| |
| |||||||
Log-Analyse und Auswertung: Windows 7: PUP.Optional.OpenCandyWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
05.09.2013, 18:30
| #1 |
 |  Windows 7: PUP.Optional.OpenCandy Liebe Freunde, ein Schädling hat sich bei mir eingeschlichen, und ich erbitte Eure wertvolle Hilfe, das Ding wieder loszuwerden. Bisher arbeitet mein PC völlig normal; per Zufall habe ich den Befall entdeckt, als ich routinemäßig mit Malwarebytes scannte. Hier meine Logs: Code:
ATTFilter Malwarebytes Anti-Malware (PRO) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.09.01.04 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16660 ARLT :: ***-VAIO [Administrator] Schutz: Aktiviert 04.09.2013 22:28:35 mbam-log-2013-09-04 (22-28-35).txt Art des Suchlaufs: Flash-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: Registrierung | Dateisystem | P2P Durchsuchte Objekte: 237527 Laufzeit: 31 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 2 C:\Users\ARLT\AppData\Roaming\OpenCandy (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\ARLT\AppData\Roaming\OpenCandy\DBE1AA5288C94DDCAABF9BC92915CD67 (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateien: 3 C:\Users\ARLT\AppData\Roaming\OpenCandy\DBE1AA5288C94DDCAABF9BC92915CD67\3709.ico (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\ARLT\AppData\Roaming\OpenCandy\DBE1AA5288C94DDCAABF9BC92915CD67\EBB77268-338F-4C6A-8590-AD88FED26F4A (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\ARLT\AppData\Roaming\OpenCandy\DBE1AA5288C94DDCAABF9BC92915CD67\OCBrowserHelper_1.0.5.112.dll (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) Code:
ATTFilter Malwarebytes Anti-Malware (PRO) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.09.01.04 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16660 ARLT :: ***-VAIO [Administrator] Schutz: Aktiviert 05.09.2013 00:32:41 mbam-log-2013-09-05 (00-32-41).txt Art des Suchlaufs: Flash-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: Registrierung | Dateisystem | P2P Durchsuchte Objekte: 237729 Laufzeit: 40 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Code:
ATTFilter Malwarebytes Anti-Malware (PRO) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.09.05.03 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16660 ARLT :: ****-VAIO [Administrator] Schutz: Aktiviert 05.09.2013 14:11:13 mbam-log-2013-09-05 (14-11-13).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 537124 Laufzeit: 1 Stunde(n), 37 Minute(n), 43 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 2 C:\Users\ARLT\Downloads\FreeFileSync_5.13_Windows_Setup.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\ARLT\Downloads\winamp563_full_emusic-7plus_de-de.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) Code:
ATTFilter Malwarebytes Anti-Malware (PRO) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.09.05.03 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16660 ARLT :: ****-VAIO [Administrator] Schutz: Aktiviert 05.09.2013 14:11:13 MBAM-log-2013-09-05 (16-54-18).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 537124 Laufzeit: 1 Stunde(n), 37 Minute(n), 43 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 2 C:\Users\ARLT\Downloads\FreeFileSync_5.13_Windows_Setup.exe (PUP.Optional.OpenCandy) -> Keine Aktion durchgeführt. C:\Users\ARLT\Downloads\winamp563_full_emusic-7plus_de-de.exe (PUP.Optional.OpenCandy) -> Keine Aktion durchgeführt. (Ende) FRST-Log: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 05-09-2013
Ran by ARLT (administrator) on ****-VAIO on 05-09-2013 18:24:32
Running from C:\Users\ARLT\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvservice.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Sony Corporation) c:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\PSIA.exe
(ArcSoft, Inc.) C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe
(Sony Corporation) C:\Program Files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe
(Microsoft Corporation) C:\Windows\SysWOW64\DllHost.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMService.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\Apoint.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe
() C:\Program Files (x86)\phonostar-Player\phonostarTimer.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Sony Corporation) C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Nullsoft, Inc.) C:\Program Files (x86)\Winamp\winampa.exe
(CANON INC.) C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\ApMsgFwd.exe
(ALPS) C:\Program Files\Apoint\Apvfb.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\Apntex.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
(InterVideo) C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe
() C:\Program Files\Sony\VAIO Care\VCPerfService.exe
() C:\Program Files\Sony\VAIO Care\listener.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VUAgent.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\system32\Macromed\Flash\FlashUtil64_11_8_800_94_ActiveX.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCSystemTray.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCService.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCAgent.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [NvCplDaemon] - C:\Windows\system32\NvCpl.dll [16397416 2010-02-22] (NVIDIA Corporation)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10060320 2010-02-25] (Realtek Semiconductor)
HKLM\...\Run: [Apoint] - C:\Program Files\Apoint\Apoint.exe [212480 2010-03-17] (Alps Electric Co., Ltd.)
HKLM\...\Run: [Logitech Download Assistant] - C:\Windows\System32\LogiLDA.dll [1832760 2012-09-20] (Logitech, Inc.)
HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2184520 2009-07-26] (CANON INC.)
HKLM\...\Run: [CanonSolutionMenu] - C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe [767312 2009-03-17] (CANON INC.)
HKLM\...\Policies\Explorer: [NoActiveDesktop] 1
HKCU\...\Run: [] - [x]
HKCU\...\Run: [GarminExpressTrayApp] - C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [1098072 2013-03-27] (Garmin Ltd or its subsidiaries)
HKCU\...\Run: [phonostar-PlayerTimer] - C:\Program Files (x86)\phonostar-Player\phonostarTimer.exe [42496 2012-10-13] ()
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2009-11-21] (Intel Corporation)
HKLM-x32\...\Run: [ISBMgr.exe] - C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe [316784 2010-01-15] (Sony Corporation)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-02] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [WinampAgent] - C:\Program Files (x86)\Winamp\winampa.exe [74752 2012-06-28] (Nullsoft, Inc.)
HKLM-x32\...\Run: [IJNetworkScanUtility] - C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe [136544 2009-05-19] (CANON INC.)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)
Startup: C:\Users\ARLT\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
BootExecute: autocheck autochk *
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.t-online.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=SVED&bmod=EU01
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
SearchScopes: HKCU - {6129AF1F-2E88-4B60-94BF-DD17B5A4ECF9} URL = hxxp://services.zinio.com/search?s={searchTerms}&rf=sonyslices
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
SearchScopes: HKCU - {86E39001-1C35-42BE-BE1C-F97B0B56BAB5} URL = hxxp://rover.ebay.com/rover/1/707-37276-16609-0/4?satitle={searchTerms}
SearchScopes: HKCU - {D2E17AA1-5F9E-4C06-B2DC-E35E6E92C280} URL = hxxp://de.shopping.com/?linkin_id=8056363
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: WOT Helper - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files\WOT\WOT.dll ()
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: WOT Helper - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files (x86)\WOT\WOT.dll ()
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - WOT - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
Toolbar: HKLM-x32 - WOT - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files (x86)\WOT\WOT.dll ()
Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Toolbar: HKCU - WOT - {71576546-354D-41C9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
Toolbar: HKCU - No Name - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - No File
DPF: HKLM-x32 {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: HKLM-x32 {233C1507-6A77-46A4-9443-F871F945D258} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: HKLM-x32 {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} hxxp://quickscan.bitdefender.com/qsax/qsax.cab
DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab
Handler: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files\WOT\WOT.dll ()
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler-x32: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files (x86)\WOT\WOT.dll ()
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Chrome:
=======
CHR HomePage: hxxp://www.spiegel.de/
CHR RestoreOnStartup: "hxxp://www.spiegel.de/"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.62\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.62\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.62\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java Deployment Toolkit 6.0.180.7) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeploytk.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U20) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll No File
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Picasa) - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
CHR Plugin: (Nokia Suite Enabler Plugin) - C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( )
CHR Plugin: (Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (phonostar Detector) - C:\Program Files (x86)\phonostar-Player\npphonostarDetectNP.dll ( )
CHR Plugin: (Shockwave for Director) - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1168638.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File
CHR Extension: (Chrome In-App Payments service) - C:\Users\ARLT\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.10_0
==================== Services (Whitelisted) =================
R2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [622648 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 Garmin Core Update Service; C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [185688 2013-03-27] (Garmin Ltd or its subsidiaries)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 McComponentHostServiceSony; C:\Program Files (x86)\Sony\MSS\3.0.271\McCHSvc.exe [237328 2012-03-30] (McAfee, Inc.)
R2 nvservice; C:\Windows\system32\nvservice.exe [192800 2013-02-04] (NVIDIA Corporation)
S3 Roxio UPnP Renderer 10; C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe [313840 2009-11-25] (Sonic Solutions)
S2 Roxio Upnp Server 10; C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUpnpService10.exe [362992 2009-11-25] (Sonic Solutions)
R2 SampleCollector; C:\Program Files\Sony\VAIO Care\VCPerfService.exe [156672 2012-08-06] ()
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1226704 2013-05-29] (Secunia)
S2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [658896 2013-05-29] (Secunia)
R2 uCamMonitor; C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [104960 2008-09-18] (ArcSoft, Inc.)
S3 VAIO Entertainment TV Device Arbitration Service; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe [74496 2010-09-27] (Sony Corporation)
S3 VCFw; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [887000 2011-01-20] (Sony Corporation)
R3 VUAgent; C:\Program Files\Sony\VAIO Update\VUAgent.exe [1359408 2013-03-26] (Sony Corporation)
==================== Drivers (Whitelisted) ====================
R3 ArcSoftKsUFilter; C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys [19968 2009-05-26] (ArcSoft, Inc.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-02] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-09-02] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-03-21] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-05-29] (Secunia)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-09-05 18:21 - 2013-09-05 18:22 - 01947160 _____ (Farbar) C:\Users\ARLT\Desktop\FRST64.exe
2013-09-05 18:19 - 2013-09-05 18:19 - 00000470 _____ C:\Users\ARLT\Desktop\defogger_disable.log
2013-09-05 18:19 - 2013-09-05 18:19 - 00000000 _____ C:\Users\ARLT\defogger_reenable
2013-09-05 18:07 - 2013-09-05 18:07 - 96141916 _____ C:\Windows\SysWOW64\埽㍶聤
2013-09-05 18:02 - 2013-09-05 18:02 - 00050477 _____ C:\Users\ARLT\Desktop\Defogger.exe
2013-09-05 17:57 - 2013-09-05 17:57 - 00050477 _____ C:\Users\ARLT\Downloads\Defogger.exe
2013-09-05 16:56 - 2013-09-05 16:56 - 00000624 _____ C:\Windows\PFRO.log
2013-09-05 08:59 - 2013-09-05 16:57 - 00000168 _____ C:\Windows\setupact.log
2013-09-05 08:59 - 2013-09-05 08:59 - 00000000 _____ C:\Windows\setuperr.log
2013-08-29 00:09 - 2013-08-29 00:10 - 00000000 ____D C:\Users\ARLT\AppData\Roaming\vlc
2013-08-29 00:09 - 2013-08-29 00:09 - 00001070 _____ C:\Users\Public\Desktop\VLC media player.lnk
