| |
| |||||||
Log-Analyse und Auswertung: Win7 Avira Free Antivir meldet TR/Xcrypt.Xpack.8884. Rechner aber schon länger immer langsamerWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
04.09.2013, 20:03
| #1 |
| |  Win7 Avira Free Antivir meldet TR/Xcrypt.Xpack.8884. Rechner aber schon länger immer langsamer Hallo werte Helfer und Helferinnen, wie Ihr gleich bemerken werdet, bin ich was Viren und Schutz anbelangt ein Laie. Und eigentlich viel zu alt für diesen S... .Avira Free Antivir hat auf meinem Rechner TR/Xcrypt.Xpack.8884 gefunden. Mein Rechner wird geringfügig geschäftlich genutzt. Der Rechner erscheint mir langsamer, rechnet immer wieder an irgendwas herum und der Internet-Traffic scheint auch zäher zu sein. Das scheint mir aber schon etwas länger der Fall zu sein. Vielleich 4-6 Wochen. Ich hatte aber keine Befallsmeldungen und der Virenscanner ist immer up to date. Mglw. bilde ich mir das auch nur ein. Ich gebe es zu: Ich sorge mich gerade jetzt um die Schäden, die durch den Befall verursacht werden können. Was macht dieses Programm? Ausspähen von Kontakten, Beschädigung von Dateien, Massenmails verschicken? Über Google habe ich das Forum hier und einen Beitrag mit einem ähnlich klingenden Viren/Trojanernamen gefunden. Den Tread empfand ich als sehr anschaulich. Hilft aber mglw. nichts, denn ähnlich ist nicht gleich. Und die Logfiles sind für mich Böhmische Dörfer. Von daher könnte die Situation bei mir wieder völlig anders liegen. Wie gesagt, ich habe von der Materie keine Ahnung. Ist Avira Free Antivir in der Lage das Problem vollständig zu bereinigen. Ich hatte jedoch beim lesen des Treads den Eindruck, dass dies eher weniger der Fall sei. Zunächst hatte ich eine Systemwiederherstellung zu einem früheren Zeitpunkt durchgeführt und dann noch einmal Antivir drüberlaufen lassen. Antivir meldete TR/Xcrypt.Xpack.8884. Ich habe den Virus/Trojaner in Quarantäne verschoben. Code:
ATTFilter Exportierte Ereignisse:
04.09.2013 07:53 [System-Scanner] Malware gefunden
Die Datei 'C:\Users\Bernd xxxxxxxxx\AppData\Local\Temp\blsoqpvwlc.pre'
enthielt einen Virus oder unerwünschtes Programm 'TR/Crypt.Xpack.8884' [trojan].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5592675e.qua'
verschoben!
Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 18:12 on 04/09/2013 (Bernd xxxxxxxxx)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03-09-2013 03
Ran by Bernd xxxxxxxxx (administrator) on BERNDxxxxxxxxx on 04-09-2013 18:13:56
Running from C:\Users\Bernd xxxxxxxxx\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(UASSOFT.COM) C:\Program Files (x86)\Trust\GXT14 Mouse\GameMouseServiceApp.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(Ask) C:\Program Files (x86)\Ask.com\Updater\Updater.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
() C:\Program Files (x86)\Trust\GXT14 Mouse\POINTERGHOST.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe
(ZF Electronics GmbH) C:\Program Files (x86)\Cherry\KeyMan\KeyMan.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe
(shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfimon.exe
(ZF Electronics GmbH) C:\Program Files (x86)\Cherry\CDI\cdi.exe
(UASSOFT.COM) C:\Program Files (x86)\Trust\GXT14 Mouse\StartAutorun.exe
(UASSOFT.COM) C:\Program Files (x86)\Trust\GXT14 Mouse\RapooV1Process.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028896 2013-07-27] (NVIDIA Corporation)
HKLM\...\Policies\Explorer: [NoActiveDesktop] 1
HKLM\...\Policies\Explorer: [NoActiveDesktopChanges] 1
MountPoints2: N - N:\HTC_Sync_Manager_PC.exe
MountPoints2: {637a6bee-c781-11e2-972b-bcaec523b6bf} - N:\HTC_Sync_Manager_PC.exe
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [ApnUpdater] - C:\Program Files (x86)\Ask.com\Updater\Updater.exe [1648264 2013-04-30] (Ask)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-03] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [trustGTX14] - C:\Program Files (x86)\Trust\GXT14 Mouse\POINTERGHOST.exe [4832256 2009-05-11] ()
HKLM-x32\...\Run: [BrMfcWnd] - C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [ControlCenter3] - C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [CherryKeyMan] - C:\Program Files (x86)\Cherry\KeyMan\KeyMan.exe [254004 2010-09-28] (ZF Electronics GmbH)
HKLM-x32\...\Run: [FreePDF Assistant] - C:\Program Files (x86)\FreePDF_XP\fpassist.exe [373760 2013-03-14] (shbox.de)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
AppInit_DLLs: C:\PROGRA~1\NVIDIA~1\NVSTRE~1\rxinput.dll [653600 2013-07-27] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\PROGRA~2\NVIDIA~1\NVSTRE~1\rxinput.dll [593696 2013-07-27] (NVIDIA Corporation)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.avira.com/?l=dis&o=APN10261&gct=hp&dc=EU&locale=de_DE
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
URLSearchHook: (No Name) - {00000000-6E41-4FD3-8538-502F5495E5FC} - No File
SearchScopes: HKCU - {0B8D26BE-58A1-482C-90BC-C62A0E16A503} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=39b18a8d-1614-4b2a-abdd-71fce6ed1871&apn_sauid=0EF40D91-9A6C-4F86-BEB6-1AA4F3A135DB
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 172.16.0.1
FireFox:
========
FF ProfilePath: C:\Users\Bernd xxxxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\towj3uha.default
FF user.js: detected! => C:\Users\Bernd xxxxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\towj3uha.default\user.js
FF SearchEngineOrder.1: Ask.com
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www1.delta-search.com/?babsrc=HP_ss&mntrId=24A400242CE6FFE4&affID=120692&tsp=4944
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @java.com/DTPlugin,version=10.21.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.21.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.6 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Bernd xxxxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\towj3uha.default\searchplugins\babylon.xml
FF SearchPlugin: C:\Users\Bernd xxxxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\towj3uha.default\searchplugins\delta.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Delta Toolbar - C:\Users\Bernd xxxxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\towj3uha.default\Extensions\ffxtlbr@delta.com
FF Extension: No Name - C:\Users\Bernd xxxxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\towj3uha.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: No Name - C:\Users\Bernd xxxxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\towj3uha.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-03] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-03] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-03] (Avira Operations GmbH & Co. KG)
R3 Cherry Device Interface; C:\Program Files (x86)\Cherry\CDI\cdi.exe [577582 2010-08-25] (ZF Electronics GmbH)
R2 KmGameMouseServiceV1; C:\Program Files (x86)\Trust\GXT14 Mouse\GameMouseServiceApp.exe [354304 2009-05-11] (UASSOFT.COM)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [14984480 2013-07-27] (NVIDIA Corporation)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-03] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-09-03] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-05-25] (Avira Operations GmbH & Co. KG)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [8192 2005-03-29] ()
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39712 2013-05-14] (NVIDIA Corporation)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-09-04 18:12 - 2013-09-04 18:12 - 00000492 _____ C:\Users\Bernd xxxxxxxxx\Desktop\defogger_disable.log
2013-09-04 18:12 - 2013-09-04 18:12 - 00000000 _____ C:\Users\Bernd xxxxxxxxx\defogger_reenable
2013-09-04 08:34 - 2013-09-04 08:34 - 00377856 _____ C:\Users\Bernd xxxxxxxxx\Desktop\gmer_2.1.19163.exe
2013-09-04 08:33 - 2013-09-04 08:34 - 01950416 _____ (Farbar) C:\Users\Bernd xxxxxxxxx\Desktop\FRST64.exe
2013-09-04 08:32 - 2013-09-04 08:32 - 00050477 _____ C:\Users\Bernd xxxxxxxxx\Desktop\Defogger.exe
2013-09-04 08:24 - 2013-09-04 08:24 - 00000762 _____ C:\Users\Bernd xxxxxxxxx\Desktop\EreignisseAVIRA20130903.txt
2013-09-03 23:13 - 2013-09-03 23:13 - 00002718 _____ C:\Users\BERNDK~1\AppData\Local\recently-used.xbel
2013-09-03 22:51 - 2013-09-03 22:51 - 00144384 _____ C:\Users\Bernd xxxxxxxxx\Downloads\standard
2013-09-03 22:32 - 2013-09-03 23:17 - 00000000 ____D C:\Users\Bernd xxxxxxxxx\AppData\Roaming\Scribus
2013-09-03 22:13 - 2013-09-03 22:13 - 00000866 _____ C:\Users\Public\Desktop\Scribus 1.4.3.lnk
2013-09-03 22:13 - 2013-09-03 22:13 - 00000000 ____D C:\ProgramData\Package Cache
2013-09-03 22:12 - 2013-09-03 22:13 - 00000000 ____D C:\Program Files\Scribus 1.4.3
2013-09-03 22:11 - 2013-09-04 08:45 - 00021415 _____ C:\Users\Bernd xxxxxxxxx\Desktop\Trojaner_Board.odt
2013-09-03 21:49 - 2013-09-03 21:54 - 83962495 _____ (The Scribus Team) C:\Users\Bernd xxxxxxxxx\Downloads\scribus-1.4.3-windows-x64.exe
2013-08-17 13:03 - 2013-08-17 13:03 - 494271956 _____ C:\Windows\MEMORY.DMP
2013-08-17 13:03 - 2013-08-17 13:03 - 00262144 _____ C:\Windows\Minidump\081713-15506-01.dmp
2013-08-17 13:03 - 2013-08-17 13:03 - 00000000 ____D C:\Windows\Minidump
2013-08-17 12:49 - 2013-08-17 12:49 - 00000000 ____D C:\Users\Bernd xxxxxxxxx\AppData\Roaming\OpenOffice
2013-08-17 12:48 - 2013-08-17 12:48 - 00001116 _____ C:\Users\Public\Desktop\OpenOffice 4.0.0.lnk
2013-08-17 12:48 - 2013-08-17 12:48 - 00000000 ____D C:\Program Files (x86)\OpenOffice 4
2013-08-17 12:47 - 2013-08-17 12:47 - 00000000 ____D C:\Users\Bernd xxxxxxxxx\Desktop\OpenOffice 4.0.0 (de) Installation Files
2013-08-17 12:43 - 2013-08-17 12:45 - 162401424 _____ C:\Users\Bernd xxxxxxxxx\Downloads\Apache_OpenOffice_4.0.0_Win_x86_install_de.exe
2013-08-17 12:42 - 2013-08-17 12:42 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-15 21:26 - 2013-08-15 21:26 - 00066419 _____ C:\Users\Bernd xxxxxxxxx\Desktop\Ernährungstagebuch.ods
2013-08-15 20:19 - 2013-08-15 20:19 - 00006656 _____ C:\Users\Bernd xxxxxxxxx\Desktop\Birken19.xls
2013-08-14 23:02 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-14 23:02 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-14 23:02 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-14 23:02 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-14 23:02 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-14 23:02 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-14 23:02 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-14 23:02 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-14 23:02 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-14 23:02 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-14 23:02 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-14 23:02 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-14 23:02 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-14 23:02 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-14 23:02 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-14 23:02 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-14 23:02 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-14 23:02 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-14 23:02 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-14 23:02 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-14 23:02 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-14 23:02 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-14 23:02 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-14 23:02 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-14 23:02 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-14 23:02 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-14 23:02 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-14 23:02 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-14 23:02 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-14 23:02 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-14 23:02 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-14 23:00 - 2013-08-14 23:01 - 00000000 ____D C:\Windows\system32\MRT
2013-08-14 18:17 - 2013-08-15 09:59 - 00036705 _____ C:\Users\Bernd xxxxxxxxx\Desktop\Bericht Kestler 130813 2.odt
2013-08-14 13:57 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-14 13:57 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-14 13:57 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-14 13:57 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-14 13:57 - 2013-07-09 08:03 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-14 13:57 - 2013-07-09 07:54 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-14 13:57 - 2013-07-09 07:53 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-08-14 13:57 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-14 13:57 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-14 13:57 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-14 13:57 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-14 13:57 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-14 13:57 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-08-14 13:57 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-08-14 13:57 - 2013-07-09 06:53 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-08-14 13:57 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-14 13:57 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-14 13:57 - 2013-07-09 06:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-08-14 13:57 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-14 13:57 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-14 13:57 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-14 13:57 - 2013-07-09 04:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-08-14 13:57 - 2013-07-09 04:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-08-14 13:57 - 2013-07-09 04:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-08-14 13:57 - 2013-07-09 04:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-08-14 13:57 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-14 13:57 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-13 13:00 - 2013-08-14 16:43 - 00032080 _____ C:\Users\Bernd xxxxxxxxx\Desktop\Bericht Kestler 130813.odt
2013-08-06 21:31 - 2013-08-07 18:06 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-08-05 15:02 - 2013-08-05 15:02 - 00015115 _____ C:\Users\Bernd xxxxxxxxx\Desktop\Würstel 050813.ods
2013-08-05 14:59 - 2013-08-05 14:59 - 00007168 _____ C:\Users\Bernd xxxxxxxxx\Desktop\050813.xls
==================== One Month Modified Files and Folders =======
2013-09-04 18:13 - 2013-09-04 18:13 - 00000000 ____D C:\FRST
2013-09-04 18:12 - 2013-09-04 18:12 - 00000492 _____ C:\Users\Bernd xxxxxxxxx\Desktop\defogger_disable.log
2013-09-04 18:12 - 2013-09-04 18:12 - 00000000 _____ C:\Users\Bernd xxxxxxxxx\defogger_reenable
2013-09-04 18:12 - 2013-05-25 21:26 - 00000000 ____D C:\Users\Bernd xxxxxxxxx
2013-09-04 18:12 - 2009-07-14 19:58 - 00696620 _____ C:\Windows\system32\perfh007.dat
2013-09-04 18:12 - 2009-07-14 19:58 - 00147916 _____ C:\Windows\system32\perfc007.dat
2013-09-04 18:12 - 2009-07-14 07:13 - 01612484 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-04 18:11 - 2013-05-25 21:15 - 01990291 _____ C:\Windows\WindowsUpdate.log
2013-09-04 18:10 - 2009-07-14 06:45 - 00014960 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-04 18:10 - 2009-07-14 06:45 - 00014960 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-04 18:09 - 2013-06-06 11:52 - 00000000 ____D C:\Users\BERNDK~1\AppData\Local\FreePDF_XP
2013-09-04 18:08 - 2013-05-25 21:32 - 00000000 ____D C:\ProgramData\NVIDIA
2013-09-04 18:08 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-04 18:08 - 2009-07-14 06:51 - 00071930 _____ C:\Windows\setupact.log
2013-09-04 08:45 - 2013-09-03 22:11 - 00021415 _____ C:\Users\Bernd xxxxxxxxx\Desktop\Trojaner_Board.odt
2013-09-04 08:34 - 2013-09-04 08:34 - 00377856 _____ C:\Users\Bernd xxxxxxxxx\Desktop\gmer_2.1.19163.exe
2013-09-04 08:34 - 2013-09-04 08:33 - 01950416 _____ (Farbar) C:\Users\Bernd xxxxxxxxx\Desktop\FRST64.exe
2013-09-04 08:32 - 2013-09-04 08:32 - 00050477 _____ C:\Users\Bernd xxxxxxxxx\Desktop\Defogger.exe
2013-09-04 08:24 - 2013-09-04 08:24 - 00000762 _____ C:\Users\Bernd xxxxxxxxx\Desktop\EreignisseAVIRA20130903.txt
2013-09-04 08:20 - 2013-05-28 12:37 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-03 23:17 - 2013-09-03 22:32 - 00000000 ____D C:\Users\Bernd xxxxxxxxx\AppData\Roaming\Scribus
2013-09-03 23:17 - 2013-06-25 22:38 - 00000000 ____D C:\Users\Bernd xxxxxxxxx\.gimp-2.8
2013-09-03 23:13 - 2013-09-03 23:13 - 00002718 _____ C:\Users\BERNDK~1\AppData\Local\recently-used.xbel
2013-09-03 23:13 - 2013-07-19 18:49 - 00000000 ____D C:\Users\BERNDK~1\AppData\Local\gtk-2.0
2013-09-03 22:51 - 2013-09-03 22:51 - 00144384 _____ C:\Users\Bernd xxxxxxxxx\Downloads\standard
2013-09-03 22:13 - 2013-09-03 22:13 - 00000866 _____ C:\Users\Public\Desktop\Scribus 1.4.3.lnk
2013-09-03 22:13 - 2013-09-03 22:13 - 00000000 ____D C:\ProgramData\Package Cache
2013-09-03 22:13 - 2013-09-03 22:12 - 00000000 ____D C:\Program Files\Scribus 1.4.3
2013-09-03 21:54 - 2013-09-03 21:49 - 83962495 _____ (The Scribus Team) C:\Users\Bernd xxxxxxxxx\Downloads\scribus-1.4.3-windows-x64.exe
2013-09-03 21:46 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2013-09-03 12:12 - 2013-05-27 22:31 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-09-03 12:12 - 2013-05-25 21:46 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-09-03 12:12 - 2013-05-25 21:46 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-09-03 12:09 - 2013-06-19 08:59 - 00000000 ___RD C:\Users\Bernd xxxxxxxxx\Dropbox
2013-09-03 12:09 - 2013-06-19 08:58 - 00000000 ____D C:\Users\Bernd xxxxxxxxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2013-09-03 12:09 - 2013-06-19 08:58 - 00000000 ____D C:\Users\Bernd xxxxxxxxx\AppData\Roaming\Dropbox
2013-09-03 12:09 - 2013-05-27 13:32 - 00000000 ____D C:\Users\Bernd xxxxxxxxx\AppData\Roaming\MyPhoneExplorer
2013-09-03 12:09 - 2013-05-26 10:02 - 00000000 ____D C:\Users\Bernd xxxxxxxxx\AppData\Roaming\Thunderbird
2013-09-03 12:09 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration
2013-08-31 17:29 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Public\Libraries
2013-08-28 15:18 - 2013-05-25 21:47 - 00000000 ____D C:\Users\BERNDK~1\AppData\Local\DoNotTrackPlus
2013-08-17 13:20 - 2013-05-26 10:55 - 00064024 _____ C:\Users\BERNDK~1\AppData\Local\GDIPFONTCACHEV1.DAT
2013-08-17 13:03 - 2013-08-17 13:03 - 494271956 _____ C:\Windows\MEMORY.DMP
