHelper.exe" [2009-04-07 62744]
"ApnTBMon"="c:\program files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe" [2013-07-26 1558480]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean64.exe
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SystemStoreService;System Store;c:\program files (x86)\SoftwareUpdater\SystemStore.exe -displayname System Store -servicename SystemStoreService;c:\program files (x86)\SoftwareUpdater\SystemStore.exe -displayname System Store -servicename SystemStoreService [x]
R3 HTCAND64;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys;c:\windows\SYSNATIVE\Drivers\ANDROIDUSB.sys [x]
R3 htcnprot;HTC NDIS Protocol Driver;c:\windows\system32\DRIVERS\htcnprot.sys;c:\windows\SYSNATIVE\DRIVERS\htcnprot.sys [x]
R3 NisSrv;NisSrv;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 SWNC8U32;Sierra Wireless MUX NDIS Driver (UMTS32);c:\windows\system32\DRIVERS\swnc8u32.sys;c:\windows\SYSNATIVE\DRIVERS\swnc8u32.sys [x]
R3 SWUMX32;Sierra Wireless USB MUX Driver (UMTS32);c:\windows\system32\DRIVERS\swumx32.sys;c:\windows\SYSNATIVE\DRIVERS\swumx32.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
S0 vmci;VMware VMCI Bus Driver;c:\windows\system32\DRIVERS\vmci.sys;c:\windows\SYSNATIVE\DRIVERS\vmci.sys [x]
S0 vsock;vSockets Driver;c:\windows\system32\drivers\vsock.sys;c:\windows\SYSNATIVE\drivers\vsock.sys [x]
S2 APNMCP;Ask Aktualisierungsdienst;c:\program files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe;c:\program files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [x]
S2 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
S2 PassThru Service;Internet Pass-Through Service;c:\program files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe;c:\program files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [x]
S2 PDF Architect Helper Service;PDF Architect Helper Service;c:\program files (x86)\PDF Architect\HelperService.exe;c:\program files (x86)\PDF Architect\HelperService.exe [x]
S2 PDF Architect Service;PDF Architect Service;c:\program files (x86)\PDF Architect\ConversionService.exe;c:\program files (x86)\PDF Architect\ConversionService.exe [x]
S2 TomTomHOMEService;TomTomHOMEService;d:\programme\TomTom HOME 2\TomTomHOMEService.exe;d:\programme\TomTom HOME 2\TomTomHOMEService.exe [x]
S2 UsbClientService;UsbClientService;d:\programme\Synology\Assistant\UsbClientService.exe;d:\programme\Synology\Assistant\UsbClientService.exe [x]
S2 VMUSBArbService;VMware USB Arbitration Service;c:\program files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe;c:\program files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe [x]
S3 busenum;Synology Virtual USB Hub;c:\windows\system32\DRIVERS\busenum.sys;c:\windows\SYSNATIVE\DRIVERS\busenum.sys [x]
S3 FUJ02E3;Fujitsu FUJ02E3 Device Driver;c:\windows\system32\DRIVERS\FUJ02E3.sys;c:\windows\SYSNATIVE\DRIVERS\FUJ02E3.sys [x]
S3 O2MDRDR;O2MDRDR;c:\windows\system32\DRIVERS\o2mdx64.sys;c:\windows\SYSNATIVE\DRIVERS\o2mdx64.sys [x]
S3 O2SDRDR;O2SDRDR;c:\windows\system32\DRIVERS\o2sdx64.sys;c:\windows\SYSNATIVE\DRIVERS\o2sdx64.sys [x]
S3 SMSCIRDA;SMSC Infrared Device Driver;c:\windows\system32\DRIVERS\SMSCir64.sys;c:\windows\SYSNATIVE\DRIVERS\SMSCir64.sys [x]
S3 yukonw7;NDIS6.2-Miniporttreiber für Marvell Yukon-Ethernet-Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - FXDDQPOB
*Deregistered* - fxddqpob
.
Inhalt des "geplante Tasks" Ordners
.
2013-08-18 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-01-20 09:35]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-23 165912]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-23 385560]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-23 363544]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-06-20 1356240]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: Interfaces\{CB83EE71-F22D-4466-8F04-EE9EACCB2BA3}: NameServer = 192.168.20.1
FF - ProfilePath - c:\users\Waxweazle2001\AppData\Roaming\Mozilla\Firefox\Profiles\pj0junss.default\
FF - prefs.js: browser.startup.homepage - about:home
FF - prefs.js: network.proxy.http - 91.143.60.172
FF - prefs.js: network.proxy.http_port - 8080
FF - prefs.js: network.proxy.type - 0
FF - ExtSQL: 2013-07-26 22:31; toolbar_AVIRA-V7@apn.ask.com; c:\users\Waxweazle2001\AppData\Roaming\Mozilla\Firefox\Profiles\pj0junss.default\extensions\toolbar_AVIRA-V7@apn.ask.com.xpi
FF - user.js: extensions.autoDisableScopes - 10
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
AddRemove-dBpoweramp AAC Encoder - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp AIFF Codec - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp Batch Ripper - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp CD Writer - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp CLI Encoder - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp Dalet Codec - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp DirectShow Decoder - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp DSP Effects - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp FLAC Codec - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp m4a Codec - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp m4a Nero AAC Encoder - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp m4a Utilities - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp m4b Audio book Encoder - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp Midi Decoder - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp Monkeys Audio Codec - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBPowerAMP Mp2 and BwfMp2 codec - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp mp3 (Fraunhofer IIS) Codec - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp Musepack Codec - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp Music Converter - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp Ogg Vorbis aoTuV Encoder - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp Ogg Vorbis Codec - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp OptimFROG Codec - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp Shorten Codec - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp Speex Codec - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBPoweramp tooLame MP2 codec - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp TTA Codec - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp Wave64 Codec - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp WavPack Codec - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp Windows Media Audio 10 Codec - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp [Arrange Audio] Codec - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp [Audio Info] Codec - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp [Calculate Audio CRC] Codec - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp [Channel Split] Codec - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp [ID Tag Update] Codec - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp [Length Split] Codec - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp [Multi Encoder] Codec - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp [ReplayGain] Codec - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp [Tag From Filename] Codec - c:\windows\system32\SpoonUninstall.exe
AddRemove-MPEG Suite 2001r2 - c:\windows\system32\SpoonUninstall.exe
AddRemove-Ogg Vorbis CLI - c:\windows\system32\SpoonUninstall.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-08-18 18:35:17
ComboFix-quarantined-files.txt 2013-08-18 16:35
ComboFix2.txt 2013-08-18 13:21
.
Vor Suchlauf: 8.232.153.088 Bytes frei
Nach Suchlauf: 8.175.173.632 Bytes frei
.
- - End Of File - - 0754A965F416B649DCBFCBCA147E31B3
A36C5E4F47E84449FF07ED3517B43A31
Geändert von Waxweazle200 (18.08.2013 um 17:43 Uhr) |
|
19.08.2013, 07:25
| #6 |
| /// the machine /// TB-Ausbilder | Sicherheitscenterdienst ist verschwunden Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ --> Sicherheitscenterdienst ist verschwunden |
|
19.08.2013, 18:50
| #7 |
| | Sicherheitscenterdienst ist verschwunden Hallo Schrauber, hier nochmal die angeforderten Scans: adwcleaner vor dem Fixen: Code:
ATTFilter # AdwCleaner v2.306 - Datei am 19/08/2013 um 19:27:40 erstellt
# Aktualisiert am 19/07/2013 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzer : Waxweazle2001 - WAX2001
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Waxweazle2001\Desktop\adwcleaner.exe
# Option [Suche]
**** [Dienste] ****
Gefunden : APNMCP
Gefunden : SystemStoreService
***** [Dateien / Ordner] *****
Ordner Gefunden : C:\Program Files (x86)\AskPartnerNetwork
Ordner Gefunden : C:\Program Files (x86)\optimizer pro
Ordner Gefunden : C:\Program Files (x86)\SoftwareUpdater
Ordner Gefunden : C:\ProgramData\APN
Ordner Gefunden : C:\ProgramData\AskPartnerNetwork
Ordner Gefunden : C:\ProgramData\boost_interprocess
Ordner Gefunden : C:\Users\WAXWEA~1\AppData\Local\Temp\APN
Ordner Gefunden : C:\Users\Waxweazle2001\AppData\Local\DownloadGuide
Ordner Gefunden : C:\Users\Waxweazle2001\AppData\LocalLow\boost_interprocess
Ordner Gefunden : C:\Users\Waxweazle2001\AppData\Roaming\pdfforge
***** [Registrierungsdatenbank] *****
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\PriceGong
Schlüssel Gefunden : HKCU\Software\AskPartnerNetwork
Schlüssel Gefunden : HKCU\Software\InstallCore
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Schlüssel Gefunden : HKCU\Software\Softonic
Schlüssel Gefunden : HKLM\Software\AskPartnerNetwork
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3BF72F68-72D8-461D-A884-329D936C5581}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{78E9D883-93CD-4072-BEF3-38EE581E2839}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{83AC1413-FCE4-4A46-9DD5-4F31F306E71F}
Wert Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnTbMon]
Wert Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{25A3A431-30BB-47C8-AD6A-E1063801134F}]
***** [Internet Browser] *****
-\\ Internet Explorer v10.0.9200.16660
[OK] Die Registrierungsdatenbank ist sauber.
-\\ Mozilla Firefox v23.0.1 (de)
Datei : C:\Users\Waxweazle2001\AppData\Roaming\Mozilla\Firefox\Profiles\pj0junss.default\prefs.js
Gefunden : user_pref("extensions.AVIRA-V7.com.avira.dnt.rules", "\"{\\\"Version\\\":38,\\\"Companies\\\":[{\\\"[...]
Gefunden : user_pref("extensions.AVIRA-V7.domain", "\"avira.search.ask.com\"");
Gefunden : user_pref("extensions.enabledAddons", "FFPDFArchitectConverter%40pdfarchitect.com:1.0,%7B23fcfd51-49[...]