2013-08-28 23:36 - 2013-07-09 08:03 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-28 23:36 - 2013-07-09 07:54 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-28 23:36 - 2013-07-09 07:53 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-08-28 23:36 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-08-28 23:36 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-08-28 23:36 - 2013-07-09 06:53 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-08-28 23:36 - 2013-07-09 06:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-08-28 23:36 - 2013-07-09 04:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-08-28 23:36 - 2013-07-09 04:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-08-28 23:36 - 2013-07-09 04:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-08-28 23:36 - 2013-07-09 04:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-08-26 20:38 - 2013-08-26 20:38 - 00018314 _____ C:\Users\ARLT\Documents\****_Millesimo.dotx
2013-08-26 19:25 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-26 19:25 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-26 19:25 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-26 19:25 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-26 19:25 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-26 19:25 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-26 19:25 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-26 19:25 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-26 19:25 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-26 19:25 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-26 19:25 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-26 19:25 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-26 19:25 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-26 19:25 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-26 19:25 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-26 19:25 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-26 19:25 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-26 19:25 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-26 19:25 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-26 19:25 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-26 19:25 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-26 19:25 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-26 19:25 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-26 19:25 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-26 19:25 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-26 19:25 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-26 19:25 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-26 19:25 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-26 19:25 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-26 19:25 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-26 19:25 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-26 18:49 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-26 18:49 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-26 18:49 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-26 18:49 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-26 18:49 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-26 18:49 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-26 18:49 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-26 18:49 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-26 18:49 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-26 18:49 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-26 18:49 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-26 18:49 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-26 18:49 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-26 18:49 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-26 18:49 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-26 18:49 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-21 11:34 - 2013-08-21 11:34 - 00013008 _____ C:\Users\ARLT\Documents\Reise nach Stuttgart Sept.2013.one
2013-08-19 10:36 - 2013-08-19 10:36 - 00002992 _____ C:\Windows\System32\Tasks\{5F7F98C4-C4D7-4325-B2CF-3756F6FA4210}
2013-08-19 10:06 - 2013-08-19 10:06 - 00002023 _____ C:\Users\ARLT\Desktop\Canon MP990 series Printer - Verknüpfung.lnk
==================== One Month Modified Files and Folders =======
2013-09-05 18:23 - 2013-09-05 18:23 - 00000000 ____D C:\FRST
2013-09-05 18:22 - 2013-09-05 18:21 - 01947160 _____ (Farbar) C:\Users\ARLT\Desktop\FRST64.exe
2013-09-05 18:19 - 2013-09-05 18:19 - 00000470 _____ C:\Users\ARLT\Desktop\defogger_disable.log
2013-09-05 18:19 - 2013-09-05 18:19 - 00000000 _____ C:\Users\ARLT\defogger_reenable
2013-09-05 18:19 - 2012-11-16 18:18 - 00000000 ____D C:\Users\ARLT
2013-09-05 18:17 - 2012-11-16 17:12 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-05 18:07 - 2013-09-05 18:07 - 96141916 _____ C:\Windows\SysWOW64\埽㍶聤
2013-09-05 18:02 - 2013-09-05 18:02 - 00050477 _____ C:\Users\ARLT\Desktop\Defogger.exe
2013-09-05 17:57 - 2013-09-05 17:57 - 00050477 _____ C:\Users\ARLT\Downloads\Defogger.exe
2013-09-05 17:56 - 2013-02-27 12:52 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-05 17:04 - 2009-07-14 06:45 - 00010096 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-05 17:04 - 2009-07-14 06:45 - 00010096 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-05 17:01 - 2012-11-16 17:05 - 01234511 _____ C:\Windows\WindowsUpdate.log
2013-09-05 16:58 - 2012-11-16 17:12 - 00001120 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-05 16:57 - 2013-09-05 08:59 - 00000168 _____ C:\Windows\setupact.log
2013-09-05 16:57 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-05 16:56 - 2013-09-05 16:56 - 00000624 _____ C:\Windows\PFRO.log
2013-09-05 08:59 - 2013-09-05 08:59 - 00000000 _____ C:\Windows\setuperr.log
2013-09-05 00:51 - 2013-03-07 19:39 - 00000000 ____D C:\Windows\Minidump
2013-09-05 00:51 - 2013-01-14 02:51 - 00000000 ____D C:\Users\ARLT\Tracing
2013-09-05 00:51 - 2010-03-26 00:52 - 00000000 ____D C:\Windows\Panther
2013-09-05 00:36 - 2012-11-21 00:53 - 00000000 ___RD C:\Users\ARLT\Desktop\Sicherheit
2013-09-05 00:35 - 2012-11-21 03:25 - 00000000 ____D C:\Program Files\CCleaner
2013-09-04 23:45 - 2013-01-20 12:58 - 00000000 ____D C:\Users\ARLT\Documents\TELEKOM
2013-09-04 22:08 - 2012-11-22 16:11 - 00000000 ____D C:\Users\ARLT\Documents\Outlook-Dateien
2013-09-04 21:27 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2013-09-04 15:06 - 2013-02-27 12:52 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-09-04 15:06 - 2013-02-27 12:52 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-04 15:06 - 2013-02-27 12:52 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-09-04 15:06 - 2012-11-21 22:02 - 00000000 ____D C:\Users\ARLT\AppData\Local\Adobe
2013-09-04 10:25 - 2012-11-21 03:14 - 00000000 ____D C:\Users\ARLT\AppData\Roaming\Skype
2013-09-03 08:32 - 2012-11-16 17:00 - 00697082 _____ C:\Windows\system32\perfh007.dat
2013-09-03 08:32 - 2012-11-16 17:00 - 00148346 _____ C:\Windows\system32\perfc007.dat
2013-09-03 08:32 - 2009-07-14 07:13 - 01613340 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-02 17:32 - 2013-01-20 12:59 - 00000000 ___RD C:\Users\ARLT\Documents\Wertpapiere
2013-09-02 15:15 - 2013-05-02 11:31 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-09-02 15:15 - 2013-03-21 14:47 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-09-02 15:15 - 2013-03-21 14:47 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-08-31 11:46 - 2012-11-21 03:15 - 00000000 ____D C:\ProgramData\ArcSoft
2013-08-31 11:46 - 2012-11-16 18:20 - 00000000 ___RD C:\Users\ARLT\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-08-31 11:46 - 2012-11-16 18:20 - 00000000 ___RD C:\Users\ARLT\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-08-31 11:46 - 2010-03-26 00:14 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-08-30 23:27 - 2013-01-20 12:19 - 00000000 ____D C:\Users\ARLT\Documents\FAMILIE
2013-08-29 00:10 - 2013-08-29 00:09 - 00000000 ____D C:\Users\ARLT\AppData\Roaming\vlc
2013-08-29 00:09 - 2013-08-29 00:09 - 00001070 _____ C:\Users\Public\Desktop\VLC media player.lnk
2013-08-29 00:00 - 2013-01-20 12:22 - 00000000 ____D C:\Users\ARLT\Documents\Korrespondenz
2013-08-28 23:57 - 2013-02-26 20:08 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-08-28 23:57 - 2012-11-16 17:22 - 00000000 ____D C:\ProgramData\Skype
2013-08-28 23:49 - 2012-11-16 18:49 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-08-28 23:49 - 2009-07-14 04:34 - 00000478 _____ C:\Windows\win.ini
2013-08-27 21:04 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-08-26 20:38 - 2013-08-26 20:38 - 00018314 _____ C:\Users\ARLT\Documents\****_Millesimo.dotx
2013-08-26 19:20 - 2013-07-11 11:10 - 00000000 ____D C:\Windows\system32\MRT
2013-08-26 19:15 - 2012-11-21 09:03 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-21 11:34 - 2013-08-21 11:34 - 00013008 _____ C:\Users\ARLT\Documents\Reise nach Stuttgart Sept.2013.one
2013-08-19 10:36 - 2013-08-19 10:36 - 00002992 _____ C:\Windows\System32\Tasks\{5F7F98C4-C4D7-4325-B2CF-3756F6FA4210}
2013-08-19 10:06 - 2013-08-19 10:06 - 00002023 _____ C:\Users\ARLT\Desktop\Canon MP990 series Printer - Verknüpfung.lnk
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-09-01 21:23
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 05-09-2013 Ran by ARLT at 2013-09-05 18:25:57 Running from C:\Users\ARLT\Desktop Boot Mode: Normal ========================================================== ==================== Installed Programs ======================= 7-Zip 9.20 (x64 edition) (Version: 9.20.00.0) Adobe Flash Player 11 ActiveX (x32 Version: 11.8.800.94) Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.94) Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03) Adobe Shockwave Player 12.0 (x32 Version: 12.0.3.133) Ahnenblatt 2.74 (x32 Version: 2.74.0.1) Alps Pointing-device for VAIO Apple Application Support (x32 Version: 2.3.4) Apple Software Update (x32 Version: 2.1.3.127) ArcSoft Magic-i Visual Effects 2 (x32 Version: 2.0.1.85) ArcSoft PhotoStudio 6 (x32 Version: 6.0.1.132) ArcSoft WebCam Companion 3 (x32 Version: 3.0.21.278) Avira Antivirus Premium (x32 Version: 13.0.0.4052) Canon Easy-PhotoPrint Pro - Pro9000 series Extention Data (x32) Canon Easy-PhotoPrint Pro - Pro9500 series Extention Data (x32) Canon Easy-WebPrint EX (x32 Version: 1.3.5.0) Canon IJ Network Scan Utility (x32) Canon IJ Network Tool (x32) Canon MP Navigator EX 3.0 (x32) Canon MP990 series Benutzerregistrierung (x32) Canon MP990 series MP Drivers Canon My Image Garden (x32 Version: 1.0.3) Canon My Image Garden Design Files (x32 Version: 1.0.1) Canon Utilities Easy-PhotoPrint EX (x32) Canon Utilities Easy-PhotoPrint Pro (x32) Canon Utilities My Printer (x32) Canon Utilities Solution Menu (x32) CCleaner (Version: 4.05) CD-LabelPrint (x32) Corel WinDVD (x32 Version: 10.0.5.296) D3DX10 (x32 Version: 15.4.2368.0902) Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32) DesignPro 5 (x32 Version: 5.5.708) dows-Treiberpaket - Broadcom HIDClass (09/11/2009 6.3.0.1500) (Version: 09/11/2009 6.3.0.1500) Einstellungen für VAIO-Inhaltsüberwachung (x32 Version: 2.6.0.13120) Elevated Installer (x32 Version: 2.1.13) ESET Online Scanner v3 (x32) Fotogalerie (x32 Version: 16.4.3505.0912) FreeFileSync 5.13 (x32 Version: 5.13) Garmin Express (x32 Version: 2.1.13) Garmin Express Tray (x32 Version: 2.1.13) Garmin Update Service (x32 Version: 2.1.13) GIMP 2.8.4 (Version: 2.8.4) Google Chrome (x32 Version: 29.0.1547.66) Google Earth Plug-in (x32 Version: 7.1.1.1888) Google Update Helper (x32 Version: 1.3.21.153) Intel PROSet Wireless Intel(R) Control Center (x32 Version: 1.2.1.1007) Intel(R) PROSet/Wireless WiFi-Software (Version: 13.00.0000) Intel(R) Rapid Storage Technology (x32 Version: 9.5.4.1001) Intel(R) Turbo Boost Technology Driver (x32 Version: 01.01.01.1007) Java 7 Update 25 (64-bit) (Version: 7.0.250) Java 7 Update 25 (x32 Version: 7.0.250) Java Auto Updater (x32 Version: 2.1.9.5) Junk Mail filter update (x32 Version: 16.4.3505.0912) Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300) Media Gallery (x32 Version: 1.2.0.15040) Media Gallery MergeModules x64 (Version: 1.0.14250) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319) Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319) Microsoft .NET Framework 4 Extended (Version: 4.0.30319) Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319) Microsoft Application Error Reporting (Version: 12.0.6015.5000) Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Home and Business 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000) Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Outlook Connector (x32 Version: 14.0.6123.5001) Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000) Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Single Image 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000) Microsoft Silverlight (Version: 5.1.20513.0) Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000) Microsoft SQL Server Compact 3.5 SP1 English (x32 Version: 3.5.5692.0) Microsoft SQL Server Compact 3.5 SP1 x64 English (Version: 3.5.5692.0) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219) Microsoft_VC100_CRT_SP1_x64 (Version: 10.0.40219.1) Microsoft_VC100_CRT_SP1_x86 (x32 Version: 10.0.40219.1) Movie Maker (x32 Version: 16.4.3505.0912) MSVC80_x64_v2 (Version: 1.0.3.0) MSVC80_x86_v2 (x32 Version: 1.0.3.0) MSVC90_x64 (Version: 1.0.1.2) MSVC90_x86 (x32 Version: 1.0.1.2) MSVCRT (x32 Version: 15.4.2862.0708) MSVCRT_amd64 (x32 Version: 15.4.2862.0708) MSVCRT110 (x32 Version: 16.4.1108.0727) MSVCRT110_amd64 (Version: 16.4.1109.0912) MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0) MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0) MSXML 4.0 SP3 Parser (KB2758694) (x32 Version: 4.30.2117.0) MSXML 4.0 SP3 Parser (x32 Version: 4.30.2100.0) MusicStation (x32 Version: 2.0.5.39) Nokia Connectivity Cable Driver (x32 Version: 7.1.101.0) Nokia Suite (x32 Version: 3.7.22.0) Norton Online Backup (x32 Version: 1.2.20.0) NVIDIA Drivers (Version: 1.10.57.35) NVIDIA Guard Service 1.3 (Version: 1.3) NVIDIA HD-Audiotreiber 1.3.18.0 (Version: 1.3.18.0) NVIDIA Install Application (Version: 2.1002.109.718) Paint.NET v3.5.10 (Version: 3.60.0) PC Connectivity Solution (x32 Version: 12.0.76.0) phonostar-Player Version 3.02.8 (x32) Photo Gallery (x32 Version: 16.4.3505.0912) Picasa 3 (x32 Version: 3.9) PMB (x32 Version: 5.1.02.03310) PMB VAIO Edition Plug-in (Version: 1.5.10.05300) PMB VAIO Edition Plug-in (x32 Version: 1.5.10.06150) PVSonyDll (Version: 1.00.0001) QuickTime (x32 Version: 7.74.80.86) Realtek High Definition Audio Driver (x32 Version: 6.0.1.6045) Remote Play mit PlayStation®3 (x32 Version: 1.0.0.15090) Remote Play with PlayStation 3 (x32 Version: 1.0.0.15090) Remote-Tastatur mit PlayStation 3 (x32 Version: 1.0.2.06170) Roxio Central Audio (x32 Version: 3.8.0) Roxio Central Copy (x32 Version: 3.8.0) Roxio Central Core (x32 Version: 3.8.0) Roxio Central Data (x32 Version: 3.8.0) Roxio Central Tools (x32 Version: 3.8.0) Roxio Easy Media Creator 10 LJ (x32 Version: 10.3) Roxio Easy Media Creator Home (x32 Version: 10.3.263) Secunia PSI (3.0.0.7010) (x32 Version: 3.0.0.7010) Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32) SES Driver (Version: 1.0.0) Setting Utility Series (x32 Version: 5.2.0.14250) Setup_msm_VCMS_x64 (Version: 2.6.0.06040) Setup_msm_VOFS_x64 (Version: 2.4.0.16010) Setup_VEP_x64 (Version: 3.9.30.19080) Skype™ 6.6 (x32 Version: 6.6.106) SOHLib Merge Module (x32 Version: 2.2.0.11240) Sony Home Network Library (x32 Version: 2.1.0.14240) Sony Home Network Library (x32 Version: 2.2.0.13270) swMSM (x32 Version: 12.0.0.1) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1) Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1) Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1) Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1) Update for Microsoft .NET Framework 4 Extended (KB2836939) (x32 Version: 1) Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32) VAIO - PMB VAIO Edition Guide (x32 Version: 1.5.00.03020) VAIO - PMB VAIO Edition Plug-in (x32 Version: 1.6.10.11160) VAIO Care (Version: 8.1.0.10120) VAIO Control Center (x32 Version: 4.2.0.15020) VAIO Data Restore Tool (x32 Version: 1.3.0.13150) VAIO DVD Menu Data (x32 Version: 2.4.00.05300) VAIO Energie Verwaltung (x32 Version: 5.1.0.13200) VAIO Entertainment Platform (x32 Version: 3.9.30.19080) VAIO Event Service (x32 Version: 5.2.0.15020) VAIO Gate (x32 Version: 2.0.0.14050) VAIO Gate Default (x32 Version: 2.0.0.04160) VAIO Hardware Diagnostics (x32 Version: 3.9.1) VAIO Media plus (x32 Version: 2.1.0.15040) VAIO Media plus Opening Movie (x32 Version: 2.1.0.13220) VAIO Movie Story Template Data (x32 Version: 2.1.00.14040) VAIO Movie Story Template Data (x32 Version: 2.5.00.05300) VAIO Original Funktion Einstellungen (x32 Version: 2.4.0.19040) VAIO Premium Partners (x32 Version: 1.0) VAIO screensaver (x32 Version: 1.0.0.0) VAIO Smart Network (x32 Version: 3.3.1.08110) VAIO Update (x32 Version: 6.2.1.03260) VAIO Wallpaper Contents (x32 Version: 2.1.0.14090) VAIO Window Organizer (x32 Version: 2.1.0.13200) VAIO-Support für Übertragungen (x32 Version: 1.1.2.06030) VD64Inst (Version: 1.00.0000) Visual C++ 9.0 CRT (x86) WinSXS MSM (x32 Version: 9.0) VLC media player 2.0.8 (x32 Version: 2.0.8) VMp MergeModule x64 (Version: 1.0.0) VU5x64 (Version: 1.1.0) VU5x86 (x32 Version: 1.0.0) VU5x86 (x32 Version: 1.1.0) WIDCOMM Bluetooth Software (Version: 6.3.0.3950) Winamp (x32 Version: 5.63 ) Winamp Erkennungs-Plug-in (HKCU Version: 1.0.0.1) Windows Driver Package - Western Digital Technologies (WDC_SAM) WDC_SAM (01/19/2011 1.0.0009.0) (Version: 01/19/2011 1.0.0009.0) Windows Live Communications Platform (x32 Version: 16.4.3505.0912) Windows Live Essentials (x32 Version: 16.4.3505.0912) Windows Live Family Safety (Version: 16.4.3505.0912) Windows Live Family Safety (x32 Version: 16.4.3505.0912) Windows Live ID Sign-in Assistant (Version: 7.250.4311.0) Windows Live Installer (x32 Version: 16.4.3505.0912) Windows Live Mail (x32 Version: 16.4.3505.0912) Windows Live Messenger (x32 Version: 16.4.3505.0912) Windows Live MIME IFilter (Version: 16.4.3505.0912) Windows Live Photo Common (x32 Version: 16.4.3505.0912) Windows Live PIMT Platform (x32 Version: 16.4.3505.0912) Windows Live SOXE (x32 Version: 16.4.3505.0912) Windows Live SOXE Definitions (x32 Version: 16.4.3505.0912) Windows Live Sync (x32 Version: 14.0.8089.726) Windows Live UX Platform (x32 Version: 16.4.3505.0912) Windows Live UX Platform Language Pack (x32 Version: 16.4.3505.0912) Windows Live Writer (x32 Version: 16.4.3505.0912) Windows Live Writer Resources (x32 Version: 16.4.3505.0912) Windows-Treiberpaket - Broadcom Corporation (BTHUSB) Bluetooth (02/12/2010 6.3.0.3820) (Version: 02/12/2010 6.3.0.3820) Windows-Treiberpaket - Broadcom Corporation (BTHUSB) Bluetooth (02/28/2010 6.3.0.3850) (Version: 02/28/2010 6.3.0.3850) Windows-Treiberpaket - Nokia pccsmcfd LegacyDriver (05/31/2012 7.1.2.0) (Version: 05/31/2012 7.1.2.0) WISO Steuer-Sparbuch 2012 (x32 Version: 19.00.7303) WISO Steuer-Sparbuch 2013 (x32 Version: 20.00.8137) WOT for Internet Explorer (Version: 12.8.2.0) ==================== Restore Points ========================= 31-07-2013 20:44:57 Geplanter Prüfpunkt 20-08-2013 17:44:03 Geplanter Prüfpunkt 26-08-2013 17:14:21 Windows Update 28-08-2013 21:43:46 Windows Update 31-08-2013 09:46:18 Installed Connect Service ==================== Hosts content: ========================== 2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: {044A6734-E90E-4F8F-B357-B2DC8AB3B5EC} - System32\Tasks\Microsoft\Windows\Time Synchronization\SynchronizeTime => Sc.exe start w32time task_started Task: {049E3F8C-5296-4631-9D82-B229525C44FD} - System32\Tasks\Sony Corporation\VAIO Care\VCOneClick => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2012-10-12] (Sony Corporation) Task: {0A7707F3-566F-44D7-A01C-82BDDBDD83BF} - System32\Tasks\SONY\VAIO Gate\StartExecuteProxy => C:\Program Files\Sony\VAIO Gate\ExecutionProxy.exe [2010-02-06] (Sony Corporation) Task: {0C00B695-105A-4809-9854-50DB1881621C} - System32\Tasks\Sony Corporation\VAIO Care\VAIO Care => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2012-10-12] (Sony Corporation) Task: {1FA68A13-C118-472E-984E-0C26B3740BF4} - System32\Tasks\User_Feed_Synchronization-{01A0BA37-2FE8-474B-A66E-54F6C55FC3F8} => C:\Windows\system32\msfeedssync.exe [2013-03-06] (Microsoft Corporation) Task: {1FEF7852-F110-478F-898F-43E0D792B39E} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.) Task: {287871F2-6FF6-4F78-9B34-E2DF53D6FC13} - System32\Tasks\Sony Corporation\VAIO Care\CRMReminder => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2012-10-12] (Sony Corporation) Task: {5AEB0DEE-3F7B-48CB-88DD-8193667F22DE} - System32\Tasks\Sony Corporation\VAIO Care\VCMetrics => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2012-10-12] (Sony Corporation) Task: {5F8F66EC-E47E-4C44-924D-38DBDAC71CDD} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task Task: {67F11F74-C9F4-449F-9A47-2E83CDE104AD} - System32\Tasks\SONY\Remote Keyboard with PlayStation 3\Remote Keyboard with PlayStation 3 => C:\Program Files\Sony\Remote Keyboard with PlayStation 3\VBTKBUtil.exe [2010-06-17] (Sony Corporation) Task: {6FD54BDB-4C1F-48D0-BEEC-F198D32EAEEC} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => C:\Windows\System32\sdengin2.dll [2010-11-20] (Microsoft Corporation) Task: {715ECDE1-AEB8-4DBD-A5A1-409C6C9D001D} - System32\Tasks\Sony Corporation\VAIO Update\VAIO Update => C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe [2013-03-26] (Sony Corporation) Task: {74D9A222-6C44-4CE5-833A-44DEAE2A43D1} - System32\Tasks\SONY\SUS-BCF\Level4Month => C:\Program Files (x86)\Sony\Setting Utility Series\WBCBatteryCare.exe [2010-03-01] (Sony Corporation) Task: {8274016A-F6AA-4DBE-8E8D-62CBCA8D3B01} - System32\Tasks\Sony Corporation\VAIO Care\VCCheckIolo => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2012-10-12] (Sony Corporation) Task: {936E657D-3BF3-401D-A042-5DC24AB1969B} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-09-04] (Adobe Systems Incorporated) Task: {9BA24212-4AE0-48BB-BD85-8F6FD0920B8A} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-08-21] (Piriform Ltd) Task: {9C9D046F-0751-4624-8310-7971D45C6984} - System32\Tasks\Microsoft\Windows\WindowsBackup\Windows Backup Monitor => C:\Windows\system32\sdclt.exe [2010-11-20] (Microsoft Corporation) Task: {A3194BA0-A3FE-4F7A-8978-D5D60BD0C9D8} - System32\Tasks\SONY\VAIO Power Management\VPM Unlock => C:\Program Files\Sony\VAIO Power Management\SPMgr.exe [2010-06-19] (Sony Corporation) Task: {A6CBE09A-3CD3-4DBB-B22C-619EEB370D78} - System32\Tasks\User_Feed_Synchronization-{84E6EC5F-FFE2-49BC-9FF2-13832946AE52} => C:\Windows\system32\msfeedssync.exe [2013-03-06] (Microsoft Corporation) Task: {B71A398D-4545-43EB-B2A5-B7983A5E2839} - System32\Tasks\VAIO Care Support => C:\Program Files\Sony\VAIO Care\VCSpt.exe Task: {B84BF13E-580E-4E7C-BBE8-895AB3619BC7} - System32\Tasks\Sony Corporation\VAIO Update\VAIO Update Self Repair => C:\Program Files\Sony\VAIO Update\VUSR.exe [2013-03-26] (Sony Corporation) Task: {B933F1F1-F5E3-408E-BE0D-958156BE920B} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-11-16] (Google Inc.) Task: {BEDB568E-2582-4832-8AD1-B0D0701D1E20} - System32\Tasks\SONY\VAIO Power Management\VPM Session Change => C:\Program Files\Sony\VAIO Power Management\SPMgr.exe [2010-06-19] (Sony Corporation) Task: {C3D63601-434E-4B1C-AFA8-4E266D70B09A} - System32\Tasks\{5F7F98C4-C4D7-4325-B2CF-3756F6FA4210} => C:\Program Files (x86)\Canon\Canon IJ Network Tool\CNMNPUT.EXE [2009-04-03] (CANON INC.) Task: {DBDB87BC-C139-4291-A901-1A9361D08B1E} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-11-16] (Google Inc.) Task: {DDC3E899-F216-48CC-8252-7861640EEC14} - System32\Tasks\Sony Corporation\VAIO Update\Launch Application => C:\Program Files\SONY\VAIO Update\ShellExeProxy.exe [2013-03-26] (Sony Corporation) Task: {E2D3F666-C79B-43CB-8B8D-F1521708E1A1} - System32\Tasks\SONY\VAIO Gate\VAIO Gate => C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe [2010-02-06] (Sony Corporation) Task: {E3A13AEC-1ED0-4E6E-ABB2-EEFCCD515782} - System32\Tasks\SONY\VAIO Power Management\VPM Logon Start => C:\Program Files\Sony\VAIO Power Management\SPMgr.exe [2010-06-19] (Sony Corporation) Task: {E5722C31-666E-4F72-97A3-EA2615F1C460} - System32\Tasks\SONY\SUS-BCF\Level4Daily => C:\Program Files (x86)\Sony\Setting Utility Series\WBCBatteryCare.exe [2010-03-01] (Sony Corporation) Task: {ECF676FA-82DD-4985-A258-7A42E86DEBA5} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc Task: {F557BAC6-F9DB-4123-BB4E-0A3A280BA7BA} - System32\Tasks\Sony Corporation\VAIO Care\VCSelfHeal => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2012-10-12] (Sony Corporation) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe ==================== Loaded Modules (whitelisted) ============= 2009-07-14 02:22 - 2009-07-14 03:38 - 00081408 _____ (Fraunhofer Institut Integrierte Schaltungen IIS) C:\Windows\System32\l3codeca.acm 2010-03-26 00:53 - 2010-03-18 11:16 - 04452456 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll 2009-11-26 13:44 - 2009-11-26 13:44 - 00145904 _____ (Sonic Solutions) C:\Program Files\Roxio\Virtual Drive 10\DC_ShellExt64.dll 2012-11-16 17:26 - 2010-02-06 02:23 - 00244224 _____ (Sony Corporation) C:\Program Files\Sony\VAIO Gate\TapTrigger.dll 2012-11-16 17:26 - 2010-02-06 02:23 - 00229888 _____ (Sony Corporation) C:\Program Files\Sony\VAIO Gate\NotificationWrapper.dll 2012-11-16 17:26 - 2010-02-06 02:23 - 00598016 _____ (Sony Corporation) C:\Program Files\Sony\VAIO Gate\VGDam.dll 2013-06-09 03:05 - 2013-03-26 15:15 - 00030784 _____ (Sony Corporation) C:\Program Files\Sony\VAIO Update\VUAgentPS64.dll 2012-11-16 17:26 - 2010-02-06 02:23 - 00039936 _____ (Sony Corporation) C:\Program Files\Sony\VAIO Gate\VGNet.dll 2012-11-16 17:10 - 2009-12-04 21:09 - 00152064 _____ (Sony Corporation) C:\Program Files\Common Files\Sony Shared\Sony Utilities\SnyUtils.dll 2012-11-16 17:26 - 2010-01-20 16:10 - 00078336 _____ (Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMDrv.dll 2013-01-28 10:14 - 2010-06-19 14:27 - 00220160 _____ (Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMDam.dll 2010-03-24 08:09 - 2010-03-17 22:03 - 00100352 _____ (Alps Electric Co., Ltd.) C:\Windows\system32\VXDIF.DLL 2010-03-24 08:09 - 2010-03-17 22:02 - 00199680 _____ (Alps Electric Co., Ltd.) C:\Program Files\Apoint\Apoint.DLL 2010-03-24 08:09 - 2010-03-17 22:02 - 00032768 _____ (Alps Electric Co., Ltd.) C:\Program Files\Apoint\EzAuto.dll 2010-03-24 08:09 - 2010-03-17 22:02 - 01389056 _____ (Alps Electric Co., Ltd.) C:\Program Files\Apoint\ApRes.dll 2010-03-24 08:09 - 2010-03-17 22:02 - 00266752 _____ (Alps Electric Co., Ltd.) C:\Program Files\Apoint\EzLaunch.DLL 2013-01-13 15:16 - 2009-07-26 19:10 - 00113152 _____ (CANON INC.) C:\Program Files\Canon\MyPrinter\cnmpu.dll 2013-01-13 15:16 - 2009-07-26 19:10 - 00065536 _____ (CANON INC.) C:\Program Files\Canon\MyPrinter\BJMyRes.dll 2009-07-14 02:09 - 2009-07-14 03:38 - 00425984 _____ (Microsoft Corporation) C:\Windows\system32\irprops.cpl 2013-01-27 15:01 - 2013-03-26 15:16 - 00017984 _____ (Sony Corporation) C:\Program Files\Sony\VAIO Update\InternetWrapperPS.dll 2013-07-11 11:25 - 2013-09-04 15:06 - 00529288 _____ (Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashUtil64_11_8_800_94_ActiveX.dll 2013-05-02 11:40 - 2013-05-02 11:40 - 00295400 _____ (Sony Corporation) C:\Windows\Microsoft.Net\assembly\GAC_64\VAIOCareToolkit\v4.0_8.1.0.10100__6b746f706d1a5a7d\VAIOCareToolkit.dll 2010-03-26 00:53 - 2010-03-18 11:15 - 09621608 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll 2012-10-12 14:02 - 2012-10-12 14:02 - 00130024 _____ (Sony Corporation) C:\Program Files\Sony\VAIO Care\de-DE\VCSystemTray.resources.dll 2012-10-12 14:02 - 2012-10-12 14:02 - 00035816 _____ (Sony Corporation) C:\Program Files\Sony\VAIO Care\Plugins\IntelMonitor\IntelMonitorBL.dll 2012-10-12 14:02 - 2012-10-12 14:02 - 00031720 _____ (Sony Corporation) C:\Program Files\Sony\VAIO Care\Plugins\CommonPlugin\CommonPluginBL.dll 2012-10-12 14:02 - 2012-10-12 14:02 - 00240616 _____ (Sony Corporation) C:\Program Files\Sony\VAIO Care\Libraries\VAIOCare.Utilities.dll 2012-10-12 14:02 - 2012-10-12 14:02 - 00023016 _____ (Sony Corporation) C:\Program Files\Sony\VAIO Care\Plugins\Metrics\MetricsBL.dll 2012-10-12 14:02 - 2012-10-12 14:02 - 00010728 _____ (Sony Corporation) C:\Program Files\Sony\VAIO Care\Plugins\Metrics\MetricsAPI.dll 2012-10-12 14:02 - 2012-10-12 14:02 - 00020456 _____ (Sony Corporation) C:\Program Files\Sony\VAIO Care\Libraries\MetricsMethod.dll 2012-10-12 14:02 - 2012-10-12 14:02 - 00016872 _____ (Sony Corporation) C:\Program Files\Sony\VAIO Care\Plugins\Metrics\MetricsPL.dll 2012-10-12 14:02 - 2012-10-12 14:02 - 00024040 _____ (Sony Corporation) C:\Program Files\Sony\VAIO Care\Plugins\Notification\NotificationBL.dll 2012-10-12 14:02 - 2012-10-12 14:02 - 00009704 _____ (Sony Corporation) C:\Program Files\Sony\VAIO Care\Plugins\Notification\NotificationAPI.dll 2012-10-12 14:02 - 2012-10-12 14:02 - 00430568 _____ (Sony Corporation) C:\Program Files\Sony\VAIO Care\Plugins\Notification\NotificationPL.dll 2012-10-12 14:02 - 2012-10-12 14:02 - 00016872 _____ (Sony Corporation) C:\Program Files\Sony\VAIO Care\Plugins\LaunchBrowser\LaunchBrowserBL.dll 2012-10-12 14:02 - 2012-10-12 14:02 - 00015336 _____ (Sony Corporation) C:\Program Files\Sony\VAIO Care\Plugins\SystemSupport\SystemSupportBL.dll 2012-10-12 14:02 - 2012-10-12 14:02 - 00097256 _____ (Sony Corporation) C:\Program Files\Sony\VAIO Care\Plugins\NetworkDiagnostics\NetworkDiagnosticsBL.dll 2012-10-12 14:02 - 2012-10-12 14:02 - 00017896 _____ (Sony Corporation) C:\Program Files\Sony\VAIO Care\Plugins\NetworkDiagnostics\NetworkDiagnosticsAPI.dll 2012-10-12 14:02 - 2012-10-12 14:02 - 00168424 _____ (Sony Corporation) C:\Program Files\Sony\VAIO Care\Plugins\AboutVAIOHub\AboutVAIOHubPL.dll 2012-10-12 14:02 - 2012-10-12 14:02 - 00028136 _____ (Sony Corporation) C:\Program Files\Sony\VAIO Care\Plugins\SelfHeal\SelfHealBL.dll 2012-10-12 14:02 - 2012-10-12 14:02 - 00011752 _____ (Sony Corporation) C:\Program Files\Sony\VAIO Care\Plugins\SelfHeal\SelfHealAPI.dll 2012-10-12 14:02 - 2012-10-12 14:02 - 00035304 _____ (Sony Corporation) C:\Program Files\Sony\VAIO Care\Libraries\SelfHeal.dll 2012-10-12 14:02 - 2012-10-12 14:02 - 00088552 _____ (Sony Corporation) C:\Program Files\Sony\VAIO Care\Plugins\AdvancedTools\AdvancedToolsBL.dll 2012-10-12 14:02 - 2012-10-12 14:02 - 00015336 _____ (Sony Corporation) C:\Program Files\Sony\VAIO Care\Plugins\AdvancedTools\AdvancedToolsAPI.dll 2012-10-12 14:02 - 2012-10-12 14:02 - 00027112 _____ (Sony Corporation) C:\Program Files\Sony\VAIO Care\Libraries\IoloToolOpt.dll 2012-10-12 14:02 - 2012-10-12 14:02 - 00032232 _____ (Sony Corporation) C:\Program Files\Sony\VAIO Care\Plugins\ContactAndSupport\ContactAndSupportBL.dll 2012-10-12 14:02 - 2012-10-12 14:02 - 00013800 _____ (Sony Corporation) C:\Program Files\Sony\VAIO Care\Plugins\ContactAndSupport\ContactAndSupportAPI.dll 2012-10-12 14:02 - 2012-10-12 14:02 - 00032744 _____ (Sony Corporation) C:\Program Files\Sony\VAIO Care\Plugins\History\HistoryBL.dll 2012-10-12 14:02 - 2012-10-12 14:02 - 00010728 _____ (Sony Corporation) C:\Program Files\Sony\VAIO Care\Plugins\History\HistoryAPI.dll 2012-10-12 14:02 - 2012-10-12 14:02 - 00024040 _____ (Sony Corporation) C:\Program Files\Sony\VAIO Care\Plugins\BatteryCheck\BatteryCheckBL.dll 2012-10-12 14:02 - 2012-10-12 14:02 - 00179176 _____ (Sony Corporation) C:\Program Files\Sony\VAIO Care\Plugins\OneClickCare\OneClickCareBL.dll 2012-10-12 14:02 - 2012-10-12 14:02 - 00032232 _____ (Sony Corporation) C:\Program Files\Sony\VAIO Care\Plugins\OneClickCare\OneClickCareAPI.dll 2012-10-12 14:02 - 2012-10-12 14:02 - 00049640 _____ (Sony Corporation) C:\Program Files\Sony\VAIO Care\Plugins\Message\MessageBL.dll 2012-10-12 14:02 - 2012-10-12 14:02 - 00025064 _____ (Sony Corporation) C:\Program Files\Sony\VAIO Care\Plugins\DownloadManager\DownloadManagerBL.dll 2012-10-12 14:02 - 2012-10-12 14:02 - 00042472 _____ (Sony Corporation) C:\Program Files\Sony\VAIO Care\Plugins\Solve\SolveBL.dll 2012-10-12 14:02 - 2012-10-12 14:02 - 00016360 _____ (Sony Corporation) C:\Program Files\Sony\VAIO Care\Plugins\Solve\SolveAPI.dll 2012-10-12 14:02 - 2012-10-12 14:02 - 00016360 _____ (Sony Corporation) C:\Program Files\Sony\VAIO Care\Plugins\GenericVAIOCareReminders\GenericVAIOCareRemindersBL.dll 2012-10-12 14:02 - 2012-10-12 14:02 - 00013288 _____ (Sony Corporation) C:\Program Files\Sony\VAIO Care\Plugins\UploadManager\UploadManagerBL.dll 2012-10-12 14:02 - 2012-10-12 14:02 - 00016360 _____ (Sony Corporation) C:\Program Files\Sony\VAIO Care\Plugins\VAIOCareUpdateCommon\VAIOCareUpdateCommonBL.dll 2012-10-12 14:02 - 2012-10-12 14:02 - 00033256 _____ (Sony Corporation) C:\Program Files\Sony\VAIO Care\Plugins\VAIOCareUpdate\VAIOCareUpdateBL.dll 2012-11-22 00:35 - 2012-01-05 16:15 - 02518528 _____ (Nokia Corporation and/or its subsidiary(-ies)) C:\Program Files (x86)\phonostar-Player\QtCore4.dll 2012-11-22 00:35 - 2011-12-08 07:59 - 08350208 _____ (Nokia Corporation and/or its subsidiary(-ies)) C:\Program Files (x86)\phonostar-Player\QtGui4.dll 2012-11-22 00:35 - 2011-12-08 07:47 - 00194560 _____ (Nokia Corporation and/or its subsidiary(-ies)) C:\Program Files (x86)\phonostar-Player\QtSql4.dll 2012-11-22 00:35 - 2011-12-08 11:03 - 00443392 _____ (Nokia Corporation and/or its subsidiary(-ies)) C:\Program Files (x86)\phonostar-Player\plugins\sqldrivers\qsqlite4.dll 2012-11-16 17:10 - 2009-12-04 21:09 - 00102400 _____ (Sony Corporation) C:\Program Files (x86)\Common Files\Sony Shared\Sony Utilities\SnyUtils.dll 2012-11-21 02:59 - 2013-09-02 15:14 - 00055352 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\cfglib.dll 2012-11-21 02:59 - 2013-09-02 15:14 - 00349752 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccguard.dll 2012-11-21 02:59 - 2013-09-02 15:14 - 00029240 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccgrdrc.dll 2012-11-21 02:59 - 2013-09-02 15:14 - 00229432 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccgrdw.dll 2012-11-21 02:59 - 2013-09-02 15:15 - 00218168 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\gpipc.dll 2012-11-21 02:59 - 2013-09-02 15:14 - 00407608 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccmguard.dll 2012-11-21 02:59 - 2013-09-02 15:14 - 00032824 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccmgrdrc.dll 2012-11-21 02:59 - 2013-09-02 15:14 - 00419384 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccwgrd.dll 2012-11-21 02:59 - 2013-09-02 15:14 - 00027192 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccwgrdrc.dll 2012-11-21 02:59 - 2013-09-02 15:14 - 00127544 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccwgrdw.dll 2012-11-21 02:59 - 2013-09-02 15:14 - 00807992 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccgen.dll 2012-11-21 02:59 - 2013-09-02 15:14 - 00049720 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccgenrc.dll 2012-11-21 02:59 - 2013-09-02 15:14 - 00220216 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccupdate.dll 2012-11-21 02:59 - 2013-09-02 15:14 - 00028728 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccupdrc.dll 2012-11-21 02:59 - 2013-09-02 15:14 - 00083000 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\cclic.dll 2012-11-21 02:59 - 2013-09-02 15:14 - 00009784 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\cclicrc.dll 2012-11-21 02:59 - 2013-09-02 15:14 - 00237624 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccmsg.dll 2012-11-21 02:59 - 2013-09-02 15:14 - 00010296 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccmsgrc.dll 2012-11-21 02:59 - 2013-09-02 15:14 - 00014392 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccmainrc.dll 2013-01-13 15:23 - 2009-05-19 19:34 - 00019968 _____ (CANON INC.) C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNSU_DEU.DLL 2013-01-13 14:18 - 2012-10-16 09:39 - 00561664 _____ (Microsoft Corporation) C:\Windows\AppPatch\AcLayers.DLL 2012-11-21 21:51 - 2010-11-20 14:16 - 00320000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WINSPOOL.DRV 2013-08-28 23:36 - 2013-07-09 06:45 - 00044032 _____ (Microsoft Corporation) C:\Windows\AppPatch\AcWow64.DLL 2012-08-02 19:15 - 2012-08-02 19:15 - 01542720 _____ () C:\Program Files (x86)\WOT\WOT.dll 2013-06-25 11:33 - 2013-06-25 11:33 - 00463272 _____ (Oracle Corporation) C:\Program Files (x86)\Java\jre7\bin\ssv.dll 2013-06-25 11:33 - 2013-06-25 11:33 - 00171944 _____ (Oracle Corporation) C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll 2013-07-11 11:25 - 2013-09-04 15:06 - 16230792 ____R (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\Flash32_11_8_800_94.ocx ==================== Alternate Data Streams (whitelisted) ========== AlternateDataStreams: C:\Users\ARLT\Documents\Thumbs.db:encryptable ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (09/05/2013 09:01:07 AM) (Source: Windows Search Service) (User: ) Description: Der Index kann nicht initialisiert werden. Details: Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801) Error: (09/05/2013 09:01:07 AM) (Source: Windows Search Service) (User: ) Description: Die Anwendung kann nicht initialisiert werden. Kontext: Windows Anwendung Details: Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801) Error: (09/05/2013 09:01:07 AM) (Source: Windows Search Service) (User: ) Description: Das Gatherer-Objekt kann nicht initialisiert werden. Kontext: Windows Anwendung, SystemIndex Katalog Details: Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801) Error: (09/05/2013 09:01:07 AM) (Source: Windows Search Service) (User: ) Description: Plug-In in <Search.TripoliIndexer> kann nicht initialisiert werden. Kontext: Windows Anwendung, SystemIndex Katalog Details: Element nicht gefunden. (HRESULT : 0x80070490) (0x80070490) Error: (09/05/2013 09:01:05 AM) (Source: Windows Search Service) (User: ) Description: Plug-In in <Search.JetPropStore> kann nicht initialisiert werden. Kontext: Windows Anwendung, SystemIndex Katalog Details: Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801) Error: (09/05/2013 09:01:05 AM) (Source: Windows Search Service) (User: ) Description: Die Eigenschaftenspeicherdaten können von Windows Search nicht geladen werden. Kontext: Windows Anwendung, SystemIndex Katalog Details: Die Inhaltsindexdatenbank ist fehlerhaft. (HRESULT : 0xc0041800) (0xc0041800) Error: (09/05/2013 09:01:05 AM) (Source: Windows Search Service) (User: ) Description: Windows Search wird aufgrund eines Problems bei der Indizierung The catalog is corrupt beendet. Details: Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801) Error: (09/05/2013 09:01:05 AM) (Source: Windows Search Service) (User: ) Description: Vom Suchdienst wurden beschädigte Datendateien im Index {id=4700} erkannt. Vom Dienst wird versucht, dieses Problem durch Neuerstellung des Indexes automatisch zu beheben. Details: Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801) Error: (09/05/2013 09:01:05 AM) (Source: Windows Search Service) (User: ) Description: Der Jet-Eigenschaftenspeicher kann von Windows Search nicht geöffnet werden. Details: 0x%08x (0xc0041800 - Die Inhaltsindexdatenbank