2013-08-17 13:03 - 2013-08-17 13:03 - 00262144 _____ C:\Windows\Minidump\081713-15506-01.dmp
2013-08-17 13:03 - 2013-08-17 13:03 - 00000000 ____D C:\Windows\Minidump
2013-08-17 13:03 - 2013-05-25 23:49 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-17 13:03 - 2009-07-14 06:45 - 00294712 _____ C:\Windows\system32\FNTCACHE.DAT
2013-08-17 12:49 - 2013-08-17 12:49 - 00000000 ____D C:\Users\Bernd xxxxxxxxx\AppData\Roaming\OpenOffice
2013-08-17 12:48 - 2013-08-17 12:48 - 00001116 _____ C:\Users\Public\Desktop\OpenOffice 4.0.0.lnk
2013-08-17 12:48 - 2013-08-17 12:48 - 00000000 ____D C:\Program Files (x86)\OpenOffice 4
2013-08-17 12:47 - 2013-08-17 12:47 - 00000000 ____D C:\Users\Bernd xxxxxxxxx\Desktop\OpenOffice 4.0.0 (de) Installation Files
2013-08-17 12:47 - 2013-05-25 21:26 - 00000000 ___RD C:\Users\Bernd xxxxxxxxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-08-17 12:47 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2013-08-17 12:45 - 2013-08-17 12:43 - 162401424 _____ C:\Users\Bernd xxxxxxxxx\Downloads\Apache_OpenOffice_4.0.0_Win_x86_install_de.exe
2013-08-17 12:42 - 2013-08-17 12:42 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-16 08:14 - 2013-05-31 16:08 - 00000864 _____ C:\Windows\Brpfx04a.ini
2013-08-16 08:11 - 2013-06-06 12:07 - 00000000 ____D C:\Users\Bernd xxxxxxxxx\AppData\Roaming\PC-FAX TX
2013-08-16 08:10 - 2009-07-14 07:32 - 00000000 ____D C:\Windows\system32\FxsTmp
2013-08-16 08:08 - 2013-05-27 11:38 - 00000000 ____D C:\Users\Bernd xxxxxxxxx\Documents\Fax
2013-08-16 07:17 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-08-15 21:26 - 2013-08-15 21:26 - 00066419 _____ C:\Users\Bernd xxxxxxxxx\Desktop\Ernährungstagebuch.ods
2013-08-15 20:19 - 2013-08-15 20:19 - 00006656 _____ C:\Users\Bernd xxxxxxxxx\Desktop\Birken19.xls
2013-08-15 19:13 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-08-15 09:59 - 2013-08-14 18:17 - 00036705 _____ C:\Users\Bernd xxxxxxxxx\Desktop\Bericht Kestler 130813 2.odt
2013-08-14 23:01 - 2013-08-14 23:00 - 00000000 ____D C:\Windows\system32\MRT
2013-08-14 23:00 - 2013-05-25 22:25 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-14 16:43 - 2013-08-13 13:00 - 00032080 _____ C:\Users\Bernd xxxxxxxxx\Desktop\Bericht Kestler 130813.odt
2013-08-07 18:06 - 2013-08-06 21:31 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-08-05 15:02 - 2013-08-05 15:02 - 00015115 _____ C:\Users\Bernd xxxxxxxxx\Desktop\Würstel 050813.ods
2013-08-05 14:59 - 2013-08-05 14:59 - 00007168 _____ C:\Users\Bernd xxxxxxxxx\Desktop\050813.xls
Files to move or delete:
====================
C:\Users\BERNDK~1\AppData\Local\Temp\msvbvm60.dll
C:\Users\BERNDK~1\AppData\Local\Temp\nv3DVStreaming.dll
C:\Users\BERNDK~1\AppData\Local\Temp\nvSCPAPI.dll
C:\Users\BERNDK~1\AppData\Local\Temp\nvStereoApiI.dll
C:\Users\BERNDK~1\AppData\Local\Temp\nvStInst.exe
C:\Users\BERNDK~1\AppData\Local\Temp\swfo.exe
C:\Users\BERNDK~1\AppData\Local\Temp\vcredist_x64.exe
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\BrC3Rgin.exe
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\BrLogRx.exe
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\difxapi.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\MSVCP60.DLL
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\ControlCenter\brccjpn.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\ContrlCenter\maxutil.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\ContrlCenter\pperr.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BrmfcwndBul.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BrmfcwndChn.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BrmfcwndCht.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BrmfcwndCze.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BrmfcwndDan.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BrmfcwndDut.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BrmfcwndEng.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BrmfcwndFin.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BrmfcwndFrc.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BrmfcwndFre.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BrmfcwndGer.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BrmfcwndHun.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BrmfcwndIta.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BrmfcwndJpn.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BrmfcwndNor.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BrmfcwndPol.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BrmfcwndPor.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BrmfcwndPtb.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BrmfcwndRom.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BrmfcwndRus.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BrmfcwndSpa.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BrmfcwndSvk.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BrmfcwndSwe.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BrmfcwndTrk.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BrmfcwndUsa.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BroSNMP.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon\BrDbgOut.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon\BrFirmUpdateCheck.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon\BRHOOK.DLL
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon\brif03a.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon\brlm03a.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon\BRLMW03A.DLL
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon\BrMfcMon.exe
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon\BrMfcWnd.exe
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon\BrMfimon.exe
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\setup.exe
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\NvVAD\nvaudcap32v.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\NvVAD\nvaudcap64v.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\NvVAD\nvgenco32.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\NvVAD\nvgenco64.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\NVI2\NVI2.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\NVI2\NVI2UI.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\NVI2\NVPrxy32.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\NVI2\NVPrxy64.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\NVI2\ReleaseHighlights.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\MS.NET\dotNetFx40_Full_setup.exe
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\MS.NET\MSNetExt.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\x86\server\clrzmq.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\x86\server\detoured.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\x86\server\libzmq.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\x86\server\nvFBC.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\x86\server\nvsteamsupport.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\x86\server\nvstreamer.exe
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\x86\server\nvstreamsvc.exe
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\x86\server\protobuf-net.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\x86\server\rxinput.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\x86\server\steam_api.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\SteamLauncher\NVIDIA.SteamLauncher.exe
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\amd64\server\detoured.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\amd64\server\libzmq.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\amd64\server\nvFBC.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\amd64\server\nvsteamsupport.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\amd64\server\nvstreamer.exe
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\amd64\server\nvstreamsvc.exe
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\amd64\server\rxinput.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\amd64\server\steam_api64.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\7z.exe
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\DisplayCplExt.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\ExtensionLoader.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\GalaSoft.MvvmLight.Extras.WPF4.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\GalaSoft.MvvmLight.WPF4.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\GFExperience.exe
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\GFExperienceControls.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\GFExperienceCore.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\GFExperienceExt.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\GridService.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\InstallerService.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\InstallerUIExtension.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\log4net.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\Microsoft.Practices.ServiceLocation.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\Microsoft.WindowsAPICodePack.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\Microsoft.WindowsAPICodePack.Shell.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\NVIDIA.Settings.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\NVIDIA.Settings.Properties.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\NVIDIA.UpdateService.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\NVIDIA.Win32Api.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\nvtmru.exe
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\oaremote_plugin.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\ShadowPlay.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\System.Reactive.Core.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\System.Reactive.Interfaces.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\System.Reactive.Linq.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\System.Reactive.PlatformServices.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\System.Reactive.Providers.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\System.Reactive.Runtime.Remoting.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\System.Reactive.Windows.Threading.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\System.Windows.Interactivity.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\zh-CHT\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\zh-CHS\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\tr-TR\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\th-TH\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\sv-SE\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\sl-SI\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\sk-SK\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\ru-RU\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\pt-PT\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\pt-BR\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\pl-PL\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\nl-NL\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\nb-NO\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\ko-KR\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\ja-JP\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\it-IT\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\hu-HU\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\he-IL\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\fr-FR\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\fi-FI\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\es-MX\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\es-ES\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\en-US\GFExperience.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\en-US\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\en-GB\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\el-GR\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\de-DE\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\da-DK\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\cs-CZ\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\ar-AE\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\Display.Update\ComUpdatus.exe
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\Display.Update\daemonu.exe
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\Display.Update\easyDaemonAPIU32.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\Display.Update\easyDaemonAPIU64.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\Display.Update\nvupdt32.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\Display.Update\nvupdt64.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\Display.Update\nvupdtr32.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\Display.Update\nvupdtr64.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\Display.Update\nvupdtrXP32.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\Display.Update\nvupdtrXP64.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\Display.Update\nvupdtXP32.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\Display.Update\nvupdtXP64.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\Display.Update\UpdateExt.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\Display.Update\WLMerger.exe
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\Display.Optimus\OptimusExt.dll
C:\Users\BERNDK~1\AppData\Local\Temp\nsd5FCD.tmp\DropboxNSISTools.dll
C:\Users\BERNDK~1\AppData\Local\Temp\nsd5FCD.tmp\UAC.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\dotNetFx40LP_Full_x86_x64de.exe
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Setup.exe
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\SetupEngine.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\SetupUi.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\SetupUtility.exe
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\sqmapi.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\3082\SetupResources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\3076\SetupResources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\2070\SetupResources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\2052\SetupResources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1055\SetupResources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1053\SetupResources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1049\SetupResources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1046\SetupResources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1045\SetupResources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1044\SetupResources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1043\SetupResources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1042\SetupResources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1041\SetupResources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1040\SetupResources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1038\SetupResources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1037\SetupResources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1036\SetupResources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1035\SetupResources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1033\SetupResources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1032\SetupResources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1031\SetupResources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1030\SetupResources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1029\SetupResources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1028\SetupResources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1025\SetupResources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F0_Vb5db.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F10_Lffax90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F11_Lffpx7.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F12_Lffpx90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F13_Lfgif90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F14_Lfica90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F15_Lfimg90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F16_Lfkodak.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F17_Lflma90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F18_Lflmb90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F19_Lfmac90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F20_Lfmsp90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F21_Lfpcd90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F22_Lfpct90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F23_Lfpcx90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F24_Lfpng90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F25_Lfpsd90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F26_Lfras90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F27_Lftga90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F28_Lftif90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F29_Lfwfx90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F2_dao360.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F30_Lfwmf90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F31_Lfwpg90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F32_Ltdis90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F33_Ltdlg90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F34_Ltefx90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F35_Ltfil90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F36_Ltimg90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F37_Ltkrn90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F38_Lttwn90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F39_msrepl35.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F3_Lfavi90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F40_Pcdlib32.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F42_msvbvm60.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F43_swfo.exe
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F4_Lfawd90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F5_Lfbmp90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F6_Lfcal90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F7_Lfcmp90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F860_HLDplus.EXE
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F8_Lfdic90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F9_Lfeps90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\iwexec.exe