Gefunden : user_pref("extensions.toolbar_AVIRA-V7@apn.ask.com.install-event-fired", true);
*************************
AdwCleaner[R1].txt - [2879 octets] - [19/08/2013 19:27:40]
########## EOF - C:\AdwCleaner[R1].txt - [2939 octets] ##########
Code:
ATTFilter # AdwCleaner v2.306 - Datei am 19/08/2013 um 19:28:34 erstellt
# Aktualisiert am 19/07/2013 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzer : Waxweazle2001 - WAX2001
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Waxweazle2001\Desktop\adwcleaner.exe
# Option [Löschen]
**** [Dienste] ****
Gestoppt & Gelöscht : APNMCP
Gestoppt & Gelöscht : SystemStoreService
***** [Dateien / Ordner] *****
Ordner Gelöscht : C:\Program Files (x86)\AskPartnerNetwork
Ordner Gelöscht : C:\Program Files (x86)\optimizer pro
Ordner Gelöscht : C:\Program Files (x86)\SoftwareUpdater
Ordner Gelöscht : C:\ProgramData\APN
Ordner Gelöscht : C:\ProgramData\AskPartnerNetwork
Ordner Gelöscht : C:\ProgramData\boost_interprocess
Ordner Gelöscht : C:\Users\WAXWEA~1\AppData\Local\Temp\APN
Ordner Gelöscht : C:\Users\Waxweazle2001\AppData\Local\DownloadGuide
Ordner Gelöscht : C:\Users\Waxweazle2001\AppData\LocalLow\boost_interprocess
Ordner Gelöscht : C:\Users\Waxweazle2001\AppData\Roaming\pdfforge
***** [Registrierungsdatenbank] *****
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\PriceGong
Schlüssel Gelöscht : HKCU\Software\AskPartnerNetwork
Schlüssel Gelöscht : HKCU\Software\InstallCore
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKLM\Software\AskPartnerNetwork
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3BF72F68-72D8-461D-A884-329D936C5581}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{78E9D883-93CD-4072-BEF3-38EE581E2839}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{83AC1413-FCE4-4A46-9DD5-4F31F306E71F}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnTbMon]
Wert Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{25A3A431-30BB-47C8-AD6A-E1063801134F}]
***** [Internet Browser] *****
-\\ Internet Explorer v10.0.9200.16660
[OK] Die Registrierungsdatenbank ist sauber.
-\\ Mozilla Firefox v23.0.1 (de)
Datei : C:\Users\Waxweazle2001\AppData\Roaming\Mozilla\Firefox\Profiles\pj0junss.default\prefs.js
C:\Users\Waxweazle2001\AppData\Roaming\Mozilla\Firefox\Profiles\pj0junss.default\user.js ... Gelöscht !
Gelöscht : user_pref("extensions.AVIRA-V7.com.avira.dnt.rules", "\"{\\\"Version\\\":38,\\\"Companies\\\":[{\\\"[...]
Gelöscht : user_pref("extensions.AVIRA-V7.domain", "\"avira.search.ask.com\"");
Gelöscht : user_pref("extensions.enabledAddons", "FFPDFArchitectConverter%40pdfarchitect.com:1.0,%7B23fcfd51-49[...]
Gelöscht : user_pref("extensions.toolbar_AVIRA-V7@apn.ask.com.install-event-fired", true);
*************************
AdwCleaner[R1].txt - [3008 octets] - [19/08/2013 19:27:40]
AdwCleaner[S1].txt - [3070 octets] - [19/08/2013 19:28:34]
########## EOF - C:\AdwCleaner[S1].txt - [3130 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.5.0 (08.18.2013:1)
OS: Windows 7 Professional x64
Ran by Waxweazle2001 on 19.08.2013 at 19:35:16,70
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\SoftonicDownloader_fuer_wettercenter_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\SoftonicDownloader_fuer_wettercenter_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\SoftonicDownloader_fuer_wettercenter_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\SoftonicDownloader_fuer_wettercenter_RASMANCS
Successfully deleted: [Registry Key] "hkey_current_user\software\askpartnernetwork"
~~~ Files
~~~ Folders
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 19.08.2013 at 19:41:41,21
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 19-08-2013
Ran by Waxweazle2001 (administrator) on 19-08-2013 19:46:11
Running from C:\Users\Waxweazle2001\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(O2Micro International) C:\Windows\SysWOW64\o2flash.exe
() C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\ConversionService.exe
(TomTom) D:\Programme\TomTom HOME 2\TomTomHOMEService.exe
() D:\Programme\Synology\Assistant\UsbClientService.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe
(VMware, Inc.) D:\Programme\VMWarePlayer\vmware-authd.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3070 B611 series\Bin\ScanToPCActivationApp.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Sierra Wireless, Inc.) C:\Program Files (x86)\Sierra Wireless Inc\WebUpdater\TRUUpdater.exe
(Sierra Wireless Inc.) C:\Program Files (x86)\Sierra Wireless Inc\3G Watcher\WaHelper.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [1356240 2013-06-20] (Microsoft Corporation)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1815848 2009-07-20] (Synaptics Incorporated)
HKCU\...\Run: [HP Deskjet 3070 B611 series (NET)] - C:\Program Files\HP\HP Deskjet 3070 B611 series\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [TRUUpdater] - C:\Program Files (x86)\Sierra Wireless Inc\WebUpdater\TRUUpdater.exe [558360 2009-06-26] (Sierra Wireless, Inc.)
HKLM-x32\...\Run: [WatcherHelper] - C:\Program Files (x86)\Sierra Wireless Inc\3G Watcher\WaHelper.exe [62744 2009-04-07] (Sierra Wireless Inc.)
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/search?q={searchTerms}&utf8in=1&fr=ietb
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GbR)
BHO-x32: Avira SearchFree Toolbar plus Web Protection - {41564952-412D-5637-00A7-7A786E7484D7} - "C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll" No File
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Programme\Java\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Programme\Java\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - Avira SearchFree Toolbar plus Web Protection - {41564952-412D-5637-00A7-7A786E7484D7} - "C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll" No File
DPF: HKLM-x32 {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: HKLM-x32 {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} hxxp://www.fotokasten.de/javaapplet/ImageUploader5.cab
Handler: ipp - No CLSID Value -
Handler: msdaipp - No CLSID Value -
Handler-x32: ipp - No CLSID Value -
Handler-x32: msdaipp - No CLSID Value -
Tcpip\..\Interfaces\{CB83EE71-F22D-4466-8F04-EE9EACCB2BA3}: [NameServer]192.168.20.1
FireFox:
========
FF ProfilePath: C:\Users\Waxweazle2001\AppData\Roaming\Mozilla\Firefox\Profiles\pj0junss.default
FF Homepage: about:home
FF NetworkProxy: "http", "91.143.60.172"
FF NetworkProxy: "http_port", 8080
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @java.com/DTPlugin,version=10.21.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.)
FF Plugin-x32: @divx.com/DivX Plus Web Player Plug-In,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - D:\Programme\Java\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.7 - D:\Programme\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: No Name - C:\Users\Waxweazle2001\AppData\Roaming\Mozilla\Extensions\home2@tomtom.com
FF Extension: Flashlight - C:\Users\Waxweazle2001\AppData\Roaming\Mozilla\Firefox\Profiles\pj0junss.default\Extensions\flashlight@stephennolan.com.au
FF Extension: DownloadHelper - C:\Users\Waxweazle2001\AppData\Roaming\Mozilla\Firefox\Profiles\pj0junss.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF Extension: toolbar_AVIRA-V7 - C:\Users\Waxweazle2001\AppData\Roaming\Mozilla\Firefox\Profiles\pj0junss.default\Extensions\toolbar_AVIRA-V7@apn.ask.com.xpi
FF Extension: No Name - C:\Users\Waxweazle2001\AppData\Roaming\Mozilla\Firefox\Profiles\pj0junss.default\Extensions\{76C80A11-FAD4-406c-8246-F5ED4F9367B5}.xpi
FF Extension: No Name - C:\Users\Waxweazle2001\AppData\Roaming\Mozilla\Firefox\Profiles\pj0junss.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF StartMenuInternet: FIREFOX.EXE - D:\Programme\Mozilla Firefox\firefox.exe
==================== Services (Whitelisted) =================
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2013-06-20] (Microsoft Corporation)
S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [366600 2013-06-20] (Microsoft Corporation)
R2 O2Flash; C:\Windows\SysWOW64\o2flash.exe [65536 2007-02-12] (O2Micro International)
R2 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [167424 2012-12-07] ()
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1324104 2013-01-09] (pdfforge GbR)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [795208 2013-01-09] (pdfforge GbR)
R2 TomTomHOMEService; D:\Programme\TomTom HOME 2\TomTomHOMEService.exe [93072 2013-03-22] (TomTom)
R2 UsbClientService; D:\Programme\Synology\Assistant\UsbClientService.exe [248704 2013-04-30] ()
R2 VMAuthdService; D:\Programme\VMWarePlayer\vmware-authd.exe [79872 2012-11-01] (VMware, Inc.)
==================== Drivers (Whitelisted) ====================
R3 FUJ02E3; C:\Windows\System32\DRIVERS\FUJ02E3.sys [7296 2006-11-01] (FUJITSU LIMITED)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [247216 2013-06-18] (Microsoft Corporation)
S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [139616 2013-06-18] (Microsoft Corporation)
R3 O2MDRDR; C:\Windows\System32\DRIVERS\o2mdx64.sys [58400 2009-05-13] (O2Micro )
R3 O2SCBUS; C:\Windows\System32\DRIVERS\ozscrx64.sys [107808 2009-05-15] (O2Micro)
R3 SMSCIRDA; C:\Windows\System32\DRIVERS\SMSCir64.sys [37376 2006-10-18] (SMSC)
S3 SWNC8U32; C:\Windows\System32\DRIVERS\swnc8u32.sys [280064 2009-07-22] (Sierra Wireless Inc.)
S3 SWUMX32; C:\Windows\System32\DRIVERS\swumx32.sys [199552 2009-07-22] (Sierra Wireless Inc.)
R2 VMparport; C:\Windows\system32\drivers\VMparport.sys [31384 2012-11-01] (VMware, Inc.)