ist fehlerhaft. (HRESULT : 0xc0041800)) Error: (09/05/2013 09:01:04 AM) (Source: ESENT) (User: ) Description: Windows (1740) Windows: Fehler -1811 beim Öffnen von Protokolldatei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS00994.log. System errors: ============= Error: (09/05/2013 04:59:43 PM) (Source: Service Control Manager) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Roxio Upnp Server 10 erreicht. Error: (09/05/2013 04:58:21 PM) (Source: DCOM) (User: NT-AUTORITÄT) Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC) Error: (09/05/2013 02:09:32 PM) (Source: Service Control Manager) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Roxio Upnp Server 10 erreicht. Error: (09/05/2013 02:08:07 PM) (Source: DCOM) (User: NT-AUTORITÄT) Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC) Error: (09/05/2013 09:03:09 AM) (Source: Service Control Manager) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Roxio Upnp Server 10 erreicht. Error: (09/05/2013 09:02:03 AM) (Source: WMPNetworkSvc) (User: ) Description: WMPNetworkSvc0x80004005 Error: (09/05/2013 09:01:52 AM) (Source: DCOM) (User: ) Description: 1053WSearch{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39} Error: (09/05/2013 09:01:52 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht gestartet: %%1053 Error: (09/05/2013 09:01:52 AM) (Source: Service Control Manager) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Search erreicht. Error: (09/05/2013 09:01:28 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts. Microsoft Office Sessions: ========================= Error: (09/05/2013 09:01:07 AM) (Source: Windows Search Service)(User: ) Description: Details: Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801) Error: (09/05/2013 09:01:07 AM) (Source: Windows Search Service)(User: ) Description: Kontext: Windows Anwendung Details: Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801) Error: (09/05/2013 09:01:07 AM) (Source: Windows Search Service)(User: ) Description: Kontext: Windows Anwendung, SystemIndex Katalog Details: Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801) Error: (09/05/2013 09:01:07 AM) (Source: Windows Search Service)(User: ) Description: Kontext: Windows Anwendung, SystemIndex Katalog Details: Element nicht gefunden. (HRESULT : 0x80070490) (0x80070490) Search.TripoliIndexer Error: (09/05/2013 09:01:05 AM) (Source: Windows Search Service)(User: ) Description: Kontext: Windows Anwendung, SystemIndex Katalog Details: Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801) Search.JetPropStore Error: (09/05/2013 09:01:05 AM) (Source: Windows Search Service)(User: ) Description: Kontext: Windows Anwendung, SystemIndex Katalog Details: Die Inhaltsindexdatenbank ist fehlerhaft. (HRESULT : 0xc0041800) (0xc0041800) Error: (09/05/2013 09:01:05 AM) (Source: Windows Search Service)(User: ) Description: Details: Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801) The catalog is corrupt Error: (09/05/2013 09:01:05 AM) (Source: Windows Search Service)(User: ) Description: Details: Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801) 4700 Error: (09/05/2013 09:01:05 AM) (Source: Windows Search Service)(User: ) Description: Details: 0x%08x (0xc0041800 - Die Inhaltsindexdatenbank ist fehlerhaft. (HRESULT : 0xc0041800)) Error: (09/05/2013 09:01:04 AM) (Source: ESENT)(User: ) Description: Windows1740Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS00994.log-1811 CodeIntegrity Errors: =================================== Date: 2013-05-20 18:25:18.203 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-05-20 18:25:18.103 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-05-20 18:25:17.995 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\gpapi.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-05-20 18:25:17.764 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\gpapi.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-01-19 16:06:53.223 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-01-19 16:06:53.155 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-01-19 16:06:53.051 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-01-19 16:06:52.927 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-01-19 16:06:52.838 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-01-19 16:06:52.754 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. ==================== Memory info =========================== Percentage of memory in use: 36% Total physical RAM: 6126.06 MB Available physical RAM: 3915.7 MB Total Pagefile: 12250.3 MB Available Pagefile: 9298.59 MB Total Virtual: 8192 MB Available Virtual: 8191.81 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:455.4 GB) (Free:355.43 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 47BF708F) Partition 1: (Not Active) - (Size=10 GB) - (Type=27) Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=455 GB) - (Type=07 NTFS) ==================== End Of Log ============================ Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-09-05 18:41:53
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST950042 rev.0002 465,76GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\ARLT\AppData\Local\Temp\pgtyipog.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 544 fffff800035f9000 45 bytes [00, 00, 04, 02, 52, 65, 54, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 591 fffff800035f902f 16 bytes [00, 00, 00, 00, 00, 00, 00, ...]
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1688] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076ab1465 2 bytes [AB, 76]
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1688] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076ab14bb 2 bytes [AB, 76]
.text ... * 2
.text C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe[2000] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076ab1465 2 bytes [AB, 76]
.text C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe[2000] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076ab14bb 2 bytes [AB, 76]
.text ... * 2
.text C:\Program Files (x86)\Secunia\PSI\PSIA.exe[2132] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076ab1465 2 bytes [AB, 76]
.text C:\Program Files (x86)\Secunia\PSI\PSIA.exe[2132] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076ab14bb 2 bytes [AB, 76]
.text ... * 2
.text C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe[2284] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076ab1465 2 bytes [AB, 76]
.text C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe[2284] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076ab14bb 2 bytes [AB, 76]
.text ... * 2
.text C:\Program Files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe[2348] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076ab1465 2 bytes [AB, 76]
.text C:\Program Files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe[2348] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076ab14bb 2 bytes [AB, 76]
.text ... * 2
.text C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[2796] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076ab1465 2 bytes [AB, 76]
.text C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[2796] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076ab14bb 2 bytes [AB, 76]
.text ... * 2
.text C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[4772] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076ab1465 2 bytes [AB, 76]
.text C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[4772] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076ab14bb 2 bytes [AB, 76]
.text ... * 2
.text C:\Windows\SysWOW64\RunDll32.exe[4768] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076ab1465 2 bytes [AB, 76]
.text C:\Windows\SysWOW64\RunDll32.exe[4768] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076ab14bb 2 bytes [AB, 76]
.text ... * 2
---- Threads - GMER 2.1 ----
Thread C:\Windows\SysWOW64\ntdll.dll [1848:1852] 000000000116d1f6
Thread C:\Windows\SysWOW64\ntdll.dll [1848:2008] 0000000074808a80
Thread C:\Windows\SysWOW64\ntdll.dll [1848:3920] 000000006aad8bf0
Thread C:\Windows\SysWOW64\ntdll.dll [1848:3924] 000000006aad8bf0
Thread C:\Windows\SysWOW64\ntdll.dll [1848:3928] 000000006aad8bf0
Thread C:\Windows\SysWOW64\ntdll.dll [1848:3932] 000000006aad4090
Thread C:\Windows\SysWOW64\ntdll.dll [1848:5356] 000000006aad8bf0
Thread C:\Windows\SysWOW64\ntdll.dll [1848:6940] 0000000071c27f30
Thread C:\Windows\SysWOW64\ntdll.dll [1848:6972] 0000000071c27cb0
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0c6076d49816
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\f07bcbe8cce5
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0c6076d49816 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\f07bcbe8cce5 (not active ControlSet)
---- EOF - GMER 2.1 ----
 |
|
05.09.2013, 19:14
| #2 |
| /// the machine /// TB-Ausbilder    | Windows 7: PUP.Optional.OpenCandy hi,
__________________Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ |
|
06.09.2013, 09:47
| #3 |
| | Windows 7: PUP.Optional.OpenCandy Hallo Schrauber
__________________ , vielen Dank für die rasche Antwort gestern. Deiner Weisung folgend habe ich gestern Abend den AdwCleaner heruntergeladen und die Suche gestartet. Einen Ordner (C:\ProgramData\Partner), zwei Einträge in Chrome und 7 Einträge in der Registry hat er erfasst. Bis jetzt  hat er jedoch nicht gemeldet, dass die Suche abgeschlossen sei. Über der (inaktiven) Verlaufzeile steht "Warte ab. Bitte wählen Sie alle Elemente ab, die sie nicht entfernen wollen". Was soll ich tun?  |
|
06.09.2013, 11:17
| #4 |
| /// the machine /// TB-Ausbilder | Windows 7: PUP.Optional.OpenCandy Clean drücken 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
06.09.2013, 12:44
| #5 |
| | Windows 7: PUP.Optional.OpenCandy Hallo Schrauber, hier die beiden Logs: Code:
ATTFilter # AdwCleaner v3.002 - Bericht erstellt am 06/09/2013 um 13:12:00
# Updated 01/09/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : ARLT - ****-VAIO
# Gestartet von : C:\Users\ARLT\Desktop\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\Partner
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{2CE4D4CF-B278-4126-AD1E-B622DA2E8339}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2CE4D4CF-B278-4126-AD1E-B622DA2E8339}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7D86A08B-0A8F-4BE0-B693-F05E6947E780}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
***** [ Browser ] *****
-\\ Internet Explorer v10.0.9200.16660
-\\ Google Chrome v29.0.1547.66
[ Datei : C:\Users\ARLT\AppData\Local\Google\Chrome\User Data\Default\preferences ]
[ Datei : C:\Users\Rita\AppData\Local\Google\Chrome\User Data\Default\preferences ]
*************************
AdwCleaner[R0].txt - [1523 octets] - [05/09/2013 21:09:20]
AdwCleaner[S0].txt - [1446 octets] - [06/09/2013 13:12:00]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1506 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.5.8 (09.05.2013:1)
OS: Windows 7 Home Premium x64
Ran by ARLT on 06.09.2013 at 13:17:15,98
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 06.09.2013 at 13:25:09,97
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 06-09-2013
Ran by ARLT (administrator) on ****-VAIO on 06-09-2013 13:41:59
Running from C:\Users\ARLT\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvservice.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Sony Corporation) c:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\PSIA.exe
(ArcSoft, Inc.) C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe
(Sony Corporation) C:\Program Files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe
(Microsoft Corporation) C:\Windows\SysWOW64\DllHost.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\Apoint.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
(Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe
() C:\Program Files (x86)\phonostar-Player\phonostarTimer.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
(Sony Corporation) C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Sony Corporation) C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Nullsoft, Inc.) C:\Program Files (x86)\Winamp\winampa.exe
(CANON INC.) C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMService.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\Apntex.exe
(ALPS) C:\Program Files\Apoint\Apvfb.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VUAgent.exe
(InterVideo) C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe
() C:\Program Files\Sony\VAIO Care\VCPerfService.exe
() C:\Program Files\Sony\VAIO Care\listener.exe
(Thisisu) C:\Users\ARLT\Desktop\JRT_NEW.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCSystemTray.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCService.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCAgent.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [NvCplDaemon] - C:\Windows\system32\NvCpl.dll [16397416 2010-02-22] (NVIDIA Corporation)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10060320 2010-02-25] (Realtek Semiconductor)
HKLM\...\Run: [Apoint] - C:\Program Files\Apoint\Apoint.exe [212480 2010-03-17] (Alps Electric Co., Ltd.)