C:\Users\BERNDK~1\AppData\Local\Temp\installtemp\InstMsiA.exe
C:\Users\BERNDK~1\AppData\Local\Temp\installtemp\InstMsiW.exe
C:\Users\BERNDK~1\AppData\Local\Temp\installtemp\MDAC_TYP.EXE
C:\Users\BERNDK~1\AppData\Local\Temp\installtemp\setup.exe
C:\Users\BERNDK~1\AppData\Local\Temp\installtemp\shlwapi.dll
C:\Users\BERNDK~1\AppData\Local\Temp\installtemp\wininet.dll
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-09-01 02:57
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 03-09-2013 03
Ran by Bernd xxxxxxxx at 2013-09-04 18:14:15
Running from C:\Users\Bernd xxxxxxxx\Desktop
Boot Mode: Normal
==========================================================
==================== Installed Programs =======================
Adobe AIR (x32 Version: 3.7.0.1860)
Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.94)
Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03)
Ask Toolbar (x32 Version: 1.15.26.0)
Avira Free Antivirus (x32 Version: 13.0.0.4052)
Avira SearchFree Toolbar plus Web Protection Updater (HKCU Version: 1.2.6.45268)
Brother MFL-Pro Suite MFC-6890CDW (x32 Version: 1.0.1.0)
Dropbox (HKCU Version: 2.2.3)
FreePDF (Remove only) (x32)
GPL Ghostscript (Version: 9.07)
HERMA Label Designer plus 1.1 (x32 Version: 1.00.0000)
Java 7 Update 21 (64-bit) (Version: 7.0.210)
Java 7 Update 25 (x32 Version: 7.0.250)
Java Auto Updater (x32 Version: 2.1.9.5)
KeyMan V4.0 Build 6 (x32 Version: 4.0.0.6)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (x32 Version: 11.0.51106.1)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.51106 (Version: 11.0.51106)
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.51106 (Version: 11.0.51106)
Mozilla Firefox 23.0.1 (x86 de) (x32 Version: 23.0.1)
Mozilla Maintenance Service (x32 Version: 23.0.1)
Mozilla Thunderbird 17.0.8 (x86 de) (x32 Version: 17.0.8)
MyPhoneExplorer (x32 Version: 1.8.4)
NVIDIA 3D Vision Controller-Treiber 320.49 (Version: 320.49)
NVIDIA 3D Vision Treiber 320.49 (Version: 320.49)
NVIDIA GeForce Experience 1.6 (Version: 1.6)
NVIDIA Grafiktreiber 320.49 (Version: 320.49)
NVIDIA HD-Audiotreiber 1.3.24.2 (Version: 1.3.24.2)
NVIDIA Install Application (Version: 2.1002.131.854)
NVIDIA PhysX (x32 Version: 9.13.0604)
NVIDIA PhysX-Systemsoftware 9.13.0604 (Version: 9.13.0604)
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.2049)
NVIDIA Systemsteuerung 320.49 (Version: 320.49)
NVIDIA Update 7.2.17 (Version: 7.2.17)
NVIDIA Update Components (Version: 7.2.17)
NVIDIA Virtual Audio 1.2.1 (Version: 1.2.1)
OpenOffice 4.0.0 (x32 Version: 4.00.9702)
P 2.8.6 (Version: 2.8.6)
RedMon - Redirection Port Monitor
Scribus 1.4.3 (64bit) (Version: 1.4.3)
SHIELD Streaming (Version: 1.05.19)
Skype™ 6.7 (x32 Version: 6.7.102)
Trust GXT14 Mouse (x32 Version: 1.2)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1)
VLC media player 2.0.6 (x32 Version: 2.0.6)
==================== Restore Points =========================
17-08-2013 10:47:37 OpenOffice 4.0.0 wird installiert
24-08-2013 18:53:41 Geplanter Prüfpunkt
01-09-2013 00:57:49 Geplanter Prüfpunkt
03-09-2013 10:08:34 Wiederherstellungsvorgang
03-09-2013 20:13:18 Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106
==================== Hosts content: ==========================
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {044A6734-E90E-4F8F-B357-B2DC8AB3B5EC} - System32\Tasks\Microsoft\Windows\Time Synchronization\SynchronizeTime => start w32time task_started
Task: {28F20C52-D689-41A9-AF9C-4E35ADD42809} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-07-18] (Adobe Systems Incorporated)
Task: {32AFA51E-2383-4FFE-A570-D9FD91A3C03D} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files (x86)\Ask.com\UpdateTask.exe [2013-04-30] ()
Task: {D1A393EA-D175-450C-90CA-7FD1BC440A89} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-23] (Microsoft Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) =============
2013-05-25 21:50 - 2013-06-21 14:06 - 15920536 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2013-06-14 01:00 - 2013-06-14 01:00 - 00164016 _____ (Dropbox, Inc.) C:\Users\Bernd xxxxxxxx\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
2013-05-25 21:32 - 2013-06-21 12:23 - 04528416 _____ (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvUI.dll
2013-05-25 21:32 - 2013-07-27 10:35 - 01180448 _____ (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Update Common\easyDaemonAPIU64.DLL
2013-05-25 21:32 - 2013-07-27 10:36 - 04864800 _____ (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Update Common\NvUpdt.dll
2013-05-25 21:32 - 2013-07-27 10:36 - 01662240 _____ (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Update Common\NVUPDTR.DLL
2013-05-31 16:08 - 2009-02-27 16:38 - 00139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll
2013-05-31 16:08 - 2008-12-14 09:11 - 00163840 ____N (Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BRMFCWNDGer.dll
2009-07-14 02:29 - 2009-07-14 03:38 - 00701952 _____ (Microsoft Corporation) C:\Windows\system32\hhctrl.ocx
2010-09-28 09:18 - 2010-09-28 09:18 - 00716852 _____ (ZF Electronics GmbH) C:\Program Files (x86)\Cherry\KeyMan\ComLib.dll
2006-02-22 14:47 - 2006-02-22 14:47 - 00073728 ____R () C:\Program Files (x86)\Cherry\KeyMan\zlib1.dll
2006-02-22 14:47 - 2006-02-22 14:47 - 00114688 ____R () C:\Program Files (x86)\Cherry\KeyMan\libpng13.dll
2007-10-23 07:10 - 2007-10-23 07:10 - 00041019 _____ (Cherry GmbH) C:\Program Files (x86)\Common Files\Cherry\Common\RCM00.dll
2010-08-30 14:14 - 2010-08-30 14:14 - 00106563 _____ (ZF Electronics GmbH) C:\Program Files (x86)\Common Files\Cherry\Common\csf01.dll
2010-06-17 12:05 - 2010-06-17 12:05 - 00038400 _____ (ZF Electronics GmbH) C:\Program Files (x86)\Common Files\Cherry\Common\volumeinterface.dll
2010-09-28 09:18 - 2010-09-28 09:18 - 00036864 _____ (ZF Electronics GmbH) C:\PROGRAM FILES (X86)\CHERRY\KEYMAN\KEYMAN_DE.DLL
2010-09-28 09:18 - 2010-09-28 09:18 - 00032768 _____ (ZF Electronics GmbH) C:\PROGRAM FILES (X86)\CHERRY\KEYMAN\COMLIB_DE.DLL
2010-08-30 14:16 - 2010-08-30 14:16 - 00028672 ____R (ZF Electronics GmbH) C:\Program Files (x86)\Common Files\Cherry\Common\csf01_de.dll
2011-03-14 11:42 - 2011-03-14 11:42 - 00138352 _____ (ZF Electronics GmbH) C:\Program Files (x86)\Common Files\Cherry\Common\ChyTrace00.dll
2009-04-01 08:58 - 2009-04-01 08:58 - 00106553 _____ (ZF Electronics GmbH) C:\Program Files (x86)\Common Files\Cherry\Common\CFI.dll
2010-09-28 09:19 - 2010-09-28 09:19 - 00090175 _____ (ZF Electronics GmbH) C:\Program Files (x86)\Cherry\KeyMan\plugins\universal.dll
2011-12-21 10:02 - 2011-12-21 10:02 - 00069695 _____ (ZF Electronics GmbH) C:\Program Files (x86)\Common Files\Cherry\Common\KbdHook00.dll
2013-05-31 16:08 - 2009-03-06 12:51 - 00770048 ____N (Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\brccDCtl.dll
2013-05-31 16:08 - 2008-10-21 19:41 - 00159744 ____N (Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\brccger.dll
2013-05-31 16:08 - 2008-07-22 21:24 - 05390336 ____N (Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\brccimg.dll
2013-05-31 16:08 - 2009-05-11 13:48 - 00372736 ____N (Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\brccFCtl.dll
2013-05-31 16:08 - 2003-06-30 00:00 - 00259584 ____N (LEAD Technologies, Inc.) C:\Program Files (x86)\Brother\ControlCenter3\LTDIS12n.dll
2013-05-31 16:08 - 2003-06-30 00:00 - 00406016 ____N (LEAD Technologies, Inc.) C:\Program Files (x86)\Brother\ControlCenter3\LTKRN12n.dll
2013-05-31 16:08 - 2005-07-05 00:00 - 00131584 ____N (LEAD Technologies, Inc.) C:\Program Files (x86)\Brother\ControlCenter3\LTFIL12n.DLL
2013-05-31 16:08 - 2008-02-05 19:17 - 00176128 ____N (Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BroSNMP.dll
2013-05-25 22:14 - 2012-10-16 09:39 - 00561664 _____ (Microsoft Corporation) C:\Windows\AppPatch\AcLayers.DLL
2009-05-04 11:22 - 2007-03-29 06:17 - 00106496 _____ () C:\Program Files (x86)\Trust\GXT14 Mouse\keydll.dll
2009-05-04 11:22 - 2009-03-02 06:45 - 00042496 _____ () C:\Program Files (x86)\Trust\GXT14 Mouse\MouseHook.dll
2013-08-17 12:42 - 2013-08-17 12:42 - 03551640 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2013-06-21 05:16 - 2013-06-21 05:16 - 00575984 _____ (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\Nv3DVStreaming.dll
2013-06-21 05:16 - 2013-06-21 05:16 - 00361744 _____ (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvStereoApiI.dll
2013-06-21 05:16 - 2013-06-21 05:16 - 01154832 _____ (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPI.dll
==================== Alternate Data Streams (whitelisted) ==========
==================== Faulty Device Manager Devices =============
Name: Realtek PCIe GBE Family Controller
Description: Realtek PCIe GBE Family Controller
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Realtek
Service: RTL8167
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (09/04/2013 06:09:43 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.6195"1".
Die abhängige Assemblierung "Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.6195"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (09/04/2013 06:08:17 PM) (Source: NvStreamSvc) (User: )
Description: NvStreamSvcUnregistering VAD endpoint [0]
Error: (09/04/2013 06:08:17 PM) (Source: NvStreamSvc) (User: )
Description: NvStreamSvcNvVAD endpoint registered successfully [0]
Error: (09/04/2013 08:56:56 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.6195"1".
Die abhängige Assemblierung "Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.6195"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (09/04/2013 08:56:46 AM) (Source: NvStreamSvc) (User: )
Description: NvStreamSvcUnregistering VAD endpoint [0]
Error: (09/04/2013 08:56:45 AM) (Source: NvStreamSvc) (User: )
Description: NvStreamSvcNvVAD endpoint registered successfully [0]
Error: (09/03/2013 02:55:36 PM) (Source: Application Hang) (User: )
Description: Programm firefox.exe, Version 23.0.1.4974 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 924
Startzeit: 01cea8a4ada73a56
Endzeit: 18
Anwendungspfad: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Berichts-ID: 1df94bab-1498-11e3-81d0-bcaec523b6bf
Error: (09/03/2013 00:10:30 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.6195"1".
Die abhängige Assemblierung "Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.6195"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (09/03/2013 00:10:04 PM) (Source: NvStreamSvc) (User: )
Description: NvStreamSvcUnregistering VAD endpoint [0]
Error: (09/03/2013 00:10:03 PM) (Source: NvStreamSvc) (User: )
Description: NvStreamSvcNvVAD endpoint registered successfully [0]
System errors:
=============
Error: (09/04/2013 06:08:13 PM) (Source: Ntfs) (User: )
Description: Auf dem Volume "L:" konnte der Transaktionsressourcen-Manager aufgrund eines nicht wiederholbaren Fehlers nicht gestartet werden. Der Fehlercode ist in den Daten enthalten.
Error: (09/04/2013 08:56:42 AM) (Source: Ntfs) (User: )
Description: Auf dem Volume "L:" konnte der Transaktionsressourcen-Manager aufgrund eines nicht wiederholbaren Fehlers nicht gestartet werden. Der Fehlercode ist in den Daten enthalten.
Error: (09/03/2013 00:10:00 PM) (Source: Ntfs) (User: )
Description: Auf dem Volume "L:" konnte der Transaktionsressourcen-Manager aufgrund eines nicht wiederholbaren Fehlers nicht gestartet werden. Der Fehlercode ist in den Daten enthalten.
Error: (09/03/2013 09:28:09 AM) (Source: Ntfs) (User: )
Description: Auf dem Volume "L:" konnte der Transaktionsressourcen-Manager aufgrund eines nicht wiederholbaren Fehlers nicht gestartet werden. Der Fehlercode ist in den Daten enthalten.
Error: (09/03/2013 09:27:20 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst Gruppenrichtlinienclient konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden.
Error: (09/03/2013 09:04:32 AM) (Source: Ntfs) (User: )
Description: Auf dem Volume "L:" konnte der Transaktionsressourcen-Manager aufgrund eines nicht wiederholbaren Fehlers nicht gestartet werden. Der Fehlercode ist in den Daten enthalten.
Error: (09/02/2013 10:58:56 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst Gruppenrichtlinienclient konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden.
Error: (09/02/2013 10:37:34 PM) (Source: DCOM) (User: )
Description: {005A3A96-BAC4-4B0A-94EA-C0CE100EA736}
Error: (09/02/2013 09:39:20 PM) (Source: Ntfs) (User: )
Description: Auf dem Volume "L:" konnte der Transaktionsressourcen-Manager aufgrund eines nicht wiederholbaren Fehlers nicht gestartet werden. Der Fehlercode ist in den Daten enthalten.
Error: (09/02/2013 04:51:29 PM) (Source: Ntfs) (User: )
Description: Auf dem Volume "L:" konnte der Transaktionsressourcen-Manager aufgrund eines nicht wiederholbaren Fehlers nicht gestartet werden. Der Fehlercode ist in den Daten enthalten.
Microsoft Office Sessions:
=========================
Error: (09/04/2013 06:09:43 PM) (Source: SideBySide)(User: )
Description: Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.6195"C:\Program Files (x86)\Common Files\Cherry\Common\KbdHook64_00.DLL
Error: (09/04/2013 06:08:17 PM) (Source: NvStreamSvc)(User: )
Description: NvStreamSvcUnregistering VAD endpoint [0]
Error: (09/04/2013 06:08:17 PM) (Source: NvStreamSvc)(User: )
Description: NvStreamSvcNvVAD endpoint registered successfully [0]
Error: (09/04/2013 08:56:56 AM) (Source: SideBySide)(User: )
Description: Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.6195"C:\Program Files (x86)\Common Files\Cherry\Common\KbdHook64_00.DLL
Error: (09/04/2013 08:56:46 AM) (Source: NvStreamSvc)(User: )
Description: NvStreamSvcUnregistering VAD endpoint [0]
Error: (09/04/2013 08:56:45 AM) (Source: NvStreamSvc)(User: )
Description: NvStreamSvcNvVAD endpoint registered successfully [0]
Error: (09/03/2013 02:55:36 PM) (Source: Application Hang)(User: )
Description: firefox.exe23.0.1.497492401cea8a4ada73a5618C:\Program Files (x86)\Mozilla Firefox\firefox.exe1df94bab-1498-11e3-81d0-bcaec523b6bf
Error: (09/03/2013 00:10:30 PM) (Source: SideBySide)(User: )
Description: Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.6195"C:\Program Files (x86)\Common Files\Cherry\Common\KbdHook64_00.DLL
Error: (09/03/2013 00:10:04 PM) (Source: NvStreamSvc)(User: )
Description: NvStreamSvcUnregistering VAD endpoint [0]
Error: (09/03/2013 00:10:03 PM) (Source: NvStreamSvc)(User: )
Description: NvStreamSvcNvVAD endpoint registered successfully [0]
==================== Memory info ===========================
Percentage of memory in use: 23%
Total physical RAM: 8190.05 MB
Available physical RAM: 6248.94 MB
Total Pagefile: 16378.29 MB
Available Pagefile: 14335.32 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:111.69 GB) (Free:69.29 GB) NTFS
Drive d: (1GB-Haupt) (Fixed) (Total:931.51 GB) (Free:240.95 GB) NTFS
Drive e: (Volume) (Fixed) (Total:931.51 GB) (Free:254.46 GB) NTFS
Drive f: () (Fixed) (Total:465.75 GB) (Free:144.08 GB) NTFS
Drive l: (Volume) (Fixed) (Total:0.01 GB) (Free:0 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 932 GB) (Disk ID: 0002B9CC)
Partition 1: (Active) - (Size=932 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 112 GB) (Disk ID: 000B3AA0)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=112 GB) - (Type=07 NTFS)
========================================================
Disk: 2 (Size: 466 GB) (Disk ID: 00081D3C)
Partition 1: (Active) - (Size=466 GB) - (Type=42)
Partition 2: (Not Active) - (Size=9 MB) - (Type=42)
========================================================
Disk: 3 (Size: 932 GB) (Disk ID: 00004B4E)
Partition 1: (Not Active) - (Size=932 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-09-04 18:41:38
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP2T0L0-2 OCZ-VERTEX3 rev.2.06 111,79GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\BERNDK~1\AppData\Local\Temp\fgldypob.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Ask.com\Updater\Updater.exe[1812] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075bc1465 2 bytes [BC, 75]
.text C:\Program Files (x86)\Ask.com\Updater\Updater.exe[1812] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075bc14bb 2 bytes [BC, 75]
.text ... * 2
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0009dd5086ba
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0009dd5086ba (not active ControlSet)
---- EOF - GMER 2.1 ----
LG Bernd |
|
04.09.2013, 20:23
| #2 | |
| /// the machine /// TB-Ausbilder    | Win7 Avira Free Antivir meldet TR/Xcrypt.Xpack.8884. Rechner aber schon länger immer langsamer hi,
__________________Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!Downloade dir bitte Combofix vom folgenden Downloadspiegel Link 1 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
__________________ |
|
05.09.2013, 09:11
| #3 |
| | Win7 Avira Free Antivir meldet TR/Xcrypt.Xpack.8884. Rechner aber schon länger immer langsamer Hallo Schrauber,
__________________vielen Dank für die rasche Antwort. Hier die Log-Datei von Combofix: Code:
ATTFilter ComboFix 13-09-04.04 - Bernd xxxxxxxxx 05.09.2013 9:54.1.4 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1252.49.1031.18.8190.6683 [GMT 2:00]
ausgeführt von:: c:\users\Bernd xxxxxxxxx\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\BrowserDefender
c:\programdata\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\bl
c:\programdata\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserDefender.settings
c:\programdata\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\dm
c:\programdata\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\00
c:\programdata\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\01
c:\programdata\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\02
c:\programdata\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\03
c:\programdata\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\10
c:\programdata\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\11
c:\programdata\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\12
c:\programdata\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\13
c:\programdata\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\20
c:\programdata\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\21
c:\programdata\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\22
c:\programdata\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\23
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-08-05 bis 2013-09-05 ))))))))))))))))))))))))))))))
.
.