R0 vsock; C:\Windows\System32\drivers\vsock.sys [70296 2012-10-24] (VMware, Inc.)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 SWUMX20; system32\DRIVERS\swumx20.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-08-19 19:41 - 2013-08-19 19:41 - 00001264 _____ C:\Users\Waxweazle2001\Desktop\JRT.txt
2013-08-19 19:35 - 2013-08-19 19:35 - 00000000 ____D C:\Windows\ERUNT
2013-08-19 19:33 - 2013-08-19 19:33 - 00000996 _____ C:\Users\Waxweazle2001\Desktop\AdwCleaner[S2].txt
2013-08-19 19:31 - 2013-08-19 19:31 - 00003199 _____ C:\Users\Waxweazle2001\Desktop\AdwCleaner[S1].txt
2013-08-19 19:31 - 2013-08-19 19:31 - 00000996 _____ C:\AdwCleaner[S2].txt
2013-08-19 19:28 - 2013-08-19 19:28 - 00003199 _____ C:\AdwCleaner[S1].txt
2013-08-19 19:28 - 2013-08-19 19:28 - 00003008 _____ C:\Users\Waxweazle2001\Desktop\AdwCleaner[R1].txt
2013-08-19 19:27 - 2013-08-19 19:27 - 00003008 _____ C:\AdwCleaner[R1].txt
2013-08-19 19:26 - 2013-08-19 19:27 - 01018305 _____ (Thisisu) C:\Users\Waxweazle2001\Desktop\JRT.exe
2013-08-19 19:22 - 2013-08-19 19:22 - 00666633 _____ C:\Users\Waxweazle2001\Desktop\adwcleaner.exe
2013-08-18 18:39 - 2013-08-18 18:39 - 00000546 _____ C:\Windows\PFRO.log
2013-08-18 18:35 - 2013-08-18 18:35 - 00017431 _____ C:\ComboFix.txt
2013-08-18 15:39 - 2013-08-18 15:39 - 00000000 ____D C:\FRST
2013-08-18 14:44 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-08-18 14:44 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-08-18 14:44 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-08-18 14:44 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-08-18 14:44 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-08-18 14:44 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-08-18 14:44 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-08-18 14:44 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-08-18 14:43 - 2013-08-18 18:36 - 00000000 ____D C:\Qoobox
2013-08-18 14:43 - 2013-08-18 15:11 - 00000000 ____D C:\Windows\erdnt
2013-08-18 12:09 - 2013-08-18 14:33 - 00000000 ____D C:\ProgramData\Avira
2013-08-17 18:25 - 2013-08-17 18:30 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-08-17 18:25 - 2013-08-17 18:25 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking
2013-08-17 18:24 - 2013-08-18 14:07 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2013-08-17 17:21 - 2013-08-17 17:21 - 00000000 ____D C:\Users\Waxweazle2001\AppData\Roaming\Malwarebytes
2013-08-17 17:21 - 2013-08-17 17:21 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-17 00:02 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-17 00:02 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-17 00:02 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-17 00:02 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-17 00:02 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-17 00:02 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-17 00:02 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-17 00:02 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-17 00:02 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-17 00:02 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-17 00:02 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-17 00:02 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-17 00:02 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-17 00:02 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-17 00:02 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-17 00:02 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-17 00:02 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-17 00:02 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-17 00:02 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-17 00:02 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-17 00:02 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-17 00:02 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-17 00:02 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-17 00:02 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-17 00:02 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-17 00:02 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-17 00:02 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-17 00:02 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-17 00:02 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-17 00:02 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-17 00:02 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-16 20:54 - 2013-08-16 20:54 - 00000000 ____D C:\Users\WAXWEA~1\AppData\Local\Google
2013-08-16 20:54 - 2013-08-16 20:54 - 00000000 ____D C:\Program Files (x86)\Google
2013-08-16 20:51 - 2013-08-16 23:50 - 00000000 ____D C:\Users\Waxweazle2001\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Xilisoft
2013-08-16 17:33 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-16 17:33 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-16 17:33 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-16 17:33 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-16 17:33 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-16 17:33 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-16 17:33 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-16 17:33 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-16 17:29 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-16 17:29 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-16 17:29 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-16 17:29 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-16 17:29 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-16 17:29 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-16 17:29 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-16 17:29 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-12 10:32 - 2013-08-12 10:32 - 00000000 ____D C:\Users\Waxweazle2001\.android
2013-08-12 10:30 - 2013-08-12 10:30 - 00000060 _____ C:\settings.dat
2013-08-12 10:27 - 2013-08-12 10:35 - 00000000 ____D C:\Users\Waxweazle2001\AppData\Roaming\MyPhoneExplorer
2013-08-12 10:27 - 2013-08-12 10:27 - 00000896 _____ C:\Users\Public\Desktop\MyPhoneExplorer.lnk
2013-08-09 07:48 - 2013-08-09 07:49 - 00000484 __RSH C:\Users\Waxweazle2001\ntuser.pol
2013-08-04 19:40 - 2013-08-04 19:40 - 00000000 ____D C:\ProgramData\Synology
2013-08-04 19:39 - 2013-08-04 19:39 - 00000789 _____ C:\Users\Public\Desktop\Synology Assistant.lnk
2013-07-22 15:25 - 2006-11-01 21:59 - 00007296 _____ (FUJITSU LIMITED) C:\Windows\system32\Drivers\fuj02e3.sys
2013-07-22 15:24 - 2013-07-22 15:24 - 00000000 ____D C:\Program Files (x86)\SMSC
2013-07-22 15:24 - 2006-10-18 15:42 - 00037376 _____ (SMSC) C:\Windows\system32\Drivers\smscir64.sys
2013-07-22 15:23 - 2013-07-22 15:23 - 00000000 ____D C:\dell
2013-07-22 15:21 - 2013-07-22 15:21 - 00000000 ____D C:\Users\Waxweazle2001\AppData\Roaming\InstallShield
2013-07-22 15:21 - 2013-07-22 15:21 - 00000000 ____D C:\Program Files (x86)\O2Micro International LTD
2013-07-22 15:21 - 2006-11-14 12:42 - 00100480 _____ (O2Micro) C:\Windows\SysWOW64\Drivers\OZSCRx64.sys
==================== One Month Modified Files and Folders =======
2013-08-19 19:43 - 2013-08-19 19:43 - 01575812 _____ (Farbar) C:\Users\Waxweazle2001\Desktop\FRST64.exe
2013-08-19 19:41 - 2013-08-19 19:41 - 00001264 _____ C:\Users\Waxweazle2001\Desktop\JRT.txt
2013-08-19 19:40 - 2009-07-14 06:45 - 00015504 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-19 19:40 - 2009-07-14 06:45 - 00015504 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-19 19:36 - 2013-01-10 18:33 - 01893529 _____ C:\Windows\WindowsUpdate.log
2013-08-19 19:35 - 2013-08-19 19:35 - 00000000 ____D C:\Windows\ERUNT
2013-08-19 19:33 - 2013-08-19 19:33 - 00000996 _____ C:\Users\Waxweazle2001\Desktop\AdwCleaner[S2].txt
2013-08-19 19:33 - 2013-01-20 14:02 - 00000000 ____D C:\ProgramData\VMware
2013-08-19 19:33 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-19 19:33 - 2009-07-14 06:51 - 00042483 _____ C:\Windows\setupact.log
2013-08-19 19:31 - 2013-08-19 19:31 - 00003199 _____ C:\Users\Waxweazle2001\Desktop\AdwCleaner[S1].txt
2013-08-19 19:31 - 2013-08-19 19:31 - 00000996 _____ C:\AdwCleaner[S2].txt
2013-08-19 19:28 - 2013-08-19 19:28 - 00003199 _____ C:\AdwCleaner[S1].txt
2013-08-19 19:28 - 2013-08-19 19:28 - 00003008 _____ C:\Users\Waxweazle2001\Desktop\AdwCleaner[R1].txt
2013-08-19 19:27 - 2013-08-19 19:27 - 00003008 _____ C:\AdwCleaner[R1].txt
2013-08-19 19:27 - 2013-08-19 19:26 - 01018305 _____ (Thisisu) C:\Users\Waxweazle2001\Desktop\JRT.exe
2013-08-19 19:22 - 2013-08-19 19:22 - 00666633 _____ C:\Users\Waxweazle2001\Desktop\adwcleaner.exe
2013-08-19 19:19 - 2013-02-05 15:59 - 00004124 _____ C:\Windows\System32\Tasks\Software Updater Ui
2013-08-19 19:19 - 2013-02-05 15:58 - 00004130 _____ C:\Windows\System32\Tasks\Software Updater
2013-08-19 19:18 - 2013-01-20 14:58 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-18 18:45 - 2009-07-14 19:58 - 00657084 _____ C:\Windows\system32\perfh007.dat
2013-08-18 18:45 - 2009-07-14 19:58 - 00131450 _____ C:\Windows\system32\perfc007.dat
2013-08-18 18:45 - 2009-07-14 07:13 - 01506670 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-18 18:39 - 2013-08-18 18:39 - 00000546 _____ C:\Windows\PFRO.log
2013-08-18 18:36 - 2013-08-18 14:43 - 00000000 ____D C:\Qoobox
2013-08-18 18:35 - 2013-08-18 18:35 - 00017431 _____ C:\ComboFix.txt
2013-08-18 18:18 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2013-08-18 18:05 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-08-18 15:39 - 2013-08-18 15:39 - 00000000 ____D C:\FRST
2013-08-18 15:21 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2013-08-18 15:11 - 2013-08-18 14:43 - 00000000 ____D C:\Windows\erdnt
2013-08-18 14:33 - 2013-08-18 12:09 - 00000000 ____D C:\ProgramData\Avira
2013-08-18 14:07 - 2013-08-17 18:24 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2013-08-18 13:47 - 2013-05-05 10:48 - 00000000 ____D C:\Users\Waxweazle2001\AppData\Roaming\Zeigih