HKLM\...\Run: [Logitech Download Assistant] - C:\Windows\System32\LogiLDA.dll [1832760 2012-09-20] (Logitech, Inc.)
HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2184520 2009-07-26] (CANON INC.)
HKLM\...\Run: [CanonSolutionMenu] - C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe [767312 2009-03-17] (CANON INC.)
HKLM\...\Policies\Explorer: [NoActiveDesktop] 1
HKCU\...\Run: [] - [x]
HKCU\...\Run: [GarminExpressTrayApp] - C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [1098072 2013-03-27] (Garmin Ltd or its subsidiaries)
HKCU\...\Run: [phonostar-PlayerTimer] - C:\Program Files (x86)\phonostar-Player\phonostarTimer.exe [42496 2012-10-13] ()
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2009-11-21] (Intel Corporation)
HKLM-x32\...\Run: [ISBMgr.exe] - C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe [316784 2010-01-15] (Sony Corporation)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-02] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [WinampAgent] - C:\Program Files (x86)\Winamp\winampa.exe [74752 2012-06-28] (Nullsoft, Inc.)
HKLM-x32\...\Run: [IJNetworkScanUtility] - C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe [136544 2009-05-19] (CANON INC.)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)
Startup: C:\Users\ARLT\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
BootExecute: autocheck autochk *
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.t-online.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=SVED&bmod=EU01
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
SearchScopes: HKCU - {6129AF1F-2E88-4B60-94BF-DD17B5A4ECF9} URL = hxxp://services.zinio.com/search?s={searchTerms}&rf=sonyslices
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
SearchScopes: HKCU - {86E39001-1C35-42BE-BE1C-F97B0B56BAB5} URL = hxxp://rover.ebay.com/rover/1/707-37276-16609-0/4?satitle={searchTerms}
SearchScopes: HKCU - {D2E17AA1-5F9E-4C06-B2DC-E35E6E92C280} URL = hxxp://de.shopping.com/?linkin_id=8056363
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: WOT Helper - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files\WOT\WOT.dll ()
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: WOT Helper - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files (x86)\WOT\WOT.dll ()
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - WOT - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
Toolbar: HKLM-x32 - WOT - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files (x86)\WOT\WOT.dll ()
Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Toolbar: HKCU - WOT - {71576546-354D-41C9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
Toolbar: HKCU - No Name - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - No File
DPF: HKLM-x32 {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: HKLM-x32 {233C1507-6A77-46A4-9443-F871F945D258} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: HKLM-x32 {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} hxxp://quickscan.bitdefender.com/qsax/qsax.cab
DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab
Handler: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files\WOT\WOT.dll ()
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler-x32: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files (x86)\WOT\WOT.dll ()
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Chrome:
=======
CHR HomePage: hxxp://www.spiegel.de/
CHR RestoreOnStartup: "hxxp://www.spiegel.de/"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.62\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.62\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.62\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java Deployment Toolkit 6.0.180.7) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeploytk.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U20) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll No File
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Picasa) - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
CHR Plugin: (Nokia Suite Enabler Plugin) - C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( )
CHR Plugin: (Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (phonostar Detector) - C:\Program Files (x86)\phonostar-Player\npphonostarDetectNP.dll ( )
CHR Plugin: (Shockwave for Director) - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1168638.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File
CHR Extension: (Chrome In-App Payments service) - C:\Users\ARLT\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.10_0
==================== Services (Whitelisted) =================
R2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [622648 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 Garmin Core Update Service; C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [185688 2013-03-27] (Garmin Ltd or its subsidiaries)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 McComponentHostServiceSony; C:\Program Files (x86)\Sony\MSS\3.0.271\McCHSvc.exe [237328 2012-03-30] (McAfee, Inc.)
R2 nvservice; C:\Windows\system32\nvservice.exe [192800 2013-02-04] (NVIDIA Corporation)
S3 Roxio UPnP Renderer 10; C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe [313840 2009-11-25] (Sonic Solutions)
S2 Roxio Upnp Server 10; C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUpnpService10.exe [362992 2009-11-25] (Sonic Solutions)
R2 SampleCollector; C:\Program Files\Sony\VAIO Care\VCPerfService.exe [156672 2012-08-06] ()
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1226704 2013-05-29] (Secunia)
S2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [658896 2013-05-29] (Secunia)
R2 uCamMonitor; C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [104960 2008-09-18] (ArcSoft, Inc.)
S3 VAIO Entertainment TV Device Arbitration Service; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe [74496 2010-09-27] (Sony Corporation)
S3 VCFw; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [887000 2011-01-20] (Sony Corporation)
R3 VUAgent; C:\Program Files\Sony\VAIO Update\VUAgent.exe [1359408 2013-03-26] (Sony Corporation)
==================== Drivers (Whitelisted) ====================
R3 ArcSoftKsUFilter; C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys [19968 2009-05-26] (ArcSoft, Inc.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-02] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-09-02] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-03-21] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-05-29] (Secunia)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-09-06 13:24 - 2013-09-06 13:24 - 96334488 _____ C:\Windows\SysWOW64\覌༅聤“
2013-09-06 13:17 - 2013-09-06 13:17 - 00000000 ____D C:\Windows\ERUNT
2013-09-06 13:16 - 2013-09-06 05:32 - 01028823 _____ (Thisisu) C:\Users\ARLT\Desktop\JRT_NEW.exe
2013-09-05 21:09 - 2013-09-06 13:12 - 00000000 ____D C:\AdwCleaner
2013-09-05 21:07 - 2013-09-05 21:07 - 01028757 _____ (Thisisu) C:\Users\ARLT\Desktop\JRT.exe
2013-09-05 21:04 - 2013-09-05 21:05 - 01037222 _____ C:\Users\ARLT\Desktop\adwcleaner.exe
2013-09-05 18:41 - 2013-09-05 18:41 - 00007950 _____ C:\Users\ARLT\Desktop\GMER.txt
2013-09-05 18:29 - 2013-09-05 18:29 - 00377856 _____ C:\Users\ARLT\Desktop\gmer_2.1.19163.exe
2013-09-05 18:25 - 2013-09-05 18:26 - 00041694 _____ C:\Users\ARLT\Desktop\Addition.txt
2013-09-05 18:23 - 2013-09-05 18:23 - 00000000 ____D C:\FRST
2013-09-05 18:21 - 2013-09-06 13:40 - 01948360 _____ (Farbar) C:\Users\ARLT\Desktop\FRST64.exe
2013-09-05 18:19 - 2013-09-05 18:19 - 00000470 _____ C:\Users\ARLT\Desktop\defogger_disable.log
2013-09-05 18:19 - 2013-09-05 18:19 - 00000000 _____ C:\Users\ARLT\defogger_reenable
2013-09-05 18:02 - 2013-09-05 18:02 - 00050477 _____ C:\Users\ARLT\Desktop\Defogger.exe
2013-09-05 17:57 - 2013-09-05 17:57 - 00050477 _____ C:\Users\ARLT\Downloads\Defogger.exe
2013-09-05 16:56 - 2013-09-05 16:56 - 00000624 _____ C:\Windows\PFRO.log
2013-09-05 08:59 - 2013-09-06 13:13 - 00000280 _____ C:\Windows\setupact.log
2013-09-05 08:59 - 2013-09-05 08:59 - 00000000 _____ C:\Windows\setuperr.log
2013-08-29 00:09 - 2013-08-29 00:10 - 00000000 ____D C:\Users\ARLT\AppData\Roaming\vlc
2013-08-29 00:09 - 2013-08-29 00:09 - 00001070 _____ C:\Users\Public\Desktop\VLC media player.lnk
2013-08-28 23:36 - 2013-07-09 08:03 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-28 23:36 - 2013-07-09 07:54 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-28 23:36 - 2013-07-09 07:53 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-08-28 23:36 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-08-28 23:36 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-08-28 23:36 - 2013-07-09 06:53 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-08-28 23:36 - 2013-07-09 06:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-08-28 23:36 - 2013-07-09 04:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-08-28 23:36 - 2013-07-09 04:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-08-28 23:36 - 2013-07-09 04:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-08-28 23:36 - 2013-07-09 04:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-08-26 20:38 - 2013-08-26 20:38 - 00018314 _____ C:\Users\ARLT\Documents\****_Millesimo.dotx
2013-08-26 19:25 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-26 19:25 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-26 19:25 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-26 19:25 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-26 19:25 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-26 19:25 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-26 19:25 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-26 19:25 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-26 19:25 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-26 19:25 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-26 19:25 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-26 19:25 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-26 19:25 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-26 19:25 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-26 19:25 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-26 19:25 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-26 19:25 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-26 19:25 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-26 19:25 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-26 19:25 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-26 19:25 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-26 19:25 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-26 19:25 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-26 19:25 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-26 19:25 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-26 19:25 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-26 19:25 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-26 19:25 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-26 19:25 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-26 19:25 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-26 19:25 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-26 18:49 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-26 18:49 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-26 18:49 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-26 18:49 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-26 18:49 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-26 18:49 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-26 18:49 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-26 18:49 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-26 18:49 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-26 18:49 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-26 18:49 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-26 18:49 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-26 18:49 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-26 18:49 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-26 18:49 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-26 18:49 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-21 11:34 - 2013-08-21 11:34 - 00013008 _____ C:\Users\ARLT\Documents\Reise nach Stuttgart Sept.2013.one
2013-08-19 10:36 - 2013-08-19 10:36 - 00002992 _____ C:\Windows\System32\Tasks\{5F7F98C4-C4D7-4325-B2CF-3756F6FA4210}
2013-08-19 10:06 - 2013-08-19 10:06 - 00002023 _____ C:\Users\ARLT\Desktop\Canon MP990 series Printer - Verknüpfung.lnk
==================== One Month Modified Files and Folders =======
2013-09-06 13:40 - 2013-09-05 18:21 - 01948360 _____ (Farbar) C:\Users\ARLT\Desktop\FRST64.exe
2013-09-06 13:25 - 2013-09-06 13:25 - 00000624 _____ C:\Users\ARLT\Desktop\JRT.txt
2013-09-06 13:24 - 2013-09-06 13:24 - 96334488 _____ C:\Windows\SysWOW64\覌༅聤“
2013-09-06 13:21 - 2009-07-14 06:45 - 00010096 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-06 13:21 - 2009-07-14 06:45 - 00010096 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-06 13:17 - 2013-09-06 13:17 - 00000000 ____D C:\Windows\ERUNT
2013-09-06 13:17 - 2012-11-16 17:12 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-06 13:17 - 2012-11-16 17:05 - 01261396 _____ C:\Windows\WindowsUpdate.log
2013-09-06 13:13 - 2013-09-05 08:59 - 00000280 _____ C:\Windows\setupact.log
2013-09-06 13:13 - 2012-11-16 17:12 - 00001120 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-06 13:13 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-06 13:12 - 2013-09-05 21:09 - 00000000 ____D C:\AdwCleaner
2013-09-06 13:11 - 2013-02-27 12:52 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-06 05:32 - 2013-09-06 13:16 - 01028823 _____ (Thisisu) C:\Users\ARLT\Desktop\JRT_NEW.exe
2013-09-05 21:07 - 2013-09-05 21:07 - 01028757 _____ (Thisisu) C:\Users\ARLT\Desktop\JRT.exe
2013-09-05 21:05 - 2013-09-05 21:04 - 01037222 _____ C:\Users\ARLT\Desktop\adwcleaner.exe
2013-09-05 18:41 - 2013-09-05 18:41 - 00007950 _____ C:\Users\ARLT\Desktop\GMER.txt
2013-09-05 18:29 - 2013-09-05 18:29 - 00377856 _____ C:\Users\ARLT\Desktop\gmer_2.1.19163.exe
2013-09-05 18:26 - 2013-09-05 18:25 - 00041694 _____ C:\Users\ARLT\Desktop\Addition.txt
2013-09-05 18:23 - 2013-09-05 18:23 - 00000000 ____D C:\FRST
2013-09-05 18:19 - 2013-09-05 18:19 - 00000470 _____ C:\Users\ARLT\Desktop\defogger_disable.log
2013-09-05 18:19 - 2013-09-05 18:19 - 00000000 _____ C:\Users\ARLT\defogger_reenable
2013-09-05 18:19 - 2012-11-16 18:18 - 00000000 ____D C:\Users\ARLT
2013-09-05 18:02 - 2013-09-05 18:02 - 00050477 _____ C:\Users\ARLT\Desktop\Defogger.exe
2013-09-05 17:57 - 2013-09-05 17:57 - 00050477 _____ C:\Users\ARLT\Downloads\Defogger.exe