2013-09-05 07:57 . 2013-09-05 07:57 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2013-09-05 07:57 . 2013-09-05 07:57 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-09-04 16:13 . 2013-09-04 16:13 -------- d-----w- C:\FRST
2013-09-03 20:32 . 2013-09-03 21:17 -------- d-----w- c:\users\Bernd xxxxxxxxx\AppData\Roaming\Scribus
2013-09-03 20:13 . 2013-09-03 20:13 -------- d-----w- c:\programdata\Package Cache
2013-09-03 20:12 . 2013-09-03 20:13 -------- d-----w- c:\program files\Scribus 1.4.3
2013-09-03 19:46 . 2013-09-03 19:46 -------- d-----w- c:\users\Bernd xxxxxxxxx\AppData\Local\ElevatedDiagnostics
2013-09-03 19:45 . 2013-09-03 19:45 -------- d-----w- c:\users\Bernd xxxxxxxxx\AppData\Local\Diagnostics
2013-08-17 10:49 . 2013-08-17 10:49 -------- d-----w- c:\users\Bernd xxxxxxxxx\AppData\Roaming\OpenOffice
2013-08-17 10:48 . 2013-08-17 10:48 -------- d-----w- c:\program files (x86)\OpenOffice 4
2013-08-14 21:00 . 2013-08-14 21:01 -------- d-----w- c:\windows\system32\MRT
2013-08-06 19:31 . 2013-08-07 16:06 -------- d-----w- c:\program files (x86)\Mozilla Thunderbird
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-09-03 10:12 . 2013-05-27 20:31 81112 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2013-09-03 10:12 . 2013-05-25 19:46 132088 ----a-w- c:\windows\system32\drivers\avipbb.sys
2013-09-03 10:12 . 2013-05-25 19:46 105344 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2013-08-14 21:00 . 2013-05-25 20:25 78161360 ----a-w- c:\windows\system32\MRT.exe
2013-07-18 17:49 . 2013-07-18 17:49 397312 ----a-w- c:\windows\iwexec.exe
2013-07-18 17:49 . 2013-07-18 17:49 98304 ----a-w- c:\windows\SysWow64\Ltfil90n.dll
2013-07-18 17:49 . 2013-07-18 17:49 89360 ----a-w- c:\windows\SysWow64\Vb5db.dll
2013-07-18 17:49 . 2013-07-18 17:49 88576 ----a-w- c:\windows\SysWow64\Lffpx90n.dll
2013-07-18 17:49 . 2013-07-18 17:49 83144 ----a-w- c:\windows\SysWow64\picclp32.ocx
2013-07-18 17:49 . 2013-07-18 17:49 64512 ----a-w- c:\windows\SysWow64\Lffax90n.dll
2013-07-18 17:49 . 2013-07-18 17:49 557328 ----a-w- c:\windows\SysWow64\dao360.dll
2013-07-18 17:49 . 2013-07-18 17:49 46592 ----a-w- c:\windows\SysWow64\Lfica90n.dll
2013-07-18 17:49 . 2013-07-18 17:49 415504 ----a-w- c:\windows\SysWow64\msrepl35.dll
2013-07-18 17:49 . 2013-07-18 17:49 39936 ----a-w- c:\windows\SysWow64\Lfgif90n.dll
2013-07-18 17:49 . 2013-07-18 17:49 35840 ----a-w- c:\windows\SysWow64\Lflma90n.dll
2013-07-18 17:49 . 2013-07-18 17:49 35328 ----a-w- c:\windows\SysWow64\Lttwn90n.dll
2013-07-18 17:49 . 2013-07-18 17:49 338944 ----a-w- c:\windows\SysWow64\Lffpx7.dll
2013-07-18 17:49 . 2013-07-18 17:49 33792 ----a-w- c:\windows\SysWow64\Lfbmp90n.dll
2013-07-18 17:49 . 2013-07-18 17:49 31232 ----a-w- c:\windows\SysWow64\Lfpct90n.dll
2013-07-18 17:49 . 2013-07-18 17:49 31232 ----a-w- c:\windows\SysWow64\Lflmb90n.dll
2013-07-18 17:49 . 2013-07-18 17:49 31232 ----a-w- c:\windows\SysWow64\Lfeps90n.dll
2013-07-18 17:49 . 2013-07-18 17:49 30720 ----a-w- c:\windows\SysWow64\Lfpcx90n.dll
2013-07-18 17:49 . 2013-07-18 17:49 29184 ----a-w- c:\windows\SysWow64\Lfpsd90n.dll
2013-07-18 17:49 . 2013-07-18 17:49 288256 ----a-w- c:\windows\SysWow64\Ltkrn90n.dll
2013-07-18 17:49 . 2013-07-18 17:49 28672 ----a-w- c:\windows\SysWow64\Lfawd90n.dll
2013-07-18 17:49 . 2013-07-18 17:49 28160 ----a-w- c:\windows\SysWow64\Lfwmf90n.dll
2013-07-18 17:49 . 2013-07-18 17:49 28160 ----a-w- c:\windows\SysWow64\Lftga90n.dll
2013-07-18 17:49 . 2013-07-18 17:49 27648 ----a-w- c:\windows\SysWow64\Lfwpg90n.dll
2013-07-18 17:49 . 2013-07-18 17:49 27136 ----a-w- c:\windows\SysWow64\Lfimg90n.dll
2013-07-18 17:49 . 2013-07-18 17:49 26624 ----a-w- c:\windows\SysWow64\Lfpcd90n.dll
2013-07-18 17:49 . 2013-07-18 17:49 26624 ----a-w- c:\windows\SysWow64\Lfcal90n.dll
2013-07-18 17:49 . 2013-07-18 17:49 26112 ----a-w- c:\windows\SysWow64\Lfras90n.dll
2013-07-18 17:49 . 2013-07-18 17:49 26112 ----a-w- c:\windows\SysWow64\Lfmsp90n.dll
2013-07-18 17:49 . 2013-07-18 17:49 25600 ----a-w- c:\windows\SysWow64\Lfwfx90n.dll
2013-07-18 17:49 . 2013-07-18 17:49 25600 ----a-w- c:\windows\SysWow64\Lfmac90n.dll
2013-07-18 17:49 . 2013-07-18 17:49 24576 ----a-w- c:\windows\SysWow64\Lfavi90n.dll
2013-07-18 17:49 . 2013-07-18 17:49 236032 ----a-w- c:\windows\SysWow64\Lfdic90n.dll
2013-07-18 17:49 . 2013-07-18 17:49 235008 ----a-w- c:\windows\SysWow64\Lfcmp90n.dll
2013-07-18 17:49 . 2013-07-18 17:49 220160 ----a-w- c:\windows\SysWow64\Ltdis90n.dll
2013-07-18 17:49 . 2013-07-18 17:49 212480 ----a-w- c:\windows\SysWow64\Pcdlib32.dll
2013-07-18 17:49 . 2013-07-18 17:49 164144 ----a-w- c:\windows\SysWow64\comct232.ocx
2013-07-18 17:49 . 2013-07-18 17:49 146432 ----a-w- c:\windows\SysWow64\Ltefx90n.dll
2013-07-18 17:49 . 2013-07-18 17:49 142336 ----a-w- c:\windows\SysWow64\Ltdlg90n.dll
2013-07-18 17:49 . 2013-07-18 17:49 133632 ----a-w- c:\windows\SysWow64\Lfpng90n.dll
2013-07-18 17:49 . 2013-07-18 17:49 122880 ----a-w- c:\windows\SysWow64\Lfkodak.dll
2013-07-18 17:49 . 2013-07-18 17:49 118272 ----a-w- c:\windows\SysWow64\Lftif90n.dll
2013-07-18 17:49 . 2013-07-18 17:49 107008 ----a-w- c:\windows\SysWow64\Ltimg90n.dll
2013-07-18 16:09 . 2013-05-28 10:37 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-07-18 16:09 . 2013-05-28 10:37 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-07-09 04:45 . 2013-08-14 11:57 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2013-06-24 08:51 . 2013-06-24 08:51 867240 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
2013-06-24 08:51 . 2013-06-24 08:51 789416 ----a-w- c:\windows\SysWow64\deployJava1.dll
2013-06-24 08:51 . 2013-06-24 08:51 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-06-21 12:06 . 2013-07-05 07:03 925648 ----a-w- c:\windows\SysWow64\nvumdshim.dll
2013-06-21 12:06 . 2013-07-05 07:03 9239344 ----a-w- c:\windows\system32\nvcuda.dll
2013-06-21 12:06 . 2013-07-05 07:03 7687592 ----a-w- c:\windows\SysWow64\nvcuda.dll
2013-06-21 12:06 . 2013-07-05 07:03 7641832 ----a-w- c:\windows\system32\nvopencl.dll
2013-06-21 12:06 . 2013-07-05 07:03 6324360 ----a-w- c:\windows\SysWow64\nvopencl.dll
2013-06-21 12:06 . 2013-07-05 07:03 572704 ----a-w- c:\windows\system32\NvFBC64.dll
2013-06-21 12:06 . 2013-07-05 07:03 570656 ----a-w- c:\windows\system32\NvIFR64.dll
2013-06-21 12:06 . 2013-07-05 07:03 467232 ----a-w- c:\windows\SysWow64\NvIFR.dll
2013-06-21 12:06 . 2013-07-05 07:03 465184 ----a-w- c:\windows\SysWow64\NvFBC.dll
2013-06-21 12:06 . 2013-07-05 07:03 2953504 ----a-w- c:\windows\system32\nvcuvid.dll
2013-06-21 12:06 . 2013-07-05 07:03 27781920 ----a-w- c:\windows\system32\nvoglv64.dll
2013-06-21 12:06 . 2013-07-05 07:03 2777888 ----a-w- c:\windows\SysWow64\nvcuvid.dll
2013-06-21 12:06 . 2013-07-05 07:03 266448 ----a-w- c:\windows\system32\nvinitx.dll
2013-06-21 12:06 . 2013-07-05 07:03 25256224 ----a-w- c:\windows\system32\nvcompiler.dll
2013-06-21 12:06 . 2013-07-05 07:03 2363680 ----a-w- c:\windows\system32\nvcuvenc.dll
2013-06-21 12:06 . 2013-07-05 07:03 218592 ----a-w- c:\windows\system32\nvoglshim64.dll
2013-06-21 12:06 . 2013-07-05 07:03 214448 ----a-w- c:\windows\SysWow64\nvinit.dll
2013-06-21 12:06 . 2013-07-05 07:03 21102368 ----a-w- c:\windows\SysWow64\nvoglv32.dll
2013-06-21 12:06 . 2013-07-05 07:03 2002720 ----a-w- c:\windows\SysWow64\nvcuvenc.dll
2013-06-21 12:06 . 2013-07-05 07:03 1832224 ----a-w- c:\windows\system32\nvdispco6432049.dll
2013-06-21 12:06 . 2013-07-05 07:03 181488 ----a-w- c:\windows\SysWow64\nvoglshim32.dll
2013-06-21 12:06 . 2013-07-05 07:03 17560352 ----a-w- c:\windows\SysWow64\nvcompiler.dll
2013-06-21 12:06 . 2013-07-05 07:03 15144928 ----a-w- c:\windows\system32\nvd3dumx.dll
2013-06-21 12:06 . 2013-07-05 07:03 1511712 ----a-w- c:\windows\system32\nvdispgenco6432049.dll
2013-06-21 12:06 . 2013-07-05 07:03 11235104 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2013-06-21 12:06 . 2013-05-25 19:50 2597856 ----a-w- c:\windows\SysWow64\nvapi.dll
2013-06-21 12:06 . 2013-05-25 19:50 15920536 ----a-w- c:\windows\system32\nvwgf2umx.dll
2013-06-21 12:06 . 2013-05-25 19:50 13411896 ----a-w- c:\windows\SysWow64\nvwgf2um.dll
2013-06-21 12:06 . 2013-05-25 19:32 61216 ----a-w- c:\windows\system32\OpenCL.dll
2013-06-21 12:06 . 2013-05-25 19:32 53024 ----a-w- c:\windows\SysWow64\OpenCL.dll
2013-06-21 12:06 . 2013-02-25 22:32 12427240 ----a-w- c:\windows\SysWow64\nvd3dum.dll
2013-06-21 12:06 . 2013-02-25 22:32 2936208 ----a-w- c:\windows\system32\nvapi64.dll
2013-06-21 12:06 . 2013-02-25 22:32 1059560 ----a-w- c:\windows\system32\nvumdshimx.dll
2013-06-21 10:23 . 2013-05-25 19:32 6496544 ----a-w- c:\windows\system32\nvcpl.dll
2013-06-21 10:23 . 2013-05-25 19:32 3514656 ----a-w- c:\windows\system32\nvsvc64.dll
2013-06-21 10:23 . 2013-05-25 19:32 884512 ----a-w- c:\windows\system32\nvvsvc.exe
2013-06-21 10:23 . 2013-05-25 19:32 63776 ----a-w- c:\windows\system32\nvshext.dll
2013-06-21 10:23 . 2013-05-25 19:32 2555680 ----a-w- c:\windows\system32\nvsvcr.dll
2013-06-21 10:23 . 2013-05-25 19:32 237856 ----a-w- c:\windows\system32\nvmctray.dll
2013-06-21 03:16 . 2013-06-21 03:16 566048 ----a-w- c:\windows\SysWow64\nvStreaming.exe
2013-06-20 04:17 . 2013-05-25 19:32 3253909 ----a-w- c:\windows\system32\nvcoproc.bin
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2013-04-30 1521800]
.
[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2013-04-30 10:02 1521800 ----a-w- c:\program files (x86)\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2013-04-30 1521800]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-06-13 23:00 130736 ----a-w- c:\users\Bernd xxxxxxxxx\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-06-13 23:00 130736 ----a-w- c:\users\Bernd xxxxxxxxx\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-06-13 23:00 130736 ----a-w- c:\users\Bernd xxxxxxxxx\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"ApnUpdater"="c:\program files (x86)\Ask.com\Updater\Updater.exe" [2013-04-30 1648264]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-09-03 347192]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-05-11 958576]
"trustGTX14"="c:\program files (x86)\Trust\GXT14 Mouse\POINTERGHOST.exe" [2009-05-11 4832256]
"BrMfcWnd"="c:\program files (x86)\Brother\Brmfcmon\BrMfcWnd.exe" [2009-05-26 1159168]
"ControlCenter3"="c:\program files (x86)\Brother\ControlCenter3\brctrcen.exe" [2008-12-24 114688]
"CherryKeyMan"="c:\program files (x86)\Cherry\KeyMan\KeyMan.exe" [2010-09-28 254004]
"FreePDF Assistant"="c:\program files (x86)\FreePDF_XP\fpassist.exe" [2013-03-14 373760]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"AppInit_DLLs"=c:\progra~2\NVIDIA~1\NVSTRE~1\rxinput.dll
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [x]
S2 KmGameMouseServiceV1;Game Mouse Communication And Update Service V1;c:\program files (x86)\Trust\GXT14 Mouse\GameMouseServiceApp.exe;c:\program files (x86)\Trust\GXT14 Mouse\GameMouseServiceApp.exe [x]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 UMVPFSrv;UMVPFSrv;c:\program files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe;c:\program files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [x]
S3 Cherry Device Interface;Cherry Device Interface;c:\program files (x86)\Cherry\CDI\cdi.exe;c:\program files (x86)\Cherry\CDI\cdi.exe [x]
S3 CompFilter64;UVCCompositeFilter;c:\windows\system32\DRIVERS\lvbflt64.sys;c:\windows\SYSNATIVE\DRIVERS\lvbflt64.sys [x]
S3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys;c:\windows\SYSNATIVE\DRIVERS\lvrs64.sys [x]
S3 LVUVC64;Logitech HD Webcam C510(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys;c:\windows\SYSNATIVE\DRIVERS\lvuvc64.sys [x]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2013-09-05 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-05-28 16:09]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-06-13 23:00 164016 ----a-w- c:\users\Bernd xxxxxxxxx\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-06-13 23:00 164016 ----a-w- c:\users\Bernd xxxxxxxxx\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-06-13 23:00 164016 ----a-w- c:\users\Bernd xxxxxxxxx\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-06-13 23:00 164016 ----a-w- c:\users\Bernd xxxxxxxxx\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Nvtmru"="c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe" [2013-07-27 1028896]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\progra~1\NVIDIA~1\NVSTRE~1\rxinput.dll
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://search.avira.com/?l=dis&o=APN10261&gct=hp&dc=EU&locale=de_DE
mLocal Page = c:\windows\SysWOW64\blank.htm
LSP: c:\program files (x86)\Avira\AntiVir Desktop\avsda.dll
TCP: DhcpNameServer = 172.16.0.1
FF - ProfilePath - c:\users\Bernd xxxxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\towj3uha.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www1.delta-search.com/?babsrc=HP_ss&mntrId=24A400242CE6FFE4&affID=120692&tsp=4944
FF - user.js: extensions.autoDisableScopes - 10
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
Wow6432Node-HKU-Default-RunOnce-SPReview - c:\windows\System32\SPReview\SPReview.exe
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-09-05 09:59:00
ComboFix-quarantined-files.txt 2013-09-05 07:59
.