2013-08-18 11:27 - 2013-01-10 23:17 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-17 18:30 - 2013-08-17 18:25 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-08-17 18:25 - 2013-08-17 18:25 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking
2013-08-17 17:21 - 2013-08-17 17:21 - 00000000 ____D C:\Users\Waxweazle2001\AppData\Roaming\Malwarebytes
2013-08-17 17:21 - 2013-08-17 17:21 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-16 23:55 - 2013-07-18 19:21 - 00000000 ____D C:\Windows\system32\MRT
2013-08-16 23:52 - 2013-01-10 20:44 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-16 23:50 - 2013-08-16 20:51 - 00000000 ____D C:\Users\Waxweazle2001\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Xilisoft
2013-08-16 20:54 - 2013-08-16 20:54 - 00000000 ____D C:\Users\WAXWEA~1\AppData\Local\Google
2013-08-16 20:54 - 2013-08-16 20:54 - 00000000 ____D C:\Program Files (x86)\Google
2013-08-13 19:58 - 2013-01-10 23:38 - 00000000 ____D C:\Users\Waxweazle2001\AppData\Roaming\HpUpdate
2013-08-12 13:27 - 2013-06-18 21:50 - 00000000 ____D C:\Users\Waxweazle2001\AppData\Roaming\vlc
2013-08-12 10:35 - 2013-08-12 10:27 - 00000000 ____D C:\Users\Waxweazle2001\AppData\Roaming\MyPhoneExplorer
2013-08-12 10:32 - 2013-08-12 10:32 - 00000000 ____D C:\Users\Waxweazle2001\.android
2013-08-12 10:32 - 2013-01-10 18:44 - 00000000 ____D C:\Users\Waxweazle2001
2013-08-12 10:30 - 2013-08-12 10:30 - 00000060 _____ C:\settings.dat
2013-08-12 10:27 - 2013-08-12 10:27 - 00000896 _____ C:\Users\Public\Desktop\MyPhoneExplorer.lnk
2013-08-09 07:49 - 2013-08-09 07:48 - 00000484 __RSH C:\Users\Waxweazle2001\ntuser.pol
2013-08-09 07:47 - 2009-07-14 05:20 - 00000000 ___HD C:\Windows\system32\GroupPolicy
2013-08-04 19:40 - 2013-08-04 19:40 - 00000000 ____D C:\ProgramData\Synology
2013-08-04 19:39 - 2013-08-04 19:39 - 00000789 _____ C:\Users\Public\Desktop\Synology Assistant.lnk
2013-07-26 11:55 - 2013-05-16 20:51 - 00000000 ____D C:\Users\Waxweazle2001\AppData\Roaming\dBpoweramp
2013-07-26 11:55 - 2013-05-16 20:42 - 00000000 ____D C:\Users\Waxweazle2001\AppData\Roaming\AccurateRip
2013-07-26 07:13 - 2013-08-17 00:02 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-26 07:13 - 2013-08-17 00:02 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-26 07:13 - 2013-08-17 00:02 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-07-26 07:12 - 2013-08-17 00:02 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-26 07:12 - 2013-08-17 00:02 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-26 07:12 - 2013-08-17 00:02 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-26 07:12 - 2013-08-17 00:02 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-26 07:12 - 2013-08-17 00:02 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-26 07:12 - 2013-08-17 00:02 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-26 07:12 - 2013-08-17 00:02 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-26 07:12 - 2013-08-17 00:02 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-07-26 07:12 - 2013-08-17 00:02 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-07-26 07:12 - 2013-08-17 00:02 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-26 07:12 - 2013-08-17 00:02 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-07-26 05:35 - 2013-08-17 00:02 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-26 05:13 - 2013-08-17 00:02 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-26 05:13 - 2013-08-17 00:02 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-26 05:12 - 2013-08-17 00:02 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-26 05:12 - 2013-08-17 00:02 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-26 05:12 - 2013-08-17 00:02 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-26 05:12 - 2013-08-17 00:02 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-26 05:12 - 2013-08-17 00:02 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-26 05:12 - 2013-08-17 00:02 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-26 05:12 - 2013-08-17 00:02 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-07-26 05:12 - 2013-08-17 00:02 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-07-26 05:12 - 2013-08-17 00:02 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-26 05:11 - 2013-08-17 00:02 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-26 05:11 - 2013-08-17 00:02 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-07-26 04:49 - 2013-08-17 00:02 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-26 04:39 - 2013-08-17 00:02 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-07-26 03:59 - 2013-08-17 00:02 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-07-25 11:25 - 2013-08-16 17:29 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-25 10:57 - 2013-08-16 17:29 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-22 15:24 - 2013-07-22 15:24 - 00000000 ____D C:\Program Files (x86)\SMSC
2013-07-22 15:24 - 2013-05-12 14:04 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-07-22 15:23 - 2013-07-22 15:23 - 00000000 ____D C:\dell
2013-07-22 15:21 - 2013-07-22 15:21 - 00000000 ____D C:\Users\Waxweazle2001\AppData\Roaming\InstallShield
2013-07-22 15:21 - 2013-07-22 15:21 - 00000000 ____D C:\Program Files (x86)\O2Micro International LTD
2013-07-22 15:19 - 2013-02-28 09:29 - 00001912 _____ C:\Windows\epplauncher.mif
2013-07-22 15:19 - 2013-01-10 22:33 - 00000000 ____D C:\Program Files\Microsoft Security Client
2013-07-22 15:19 - 2013-01-10 22:33 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2013-07-22 13:03 - 2013-04-11 22:05 - 00000000 ____D C:\Users\WAXWEA~1\AppData\Local\Htc
Files to move or delete:
====================
ZeroAccess:
C:\Users\WAXWEA~1\AppData\Local\Google\Desktop\Install\{a7d7ca63-a464-60ab-a9cd-88fda9fa91af}
ZeroAccess:
C:\Program Files (x86)\Google\Desktop\Install\{a7d7ca63-a464-60ab-a9cd-88fda9fa91af}
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-08-12 09:19
==================== End Of Log ============================
Und die Addition-Log: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 19-08-2013
Ran by Waxweazle2001 at 2013-08-19 19:46:32
Running from C:\Users\Waxweazle2001\Desktop
Boot Mode: Normal
==========================================================
==================== Installed Programs =======================
7-Zip 9.20 (x64 edition) (Version: 9.20.00.0)
Adobe AIR (x32 Version: 3.5.0.880)
Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.94)
Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03)
Adobe Shockwave Player 12.0 (x32 Version: 12.0.2.122)
Any Video Converter 5 5.0.4 (x32)
Ashampoo Burning Studio 2013 v.11.0.5 (x32 Version: 11.0.5)
Avira SearchFree Toolbar plus Web Protection (x32 Version: 12.2.2.663)
Biet-O-Matic v2.14.12 (x32 Version: 2.14.12)
Cardbus Smartcard Reader Driver (x64) (x32 Version: 1.00)
dBpoweramp [Arrange Audio] Codec (x32 Version: Release 3)
dBpoweramp [Audio Info] Codec (x32 Version: Release 1)
dBpoweramp [Calculate Audio CRC] Codec (x32 Version: Release 1)
dBpoweramp [Channel Split] Codec (x32)
dBpoweramp [ID Tag Update] Codec (x32 Version: Release 3)
dBpoweramp [Length Split] Codec (x32)
dBpoweramp [Multi Encoder] Codec (x32 Version: Release 4)
dBpoweramp [ReplayGain] Codec (x32 Version: Release 2)
dBpoweramp [Tag From Filename] Codec (x32 Version: Release 1)
dBpoweramp AAC Encoder (x32)
dBpoweramp AIFF Codec (x32 Version: Release 11)
dBpoweramp Batch Ripper (x32 Version: Release 1.3)
dBpoweramp CD Writer (x32 Version: Release 3.1)
dBpoweramp CLI Encoder (x32 Version: Release 4)
dBpoweramp Dalet Codec (x32 Version: Release 4)
dBpoweramp DirectShow Decoder (x32 Version: Release 2)
dBpoweramp DSP Effects (x32 Version: Release 7)
dBpoweramp FLAC Codec (x32 Version: Release 14 (FLAC 1.2.1))
dBpoweramp m4a Codec (x32 Version: Release 14)
dBpoweramp m4a Nero AAC Encoder (x32 Version: Release 1)
dBpoweramp m4a Utilities (x32)
dBpoweramp m4b Audio book Encoder (x32)
dBpoweramp Midi Decoder (x32)
dBpoweramp Monkeys Audio Codec (x32 Version: Release 10 (Monkeys v4.06))
dBPowerAMP Mp2 and BwfMp2 codec (x32 Version: Release 6)
dBpoweramp mp3 (Fraunhofer IIS) Codec (x32 Version: Release 2a (v4.0.3))
dBpoweramp Musepack Codec (x32)
dBpoweramp Music Converter (x32 Version: Release 14.2)
dBpoweramp Ogg Vorbis aoTuV Encoder (x32 Version: R5 aoTuV b6.02)
dBpoweramp Ogg Vorbis Codec (x32 Version: Release 21 (Vorbis v1.3.2))
dBpoweramp OptimFROG Codec (x32)
dBpoweramp Shorten Codec (x32)
dBpoweramp Speex Codec (x32)
dBPoweramp tooLame MP2 codec (x32)
dBpoweramp TTA Codec (x32)
dBpoweramp Wave64 Codec (x32)
dBpoweramp WavPack Codec (x32 Version: Release 8 (WavPack v4.60))
dBpoweramp Windows Media Audio 10 Codec (x32 Version: Release 7)
DC-Bass Source 1.3.0 (x32)
DEUTSCHLAND SPIELT GAME CENTER (x32)
DirectVobSub 2.40.4209 (x32 Version: 2.40.4209)
DivX-Setup (x32 Version: 2.6.1.8)
el(R) Graphics Media Accelerator Driver (Version: 8.15.10.1930)
ffdshow v1.1.4399 [2012-03-22] (x32 Version: 1.1.4399.0)
GoldWave v4.26 (x32)
Haali Media Splitter (x32)
HP Deskjet 3070 B611 series - Grundlegende Software für das Gerät (Version: 28.0.1315.0)
HP Update (x32 Version: 5.003.003.001)
HPDiagnosticAlert (x32 Version: 1.00.0000)
HTC BMP USB Driver (x32 Version: 1.0.5375)
HTC Driver Installer (x32 Version: 4.0.1.001)
HTC Sync (x32 Version: 3.3.21)
ICQ 8.0 (build 5981, für aktuellen Benutzer) (HKCU Version: 8.0.5981.0)
In 80 Tagen um die Welt (x32)
IPTInstaller (x32 Version: 4.0.8)
IrfanView (remove only) (x32 Version: 4.35)
IsoBuster 3.1 (x32 Version: 3.1)
Java 7 Update 21 (64-bit) (Version: 7.0.210)
Java 7 Update 25 (x32 Version: 7.0.250)
Java Auto Updater (x32 Version: 2.1.9.5)
JDownloader 0.9 (x32 Version: 0.9)
K-Lite Codec Pack 9.8.0 (Full) (x32 Version: 9.8.0)
Lagarith Lossless Codec (1.3.27) (x32)
LAME v3.99.3 (for Windows) (x32)
Medieval CUE Splitter (x32 Version: 1.2.0)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Office 2000 SR-1 Professional (x32 Version: 9.00.3821)
Microsoft Security Client (Version: 4.3.0215.0)
Microsoft Security Essentials (Version: 4.3.215.0)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Mozilla Firefox 23.0.1 (x86 de) (x32 Version: 23.0.1)