2013-09-05 16:56 - 2013-09-05 16:56 - 00000624 _____ C:\Windows\PFRO.log
2013-09-05 08:59 - 2013-09-05 08:59 - 00000000 _____ C:\Windows\setuperr.log
2013-09-05 00:51 - 2013-03-07 19:39 - 00000000 ____D C:\Windows\Minidump
2013-09-05 00:51 - 2013-01-14 02:51 - 00000000 ____D C:\Users\ARLT\Tracing
2013-09-05 00:51 - 2010-03-26 00:52 - 00000000 ____D C:\Windows\Panther
2013-09-05 00:36 - 2012-11-21 00:53 - 00000000 ___RD C:\Users\ARLT\Desktop\Sicherheit
2013-09-05 00:35 - 2012-11-21 03:25 - 00000000 ____D C:\Program Files\CCleaner
2013-09-04 23:45 - 2013-01-20 12:58 - 00000000 ____D C:\Users\ARLT\Documents\TELEKOM
2013-09-04 22:08 - 2012-11-22 16:11 - 00000000 ____D C:\Users\ARLT\Documents\Outlook-Dateien
2013-09-04 21:27 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2013-09-04 15:06 - 2013-02-27 12:52 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-09-04 15:06 - 2013-02-27 12:52 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-04 15:06 - 2013-02-27 12:52 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-09-04 15:06 - 2012-11-21 22:02 - 00000000 ____D C:\Users\ARLT\AppData\Local\Adobe
2013-09-04 10:25 - 2012-11-21 03:14 - 00000000 ____D C:\Users\ARLT\AppData\Roaming\Skype
2013-09-03 08:32 - 2012-11-16 17:00 - 00697082 _____ C:\Windows\system32\perfh007.dat
2013-09-03 08:32 - 2012-11-16 17:00 - 00148346 _____ C:\Windows\system32\perfc007.dat
2013-09-03 08:32 - 2009-07-14 07:13 - 01613340 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-02 17:32 - 2013-01-20 12:59 - 00000000 ___RD C:\Users\ARLT\Documents\Wertpapiere
2013-09-02 15:15 - 2013-05-02 11:31 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-09-02 15:15 - 2013-03-21 14:47 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-09-02 15:15 - 2013-03-21 14:47 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-08-31 11:46 - 2012-11-21 03:15 - 00000000 ____D C:\ProgramData\ArcSoft
2013-08-31 11:46 - 2012-11-16 18:20 - 00000000 ___RD C:\Users\ARLT\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-08-31 11:46 - 2012-11-16 18:20 - 00000000 ___RD C:\Users\ARLT\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-08-31 11:46 - 2010-03-26 00:14 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-08-30 23:27 - 2013-01-20 12:19 - 00000000 ____D C:\Users\ARLT\Documents\FAMILIE
2013-08-29 00:10 - 2013-08-29 00:09 - 00000000 ____D C:\Users\ARLT\AppData\Roaming\vlc
2013-08-29 00:09 - 2013-08-29 00:09 - 00001070 _____ C:\Users\Public\Desktop\VLC media player.lnk
2013-08-29 00:00 - 2013-01-20 12:22 - 00000000 ____D C:\Users\ARLT\Documents\Korrespondenz
2013-08-28 23:57 - 2013-02-26 20:08 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-08-28 23:57 - 2012-11-16 17:22 - 00000000 ____D C:\ProgramData\Skype
2013-08-28 23:49 - 2012-11-16 18:49 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-08-28 23:49 - 2009-07-14 04:34 - 00000478 _____ C:\Windows\win.ini
2013-08-27 21:04 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-08-26 20:38 - 2013-08-26 20:38 - 00018314 _____ C:\Users\ARLT\Documents\****_Millesimo.dotx
2013-08-26 19:20 - 2013-07-11 11:10 - 00000000 ____D C:\Windows\system32\MRT
2013-08-26 19:15 - 2012-11-21 09:03 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-21 11:34 - 2013-08-21 11:34 - 00013008 _____ C:\Users\ARLT\Documents\Reise nach Stuttgart Sept.2013.one
2013-08-19 10:36 - 2013-08-19 10:36 - 00002992 _____ C:\Windows\System32\Tasks\{5F7F98C4-C4D7-4325-B2CF-3756F6FA4210}
2013-08-19 10:06 - 2013-08-19 10:06 - 00002023 _____ C:\Users\ARLT\Desktop\Canon MP990 series Printer - Verknüpfung.lnk
Files to move or delete:
====================
C:\Users\ARLT\AppData\Local\Temp\Quarantine.exe
C:\Users\ARLT\AppData\Local\Temp\jrt\erunt\ERUNT.EXE
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-09-01 21:23
==================== End Of Log ============================
|
|
06.09.2013, 17:31
| #6 |
| /// the machine /// TB-Ausbilder | Windows 7: PUP.Optional.OpenCandyESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ --> Windows 7: PUP.Optional.OpenCandy |
|
07.09.2013, 13:59
| #7 |
| |  Windows 7: PUP.Optional.OpenCandy Hallo Schrauber erst heute komme ich dazu, Deine Ratschläge weiter zu befolgen. Ich habe jedoch jetzt schon den beruhigenden Eindruck, dass ich den Eindringling mit Deiner Hilfe losgeworden bin. Aber das wirst Du anhand meiner Logs besser beurteilen können. Code:
ATTFilter ESETSmartInstaller@High as CAB hook log:
OnlineScanner64.ocx - registred OK
OnlineScanner.ocx - registred OK
# version=8
# IEXPLORE.EXE=10.00.9200.16521 (win8_gdr_soc_ie.130216-2100)
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=77463e965f170b448a638e0ce8035065
# engine=13369
# end=stopped
# remove_checked=false
# archives_checked=false
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-03-12 11:01:23
# local_time=2013-03-13 12:01:23 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776574 66 85 9452566 114759133 0 0
# scanned=80355
# found=0
# cleaned=0
# scan_time=1913
# version=8
# IEXPLORE.EXE=10.00.9200.16521 (win8_gdr_soc_ie.130216-2100)
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=77463e965f170b448a638e0ce8035065
# engine=13505
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-03-28 07:35:01
# local_time=2013-03-28 08:35:01 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776574 66 85 10822584 116129151 0 0
# scanned=696526
# found=0
# cleaned=0
# scan_time=13465
# version=8
# IEXPLORE.EXE=10.00.9200.16521 (win8_gdr_soc_ie.130216-2100)
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=77463e965f170b448a638e0ce8035065
# engine=13863
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-05-19 11:02:10
# local_time=2013-05-20 01:02:10 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776574 66 85 15331413 120634380 0 0
# scanned=512109
# found=0
# cleaned=0
# scan_time=41368
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=77463e965f170b448a638e0ce8035065
# engine=15037
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-09-07 12:27:26
# local_time=2013-09-07 02:27:26 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776574 66 85 5073954 130143496 0 0
# scanned=284030
# found=0
# cleaned=0
# scan_time=5749
Code:
ATTFilter Results of screen317's Security Check version 0.99.72 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 10 ``````````````Antivirus/Firewall Check:`````````````` Avira Desktop Antivirus up to date! (On Access scanning disabled!) `````````Anti-malware/Other Utilities Check:````````` Secunia PSI (3.0.0.7010) Malwarebytes Anti-Malware Version 1.75.0.1300 Java 7 Update 25 Adobe Flash Player 11.8.800.94 Adobe Reader XI Google Chrome 29.0.1547.62 Google Chrome 29.0.1547.66 ````````Process Check: objlist.exe by Laurent```````` Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbamgui.exe Avira Antivir avgnt.exe Avira Antivir avguard.exe Malwarebytes' Anti-Malware mbamscheduler.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-09-2013 01
Ran by ARLT (administrator) on ****-VAIO on 07-09-2013 14:56:12
Running from C:\Users\ARLT\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvservice.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Sony Corporation) c:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\PSIA.exe
(ArcSoft, Inc.) C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe
(Sony Corporation) C:\Program Files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe
(Microsoft Corporation) C:\Windows\SysWOW64\DllHost.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(InterVideo) C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe
() C:\Program Files\Sony\VAIO Care\VCPerfService.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\Apoint.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe
() C:\Program Files (x86)\phonostar-Player\phonostarTimer.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Sony Corporation) C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Nullsoft, Inc.) C:\Program Files (x86)\Winamp\winampa.exe
(CANON INC.) C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMService.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\Apntex.exe
(ALPS) C:\Program Files\Apoint\Apvfb.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\system32\Macromed\Flash\FlashUtil64_11_8_800_94_ActiveX.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VUAgent.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCSystemTray.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCService.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCAgent.exe
() C:\Program Files\Sony\VAIO Care\listener.exe
(Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [NvCplDaemon] - C:\Windows\system32\NvCpl.dll [16397416 2010-02-22] (NVIDIA Corporation)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10060320 2010-02-25] (Realtek Semiconductor)
HKLM\...\Run: [Apoint] - C:\Program Files\Apoint\Apoint.exe [212480 2010-03-17] (Alps Electric Co., Ltd.)
HKLM\...\Run: [Logitech Download Assistant] - C:\Windows\System32\LogiLDA.dll [1832760 2012-09-20] (Logitech, Inc.)
HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2184520 2009-07-26] (CANON INC.)
HKLM\...\Run: [CanonSolutionMenu] - C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe [767312 2009-03-17] (CANON INC.)
HKLM\...\Policies\Explorer: [NoActiveDesktop] 1
HKCU\...\Run: [] - [x]
HKCU\...\Run: [GarminExpressTrayApp] - C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [1098072 2013-03-27] (Garmin Ltd or its subsidiaries)
HKCU\...\Run: [phonostar-PlayerTimer] - C:\Program Files (x86)\phonostar-Player\phonostarTimer.exe [42496 2012-10-13] ()
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2009-11-21] (Intel Corporation)
HKLM-x32\...\Run: [ISBMgr.exe] - C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe [316784 2010-01-15] (Sony Corporation)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-02] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [WinampAgent] - C:\Program Files (x86)\Winamp\winampa.exe [74752 2012-06-28] (Nullsoft, Inc.)
HKLM-x32\...\Run: [IJNetworkScanUtility] - C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe [136544 2009-05-19] (CANON INC.)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)
Startup: C:\Users\ARLT\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
BootExecute: autocheck autochk *
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.t-online.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=SVED&bmod=EU01
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
SearchScopes: HKCU - {6129AF1F-2E88-4B60-94BF-DD17B5A4ECF9} URL = hxxp://services.zinio.com/search?s={searchTerms}&rf=sonyslices
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
SearchScopes: HKCU - {86E39001-1C35-42BE-BE1C-F97B0B56BAB5} URL = hxxp://rover.ebay.com/rover/1/707-37276-16609-0/4?satitle={searchTerms}
SearchScopes: HKCU - {D2E17AA1-5F9E-4C06-B2DC-E35E6E92C280} URL = hxxp://de.shopping.com/?linkin_id=8056363
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: WOT Helper - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files\WOT\WOT.dll ()
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: WOT Helper - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files (x86)\WOT\WOT.dll ()
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - WOT - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
Toolbar: HKLM-x32 - WOT - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files (x86)\WOT\WOT.dll ()
Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Toolbar: HKCU - WOT - {71576546-354D-41C9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
Toolbar: HKCU - No Name - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - No File
DPF: HKLM-x32 {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: HKLM-x32 {233C1507-6A77-46A4-9443-F871F945D258} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: HKLM-x32 {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} hxxp://quickscan.bitdefender.com/qsax/qsax.cab
DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab
Handler: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files\WOT\WOT.dll ()
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler-x32: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files (x86)\WOT\WOT.dll ()
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Chrome:
=======
CHR HomePage: hxxp://www.spiegel.de/
CHR RestoreOnStartup: "hxxp://www.spiegel.de/"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.62\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.62\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.62\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java Deployment Toolkit 6.0.180.7) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeploytk.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U20) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll No File
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Picasa) - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
CHR Plugin: (Nokia Suite Enabler Plugin) - C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( )
CHR Plugin: (Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (phonostar Detector) - C:\Program Files (x86)\phonostar-Player\npphonostarDetectNP.dll ( )
CHR Plugin: (Shockwave for Director) - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1168638.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File
CHR Extension: (Chrome In-App Payments service) - C:\Users\ARLT\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.10_0
==================== Services (Whitelisted) =================
R2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [622648 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 Garmin Core Update Service; C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [185688 2013-03-27] (Garmin Ltd or its subsidiaries)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 McComponentHostServiceSony; C:\Program Files (x86)\Sony\MSS\3.0.271\McCHSvc.exe [237328 2012-03-30] (McAfee, Inc.)
R2 nvservice; C:\Windows\system32\nvservice.exe [192800 2013-02-04] (NVIDIA Corporation)
S3 Roxio UPnP Renderer 10; C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe [313840 2009-11-25] (Sonic Solutions)
S2 Roxio Upnp Server 10; C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUpnpService10.exe [362992 2009-11-25] (Sonic Solutions)
R2 SampleCollector; C:\Program Files\Sony\VAIO Care\VCPerfService.exe [156672 2012-08-06] ()
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1226704 2013-05-29] (Secunia)
S2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [658896 2013-05-29] (Secunia)
R2 uCamMonitor; C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [104960 2008-09-18] (ArcSoft, Inc.)