Vor Suchlauf: 11 Verzeichnis(se), 74.272.657.408 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 74.884.640.768 Bytes frei
.
- - End Of File - - DA52CFD470C8ABDB264B65F26F5B3A40
C06575B18B90345CE86AB291B56DB94D
|
|
05.09.2013, 10:49
| #4 |
| /// the machine /// TB-Ausbilder | Win7 Avira Free Antivir meldet TR/Xcrypt.Xpack.8884. Rechner aber schon länger immer langsamer Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
05.09.2013, 19:21
| #5 |
| | Win7 Avira Free Antivir meldet TR/Xcrypt.Xpack.8884. Rechner aber schon länger immer langsamer Hallo Schrauber, hier die gewünschten Log's: Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.09.05.04 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16660 Bernd xxxxxxxx :: BERNDxxxxxxxx [Administrator] Schutz: Aktiviert 05.09.2013 12:00:07 mbam-log-2013-09-05 (12-00-07).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|L:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 737303 Laufzeit: 1 Stunde(n), 29 Minute(n), 32 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 3 C:\Users\Bernd xxxxxxxx\AppData\Roaming\Babylon (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Bernd xxxxxxxx\AppData\Roaming\BabSolution (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Bernd xxxxxxxx\AppData\Roaming\BabSolution\CR (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateien: 4 C:\Users\Bernd xxxxxxxx\Downloads\MyPhoneExplorer_Setup_1.8.4.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. D:\Computing\DTLite4471-0333.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Bernd xxxxxxxx\AppData\Roaming\Babylon\log_file.txt (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Bernd xxxxxxxx\AppData\Roaming\BabSolution\CR\Delta.crx (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) Code:
ATTFilter # AdwCleaner v3.002 - Bericht erstellt am 05/09/2013 um 16:16:40
# Updated 01/09/2013 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : Bernd xxxxxxxxx - BERNDxxxxxxxxx
# Gestartet von : C:\Users\Bernd xxxxxxxxx\Desktop\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\Program Files (x86)\Ask.com
Ordner Gelöscht : C:\Users\Bernd xxxxxxxxx\AppData\Local\AskToolbar
Ordner Gelöscht : C:\Users\Bernd xxxxxxxxx\AppData\LocalLow\AskToolbar
Ordner Gelöscht : C:\Users\Bernd xxxxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\towj3uha.default\Extensions\ffxtlbr@delta.com
Datei Gelöscht : C:\Users\Bernd xxxxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\towj3uha.default\bprotector_extensions.sqlite
Datei Gelöscht : C:\Users\Bernd xxxxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\towj3uha.default\searchplugins\Babylon.xml
Datei Gelöscht : C:\Users\Bernd xxxxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\towj3uha.default\searchplugins\delta.xml
Datei Gelöscht : C:\Users\Bernd xxxxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\towj3uha.default\user.js
Datei Gelöscht : C:\Windows\System32\Tasks\Scheduled Update for Ask Toolbar
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHost.Tool
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHost.Tool.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\tracing\askpartnercobrandingtool_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnUpdater]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C17DC5CF-54FF-4E63-8AC7-94335D6DA231}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{D14D0EE2-2DD1-4230-BE70-3F3AD6172C40}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{05366194-3126-4601-AC1A-DDE573E093DC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{061F450C-37B9-4330-9235-0F25D9F75B33}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{19D2F415-D58B-46BC-9390-C03DCBC21EB2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{22FEB0F5-0BA0-4D4B-8A66-55A21667BC31}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{26249267-15F4-4DA3-8247-C5A78E4FA918}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{2CE4D4CF-B278-4126-AD1E-B622DA2E8339}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{39B217B4-8C69-4E45-A8DC-8CC4DAD3CF0A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3CB4CE45-8849-4638-9226-D6B615A15827}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{43AB7B5D-4C40-4103-A549-7002A116A7D5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6E45F3E8-2683-4824-A6BE-08108022FB36}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{996ED20F-A740-47A2-A7EF-9620D422BB4E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{9F0F16DD-4E76-4049-A9B1-7A91E48F0323}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D2B79F7D-2D7D-4420-B2A9-ECE52C7C83A0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F4288797-CB12-49CE-9DF8-7CDFA1143BEA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{061F450C-37B9-4330-9235-0F25D9F75B33}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{22FEB0F5-0BA0-4D4B-8A66-55A21667BC31}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2CE4D4CF-B278-4126-AD1E-B622DA2E8339}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D2B79F7D-2D7D-4420-B2A9-ECE52C7C83A0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{1D55DAA5-04AC-4036-B0BE-DA81EE9676CD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{212C2C4F-C845-4FBC-9561-C833A13D8DCE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{3C5D1D57-16C8-473C-A552-37B8D88596FE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{4A115D8A-6A7B-4C72-92B1-2E2D01F36979}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{58CBF821-A0C7-4AE8-9430-77DD1AF38E99}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{72BCBFF7-2837-4CA0-B3B5-3DAED7F54601}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{824125FD-7732-4DA2-9277-3A7D0A0A0813}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{99DF8440-814E-497F-BDDD-FB93E9E9DF96}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{83CAD530-387D-40FD-82EA-B9E863D92A9B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C17DC5CF-54FF-4E63-8AC7-94335D6DA231}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D14D0EE2-2DD1-4230-BE70-3F3AD6172C40}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F994E0D9-8335-48F1-99C2-A712C21F8D5F}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Schlüssel Gelöscht : HKCU\Software\Ask.com
Schlüssel Gelöscht : HKCU\Software\AskToolbar
Schlüssel Gelöscht : HKCU\Software\powerpack
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\AskToolbar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\PriceGong
Schlüssel Gelöscht : HKLM\Software\AskToolbar
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
***** [ Browser ] *****
-\\ Internet Explorer v10.0.9200.16660
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
-\\ Mozilla Firefox v23.0.1 (de)
[ Datei : C:\Users\Bernd xxxxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\towj3uha.default\prefs.js ]
Zeile gelöscht : user_pref("browser.startup.homepage", "hxxp://www1.delta-search.com/?babsrc=HP_ss&mntrId=24A400242CE6FFE4&affID=120692&tsp=4944");
Zeile gelöscht : user_pref("extensions.asktb.ff-original-keyword-url", "");
Zeile gelöscht : user_pref("extensions.enabledAddons", "%7Bd40f5e7b-d2cf-4856-b441-cc613eeffbe3%7D:1.68,ffxtlbr%40delta.com:1.5.0,%7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:23.0.1");
*************************
AdwCleaner[R0].txt - [7805 octets] - [05/09/2013 16:14:13]
AdwCleaner[R1].txt - [7862 octets] - [05/09/2013 16:16:14]
AdwCleaner[S0].txt - [7575 octets] - [05/09/2013 16:16:40]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [7635 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.5.7 (09.01.2013:1)
OS: Windows 7 Professional x64
Ran by Bernd xxxxxxx on 05.09.2013 at 16:22:35,56
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\installer\features\a28b4d68debaa244eb686953b7074fef
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\installer\products\a28b4d68debaa244eb686953b7074fef
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\installer\upgradecodes\f928123a039649549966d4c29d35b1c9
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0B8D26BE-58A1-482C-90BC-C62A0E16A503}
~~~ Files
~~~ Folders
~~~ FireFox
Emptied folder: C:\Users\Bernd xxxxxxx\AppData\Roaming\mozilla\firefox\profiles\towj3uha.default\minidumps [3 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 05.09.2013 at 16:27:00,93
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 05-09-2013
Ran by Bernd xxxxxxxxxx (administrator) on BERNDxxxxxxxxxx on 05-09-2013 20:15:54
Running from C:\Users\Bernd xxxxxxxxxx\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(UASSOFT.COM) C:\Program Files (x86)\Trust\GXT14 Mouse\GameMouseServiceApp.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
() C:\Program Files (x86)\Trust\GXT14 Mouse\POINTERGHOST.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe
(ZF Electronics GmbH) C:\Program Files (x86)\Cherry\KeyMan\KeyMan.exe
(shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe
(UASSOFT.COM) C:\Program Files (x86)\Trust\GXT14 Mouse\StartAutorun.exe
(UASSOFT.COM) C:\Program Files (x86)\Trust\GXT14 Mouse\RapooV1Process.exe
(ZF Electronics GmbH) C:\Program Files (x86)\Cherry\CDI\cdi.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfimon.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028896 2013-07-27] (NVIDIA Corporation)
HKLM\...\Policies\Explorer: [NoDrives] 0
HKCU\...\Policies\Explorer: [NoDrives] 0
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-03] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [trustGTX14] - C:\Program Files (x86)\Trust\GXT14 Mouse\POINTERGHOST.exe [4832256 2009-05-11] ()
HKLM-x32\...\Run: [BrMfcWnd] - C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [ControlCenter3] - C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [CherryKeyMan] - C:\Program Files (x86)\Cherry\KeyMan\KeyMan.exe [254004 2010-09-28] (ZF Electronics GmbH)
HKLM-x32\...\Run: [FreePDF Assistant] - C:\Program Files (x86)\FreePDF_XP\fpassist.exe [373760 2013-03-14] (shbox.de)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
AppInit_DLLs: C:\PROGRA~1\NVIDIA~1\NVSTRE~1\rxinput.dll [653600 2013-07-27] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\PROGRA~2\NVIDIA~1\NVSTRE~1\rxinput.dll [593696 2013-07-27] (NVIDIA Corporation)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
URLSearchHook: (No Name) - {00000000-6E41-4FD3-8538-502F5495E5FC} - No File
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 172.16.0.1
FireFox:
========
FF ProfilePath: C:\Users\Bernd xxxxxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\towj3uha.default
FF SearchEngineOrder.1: Ask.com
FF SelectedSearchEngine: Google
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @java.com/DTPlugin,version=10.21.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.21.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.6 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\Bernd xxxxxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\towj3uha.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: No Name - C:\Users\Bernd xxxxxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\towj3uha.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-03] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-03] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-03] (Avira Operations GmbH & Co. KG)
R3 Cherry Device Interface; C:\Program Files (x86)\Cherry\CDI\cdi.exe [577582 2010-08-25] (ZF Electronics GmbH)
R2 KmGameMouseServiceV1; C:\Program Files (x86)\Trust\GXT14 Mouse\GameMouseServiceApp.exe [354304 2009-05-11] (UASSOFT.COM)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [14984480 2013-07-27] (NVIDIA Corporation)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-03] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-09-03] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-05-25] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [8192 2005-03-29] ()
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39712 2013-05-14] (NVIDIA Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-09-05 20:09 - 2013-09-05 20:09 - 96185213 _____ C:\Windows\SysWOW64\ꖬ썐•
2013-09-05 16:27 - 2013-09-05 16:34 - 00001301 _____ C:\Users\Bernd xxxxxxxxxx\Desktop\JRT.txt
2013-09-05 16:22 - 2013-09-05 16:22 - 00000000 ____D C:\Windows\ERUNT
2013-09-05 16:21 - 2013-09-05 16:21 - 01028757 _____ (Thisisu) C:\Users\Bernd xxxxxxxxxx\Desktop\JRT.exe
2013-09-05 16:19 - 2013-09-05 16:19 - 00007715 _____ C:\Users\Bernd xxxxxxxxxx\Desktop\AdwCleaner[S0].txt
2013-09-05 16:13 - 2013-09-05 16:16 - 00000000 ____D C:\AdwCleaner
2013-09-05 16:13 - 2013-09-05 16:13 - 01037222 _____ C:\Users\Bernd xxxxxxxxxx\Desktop\adwcleaner(1).exe
2013-09-05 16:12 - 2013-09-05 16:12 - 01037222 _____ C:\Users\Bernd xxxxxxxxxx\Desktop\adwcleaner.exe
2013-09-05 11:56 - 2013-09-05 11:56 - 00001113 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-05 11:56 - 2013-09-05 11:56 - 00000000 ____D C:\Users\Bernd xxxxxxxxxx\AppData\Roaming\Malwarebytes
2013-09-05 11:56 - 2013-09-05 11:56 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-05 11:56 - 2013-09-05 11:56 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-05 11:56 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-09-05 11:54 - 2013-09-05 11:54 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Bernd xxxxxxxxxx\Desktop\mbam-setup-1.75.0.1300.exe
2013-09-05 09:59 - 2013-09-05 10:01 - 00021083 _____ C:\Users\Bernd xxxxxxxxxx\Desktop\combofix.txt
2013-09-05 09:59 - 2013-09-05 09:59 - 00021083 _____ C:\ComboFix.txt
2013-09-05 09:53 - 2013-09-05 09:59 - 00000000 ____D C:\Qoobox
2013-09-05 09:53 - 2013-09-05 09:58 - 00000000 ____D C:\Windows\erdnt
2013-09-05 09:53 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-09-05 09:53 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-09-05 09:53 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-09-05 09:53 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-09-05 09:53 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-09-05 09:53 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-09-05 09:53 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-09-05 09:53 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-09-05 09:51 - 2013-09-05 09:51 - 05120804 ____R (Swearware) C:\Users\Bernd xxxxxxxxxx\Desktop\ComboFix.exe
2013-09-04 18:49 - 2013-09-04 18:49 - 00292152 _____ C:\Windows\Minidump\090413-11325-01.dmp
2013-09-04 18:41 - 2013-09-04 18:41 - 00001081 _____ C:\Users\Bernd xxxxxxxxxx\Desktop\Gmer.txt
2013-09-04 18:14 - 2013-09-04 20:36 - 00018993 _____ C:\Users\Bernd xxxxxxxxxx\Desktop\Addition.txt
2013-09-04 18:13 - 2013-09-04 18:13 - 00000000 ____D C:\FRST
2013-09-04 18:12 - 2013-09-04 20:37 - 00000494 _____ C:\Users\Bernd xxxxxxxxxx\Desktop\defogger_disable.log
2013-09-04 18:12 - 2013-09-04 18:12 - 00000000 _____ C:\Users\Bernd xxxxxxxxxx\defogger_reenable
2013-09-04 08:34 - 2013-09-04 08:34 - 00377856 _____ C:\Users\Bernd xxxxxxxxxx\Desktop\gmer_2.1.19163.exe
2013-09-04 08:32 - 2013-09-04 08:32 - 00050477 _____ C:\Users\Bernd xxxxxxxxxx\Desktop\Defogger.exe
2013-09-04 08:24 - 2013-09-04 20:40 - 00000762 _____ C:\Users\Bernd xxxxxxxxxx\Desktop\EreignisseAVIRA20130903.txt