Mozilla Maintenance Service (x32 Version: 23.0.1)
Mozilla Thunderbird 17.0.8 (x86 de) (x32 Version: 17.0.8)
MPEG Suite 2001r2 (x32)
MSXML 4.0 SP3 Parser (KB2758694) (x32 Version: 4.30.2117.0)
MSXML 4.0 SP3 Parser (x32 Version: 4.30.2100.0)
MyPhoneExplorer (x32 Version: 1.8.4)
NAVIGON Fresh 3.4.1 (x32 Version: 3.4.1)
NewsLeecher v5.0 Final (x32)
Notepad++ (x32 Version: 6.3.2)
O2Micro Flash Memory Card Windows Driver (Version: 3.00.0006)
O2Micro Flash Memory Card Windows Driver (x32 Version: 3.00.0006)
Ogg Vorbis CLI (x32)
OpenSource Flash Video Splitter 1.0.0.5 (x32 Version: 1.0.0.5)
OZ711 SCR Driver (x64) (Version: 3.0.1.6D)
OZ711 SCR Driver (x64) (x32 Version: 3.0.1.6D)
Paint.NET v3.5.10 (Version: 3.60.0)
PDF Architect (x32 Version: 1.0.52.8917)
PDFCreator (x32 Version: 1.6.2)
Sierra Wireless 3G Watcher (x32 Version: 5.0.2267.1601)
SMSC Fast Infrared Driver (x32 Version: 1.01.0000)
swMSM (x32 Version: 12.0.0.1)
Synaptics Pointing Device Driver (Version: 13.2.6.1)
Synology Assistant (remove only) (x32)
TomTom HOME (x32 Version: 2.9.5)
TomTom HOME Visual Studio Merge Modules (x32 Version: 1.0.2)
tools-windows (x32 Version: 9.2.2.894247)
TubeBox (x32 Version: 4.3.0.21)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0)
VirtualDJ Home FREE (x32 Version: 7.3)
VLC media player 2.0.7 (x32 Version: 2.0.7)
VMware Player (Version: 5.0.1)
VMware Player (x32 Version: 5.0.1)
Winamp (x32 Version: 5.63 )
Winamp Erkennungs-Plug-in (HKCU Version: 1.0.0.1)
==================== Restore Points =========================
==================== Hosts content: ==========================
2009-07-14 04:34 - 2013-08-18 15:03 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
Task: {0C88663F-E6AC-48C3-811C-00CF95930EF3} - System32\Tasks\Software Updater => C:\Program Files (x86)\SoftwareUpdater\SoftwareUpdater.Bootstrapper.exe No File
Task: {4E2213CC-B222-46CC-A0E6-210590D76889} - System32\Tasks\Software Updater Ui => C:\Program Files (x86)\SoftwareUpdater\SoftwareUpdater.Ui.exe No File
Task: {63043F63-D981-4C69-A56C-303A96A69A34} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-23] (Microsoft Corporation)
Task: {6C277558-6783-4CCE-8700-C3BB2CA92D9B} - System32\Tasks\Microsoft\Microsoft Antimalware\MpIdleTask => C:\Program Files\Microsoft Security Client\MpCmdRun.exe [2013-06-20] (Microsoft Corporation)
Task: {BFEE36CB-EC38-453A-A150-A9CFBEEF3D03} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-07-14] (Adobe Systems Incorporated)
Task: {C4BBEE66-27B6-4548-82D2-07ED56C27C18} - System32\Tasks\Launch HTC Sync Loader => D:\Programme\HTC\HTC Sync 3.0\htcUPCTLoader.exe [2012-12-12] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Faulty Device Manager Devices =============
Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
==================== Event log errors: =========================
Application errors:
==================
System errors:
=============
Microsoft Office Sessions:
=========================
CodeIntegrity Errors:
===================================
Date: 2013-08-18 14:57:14.643
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume4\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-08-18 14:57:14.538
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume4\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Percentage of memory in use: 41%
Total physical RAM: 2038.3 MB
Available physical RAM: 1200.44 MB
Total Pagefile: 4076.6 MB
Available Pagefile: 3048.06 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:33.57 GB) (Free:8.44 GB) NTFS
Drive d: () (Fixed) (Total:58.59 GB) (Free:22.62 GB) NTFS
Drive e: () (Fixed) (Total:19.53 GB) (Free:16.54 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 112 GB) (Disk ID: C5FBC5FB)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=59 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=20 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=34 GB) - (Type=07 NTFS)
==================== End Of Log ============================
|
|
20.08.2013, 11:51
| #8 |
| /// the machine /// TB-Ausbilder | Sicherheitscenterdienst ist verschwundenESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
20.08.2013, 11:51
| #9 |
| /// the machine /// TB-Ausbilder | Sicherheitscenterdienst ist verschwundenESET Online Scanner
Downloade Dir bitte SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
20.08.2013, 17:27
| #10 |
| | Sicherheitscenterdienst ist verschwunden Hallo Schrauber, Das ESET-log ist mir abhanden gekommen aber der Scan hatte nix gefunden. Hier der Security-Check-Log: Code:
ATTFilter Results of screen317's Security Check version 0.99.72
Windows 7 Service Pack 1 x64 (UAC is disabled!)
Internet Explorer 10
``````````````Antivirus/Firewall Check:``````````````
Microsoft Security Essentials
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
Java 7 Update 25
Adobe Flash Player 11.8.800.94
Adobe Reader XI
Mozilla Firefox (23.0.1)
Mozilla Thunderbird (17.0.8)
````````Process Check: objlist.exe by Laurent````````
Microsoft Security Essentials MSMpEng.exe
Microsoft Security Essentials msseces.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 19-08-2013
Ran by Waxweazle2001 (administrator) on 20-08-2013 18:25:23
Running from C:\Users\Waxweazle2001\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(O2Micro International) C:\Windows\SysWOW64\o2flash.exe
() C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\ConversionService.exe
(TomTom) D:\Programme\TomTom HOME 2\TomTomHOMEService.exe
() D:\Programme\Synology\Assistant\UsbClientService.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe
(VMware, Inc.) D:\Programme\VMWarePlayer\vmware-authd.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3070 B611 series\Bin\ScanToPCActivationApp.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Sierra Wireless, Inc.) C:\Program Files (x86)\Sierra Wireless Inc\WebUpdater\TRUUpdater.exe
(Sierra Wireless Inc.) C:\Program Files (x86)\Sierra Wireless Inc\3G Watcher\WaHelper.exe
(Mozilla Corporation) D:\Programme\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [1356240 2013-06-20] (Microsoft Corporation)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1815848 2009-07-20] (Synaptics Incorporated)
HKCU\...\Run: [HP Deskjet 3070 B611 series (NET)] - C:\Program Files\HP\HP Deskjet 3070 B611 series\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [TRUUpdater] - C:\Program Files (x86)\Sierra Wireless Inc\WebUpdater\TRUUpdater.exe [558360 2009-06-26] (Sierra Wireless, Inc.)
HKLM-x32\...\Run: [WatcherHelper] - C:\Program Files (x86)\Sierra Wireless Inc\3G Watcher\WaHelper.exe [62744 2009-04-07] (Sierra Wireless Inc.)
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/search?q={searchTerms}&utf8in=1&fr=ietb
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GbR)
BHO-x32: Avira SearchFree Toolbar plus Web Protection - {41564952-412D-5637-00A7-7A786E7484D7} - "C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll" No File
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Programme\Java\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Programme\Java\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - Avira SearchFree Toolbar plus Web Protection - {41564952-412D-5637-00A7-7A786E7484D7} - "C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll" No File
DPF: HKLM-x32 {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: HKLM-x32 {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} hxxp://www.fotokasten.de/javaapplet/ImageUploader5.cab
Handler: ipp - No CLSID Value -
Handler: msdaipp - No CLSID Value -
Handler-x32: ipp - No CLSID Value -
Handler-x32: msdaipp - No CLSID Value -
Tcpip\..\Interfaces\{CB83EE71-F22D-4466-8F04-EE9EACCB2BA3}: [NameServer]192.168.20.1
FireFox:
========
FF ProfilePath: C:\Users\Waxweazle2001\AppData\Roaming\Mozilla\Firefox\Profiles\pj0junss.default
FF Homepage: about:home
FF NetworkProxy: "http", "91.143.60.172"
FF NetworkProxy: "http_port", 8080
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @java.com/DTPlugin,version=10.21.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.)
FF Plugin-x32: @divx.com/DivX Plus Web Player Plug-In,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - D:\Programme\Java\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.7 - D:\Programme\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: No Name - C:\Users\Waxweazle2001\AppData\Roaming\Mozilla\Extensions\home2@tomtom.com
FF Extension: Flashlight - C:\Users\Waxweazle2001\AppData\Roaming\Mozilla\Firefox\Profiles\pj0junss.default\Extensions\flashlight@stephennolan.com.au
FF Extension: DownloadHelper - C:\Users\Waxweazle2001\AppData\Roaming\Mozilla\Firefox\Profiles\pj0junss.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF Extension: toolbar_AVIRA-V7 - C:\Users\Waxweazle2001\AppData\Roaming\Mozilla\Firefox\Profiles\pj0junss.default\Extensions\toolbar_AVIRA-V7@apn.ask.com.xpi
FF Extension: No Name - C:\Users\Waxweazle2001\AppData\Roaming\Mozilla\Firefox\Profiles\pj0junss.default\Extensions\{76C80A11-FAD4-406c-8246-F5ED4F9367B5}.xpi
FF Extension: No Name - C:\Users\Waxweazle2001\AppData\Roaming\Mozilla\Firefox\Profiles\pj0junss.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF StartMenuInternet: FIREFOX.EXE - D:\Programme\Mozilla Firefox\firefox.exe
==================== Services (Whitelisted) =================
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2013-06-20] (Microsoft Corporation)
S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [366600 2013-06-20] (Microsoft Corporation)
R2 O2Flash; C:\Windows\SysWOW64\o2flash.exe [65536 2007-02-12] (O2Micro International)
R2 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [167424 2012-12-07] ()
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1324104 2013-01-09] (pdfforge GbR)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [795208 2013-01-09] (pdfforge GbR)
R2 TomTomHOMEService; D:\Programme\TomTom HOME 2\TomTomHOMEService.exe [93072 2013-03-22] (TomTom)
R2 UsbClientService; D:\Programme\Synology\Assistant\UsbClientService.exe [248704 2013-04-30] ()
R2 VMAuthdService; D:\Programme\VMWarePlayer\vmware-authd.exe [79872 2012-11-01] (VMware, Inc.)