2013-09-03 23:13 - 2013-09-03 23:13 - 00002718 _____ C:\Users\BERNDK~1\AppData\Local\recently-used.xbel
2013-09-03 22:51 - 2013-09-03 22:51 - 00144384 _____ C:\Users\Bernd xxxxxxxxxx\Downloads\standard
2013-09-03 22:32 - 2013-09-03 23:17 - 00000000 ____D C:\Users\Bernd xxxxxxxxxx\AppData\Roaming\Scribus
2013-09-03 22:13 - 2013-09-03 22:13 - 00000866 _____ C:\Users\Public\Desktop\Scribus 1.4.3.lnk
2013-09-03 22:13 - 2013-09-03 22:13 - 00000000 ____D C:\ProgramData\Package Cache
2013-09-03 22:12 - 2013-09-03 22:13 - 00000000 ____D C:\Program Files\Scribus 1.4.3
2013-09-03 22:11 - 2013-09-04 20:54 - 00016195 _____ C:\Users\Bernd xxxxxxxxxx\Desktop\Trojaner_Board.odt
2013-09-03 21:49 - 2013-09-03 21:54 - 83962495 _____ (The Scribus Team) C:\Users\Bernd xxxxxxxxxx\Downloads\scribus-1.4.3-windows-x64.exe
2013-08-17 13:03 - 2013-09-04 18:49 - 441638356 _____ C:\Windows\MEMORY.DMP
2013-08-17 13:03 - 2013-09-04 18:49 - 00000000 ____D C:\Windows\Minidump
2013-08-17 13:03 - 2013-08-17 13:03 - 00262144 _____ C:\Windows\Minidump\081713-15506-01.dmp
2013-08-17 12:49 - 2013-08-17 12:49 - 00000000 ____D C:\Users\Bernd xxxxxxxxxx\AppData\Roaming\OpenOffice
2013-08-17 12:48 - 2013-08-17 12:48 - 00001116 _____ C:\Users\Public\Desktop\OpenOffice 4.0.0.lnk
2013-08-17 12:48 - 2013-08-17 12:48 - 00000000 ____D C:\Program Files (x86)\OpenOffice 4
2013-08-17 12:47 - 2013-08-17 12:47 - 00000000 ____D C:\Users\Bernd xxxxxxxxxx\Desktop\OpenOffice 4.0.0 (de) Installation Files
2013-08-17 12:43 - 2013-08-17 12:45 - 162401424 _____ C:\Users\Bernd xxxxxxxxxx\Downloads\Apache_OpenOffice_4.0.0_Win_x86_install_de.exe
2013-08-17 12:42 - 2013-08-17 12:42 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-15 21:26 - 2013-08-15 21:26 - 00066419 _____ C:\Users\Bernd xxxxxxxxxx\Desktop\Ernährungstagebuch.ods
2013-08-15 20:19 - 2013-08-15 20:19 - 00006656 _____ C:\Users\Bernd xxxxxxxxxx\Desktop\Birken19.xls
2013-08-14 23:02 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-14 23:02 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-14 23:02 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-14 23:02 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-14 23:02 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-14 23:02 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-14 23:02 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-14 23:02 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-14 23:02 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-14 23:02 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-14 23:02 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-14 23:02 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-14 23:02 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-14 23:02 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-14 23:02 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-14 23:02 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-14 23:02 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-14 23:02 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-14 23:02 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-14 23:02 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-14 23:02 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-14 23:02 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-14 23:02 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-14 23:02 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-14 23:02 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-14 23:02 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-14 23:02 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-14 23:02 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-14 23:02 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-14 23:02 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-14 23:02 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-14 23:00 - 2013-08-14 23:01 - 00000000 ____D C:\Windows\system32\MRT
2013-08-14 18:17 - 2013-08-15 09:59 - 00036705 _____ C:\Users\Bernd xxxxxxxxxx\Desktop\Bericht Kestler 130813 2.odt
2013-08-14 13:57 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-14 13:57 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-14 13:57 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-14 13:57 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-14 13:57 - 2013-07-09 08:03 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-14 13:57 - 2013-07-09 07:54 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-14 13:57 - 2013-07-09 07:53 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-08-14 13:57 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-14 13:57 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-14 13:57 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-14 13:57 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-14 13:57 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-14 13:57 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-08-14 13:57 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-08-14 13:57 - 2013-07-09 06:53 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-08-14 13:57 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-14 13:57 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-14 13:57 - 2013-07-09 06:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-08-14 13:57 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-14 13:57 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-14 13:57 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-14 13:57 - 2013-07-09 04:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-08-14 13:57 - 2013-07-09 04:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-08-14 13:57 - 2013-07-09 04:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-08-14 13:57 - 2013-07-09 04:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-08-14 13:57 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-14 13:57 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-13 13:00 - 2013-08-14 16:43 - 00032080 _____ C:\Users\Bernd xxxxxxxxxx\Desktop\Bericht Kestler 130813.odt
2013-08-06 21:31 - 2013-08-07 18:06 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
==================== One Month Modified Files and Folders =======
2013-09-05 20:15 - 2013-09-05 20:15 - 01947160 _____ (Farbar) C:\Users\Bernd xxxxxxxxxx\Desktop\FRST64.exe
2013-09-05 20:09 - 2013-09-05 20:09 - 96185213 _____ C:\Windows\SysWOW64\ꖬ썐•
2013-09-05 20:08 - 2013-05-28 12:37 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-05 16:34 - 2013-09-05 16:27 - 00001301 _____ C:\Users\Bernd xxxxxxxxxx\Desktop\JRT.txt
2013-09-05 16:25 - 2009-07-14 06:45 - 00014960 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-05 16:25 - 2009-07-14 06:45 - 00014960 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-05 16:22 - 2013-09-05 16:22 - 00000000 ____D C:\Windows\ERUNT
2013-09-05 16:22 - 2009-07-14 19:58 - 00696620 _____ C:\Windows\system32\perfh007.dat
2013-09-05 16:22 - 2009-07-14 19:58 - 00147916 _____ C:\Windows\system32\perfc007.dat
2013-09-05 16:22 - 2009-07-14 07:13 - 01612484 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-05 16:21 - 2013-09-05 16:21 - 01028757 _____ (Thisisu) C:\Users\Bernd xxxxxxxxxx\Desktop\JRT.exe
2013-09-05 16:19 - 2013-09-05 16:19 - 00007715 _____ C:\Users\Bernd xxxxxxxxxx\Desktop\AdwCleaner[S0].txt
2013-09-05 16:18 - 2013-06-06 11:52 - 00000000 ____D C:\Users\BERNDK~1\AppData\Local\FreePDF_XP
2013-09-05 16:18 - 2013-05-25 21:32 - 00000000 ____D C:\ProgramData\NVIDIA
2013-09-05 16:18 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-05 16:18 - 2009-07-14 06:51 - 00073274 _____ C:\Windows\setupact.log
2013-09-05 16:17 - 2013-05-25 21:15 - 01069671 _____ C:\Windows\WindowsUpdate.log
2013-09-05 16:16 - 2013-09-05 16:13 - 00000000 ____D C:\AdwCleaner
2013-09-05 16:13 - 2013-09-05 16:13 - 01037222 _____ C:\Users\Bernd xxxxxxxxxx\Desktop\adwcleaner(1).exe
2013-09-05 16:12 - 2013-09-05 16:12 - 01037222 _____ C:\Users\Bernd xxxxxxxxxx\Desktop\adwcleaner.exe
2013-09-05 16:10 - 2013-05-27 12:07 - 00008124 _____ C:\Windows\PFRO.log
2013-09-05 11:56 - 2013-09-05 11:56 - 00001113 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-05 11:56 - 2013-09-05 11:56 - 00000000 ____D C:\Users\Bernd xxxxxxxxxx\AppData\Roaming\Malwarebytes
2013-09-05 11:56 - 2013-09-05 11:56 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-05 11:56 - 2013-09-05 11:56 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-05 11:54 - 2013-09-05 11:54 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Bernd xxxxxxxxxx\Desktop\mbam-setup-1.75.0.1300.exe
2013-09-05 10:01 - 2013-09-05 09:59 - 00021083 _____ C:\Users\Bernd xxxxxxxxxx\Desktop\combofix.txt
2013-09-05 09:59 - 2013-09-05 09:59 - 00021083 _____ C:\ComboFix.txt
2013-09-05 09:59 - 2013-09-05 09:53 - 00000000 ____D C:\Qoobox
2013-09-05 09:58 - 2013-09-05 09:53 - 00000000 ____D C:\Windows\erdnt
2013-09-05 09:57 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2013-09-05 09:51 - 2013-09-05 09:51 - 05120804 ____R (Swearware) C:\Users\Bernd xxxxxxxxxx\Desktop\ComboFix.exe
2013-09-04 20:54 - 2013-09-03 22:11 - 00016195 _____ C:\Users\Bernd xxxxxxxxxx\Desktop\Trojaner_Board.odt
2013-09-04 20:40 - 2013-09-04 08:24 - 00000762 _____ C:\Users\Bernd xxxxxxxxxx\Desktop\EreignisseAVIRA20130903.txt
2013-09-04 20:37 - 2013-09-04 18:12 - 00000494 _____ C:\Users\Bernd xxxxxxxxxx\Desktop\defogger_disable.log
2013-09-04 20:36 - 2013-09-04 18:14 - 00018993 _____ C:\Users\Bernd xxxxxxxxxx\Desktop\Addition.txt
2013-09-04 18:49 - 2013-09-04 18:49 - 00292152 _____ C:\Windows\Minidump\090413-11325-01.dmp
2013-09-04 18:49 - 2013-08-17 13:03 - 441638356 _____ C:\Windows\MEMORY.DMP
2013-09-04 18:49 - 2013-08-17 13:03 - 00000000 ____D C:\Windows\Minidump
2013-09-04 18:41 - 2013-09-04 18:41 - 00001081 _____ C:\Users\Bernd xxxxxxxxxx\Desktop\Gmer.txt
2013-09-04 18:13 - 2013-09-04 18:13 - 00000000 ____D C:\FRST
2013-09-04 18:12 - 2013-09-04 18:12 - 00000000 _____ C:\Users\Bernd xxxxxxxxxx\defogger_reenable
2013-09-04 18:12 - 2013-05-25 21:26 - 00000000 ____D C:\Users\Bernd xxxxxxxxxx
2013-09-04 08:34 - 2013-09-04 08:34 - 00377856 _____ C:\Users\Bernd xxxxxxxxxx\Desktop\gmer_2.1.19163.exe
2013-09-04 08:32 - 2013-09-04 08:32 - 00050477 _____ C:\Users\Bernd xxxxxxxxxx\Desktop\Defogger.exe
2013-09-03 23:17 - 2013-09-03 22:32 - 00000000 ____D C:\Users\Bernd xxxxxxxxxx\AppData\Roaming\Scribus
2013-09-03 23:17 - 2013-06-25 22:38 - 00000000 ____D C:\Users\Bernd xxxxxxxxxx\.gimp-2.8
2013-09-03 23:13 - 2013-09-03 23:13 - 00002718 _____ C:\Users\BERNDK~1\AppData\Local\recently-used.xbel
2013-09-03 23:13 - 2013-07-19 18:49 - 00000000 ____D C:\Users\BERNDK~1\AppData\Local\gtk-2.0
2013-09-03 22:51 - 2013-09-03 22:51 - 00144384 _____ C:\Users\Bernd xxxxxxxxxx\Downloads\standard
2013-09-03 22:13 - 2013-09-03 22:13 - 00000866 _____ C:\Users\Public\Desktop\Scribus 1.4.3.lnk
2013-09-03 22:13 - 2013-09-03 22:13 - 00000000 ____D C:\ProgramData\Package Cache
2013-09-03 22:13 - 2013-09-03 22:12 - 00000000 ____D C:\Program Files\Scribus 1.4.3
2013-09-03 21:54 - 2013-09-03 21:49 - 83962495 _____ (The Scribus Team) C:\Users\Bernd xxxxxxxxxx\Downloads\scribus-1.4.3-windows-x64.exe
2013-09-03 21:46 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2013-09-03 12:12 - 2013-05-27 22:31 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-09-03 12:12 - 2013-05-25 21:46 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-09-03 12:12 - 2013-05-25 21:46 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-09-03 12:09 - 2013-06-19 08:59 - 00000000 ___RD C:\Users\Bernd xxxxxxxxxx\Dropbox
2013-09-03 12:09 - 2013-06-19 08:58 - 00000000 ____D C:\Users\Bernd xxxxxxxxxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2013-09-03 12:09 - 2013-06-19 08:58 - 00000000 ____D C:\Users\Bernd xxxxxxxxxx\AppData\Roaming\Dropbox
2013-09-03 12:09 - 2013-05-27 13:32 - 00000000 ____D C:\Users\Bernd xxxxxxxxxx\AppData\Roaming\MyPhoneExplorer
2013-09-03 12:09 - 2013-05-26 10:02 - 00000000 ____D C:\Users\Bernd xxxxxxxxxx\AppData\Roaming\Thunderbird
2013-09-03 12:09 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration
2013-08-31 17:29 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Public\Libraries
2013-08-28 15:18 - 2013-05-25 21:47 - 00000000 ____D C:\Users\BERNDK~1\AppData\Local\DoNotTrackPlus
2013-08-17 13:20 - 2013-05-26 10:55 - 00064024 _____ C:\Users\BERNDK~1\AppData\Local\GDIPFONTCACHEV1.DAT
2013-08-17 13:03 - 2013-08-17 13:03 - 00262144 _____ C:\Windows\Minidump\081713-15506-01.dmp
2013-08-17 13:03 - 2013-05-25 23:49 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-17 13:03 - 2009-07-14 06:45 - 00294712 _____ C:\Windows\system32\FNTCACHE.DAT
2013-08-17 12:49 - 2013-08-17 12:49 - 00000000 ____D C:\Users\Bernd xxxxxxxxxx\AppData\Roaming\OpenOffice
2013-08-17 12:48 - 2013-08-17 12:48 - 00001116 _____ C:\Users\Public\Desktop\OpenOffice 4.0.0.lnk
2013-08-17 12:48 - 2013-08-17 12:48 - 00000000 ____D C:\Program Files (x86)\OpenOffice 4
2013-08-17 12:47 - 2013-08-17 12:47 - 00000000 ____D C:\Users\Bernd xxxxxxxxxx\Desktop\OpenOffice 4.0.0 (de) Installation Files
2013-08-17 12:47 - 2013-05-25 21:26 - 00000000 ___RD C:\Users\Bernd xxxxxxxxxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-08-17 12:47 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2013-08-17 12:45 - 2013-08-17 12:43 - 162401424 _____ C:\Users\Bernd xxxxxxxxxx\Downloads\Apache_OpenOffice_4.0.0_Win_x86_install_de.exe
2013-08-17 12:42 - 2013-08-17 12:42 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-16 08:14 - 2013-05-31 16:08 - 00000864 _____ C:\Windows\Brpfx04a.ini
2013-08-16 08:11 - 2013-06-06 12:07 - 00000000 ____D C:\Users\Bernd xxxxxxxxxx\AppData\Roaming\PC-FAX TX
2013-08-16 08:10 - 2009-07-14 07:32 - 00000000 ____D C:\Windows\system32\FxsTmp
2013-08-16 08:08 - 2013-05-27 11:38 - 00000000 ____D C:\Users\Bernd xxxxxxxxxx\Documents\Fax
2013-08-16 07:17 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-08-15 21:26 - 2013-08-15 21:26 - 00066419 _____ C:\Users\Bernd xxxxxxxxxx\Desktop\Ernährungstagebuch.ods
2013-08-15 20:19 - 2013-08-15 20:19 - 00006656 _____ C:\Users\Bernd xxxxxxxxxx\Desktop\Birken19.xls
2013-08-15 19:13 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-08-15 09:59 - 2013-08-14 18:17 - 00036705 _____ C:\Users\Bernd xxxxxxxxxx\Desktop\Bericht Kestler 130813 2.odt
2013-08-14 23:01 - 2013-08-14 23:00 - 00000000 ____D C:\Windows\system32\MRT
2013-08-14 23:00 - 2013-05-25 22:25 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-14 16:43 - 2013-08-13 13:00 - 00032080 _____ C:\Users\Bernd xxxxxxxxxx\Desktop\Bericht Kestler 130813.odt
2013-08-07 18:06 - 2013-08-06 21:31 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-08-07 04:22 - 2013-05-25 21:30 - 00278800 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
Files to move or delete:
====================
C:\Users\BERNDK~1\AppData\Local\Temp\Quarantine.exe
C:\Users\BERNDK~1\AppData\Local\Temp\jrt\erunt\ERUNT.EXE
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-09-01 02:57
==================== End Of Log ============================
--- --- --- |
|
06.09.2013, 08:20
| #6 |