==================== Drivers (Whitelisted) ====================
R3 FUJ02E3; C:\Windows\System32\DRIVERS\FUJ02E3.sys [7296 2006-11-01] (FUJITSU LIMITED)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [247216 2013-06-18] (Microsoft Corporation)
S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [139616 2013-06-18] (Microsoft Corporation)
R3 O2MDRDR; C:\Windows\System32\DRIVERS\o2mdx64.sys [58400 2009-05-13] (O2Micro )
R3 O2SCBUS; C:\Windows\System32\DRIVERS\ozscrx64.sys [107808 2009-05-15] (O2Micro)
R3 SMSCIRDA; C:\Windows\System32\DRIVERS\SMSCir64.sys [37376 2006-10-18] (SMSC)
S3 SWNC8U32; C:\Windows\System32\DRIVERS\swnc8u32.sys [280064 2009-07-22] (Sierra Wireless Inc.)
S3 SWUMX32; C:\Windows\System32\DRIVERS\swumx32.sys [199552 2009-07-22] (Sierra Wireless Inc.)
R2 VMparport; C:\Windows\system32\drivers\VMparport.sys [31384 2012-11-01] (VMware, Inc.)
R0 vsock; C:\Windows\System32\drivers\vsock.sys [70296 2012-10-24] (VMware, Inc.)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 SWUMX20; system32\DRIVERS\swumx20.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-08-19 19:43 - 2013-08-19 19:43 - 01575812 _____ (Farbar) C:\Users\Waxweazle2001\Desktop\FRST64.exe
2013-08-19 19:35 - 2013-08-19 19:35 - 00000000 ____D C:\Windows\ERUNT
2013-08-19 19:31 - 2013-08-19 19:31 - 00000996 _____ C:\AdwCleaner[S2].txt
2013-08-19 19:28 - 2013-08-19 19:28 - 00003199 _____ C:\AdwCleaner[S1].txt
2013-08-19 19:27 - 2013-08-19 19:27 - 00003008 _____ C:\AdwCleaner[R1].txt
2013-08-19 19:26 - 2013-08-19 19:27 - 01018305 _____ (Thisisu) C:\Users\Waxweazle2001\Desktop\JRT.exe
2013-08-19 19:22 - 2013-08-19 19:22 - 00666633 _____ C:\Users\Waxweazle2001\Desktop\adwcleaner.exe
2013-08-18 18:39 - 2013-08-18 18:39 - 00000546 _____ C:\Windows\PFRO.log
2013-08-18 18:35 - 2013-08-18 18:35 - 00017431 _____ C:\ComboFix.txt
2013-08-18 15:39 - 2013-08-18 15:39 - 00000000 ____D C:\FRST
2013-08-18 14:44 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-08-18 14:44 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-08-18 14:44 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-08-18 14:44 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-08-18 14:44 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-08-18 14:44 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-08-18 14:44 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-08-18 14:44 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-08-18 14:43 - 2013-08-18 18:36 - 00000000 ____D C:\Qoobox
2013-08-18 14:43 - 2013-08-18 15:11 - 00000000 ____D C:\Windows\erdnt
2013-08-18 12:09 - 2013-08-18 14:33 - 00000000 ____D C:\ProgramData\Avira
2013-08-17 18:25 - 2013-08-17 18:30 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-08-17 18:25 - 2013-08-17 18:25 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking
2013-08-17 18:24 - 2013-08-18 14:07 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2013-08-17 17:21 - 2013-08-17 17:21 - 00000000 ____D C:\Users\Waxweazle2001\AppData\Roaming\Malwarebytes
2013-08-17 17:21 - 2013-08-17 17:21 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-17 00:02 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-17 00:02 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-17 00:02 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-17 00:02 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-17 00:02 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-17 00:02 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-17 00:02 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-17 00:02 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-17 00:02 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-17 00:02 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-17 00:02 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-17 00:02 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-17 00:02 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-17 00:02 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-17 00:02 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-17 00:02 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-17 00:02 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-17 00:02 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-17 00:02 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-17 00:02 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-17 00:02 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-17 00:02 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-17 00:02 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-17 00:02 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-17 00:02 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-17 00:02 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-17 00:02 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-17 00:02 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-17 00:02 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-17 00:02 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-17 00:02 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-16 20:54 - 2013-08-16 20:54 - 00000000 ____D C:\Users\WAXWEA~1\AppData\Local\Google
2013-08-16 20:54 - 2013-08-16 20:54 - 00000000 ____D C:\Program Files (x86)\Google
2013-08-16 20:51 - 2013-08-16 23:50 - 00000000 ____D C:\Users\Waxweazle2001\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Xilisoft
2013-08-16 17:33 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-16 17:33 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-16 17:33 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-16 17:33 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-16 17:33 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-16 17:33 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-16 17:33 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-16 17:33 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-16 17:29 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-16 17:29 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-16 17:29 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-16 17:29 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-16 17:29 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-16 17:29 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-16 17:29 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-16 17:29 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-12 10:32 - 2013-08-12 10:32 - 00000000 ____D C:\Users\Waxweazle2001\.android
2013-08-12 10:30 - 2013-08-12 10:30 - 00000060 _____ C:\settings.dat
2013-08-12 10:27 - 2013-08-12 10:35 - 00000000 ____D C:\Users\Waxweazle2001\AppData\Roaming\MyPhoneExplorer
2013-08-12 10:27 - 2013-08-12 10:27 - 00000896 _____ C:\Users\Public\Desktop\MyPhoneExplorer.lnk
2013-08-09 07:48 - 2013-08-09 07:49 - 00000484 __RSH C:\Users\Waxweazle2001\ntuser.pol
2013-08-04 19:40 - 2013-08-04 19:40 - 00000000 ____D C:\ProgramData\Synology
2013-08-04 19:39 - 2013-08-04 19:39 - 00000789 _____ C:\Users\Public\Desktop\Synology Assistant.lnk
2013-07-22 15:25 - 2006-11-01 21:59 - 00007296 _____ (FUJITSU LIMITED) C:\Windows\system32\Drivers\fuj02e3.sys
2013-07-22 15:24 - 2013-07-22 15:24 - 00000000 ____D C:\Program Files (x86)\SMSC
2013-07-22 15:24 - 2006-10-18 15:42 - 00037376 _____ (SMSC) C:\Windows\system32\Drivers\smscir64.sys
2013-07-22 15:23 - 2013-07-22 15:23 - 00000000 ____D C:\dell
2013-07-22 15:21 - 2013-07-22 15:21 - 00000000 ____D C:\Users\Waxweazle2001\AppData\Roaming\InstallShield
2013-07-22 15:21 - 2013-07-22 15:21 - 00000000 ____D C:\Program Files (x86)\O2Micro International LTD
2013-07-22 15:21 - 2006-11-14 12:42 - 00100480 _____ (O2Micro) C:\Windows\SysWOW64\Drivers\OZSCRx64.sys
==================== One Month Modified Files and Folders =======
2013-08-20 18:21 - 2013-08-20 18:21 - 00891115 _____ C:\Users\Waxweazle2001\Desktop\SecurityCheck.exe
2013-08-20 18:18 - 2013-01-20 14:58 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-20 18:14 - 2013-01-10 18:33 - 01911900 _____ C:\Windows\WindowsUpdate.log
2013-08-20 16:47 - 2009-07-14 06:45 - 00015504 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-20 16:47 - 2009-07-14 06:45 - 00015504 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-20 16:40 - 2013-01-20 14:02 - 00000000 ____D C:\ProgramData\VMware
2013-08-20 16:40 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-20 16:40 - 2009-07-14 06:51 - 00042539 _____ C:\Windows\setupact.log
2013-08-19 19:43 - 2013-08-19 19:43 - 01575812 _____ (Farbar) C:\Users\Waxweazle2001\Desktop\FRST64.exe
2013-08-19 19:35 - 2013-08-19 19:35 - 00000000 ____D C:\Windows\ERUNT
2013-08-19 19:31 - 2013-08-19 19:31 - 00000996 _____ C:\AdwCleaner[S2].txt
2013-08-19 19:28 - 2013-08-19 19:28 - 00003199 _____ C:\AdwCleaner[S1].txt
2013-08-19 19:27 - 2013-08-19 19:27 - 00003008 _____ C:\AdwCleaner[R1].txt
2013-08-19 19:27 - 2013-08-19 19:26 - 01018305 _____ (Thisisu) C:\Users\Waxweazle2001\Desktop\JRT.exe
2013-08-19 19:22 - 2013-08-19 19:22 - 00666633 _____ C:\Users\Waxweazle2001\Desktop\adwcleaner.exe
2013-08-19 19:19 - 2013-02-05 15:59 - 00004124 _____ C:\Windows\System32\Tasks\Software Updater Ui
2013-08-19 19:19 - 2013-02-05 15:58 - 00004130 _____ C:\Windows\System32\Tasks\Software Updater
2013-08-18 18:45 - 2009-07-14 19:58 - 00657084 _____ C:\Windows\system32\perfh007.dat
2013-08-18 18:45 - 2009-07-14 19:58 - 00131450 _____ C:\Windows\system32\perfc007.dat