| /// the machine /// TB-Ausbilder | Win7 Avira Free Antivir meldet TR/Xcrypt.Xpack.8884. Rechner aber schon länger immer langsamerESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ --> Win7 Avira Free Antivir meldet TR/Xcrypt.Xpack.8884. Rechner aber schon länger immer langsamer |
|
07.09.2013, 10:19
| #7 |
| | Win7 Avira Free Antivir meldet TR/Xcrypt.Xpack.8884. Rechner aber schon länger immer langsamer Hallo Schrauber, der ESET Onlinescanner lauft seit ca. 22 Stunden und hat bisher 17% gescannt. Er scannt dabei derzeit vermutlich Windows Backupfiles. Ist das normal oder läuft da etwas nicht korrekt? Sollte es normal sein, dann dauert es noch die ganze Woch bis ich ein Feedback mittels Log's geben kann. LG Bernd |
|
07.09.2013, 14:34
| #8 |
| /// the machine /// TB-Ausbilder | Win7 Avira Free Antivir meldet TR/Xcrypt.Xpack.8884. Rechner aber schon länger immer langsamer 22h Stunden ist schon stramm. Welche Datenmenge hast Du denn zu scannen?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
08.09.2013, 14:45
| #9 |
| | Win7 Avira Free Antivir meldet TR/Xcrypt.Xpack.8884. Rechner aber schon länger immer langsamer Hallo Schrauber, insgesamt habe ich ca 1,7 TB Daten zu scannen. Das sind eine interne 1TB und eine externe 2TB Backup-Platte. Dann noch ein 500er Laufwerk mit winXP wg. Progs die unter win7 nicht mehr laufen. Momentan läuft es wieder schneller. Bin inzwischen bei 32%. Ich könnte die externe FP auch abziehen und formatieren, da die Daten ja vorhanden sind. Würde das etwas bringen? Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=d45dfab2b01d4240a82339a0dcb35cee
# engine=15028
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-09-07 04:15:46
# local_time=2013-09-07 06:15:46 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 96 119052 9059511 111841 0
# compatibility_mode=5893 16776573 100 94 103895 130200396 0 0
# scanned=618493
# found=0
# cleaned=0
# scan_time=16943
Code:
ATTFilter Results of screen317's Security Check version 0.99.72 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 10 ``````````````Antivirus/Firewall Check:`````````````` Avira Desktop Antivirus up to date! (On Access scanning disabled!) `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware Version 1.75.0.1300 Java 7 Update 25 Adobe Flash Player 11.8.800.94 Adobe Reader XI Mozilla Firefox (23.0.1) Mozilla Thunderbird (17.0.8) ````````Process Check: objlist.exe by Laurent```````` Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbamgui.exe Avira Antivir avgnt.exe Avira Antivir avguard.exe Malwarebytes' Anti-Malware mbamscheduler.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-09-2013 03
Ran by Bernd xxxxxxxx (administrator) on BERNDxxxxxxxx on 07-09-2013 18:37:48
Running from C:\Users\Bernd xxxxxxxx\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(UASSOFT.COM) C:\Program Files (x86)\Trust\GXT14 Mouse\GameMouseServiceApp.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
() C:\Program Files (x86)\Trust\GXT14 Mouse\POINTERGHOST.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe
(ZF Electronics GmbH) C:\Program Files (x86)\Cherry\KeyMan\KeyMan.exe
(shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe
(UASSOFT.COM) C:\Program Files (x86)\Trust\GXT14 Mouse\StartAutorun.exe
(UASSOFT.COM) C:\Program Files (x86)\Trust\GXT14 Mouse\RapooV1Process.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfimon.exe
(ZF Electronics GmbH) C:\Program Files (x86)\Cherry\CDI\cdi.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
() C:\Users\Bernd xxxxxxxx\Desktop\SecurityCheck.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Microsoft Corporation) c:\program files\windows defender\MpCmdRun.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028896 2013-07-27] (NVIDIA Corporation)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-03] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [trustGTX14] - C:\Program Files (x86)\Trust\GXT14 Mouse\POINTERGHOST.exe [4832256 2009-05-11] ()
HKLM-x32\...\Run: [BrMfcWnd] - C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [ControlCenter3] - C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [CherryKeyMan] - C:\Program Files (x86)\Cherry\KeyMan\KeyMan.exe [254004 2010-09-28] (ZF Electronics GmbH)
HKLM-x32\...\Run: [FreePDF Assistant] - C:\Program Files (x86)\FreePDF_XP\fpassist.exe [373760 2013-03-14] (shbox.de)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
AppInit_DLLs: C:\PROGRA~1\NVIDIA~1\NVSTRE~1\rxinput.dll [653600 2013-07-27] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\PROGRA~2\NVIDIA~1\NVSTRE~1\rxinput.dll [593696 2013-07-27] (NVIDIA Corporation)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
URLSearchHook: (No Name) - {00000000-6E41-4FD3-8538-502F5495E5FC} - No File
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 172.16.0.1
FireFox:
========
FF ProfilePath: C:\Users\Bernd xxxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\towj3uha.default
FF SearchEngineOrder.1: Ask.com
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www1.delta-search.com/?babsrc=HP_ss&mntrId=24A400242CE6FFE4&affID=120692&tsp=4944
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @java.com/DTPlugin,version=10.21.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.21.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.6 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\Bernd xxxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\towj3uha.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: No Name - C:\Users\Bernd xxxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\towj3uha.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-03] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-03] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-03] (Avira Operations GmbH & Co. KG)
R3 Cherry Device Interface; C:\Program Files (x86)\Cherry\CDI\cdi.exe [577582 2010-08-25] (ZF Electronics GmbH)
R2 KmGameMouseServiceV1; C:\Program Files (x86)\Trust\GXT14 Mouse\GameMouseServiceApp.exe [354304 2009-05-11] (UASSOFT.COM)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [14984480 2013-07-27] (NVIDIA Corporation)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-03] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-09-03] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-05-25] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [8192 2005-03-29] ()
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39712 2013-05-14] (NVIDIA Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-09-07 18:30 - 2013-09-07 18:30 - 00891115 _____ C:\Users\Bernd xxxxxxxx\Desktop\SecurityCheck.exe
2013-09-07 16:46 - 2013-09-07 16:46 - 96511910 _____ C:\Windows\SysWOW64\铬ᆕf
2013-09-06 13:30 - 2013-09-06 13:30 - 02347384 _____ (ESET) C:\Users\Bernd xxxxxxxx\Desktop\esetsmartinstaller_enu.exe
2013-09-05 20:18 - 2013-09-05 20:18 - 00032004 _____ C:\Users\Bernd xxxxxxxx\Desktop\FRST#2.txt
2013-09-05 20:09 - 2013-09-05 20:09 - 96185213 _____ C:\Windows\SysWOW64\ꖬ썐•
2013-09-05 16:27 - 2013-09-05 16:34 - 00001301 _____ C:\Users\Bernd xxxxxxxx\Desktop\JRT.txt
2013-09-05 16:22 - 2013-09-05 16:22 - 00000000 ____D C:\Windows\ERUNT
2013-09-05 16:21 - 2013-09-05 16:21 - 01028757 _____ (Thisisu) C:\Users\Bernd xxxxxxxx\Desktop\JRT.exe
2013-09-05 16:19 - 2013-09-05 16:19 - 00007715 _____ C:\Users\Bernd xxxxxxxx\Desktop\AdwCleaner[S0].txt
2013-09-05 16:13 - 2013-09-05 16:16 - 00000000 ____D C:\AdwCleaner
2013-09-05 16:12 - 2013-09-05 16:12 - 01037222 _____ C:\Users\Bernd xxxxxxxx\Desktop\adwcleaner.exe
2013-09-05 11:56 - 2013-09-05 11:56 - 00001113 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-05 11:56 - 2013-09-05 11:56 - 00000000 ____D C:\Users\Bernd xxxxxxxx\AppData\Roaming\Malwarebytes
2013-09-05 11:56 - 2013-09-05 11:56 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-05 11:56 - 2013-09-05 11:56 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-05 11:56 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-09-05 11:54 - 2013-09-05 11:54 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Bernd xxxxxxxx\Desktop\mbam-setup-1.75.0.1300.exe
2013-09-05 09:59 - 2013-09-05 10:01 - 00021083 _____ C:\Users\Bernd xxxxxxxx\Desktop\combofix.txt
2013-09-05 09:59 - 2013-09-05 09:59 - 00021083 _____ C:\ComboFix.txt
2013-09-05 09:53 - 2013-09-05 09:59 - 00000000 ____D C:\Qoobox
2013-09-05 09:53 - 2013-09-05 09:58 - 00000000 ____D C:\Windows\erdnt
2013-09-05 09:53 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-09-05 09:53 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-09-05 09:53 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-09-05 09:53 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-09-05 09:53 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-09-05 09:53 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-09-05 09:53 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-09-05 09:53 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-09-05 09:51 - 2013-09-05 09:51 - 05120804 ____R (Swearware) C:\Users\Bernd xxxxxxxx\Desktop\ComboFix.exe
2013-09-04 18:49 - 2013-09-04 18:49 - 00292152 _____ C:\Windows\Minidump\090413-11325-01.dmp
2013-09-04 18:41 - 2013-09-04 18:41 - 00001081 _____ C:\Users\Bernd xxxxxxxx\Desktop\Gmer.txt
2013-09-04 18:14 - 2013-09-04 20:36 - 00018993 _____ C:\Users\Bernd xxxxxxxx\Desktop\Addition.txt
2013-09-04 18:13 - 2013-09-04 18:13 - 00000000 ____D C:\FRST
2013-09-04 18:12 - 2013-09-04 20:37 - 00000494 _____ C:\Users\Bernd xxxxxxxx\Desktop\defogger_disable.log
2013-09-04 18:12 - 2013-09-04 18:12 - 00000000 _____ C:\Users\Bernd xxxxxxxx\defogger_reenable
2013-09-04 08:34 - 2013-09-04 08:34 - 00377856 _____ C:\Users\Bernd xxxxxxxx\Desktop\gmer_2.1.19163.exe
2013-09-04 08:32 - 2013-09-04 08:32 - 00050477 _____ C:\Users\Bernd xxxxxxxx\Desktop\Defogger.exe
2013-09-04 08:24 - 2013-09-04 20:40 - 00000762 _____ C:\Users\Bernd xxxxxxxx\Desktop\EreignisseAVIRA20130903.txt
2013-09-03 23:13 - 2013-09-03 23:13 - 00002718 _____ C:\Users\BERNDK~1\AppData\Local\recently-used.xbel
2013-09-03 22:51 - 2013-09-03 22:51 - 00144384 _____ C:\Users\Bernd xxxxxxxx\Downloads\standard
2013-09-03 22:32 - 2013-09-03 23:17 - 00000000 ____D C:\Users\Bernd xxxxxxxx\AppData\Roaming\Scribus
2013-09-03 22:13 - 2013-09-03 22:13 - 00000866 _____ C:\Users\Public\Desktop\Scribus 1.4.3.lnk
2013-09-03 22:13 - 2013-09-03 22:13 - 00000000 ____D C:\ProgramData\Package Cache
2013-09-03 22:12 - 2013-09-03 22:13 - 00000000 ____D C:\Program Files\Scribus 1.4.3
2013-09-03 22:11 - 2013-09-04 20:54 - 00016195 _____ C:\Users\Bernd xxxxxxxx\Desktop\Trojaner_Board.odt
2013-09-03 21:49 - 2013-09-03 21:54 - 83962495 _____ (The Scribus Team) C:\Users\Bernd xxxxxxxx\Downloads\scribus-1.4.3-windows-x64.exe
2013-08-17 13:03 - 2013-09-04 18:49 - 441638356 _____ C:\Windows\MEMORY.DMP
2013-08-17 13:03 - 2013-09-04 18:49 - 00000000 ____D C:\Windows\Minidump
2013-08-17 13:03 - 2013-08-17 13:03 - 00262144 _____ C:\Windows\Minidump\081713-15506-01.dmp
2013-08-17 12:49 - 2013-08-17 12:49 - 00000000 ____D C:\Users\Bernd xxxxxxxx\AppData\Roaming\OpenOffice
2013-08-17 12:48 - 2013-08-17 12:48 - 00001116 _____ C:\Users\Public\Desktop\OpenOffice 4.0.0.lnk
2013-08-17 12:48 - 2013-08-17 12:48 - 00000000 ____D C:\Program Files (x86)\OpenOffice 4
2013-08-17 12:47 - 2013-08-17 12:47 - 00000000 ____D C:\Users\Bernd xxxxxxxx\Desktop\OpenOffice 4.0.0 (de) Installation Files
2013-08-17 12:43 - 2013-08-17 12:45 - 162401424 _____ C:\Users\Bernd xxxxxxxx\Downloads\Apache_OpenOffice_4.0.0_Win_x86_install_de.exe
2013-08-17 12:42 - 2013-08-17 12:42 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-15 21:26 - 2013-08-15 21:26 - 00066419 _____ C:\Users\Bernd xxxxxxxx\Desktop\Ernährungstagebuch.ods
2013-08-15 20:19 - 2013-08-15 20:19 - 00006656 _____ C:\Users\Bernd xxxxxxxx\Desktop\Birken19.xls
2013-08-14 23:02 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-14 23:02 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-14 23:02 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-14 23:02 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-14 23:02 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-14 23:02 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-14 23:02 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-14 23:02 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-14 23:02 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-14 23:02 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-14 23:02 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-14 23:02 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-14 23:02 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-14 23:02 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-14 23:02 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-14 23:02 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-14 23:02 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-14 23:02 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-14 23:02 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-14 23:02 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-14 23:02 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-14 23:02 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-14 23:02 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-14 23:02 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-14 23:02 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-14 23:02 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-14 23:02 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-14 23:02 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-14 23:02 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-14 23:02 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-14 23:02 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-14 23:00 - 2013-08-14 23:01 - 00000000 ____D C:\Windows\system32\MRT
2013-08-14 18:17 - 2013-08-15 09:59 - 00036705 _____ C:\Users\Bernd xxxxxxxx\Desktop\Bericht Kestler 130813 2.odt
2013-08-14 13:57 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-14 13:57 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-14 13:57 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-14 13:57 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-14 13:57 - 2013-07-09 08:03 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-14 13:57 - 2013-07-09 07:54 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-14 13:57 - 2013-07-09 07:53 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-08-14 13:57 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-14 13:57 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-14 13:57 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-14 13:57 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-14 13:57 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-14 13:57 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-08-14 13:57 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-08-14 13:57 - 2013-07-09 06:53 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-08-14 13:57 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-14 13:57 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-14 13:57 - 2013-07-09 06:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-08-14 13:57 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-14 13:57 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-14 13:57 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-14 13:57 - 2013-07-09 04:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-08-14 13:57 - 2013-07-09 04:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-08-14 13:57 - 2013-07-09 04:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-08-14 13:57 - 2013-07-09 04:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-08-14 13:57 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-14 13:57 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-13 13:00 - 2013-08-14 16:43 - 00032080 _____ C:\Users\Bernd xxxxxxxx\Desktop\Bericht Kestler 130813.odt
==================== One Month Modified Files and Folders =======
2013-09-07 18:30 - 2013-09-07 18:30 - 00891115 _____ C:\Users\Bernd xxxxxxxx\Desktop\SecurityCheck.exe
2013-09-07 18:27 - 2013-06-19 08:58 - 00000000 ____D C:\Users\Bernd xxxxxxxx\AppData\Roaming\Dropbox
2013-09-07 18:27 - 2013-05-25 21:26 - 00000000 ___RD C:\Users\Bernd xxxxxxxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-07 18:20 - 2013-05-28 12:37 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-07 17:29 - 2013-05-25 21:15 - 01220992 _____ C:\Windows\WindowsUpdate.log
2013-09-07 16:46 - 2013-09-07 16:46 - 96511910 _____ C:\Windows\SysWOW64\铬ᆕf
2013-09-06 13:35 - 2009-07-14 06:45 - 00014960 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-06 13:35 - 2009-07-14 06:45 - 00014960 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-06 13:31 - 2009-07-14 19:58 - 00696620 _____ C:\Windows\system32\perfh007.dat
2013-09-06 13:31 - 2009-07-14 19:58 - 00147916 _____ C:\Windows\system32\perfc007.dat
2013-09-06 13:31 - 2009-07-14 07:13 - 01612484 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-06 13:30 - 2013-09-06 13:30 - 02347384 _____ (ESET) C:\Users\Bernd xxxxxxxx\Desktop\esetsmartinstaller_enu.exe
2013-09-06 13:28 - 2009-07-14 06:51 - 00074170 _____ C:\Windows\setupact.log
2013-09-06 13:27 - 2013-06-06 11:52 - 00000000 ____D C:\Users\BERNDK~1\AppData\Local\FreePDF_XP
2013-09-06 13:27 - 2013-05-25 21:32 - 00000000 ____D C:\ProgramData\NVIDIA
2013-09-06 13:27 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-05 20:18 - 2013-09-05 20:18 - 00032004 _____ C:\Users\Bernd xxxxxxxx\Desktop\FRST#2.txt
2013-09-05 20:09 - 2013-09-05 20:09 - 96185213 _____ C:\Windows\SysWOW64\ꖬ썐•
2013-09-05 16:34 - 2013-09-05 16:27 - 00001301 _____ C:\Users\Bernd xxxxxxxx\Desktop\JRT.txt
2013-09-05 16:22 - 2013-09-05 16:22 - 00000000 ____D C:\Windows\ERUNT
2013-09-05 16:21 - 2013-09-05 16:21 - 01028757 _____ (Thisisu) C:\Users\Bernd xxxxxxxx\Desktop\JRT.exe
2013-09-05 16:19 - 2013-09-05 16:19 - 00007715 _____ C:\Users\Bernd xxxxxxxx\Desktop\AdwCleaner[S0].txt
2013-09-05 16:16 - 2013-09-05 16:13 - 00000000 ____D C:\AdwCleaner
2013-09-05 16:12 - 2013-09-05 16:12 - 01037222 _____ C:\Users\Bernd xxxxxxxx\Desktop\adwcleaner.exe
2013-09-05 16:10 - 2013-05-27 12:07 - 00008124 _____ C:\Windows\PFRO.log
2013-09-05 11:56 - 2013-09-05 11:56 - 00001113 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-05 11:56 - 2013-09-05 11:56 - 00000000 ____D C:\Users\Bernd xxxxxxxx\AppData\Roaming\Malwarebytes
2013-09-05 11:56 - 2013-09-05 11:56 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-05 11:56 - 2013-09-05 11:56 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-05 11:54 - 2013-09-05 11:54 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Bernd xxxxxxxx\Desktop\mbam-setup-1.75.0.1300.exe
2013-09-05 10:01 - 2013-09-05 09:59 - 00021083 _____ C:\Users\Bernd xxxxxxxx\Desktop\combofix.txt
2013-09-05 09:59 - 2013-09-05 09:59 - 00021083 _____ C:\ComboFix.txt
2013-09-05 09:59 - 2013-09-05 09:53 - 00000000 ____D C:\Qoobox
2013-09-05 09:58 - 2013-09-05 09:53 - 00000000 ____D C:\Windows\erdnt
2013-09-05 09:57 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2013-09-05 09:51 - 2013-09-05 09:51 - 05120804 ____R (Swearware) C:\Users\Bernd xxxxxxxx\Desktop\ComboFix.exe
2013-09-04 20:54 - 2013-09-03 22:11 - 00016195 _____ C:\Users\Bernd xxxxxxxx\Desktop\Trojaner_Board.odt
2013-09-04 20:40 - 2013-09-04 08:24 - 00000762 _____ C:\Users\Bernd xxxxxxxx\Desktop\EreignisseAVIRA20130903.txt
2013-09-04 20:37 - 2013-09-04 18:12 - 00000494 _____ C:\Users\Bernd xxxxxxxx\Desktop\defogger_disable.log
2013-09-04 20:36 - 2013-09-04 18:14 - 00018993 _____ C:\Users\Bernd xxxxxxxx\Desktop\Addition.txt
2013-09-04 18:49 - 2013-09-04 18:49 - 00292152 _____ C:\Windows\Minidump\090413-11325-01.dmp
2013-09-04 18:49 - 2013-08-17 13:03 - 441638356 _____ C:\Windows\MEMORY.DMP
2013-09-04 18:49 - 2013-08-17 13:03 - 00000000 ____D C:\Windows\Minidump
2013-09-04 18:41 - 2013-09-04 18:41 - 00001081 _____ C:\Users\Bernd xxxxxxxx\Desktop\Gmer.txt
2013-09-04 18:13 - 2013-09-04 18:13 - 00000000 ____D C:\FRST
2013-09-04 18:12 - 2013-09-04 18:12 - 00000000 _____ C:\Users\Bernd xxxxxxxx\defogger_reenable
2013-09-04 18:12 - 2013-05-25 21:26 - 00000000 ____D C:\Users\Bernd xxxxxxxx
2013-09-04 08:34 - 2013-09-04 08:34 - 00377856 _____ C:\Users\Bernd xxxxxxxx\Desktop\gmer_2.1.19163.exe
2013-09-04 08:32 - 2013-09-04 08:32 - 00050477 _____ C:\Users\Bernd xxxxxxxx\Desktop\Defogger.exe
2013-09-03 23:17 - 2013-09-03 22:32 - 00000000 ____D C:\Users\Bernd xxxxxxxx\AppData\Roaming\Scribus
2013-09-03 23:17 - 2013-06-25 22:38 - 00000000 ____D C:\Users\Bernd xxxxxxxx\.gimp-2.8
2013-09-03 23:13 - 2013-09-03 23:13 - 00002718 _____ C:\Users\BERNDK~1\AppData\Local\recently-used.xbel
2013-09-03 23:13 - 2013-07-19 18:49 - 00000000 ____D C:\Users\BERNDK~1\AppData\Local\gtk-2.0
2013-09-03 22:51 - 2013-09-03 22:51 - 00144384 _____ C:\Users\Bernd xxxxxxxx\Downloads\standard
2013-09-03 22:13 - 2013-09-03 22:13 - 00000866 _____ C:\Users\Public\Desktop\Scribus 1.4.3.lnk
2013-09-03 22:13 - 2013-09-03 22:13 - 00000000 ____D C:\ProgramData\Package Cache
2013-09-03 22:13 - 2013-09-03 22:12 - 00000000 ____D C:\Program Files\Scribus 1.4.3
2013-09-03 21:54 - 2013-09-03 21:49 - 83962495 _____ (The Scribus Team) C:\Users\Bernd xxxxxxxx\Downloads\scribus-1.4.3-windows-x64.exe
2013-09-03 21:46 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2013-09-03 12:12 - 2013-05-27 22:31 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-09-03 12:12 - 2013-05-25 21:46 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-09-03 12:12 - 2013-05-25 21:46 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-09-03 12:09 - 2013-06-19 08:59 - 00000000 ___RD C:\Users\Bernd xxxxxxxx\Dropbox
2013-09-03 12:09 - 2013-05-27 13:32 - 00000000 ____D C:\Users\Bernd xxxxxxxx\AppData\Roaming\MyPhoneExplorer
2013-09-03 12:09 - 2013-05-26 10:02 - 00000000 ____D C:\Users\Bernd xxxxxxxx\AppData\Roaming\Thunderbird
2013-09-03 12:09 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration
2013-08-31 17:29 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Public\Libraries
2013-08-28 15:18 - 2013-05-25 21:47 - 00000000 ____D C:\Users\BERNDK~1\AppData\Local\DoNotTrackPlus
2013-08-17 13:20 - 2013-05-26 10:55 - 00064024 _____ C:\Users\BERNDK~1\AppData\Local\GDIPFONTCACHEV1.DAT
2013-08-17 13:03 - 2013-08-17 13:03 - 00262144 _____ C:\Windows\Minidump\081713-15506-01.dmp
2013-08-17 13:03 - 2013-05-25 23:49 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-17 13:03 - 2009-07-14 06:45 - 00294712 _____ C:\Windows\system32\FNTCACHE.DAT
2013-08-17 12:49 - 2013-08-17 12:49 - 00000000 ____D C:\Users\Bernd xxxxxxxx\AppData\Roaming\OpenOffice
2013-08-17 12:48 - 2013-08-17 12:48 - 00001116 _____ C:\Users\Public\Desktop\OpenOffice 4.0.0.lnk
2013-08-17 12:48 - 2013-08-17 12:48 - 00000000 ____D C:\Program Files (x86)\OpenOffice 4
2013-08-17 12:47 - 2013-08-17 12:47 - 00000000 ____D C:\Users\Bernd xxxxxxxx\Desktop\OpenOffice 4.0.0 (de) Installation Files
2013-08-17 12:47 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2013-08-17 12:45 - 2013-08-17 12:43 - 162401424 _____ C:\Users\Bernd xxxxxxxx\Downloads\Apache_OpenOffice_4.0.0_Win_x86_install_de.exe
2013-08-17 12:42 - 2013-08-17 12:42 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-16 08:14 - 2013-05-31 16:08 - 00000864 _____ C:\Windows\Brpfx04a.ini
2013-08-16 08:11 - 2013-06-06 12:07 - 00000000 ____D C:\Users\Bernd xxxxxxxx\AppData\Roaming\PC-FAX TX
2013-08-16 08:10 - 2009-07-14 07:32 - 00000000 ____D C:\Windows\system32\FxsTmp
2013-08-16 08:08 - 2013-05-27 11:38 - 00000000 ____D C:\Users\Bernd xxxxxxxx\Documents\Fax
2013-08-16 07:17 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-08-15 21:26 - 2013-08-15 21:26 - 00066419 _____ C:\Users\Bernd xxxxxxxx\Desktop\Ernährungstagebuch.ods
2013-08-15 20:19 - 2013-08-15 20:19 - 00006656 _____ C:\Users\Bernd xxxxxxxx\Desktop\Birken19.xls
2013-08-15 19:13 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-08-15 09:59 - 2013-08-14 18:17 - 00036705 _____ C:\Users\Bernd xxxxxxxx\Desktop\Bericht Kestler 130813 2.odt
2013-08-14 23:01 - 2013-08-14 23:00 - 00000000 ____D C:\Windows\system32\MRT
2013-08-14 23:00 - 2013-05-25 22:25 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-14 16:43 - 2013-08-13 13:00 - 00032080 _____ C:\Users\Bernd xxxxxxxx\Desktop\Bericht Kestler 130813.odt
Files to move or delete:
====================
C:\Users\BERNDK~1\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-09-01 02:57
==================== End Of Log ============================
--- --- --- --- --- --- THNX Beim Hochfahren meldet ein Pop-Up "Fehler: Invalid picture." Avira meldet: "Browserschutz wurde deaktiviert. Die Avira Search Free Toolbar ist nicht korrekt installiert. Browserschutz wurde deswegen deaktiviert. Um den Browserschutz wieder zu aktivieren installieren Sie die Toolbar." Der Avira hinweis nähere Details rät zur De- und zu Reinstallation. Thunderbird kann Mails empfangen aber nicht versenden. Meldung: "Senden der Nachricht fehlgeschlagen. Bitte überprüfen Sie Ihre Konten-Einstellungen, und wiederholen Sie den Vorgang." Die Einstellungen scheinen mir jedoch die selben als zuvor. Zudem hat es zwischenzeitlich mal funktioniert, jetzt aber wieder nicht mehr. Zudem scheinen mir Dateien zu fehlen. Diese sind auf den Backup-Platten noch vorhanden, die Ordenr auf dem Hauptlaufwerk sind jedoch häufig leer. Ich muss allerdings zugeben, dass ich diese Ordner schon sehr lange nicht mehr angesehen hatte. Der Dateienverlust könnte also schon älteren Datums sein. Open Office kann zwar nach wie vor Word Dateien lesen aber keine *.odt. Meldung: "Schreibfehler. Die Datei konnte nicht geschrieben werden." Es lassen sich auch keine Dateien in den Open-Office-Formaten speichern. Manche Office Dokumente bringen jedoch auch Meldungen wie: "Die Dukument-Datei RExxxx.doc ist zum Bearbeiten Gesperrt durch Unbekannter Anwender Öffnen Sie das Dukument schreibgeschützt oder erstellen Sie eine Arbeitskopie." |
|
09.09.2013, 06:08
| #10 | ||
| /// the machine /// TB-Ausbilder | Win7 Avira Free Antivir meldet TR/Xcrypt.Xpack.8884. Rechner aber schon länger immer langsamerZitat:
 Lesestoff:Warum wir Avira nicht mehr empfehlen Avira liefert seit einiger Zeit mit der Standardinstallation die Ask Toolbar mit aus. Diese Toolbar ist Voraussetzung dafür, dass der Webguard zuverlässig funktioniert. Die Ask Toolbar ist dafür bekannt, dass sie das Surfverhalten des Benutzers ausspioniert, um damit in letzter Konsequenz Geld zu verdienen. Daher wird von uns auf diesem Board als "schädlich" eingestuft. Mehr Informationen. Eine Sicherheitsfirma, die dem Benutzer praktisch ungefragt schädliche Software "unterjubelt", scheidet für uns daher aus. Wir empfehlen daher allen Nutzern von Avira aufgrund dieser Geschäftspraktik, der teilweise äußerst schlechten Erkennungsrate und der überaus nervtötenden Werbung Avira zu deinstallieren und auf ein alternatives Produkt auszuweichen. Solltest du dich zu einem Wechsel entscheiden, empfehlen wir dir nach der Deinstallation mit dem Avira-Cleaner alle Reste zu entfernen. Zitat:
Gleiches mit Openoffice. Downloade dir bitte Windows Repair (All In One) von hier.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
09.09.2013, 16:52
| #11 |
| | Win7 Avira Free Antivir meldet TR/Xcrypt.Xpack.8884. Rechner aber schon länger immer langsamer Hallo Schrauber, also kommt Avira runter. Kannst Du etwas empfehlen? Ich kann Thunderbird nicht herunterladen, da mir die Meldung hochpoppt: "C.\Users\Berndx~1/AppData\Local\Temp konnte nicht gespeichert werden, weil Sie die Inhalte dieses Ordners nicht ändern können. Ändern Sie die Ordnereigenschaften und versuchen Sie es nochmals oder versuchen Sie, an einem anderen Ort zu speichern. Der Ordner: C:\Users\Berndx ist schreibgeschützt und die Berechtigung läst sich nicht ändern. !!!! JETZT LÄUFT ALLES EINWANDFREI; SOFERN ICH DAS BIS JETZT BEURTEILEN KANN !!!! >>>>>> SUPER FEDDEZ DANKE <<<<<< Avira muss nach wie vor noch runter und etwas anderes drauf. Wie verhält es sich eigentlich hier mit den Spenden? Bekommt der Helfer/die Helferin die Spenden direkt? Dann wäre ich noch dankbar, wenn Du mir ein gutes Programm empfehlen kannst um Doubletten aufzuspüren und zusammenzuführen. Vielen Dank LG Bernd |
|
09.09.2013, 19:30
| #12 |
| /// the machine /// TB-Ausbilder | Win7 Avira Free Antivir meldet TR/Xcrypt.Xpack.8884. Rechner aber schon länger immer langsamer Wir haben alle was von den Spenden Fertig Die Reihenfolge ist hier entscheidend.
Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
09.09.2013, 21:34
| #13 |
| | Win7 Avira Free Antivir meldet TR/Xcrypt.Xpack.8884. Rechner aber schon länger immer langsamer Hallo Schrauber, die Spende ist raus. Und das war mir ein echtes Bedürfnis. Ich finde Eure Plattform toll. Es scheint alles prima zu funktionieren. Nochmals tausend Dank. Und ich hätte da noch ein Netbook.;-) Dafür sollte ich wohl dann einen neuen Tread aufmachen? LG Bernd |
|
10.09.2013, 08:13
| #14 |
| /// the machine /// TB-Ausbilder | Win7 Avira Free Antivir meldet TR/Xcrypt.Xpack.8884. Rechner aber schon länger immer langsamer Nö machen wir hier Was für Probleme? Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
10.09.2013, 15:09
| #15 |
| | Win7 Avira Free Antivir meldet TR/Xcrypt.Xpack.8884. Rechner aber schon länger immer langsamer Hallo Schrauber, vielen Dank. Aber ich denke das macht weniger Sinn. Auf dem Rechner ist eigentlich nichts nennenswertes drauf. Ich benutze ihn quasi als Schmutzigen Rechner ohne Anbindung an die anderen, um relativ gefahrlos im Netz zu surfen. Da ist es vermutlich einfacher und geht schneller wenn ich ihn platt mache und neu aufziehe. LG Bernd |
|
| Themen zu Win7 Avira Free Antivir meldet TR/Xcrypt.Xpack.8884. Rechner aber schon länger immer langsamer |
| .com, 4d36e972-e325-11ce-bfc1-08002be10318, adobe, antivir, antivirus, avira searchfree toolbar, beschädigung, browser, farbar, farbar recovery scan tool, flash player, google, homepage, installation, minidump, mozilla, plug-in, pup.optional.babsolution.a, pup.optional.babylon.a, pup.optional.opencandy, realtek, richtlinie, schutz, services.exe, software, svchost.exe, tr/crypt.xpack.8884, tr/xcrypt.xpack.8884, tr/xcrypt.xpack.8884., vcredist, viren |
Linear-Darstellung