2013-08-18 18:45 - 2009-07-14 07:13 - 01506670 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-18 18:39 - 2013-08-18 18:39 - 00000546 _____ C:\Windows\PFRO.log
2013-08-18 18:36 - 2013-08-18 14:43 - 00000000 ____D C:\Qoobox
2013-08-18 18:35 - 2013-08-18 18:35 - 00017431 _____ C:\ComboFix.txt
2013-08-18 18:18 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2013-08-18 18:05 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-08-18 15:39 - 2013-08-18 15:39 - 00000000 ____D C:\FRST
2013-08-18 15:21 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2013-08-18 15:11 - 2013-08-18 14:43 - 00000000 ____D C:\Windows\erdnt
2013-08-18 14:33 - 2013-08-18 12:09 - 00000000 ____D C:\ProgramData\Avira
2013-08-18 14:07 - 2013-08-17 18:24 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2013-08-18 13:47 - 2013-05-05 10:48 - 00000000 ____D C:\Users\Waxweazle2001\AppData\Roaming\Zeigih
2013-08-18 11:27 - 2013-01-10 23:17 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-17 18:30 - 2013-08-17 18:25 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-08-17 18:25 - 2013-08-17 18:25 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking
2013-08-17 17:21 - 2013-08-17 17:21 - 00000000 ____D C:\Users\Waxweazle2001\AppData\Roaming\Malwarebytes
2013-08-17 17:21 - 2013-08-17 17:21 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-16 23:55 - 2013-07-18 19:21 - 00000000 ____D C:\Windows\system32\MRT
2013-08-16 23:52 - 2013-01-10 20:44 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-16 23:50 - 2013-08-16 20:51 - 00000000 ____D C:\Users\Waxweazle2001\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Xilisoft
2013-08-16 20:54 - 2013-08-16 20:54 - 00000000 ____D C:\Users\WAXWEA~1\AppData\Local\Google
2013-08-16 20:54 - 2013-08-16 20:54 - 00000000 ____D C:\Program Files (x86)\Google
2013-08-13 19:58 - 2013-01-10 23:38 - 00000000 ____D C:\Users\Waxweazle2001\AppData\Roaming\HpUpdate
2013-08-12 13:27 - 2013-06-18 21:50 - 00000000 ____D C:\Users\Waxweazle2001\AppData\Roaming\vlc
2013-08-12 10:35 - 2013-08-12 10:27 - 00000000 ____D C:\Users\Waxweazle2001\AppData\Roaming\MyPhoneExplorer
2013-08-12 10:32 - 2013-08-12 10:32 - 00000000 ____D C:\Users\Waxweazle2001\.android
2013-08-12 10:32 - 2013-01-10 18:44 - 00000000 ____D C:\Users\Waxweazle2001
2013-08-12 10:30 - 2013-08-12 10:30 - 00000060 _____ C:\settings.dat
2013-08-12 10:27 - 2013-08-12 10:27 - 00000896 _____ C:\Users\Public\Desktop\MyPhoneExplorer.lnk
2013-08-09 07:49 - 2013-08-09 07:48 - 00000484 __RSH C:\Users\Waxweazle2001\ntuser.pol
2013-08-09 07:47 - 2009-07-14 05:20 - 00000000 ___HD C:\Windows\system32\GroupPolicy
2013-08-04 19:40 - 2013-08-04 19:40 - 00000000 ____D C:\ProgramData\Synology
2013-08-04 19:39 - 2013-08-04 19:39 - 00000789 _____ C:\Users\Public\Desktop\Synology Assistant.lnk
2013-07-26 11:55 - 2013-05-16 20:51 - 00000000 ____D C:\Users\Waxweazle2001\AppData\Roaming\dBpoweramp
2013-07-26 11:55 - 2013-05-16 20:42 - 00000000 ____D C:\Users\Waxweazle2001\AppData\Roaming\AccurateRip
2013-07-26 07:13 - 2013-08-17 00:02 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-26 07:13 - 2013-08-17 00:02 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-26 07:13 - 2013-08-17 00:02 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-07-26 07:12 - 2013-08-17 00:02 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-26 07:12 - 2013-08-17 00:02 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-26 07:12 - 2013-08-17 00:02 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-26 07:12 - 2013-08-17 00:02 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-26 07:12 - 2013-08-17 00:02 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-26 07:12 - 2013-08-17 00:02 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-26 07:12 - 2013-08-17 00:02 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-26 07:12 - 2013-08-17 00:02 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-07-26 07:12 - 2013-08-17 00:02 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-07-26 07:12 - 2013-08-17 00:02 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-26 07:12 - 2013-08-17 00:02 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-07-26 05:35 - 2013-08-17 00:02 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-26 05:13 - 2013-08-17 00:02 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-26 05:13 - 2013-08-17 00:02 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-26 05:12 - 2013-08-17 00:02 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-26 05:12 - 2013-08-17 00:02 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-26 05:12 - 2013-08-17 00:02 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-26 05:12 - 2013-08-17 00:02 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-26 05:12 - 2013-08-17 00:02 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-26 05:12 - 2013-08-17 00:02 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-26 05:12 - 2013-08-17 00:02 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-07-26 05:12 - 2013-08-17 00:02 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-07-26 05:12 - 2013-08-17 00:02 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-26 05:11 - 2013-08-17 00:02 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-26 05:11 - 2013-08-17 00:02 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-07-26 04:49 - 2013-08-17 00:02 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-26 04:39 - 2013-08-17 00:02 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-07-26 03:59 - 2013-08-17 00:02 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-07-25 11:25 - 2013-08-16 17:29 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-25 10:57 - 2013-08-16 17:29 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-22 15:24 - 2013-07-22 15:24 - 00000000 ____D C:\Program Files (x86)\SMSC
2013-07-22 15:24 - 2013-05-12 14:04 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-07-22 15:23 - 2013-07-22 15:23 - 00000000 ____D C:\dell
2013-07-22 15:21 - 2013-07-22 15:21 - 00000000 ____D C:\Users\Waxweazle2001\AppData\Roaming\InstallShield
2013-07-22 15:21 - 2013-07-22 15:21 - 00000000 ____D C:\Program Files (x86)\O2Micro International LTD
2013-07-22 15:19 - 2013-02-28 09:29 - 00001912 _____ C:\Windows\epplauncher.mif
2013-07-22 15:19 - 2013-01-10 22:33 - 00000000 ____D C:\Program Files\Microsoft Security Client
2013-07-22 15:19 - 2013-01-10 22:33 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2013-07-22 13:03 - 2013-04-11 22:05 - 00000000 ____D C:\Users\WAXWEA~1\AppData\Local\Htc
Files to move or delete:
====================
ZeroAccess:
C:\Users\WAXWEA~1\AppData\Local\Google\Desktop\Install\{a7d7ca63-a464-60ab-a9cd-88fda9fa91af}
ZeroAccess:
C:\Program Files (x86)\Google\Desktop\Install\{a7d7ca63-a464-60ab-a9cd-88fda9fa91af}
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-08-12 09:19
==================== End Of Log ============================
Und das zugehörige Addition-Log: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 19-08-2013
Ran by Waxweazle2001 at 2013-08-20 18:26:21
Running from C:\Users\Waxweazle2001\Desktop
Boot Mode: Normal
==========================================================
==================== Installed Programs =======================
7-Zip 9.20 (x64 edition) (Version: 9.20.00.0)
Adobe AIR (x32 Version: 3.5.0.880)
Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.94)
Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03)
Adobe Shockwave Player 12.0 (x32 Version: 12.0.2.122)
Any Video Converter 5 5.0.4 (x32)
Ashampoo Burning Studio 2013 v.11.0.5 (x32 Version: 11.0.5)
Avira SearchFree Toolbar plus Web Protection (x32 Version: 12.2.2.663)
Biet-O-Matic v2.14.12 (x32 Version: 2.14.12)
Cardbus Smartcard Reader Driver (x64) (x32 Version: 1.00)
dBpoweramp [Arrange Audio] Codec (x32 Version: Release 3)
dBpoweramp [Audio Info] Codec (x32 Version: Release 1)
dBpoweramp [Calculate Audio CRC] Codec (x32 Version: Release 1)
dBpoweramp [Channel Split] Codec (x32)
dBpoweramp [ID Tag Update] Codec (x32 Version: Release 3)
dBpoweramp [Length Split] Codec (x32)
dBpoweramp [Multi Encoder] Codec (x32 Version: Release 4)
dBpoweramp [ReplayGain] Codec (x32 Version: Release 2)
dBpoweramp [Tag From Filename] Codec (x32 Version: Release 1)
dBpoweramp AAC Encoder (x32)
dBpoweramp AIFF Codec (x32 Version: Release 11)
dBpoweramp Batch Ripper (x32 Version: Release 1.3)
dBpoweramp CD Writer (x32 Version: Release 3.1)
dBpoweramp CLI Encoder (x32 Version: Release 4)
dBpoweramp Dalet Codec (x32 Version: Release 4)
dBpoweramp DirectShow Decoder (x32 Version: Release 2)
dBpoweramp DSP Effects (x32 Version: Release 7)
dBpoweramp FLAC Codec (x32 Version: Release 14 (FLAC 1.2.1))
dBpoweramp m4a Codec (x32 Version: Release 14)
dBpoweramp m4a Nero AAC Encoder (x32 Version: Release 1)
dBpoweramp m4a Utilities (x32)
dBpoweramp m4b Audio book Encoder (x32)
dBpoweramp Midi Decoder (x32)
dBpoweramp Monkeys Audio Codec (x32 Version: Release 10 (Monkeys v4.06))
dBPowerAMP Mp2 and BwfMp2 codec (x32 Version: Release 6)
dBpoweramp mp3 (Fraunhofer IIS) Codec (x32 Version: Release 2a (v4.0.3))
dBpoweramp Musepack Codec (x32)
dBpoweramp Music Converter (x32 Version: Release 14.2)
dBpoweramp Ogg Vorbis aoTuV Encoder (x32 Version: R5 aoTuV b6.02)
dBpoweramp Ogg Vorbis Codec (x32 Version: Release 21 (Vorbis v1.3.2))
dBpoweramp OptimFROG Codec (x32)
dBpoweramp Shorten Codec (x32)
dBpoweramp Speex Codec (x32)
dBPoweramp tooLame MP2 codec (x32)
dBpoweramp TTA Codec (x32)
dBpoweramp Wave64 Codec (x32)
dBpoweramp WavPack Codec (x32 Version: Release 8 (WavPack v4.60))
dBpoweramp Windows Media Audio 10 Codec (x32 Version: Release 7)
DC-Bass Source 1.3.0 (x32)
DEUTSCHLAND SPIELT GAME CENTER (x32)
DirectVobSub 2.40.4209 (x32 Version: 2.40.4209)
DivX-Setup (x32 Version: 2.6.1.8)
el(R) Graphics Media Accelerator Driver (Version: 8.15.10.1930)
ffdshow v1.1.4399 [2012-03-22] (x32 Version: 1.1.4399.0)
GoldWave v4.26 (x32)
Haali Media Splitter (x32)
HP Deskjet 3070 B611 series - Grundlegende Software für das Gerät (Version: 28.0.1315.0)
HP Update (x32 Version: 5.003.003.001)
HPDiagnosticAlert (x32 Version: 1.00.0000)
HTC BMP USB Driver (x32 Version: 1.0.5375)
HTC Driver Installer (x32 Version: 4.0.1.001)
HTC Sync (x32 Version: 3.3.21)
ICQ 8.0 (build 5981, für aktuellen Benutzer) (HKCU Version: 8.0.5981.0)
In 80 Tagen um die Welt (x32)
IPTInstaller (x32 Version: 4.0.8)
IrfanView (remove only) (x32 Version: 4.35)
IsoBuster 3.1 (x32 Version: 3.1)
Java 7 Update 21 (64-bit) (Version: 7.0.210)
Java 7 Update 25 (x32 Version: 7.0.250)
Java Auto Updater (x32 Version: 2.1.9.5)
JDownloader 0.9 (x32 Version: 0.9)
K-Lite Codec Pack 9.8.0 (Full) (x32 Version: 9.8.0)
Lagarith Lossless Codec (1.3.27) (x32)
LAME v3.99.3 (for Windows) (x32)
Medieval CUE Splitter (x32 Version: 1.2.0)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Office 2000 SR-1 Professional (x32 Version: 9.00.3821)
Microsoft Security Client (Version: 4.3.0215.0)
Microsoft Security Essentials (Version: 4.3.215.0)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Mozilla Firefox 23.0.1 (x86 de) (x32 Version: 23.0.1)
Mozilla Maintenance Service (x32 Version: 23.0.1)
Mozilla Thunderbird 17.0.8 (x86 de) (x32 Version: 17.0.8)
MPEG Suite 2001r2 (x32)
MSXML 4.0 SP3 Parser (KB2758694) (x32 Version: 4.30.2117.0)
MSXML 4.0 SP3 Parser (x32 Version: 4.30.2100.0)
MyPhoneExplorer (x32 Version: 1.8.4)
NAVIGON Fresh 3.4.1 (x32 Version: 3.4.1)
NewsLeecher v5.0 Final (x32)
Notepad++ (x32 Version: 6.3.2)
O2Micro Flash Memory Card Windows Driver (Version: 3.00.0006)
O2Micro Flash Memory Card Windows Driver (x32 Version: 3.00.0006)
Ogg Vorbis CLI (x32)
OpenSource Flash Video Splitter 1.0.0.5 (x32 Version: 1.0.0.5)
OZ711 SCR Driver (x64) (Version: 3.0.1.6D)
OZ711 SCR Driver (x64) (x32 Version: 3.0.1.6D)
Paint.NET v3.5.10 (Version: 3.60.0)
PDF Architect (x32 Version: 1.0.52.8917)
PDFCreator (x32 Version: 1.6.2)
Sierra Wireless 3G Watcher (x32 Version: 5.0.2267.1601)
SMSC Fast Infrared Driver (x32 Version: 1.01.0000)
swMSM (x32 Version: 12.0.0.1)
Synaptics Pointing Device Driver (Version: 13.2.6.1)
Synology Assistant (remove only) (x32)
TomTom HOME (x32 Version: 2.9.5)
TomTom HOME Visual Studio Merge Modules (x32 Version: 1.0.2)
tools-windows (x32 Version: 9.2.2.894247)
TubeBox (x32 Version: 4.3.0.21)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0)
VirtualDJ Home FREE (x32 Version: 7.3)
VLC media player 2.0.7 (x32 Version: 2.0.7)
VMware Player (Version: 5.0.1)
VMware Player (x32 Version: 5.0.1)
Winamp (x32 Version: 5.63 )
Winamp Erkennungs-Plug-in (HKCU Version: 1.0.0.1)
==================== Restore Points =========================
==================== Hosts content: ==========================
2009-07-14 04:34 - 2013-08-18 15:03 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
Task: {0C88663F-E6AC-48C3-811C-00CF95930EF3} - System32\Tasks\Software Updater => C:\Program Files (x86)\SoftwareUpdater\SoftwareUpdater.Bootstrapper.exe No File
Task: {4E2213CC-B222-46CC-A0E6-210590D76889} - System32\Tasks\Software Updater Ui => C:\Program Files (x86)\SoftwareUpdater\SoftwareUpdater.Ui.exe No File
Task: {63043F63-D981-4C69-A56C-303A96A69A34} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-23] (Microsoft Corporation)
Task: {BFEE36CB-EC38-453A-A150-A9CFBEEF3D03} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-07-14] (Adobe Systems Incorporated)
Task: {C4BBEE66-27B6-4548-82D2-07ED56C27C18} - System32\Tasks\Launch HTC Sync Loader => D:\Programme\HTC\HTC Sync 3.0\htcUPCTLoader.exe [2012-12-12] ()
Task: {E2DE1707-FE86-4B0E-A73A-C6D240EA5C73} - System32\Tasks\Microsoft\Microsoft Antimalware\MpIdleTask => C:\Program Files\Microsoft Security Client\MpCmdRun.exe [2013-06-20] (Microsoft Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Faulty Device Manager Devices =============
Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (08/20/2013 05:34:48 PM) (Source: Customer Experience Improvement Program) (User: )
Description: 80004005
Error: (08/20/2013 05:04:07 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (08/20/2013 05:04:06 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (08/20/2013 05:03:59 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
System errors:
=============
Microsoft Office Sessions:
=========================
Error: (08/20/2013 05:34:48 PM) (Source: Customer Experience Improvement Program)(User: )
Description: 80004005
Error: (08/20/2013 05:04:07 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Waxweazle2001\Desktop\esetsmartinstaller_enu.exe
Error: (08/20/2013 05:04:06 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Waxweazle2001\Desktop\esetsmartinstaller_enu.exe
Error: (08/20/2013 05:03:59 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestE:\Downloads\esetsmartinstaller_enu.exe
CodeIntegrity Errors:
===================================
Date: 2013-08-18 14:57:14.643
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume4\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-08-18 14:57:14.538
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume4\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Percentage of memory in use: 62%
Total physical RAM: 2038.3 MB
Available physical RAM: 771.47 MB
Total Pagefile: 4076.6 MB
Available Pagefile: 2576.55 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:33.57 GB) (Free:8.43 GB) NTFS
Drive d: () (Fixed) (Total:58.59 GB) (Free:22.62 GB) NTFS
Drive e: () (Fixed) (Total:19.53 GB) (Free:16.49 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 112 GB) (Disk ID: C5FBC5FB)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=59 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=20 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=34 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Probleme habe ich keine mehr, Sicherheitscenter, Windows Update und Security Essentails laufen wieder wie vorher. Danke!!! |
|
21.08.2013, 07:43
| #11 |
| /// the machine /// TB-Ausbilder | Sicherheitscenterdienst ist verschwunden Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter ZeroAccess:
C:\Users\WAXWEA~1\AppData\Local\Google\Desktop\Install\{a7d7ca63-a464-60ab-a9cd-88fda9fa91af}
ZeroAccess:
C:\Program Files (x86)\Google\Desktop\Install\{a7d7ca63-a464-60ab-a9cd-88fda9fa91af}
FF NetworkProxy: "http", "91.143.60.172"
FF NetworkProxy: "http_port", 8080
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
21.08.2013, 20:31
| #12 |
| | Sicherheitscenterdienst ist verschwunden Hallo, alles erledigt hier die Fixlog: Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 21-08-2013 02
Ran by Waxweazle2001 at 2013-08-21 21:30:45 Run:1
Running from C:\Users\Waxweazle2001\Desktop
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
ZeroAccess:
C:\Users\WAXWEA~1\AppData\Local\Google\Desktop\Install\{a7d7ca63-a464-60ab-a9cd-88fda9fa91af}
ZeroAccess:
C:\Program Files (x86)\Google\Desktop\Install\{a7d7ca63-a464-60ab-a9cd-88fda9fa91af}
FF NetworkProxy: "http", "91.143.60.172"
FF NetworkProxy: "http_port", 8080
*****************
C:\Users\WAXWEA~1\AppData\Local\Google\Desktop\Install\{a7d7ca63-a464-60ab-a9cd-88fda9fa91af} => Moved successfully.
C:\Program Files (x86)\Google\Desktop\Install\{a7d7ca63-a464-60ab-a9cd-88fda9fa91af} => Moved successfully.
Firefox Proxy settings were reset.
Firefox Proxy settings were reset.
==== End of Fixlog ====
|
|
22.08.2013, 08:14
| #13 |
| /// the machine /// TB-Ausbilder | Sicherheitscenterdienst ist verschwunden Fertig Die Reihenfolge ist hier entscheidend.
Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
22.08.2013, 17:05
| #14 |
| | Sicherheitscenterdienst ist verschwunden Hallo Schrauber, soweit ist alles erledigt, allerdings hab ich jetzt nur einen Ordner FRST direkt auf laufwerk C: und diesen kann ich nicht löschen. Immer wenn ich den Ordner löschen möchte stürzt der Explorer ab. Wäre schön wenn du da noch ne Idee hättest, als letzten Ausweg würde ich sonst den Laptop mit Knoppix starten und dann versuchen den Ordner zu löschen. Allerdings nur wenn dir nicht noch was anderes dazu einfällt. Defix hatte ich ausgeführt wie du gesagt hattest. |
|
23.08.2013, 07:35
| #15 |
| /// the machine /// TB-Ausbilder | Sicherheitscenterdienst ist verschwunden Rebooten, Delfix neu laden und laufen lassen. Sollte den Ordne reigentlich entfernen.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Sicherheitscenterdienst ist verschwunden |
| adobe, antivir, browser, combofix, converter, defender, device driver, firefox, flash player, helper, hijack, hijackthis, internet, internet explorer, log-datei, mozilla, mp3, problem, prozesse, scan, security, sierra, software, system, trojaner, updates, virus, windows, windows e |