S3 VAIO Entertainment TV Device Arbitration Service; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe [74496 2010-09-27] (Sony Corporation)
S3 VCFw; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [887000 2011-01-20] (Sony Corporation)
R3 VUAgent; C:\Program Files\Sony\VAIO Update\VUAgent.exe [1359408 2013-03-26] (Sony Corporation)
==================== Drivers (Whitelisted) ====================
R3 ArcSoftKsUFilter; C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys [19968 2009-05-26] (ArcSoft, Inc.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-02] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-09-02] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-03-21] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-05-29] (Secunia)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-09-07 14:48 - 2013-09-07 14:48 - 00891115 _____ C:\Users\ARLT\Desktop\SecurityCheck.exe
2013-09-07 13:36 - 2013-09-07 13:36 - 96511910 _____ C:\Windows\SysWOW64\鲞䗹聤¢
2013-09-07 00:44 - 2013-09-07 00:49 - 02347384 _____ (ESET) C:\Users\ARLT\Desktop\esetsmartinstaller_enu.exe
2013-09-06 13:25 - 2013-09-06 13:25 - 00000624 _____ C:\Users\ARLT\Desktop\JRT.txt
2013-09-06 13:17 - 2013-09-06 13:17 - 00000000 ____D C:\Windows\ERUNT
2013-09-06 13:16 - 2013-09-06 05:32 - 01028823 _____ (Thisisu) C:\Users\ARLT\Desktop\JRT_NEW.exe
2013-09-05 21:09 - 2013-09-06 13:12 - 00000000 ____D C:\AdwCleaner
2013-09-05 21:04 - 2013-09-05 21:05 - 01037222 _____ C:\Users\ARLT\Desktop\adwcleaner.exe
2013-09-05 18:41 - 2013-09-05 18:41 - 00007950 _____ C:\Users\ARLT\Desktop\GMER.txt
2013-09-05 18:29 - 2013-09-05 18:29 - 00377856 _____ C:\Users\ARLT\Desktop\gmer_2.1.19163.exe
2013-09-05 18:25 - 2013-09-05 18:26 - 00041694 _____ C:\Users\ARLT\Desktop\Addition.txt
2013-09-05 18:23 - 2013-09-05 18:23 - 00000000 ____D C:\FRST
2013-09-05 18:19 - 2013-09-05 18:19 - 00000470 _____ C:\Users\ARLT\Desktop\defogger_disable.log
2013-09-05 18:19 - 2013-09-05 18:19 - 00000000 _____ C:\Users\ARLT\defogger_reenable
2013-09-05 18:02 - 2013-09-05 18:02 - 00050477 _____ C:\Users\ARLT\Desktop\Defogger.exe
2013-09-05 17:57 - 2013-09-05 17:57 - 00050477 _____ C:\Users\ARLT\Downloads\Defogger.exe
2013-09-05 16:56 - 2013-09-05 16:56 - 00000624 _____ C:\Windows\PFRO.log
2013-09-05 08:59 - 2013-09-07 13:34 - 00000392 _____ C:\Windows\setupact.log
2013-09-05 08:59 - 2013-09-05 08:59 - 00000000 _____ C:\Windows\setuperr.log
2013-08-29 00:09 - 2013-08-29 00:10 - 00000000 ____D C:\Users\ARLT\AppData\Roaming\vlc
2013-08-29 00:09 - 2013-08-29 00:09 - 00001070 _____ C:\Users\Public\Desktop\VLC media player.lnk
2013-08-28 23:36 - 2013-07-09 08:03 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-28 23:36 - 2013-07-09 07:54 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-28 23:36 - 2013-07-09 07:53 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-08-28 23:36 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-08-28 23:36 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-08-28 23:36 - 2013-07-09 06:53 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-08-28 23:36 - 2013-07-09 06:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-08-28 23:36 - 2013-07-09 04:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-08-28 23:36 - 2013-07-09 04:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-08-28 23:36 - 2013-07-09 04:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-08-28 23:36 - 2013-07-09 04:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-08-26 20:38 - 2013-08-26 20:38 - 00018314 _____ C:\Users\ARLT\Documents\****_Millesimo.dotx
2013-08-26 19:25 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-26 19:25 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-26 19:25 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-26 19:25 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-26 19:25 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-26 19:25 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-26 19:25 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-26 19:25 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-26 19:25 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-26 19:25 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-26 19:25 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-26 19:25 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-26 19:25 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-26 19:25 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-26 19:25 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-26 19:25 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-26 19:25 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-26 19:25 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-26 19:25 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-26 19:25 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-26 19:25 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-26 19:25 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-26 19:25 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-26 19:25 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-26 19:25 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-26 19:25 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-26 19:25 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-26 19:25 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-26 19:25 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-26 19:25 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-26 19:25 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-26 18:49 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-26 18:49 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-26 18:49 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-26 18:49 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-26 18:49 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-26 18:49 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-26 18:49 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-26 18:49 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-26 18:49 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-26 18:49 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-26 18:49 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-26 18:49 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-26 18:49 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-26 18:49 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-26 18:49 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-26 18:49 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-21 11:34 - 2013-08-21 11:34 - 00013008 _____ C:\Users\ARLT\Documents\Reise nach Stuttgart Sept.2013.one
2013-08-19 10:36 - 2013-08-19 10:36 - 00002992 _____ C:\Windows\System32\Tasks\{5F7F98C4-C4D7-4325-B2CF-3756F6FA4210}
2013-08-19 10:06 - 2013-08-19 10:06 - 00002023 _____ C:\Users\ARLT\Desktop\Canon MP990 series Printer - Verknüpfung.lnk
==================== One Month Modified Files and Folders =======
2013-09-07 14:56 - 2013-02-27 12:52 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-07 14:55 - 2013-09-07 14:55 - 01948682 _____ (Farbar) C:\Users\ARLT\Desktop\FRST64.exe
2013-09-07 14:48 - 2013-09-07 14:48 - 00891115 _____ C:\Users\ARLT\Desktop\SecurityCheck.exe
2013-09-07 14:32 - 2012-11-16 17:05 - 01283276 _____ C:\Windows\WindowsUpdate.log
2013-09-07 14:17 - 2012-11-16 17:12 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-07 13:42 - 2009-07-14 06:45 - 00010096 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-07 13:42 - 2009-07-14 06:45 - 00010096 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-07 13:39 - 2012-11-16 17:12 - 00001120 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-07 13:36 - 2013-09-07 13:36 - 96511910 _____ C:\Windows\SysWOW64\鲞䗹聤¢
2013-09-07 13:34 - 2013-09-05 08:59 - 00000392 _____ C:\Windows\setupact.log
2013-09-07 13:34 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-07 00:49 - 2013-09-07 00:44 - 02347384 _____ (ESET) C:\Users\ARLT\Desktop\esetsmartinstaller_enu.exe
2013-09-06 13:58 - 2013-05-02 11:37 - 01642510 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2013-09-06 13:58 - 2012-11-22 16:11 - 00000000 ____D C:\Users\ARLT\Documents\Outlook-Dateien
2013-09-06 13:58 - 2012-11-16 17:00 - 00700630 _____ C:\Windows\system32\perfh007.dat
2013-09-06 13:58 - 2012-11-16 17:00 - 00149394 _____ C:\Windows\system32\perfc007.dat
2013-09-06 13:25 - 2013-09-06 13:25 - 00000624 _____ C:\Users\ARLT\Desktop\JRT.txt
2013-09-06 13:17 - 2013-09-06 13:17 - 00000000 ____D C:\Windows\ERUNT
2013-09-06 13:12 - 2013-09-05 21:09 - 00000000 ____D C:\AdwCleaner
2013-09-06 05:32 - 2013-09-06 13:16 - 01028823 _____ (Thisisu) C:\Users\ARLT\Desktop\JRT_NEW.exe
2013-09-05 21:05 - 2013-09-05 21:04 - 01037222 _____ C:\Users\ARLT\Desktop\adwcleaner.exe
2013-09-05 18:41 - 2013-09-05 18:41 - 00007950 _____ C:\Users\ARLT\Desktop\GMER.txt
2013-09-05 18:29 - 2013-09-05 18:29 - 00377856 _____ C:\Users\ARLT\Desktop\gmer_2.1.19163.exe
2013-09-05 18:26 - 2013-09-05 18:25 - 00041694 _____ C:\Users\ARLT\Desktop\Addition.txt
2013-09-05 18:23 - 2013-09-05 18:23 - 00000000 ____D C:\FRST
2013-09-05 18:19 - 2013-09-05 18:19 - 00000470 _____ C:\Users\ARLT\Desktop\defogger_disable.log
2013-09-05 18:19 - 2013-09-05 18:19 - 00000000 _____ C:\Users\ARLT\defogger_reenable
2013-09-05 18:19 - 2012-11-16 18:18 - 00000000 ____D C:\Users\ARLT
2013-09-05 18:02 - 2013-09-05 18:02 - 00050477 _____ C:\Users\ARLT\Desktop\Defogger.exe
2013-09-05 17:57 - 2013-09-05 17:57 - 00050477 _____ C:\Users\ARLT\Downloads\Defogger.exe
2013-09-05 16:56 - 2013-09-05 16:56 - 00000624 _____ C:\Windows\PFRO.log
2013-09-05 08:59 - 2013-09-05 08:59 - 00000000 _____ C:\Windows\setuperr.log
2013-09-05 00:51 - 2013-03-07 19:39 - 00000000 ____D C:\Windows\Minidump
2013-09-05 00:51 - 2013-01-14 02:51 - 00000000 ____D C:\Users\ARLT\Tracing
2013-09-05 00:51 - 2010-03-26 00:52 - 00000000 ____D C:\Windows\Panther
2013-09-05 00:36 - 2012-11-21 00:53 - 00000000 ___RD C:\Users\ARLT\Desktop\Sicherheit
2013-09-05 00:35 - 2012-11-21 03:25 - 00000000 ____D C:\Program Files\CCleaner
2013-09-04 23:45 - 2013-01-20 12:58 - 00000000 ____D C:\Users\ARLT\Documents\TELEKOM
2013-09-04 21:27 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2013-09-04 15:06 - 2013-02-27 12:52 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-09-04 15:06 - 2013-02-27 12:52 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-04 15:06 - 2013-02-27 12:52 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-09-04 15:06 - 2012-11-21 22:02 - 00000000 ____D C:\Users\ARLT\AppData\Local\Adobe
2013-09-04 10:25 - 2012-11-21 03:14 - 00000000 ____D C:\Users\ARLT\AppData\Roaming\Skype
2013-09-03 08:32 - 2009-07-14 07:13 - 01613340 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-02 17:32 - 2013-01-20 12:59 - 00000000 ___RD C:\Users\ARLT\Documents\Wertpapiere
2013-09-02 15:15 - 2013-05-02 11:31 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-09-02 15:15 - 2013-03-21 14:47 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-09-02 15:15 - 2013-03-21 14:47 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-08-31 11:46 - 2012-11-21 03:15 - 00000000 ____D C:\ProgramData\ArcSoft
2013-08-31 11:46 - 2012-11-16 18:20 - 00000000 ___RD C:\Users\ARLT\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-08-31 11:46 - 2012-11-16 18:20 - 00000000 ___RD C:\Users\ARLT\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-08-31 11:46 - 2010-03-26 00:14 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-08-30 23:27 - 2013-01-20 12:19 - 00000000 ____D C:\Users\ARLT\Documents\FAMILIE
2013-08-29 00:10 - 2013-08-29 00:09 - 00000000 ____D C:\Users\ARLT\AppData\Roaming\vlc
2013-08-29 00:09 - 2013-08-29 00:09 - 00001070 _____ C:\Users\Public\Desktop\VLC media player.lnk
2013-08-29 00:00 - 2013-01-20 12:22 - 00000000 ____D C:\Users\ARLT\Documents\Korrespondenz
2013-08-28 23:57 - 2013-02-26 20:08 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-08-28 23:57 - 2012-11-16 17:22 - 00000000 ____D C:\ProgramData\Skype
2013-08-28 23:49 - 2012-11-16 18:49 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-08-28 23:49 - 2009-07-14 04:34 - 00000478 _____ C:\Windows\win.ini
2013-08-27 21:04 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-08-26 20:38 - 2013-08-26 20:38 - 00018314 _____ C:\Users\ARLT\Documents\****_Millesimo.dotx
2013-08-26 19:20 - 2013-07-11 11:10 - 00000000 ____D C:\Windows\system32\MRT
2013-08-26 19:15 - 2012-11-21 09:03 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-21 11:34 - 2013-08-21 11:34 - 00013008 _____ C:\Users\ARLT\Documents\Reise nach Stuttgart Sept.2013.one
2013-08-19 10:36 - 2013-08-19 10:36 - 00002992 _____ C:\Windows\System32\Tasks\{5F7F98C4-C4D7-4325-B2CF-3756F6FA4210}
2013-08-19 10:06 - 2013-08-19 10:06 - 00002023 _____ C:\Users\ARLT\Desktop\Canon MP990 series Printer - Verknüpfung.lnk
Files to move or delete:
====================
C:\Users\ARLT\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-09-01 21:23
==================== End Of Log ============================
Gruß treverer |
|
07.09.2013, 21:10
| #8 |
| /// the machine /// TB-Ausbilder | Windows 7: PUP.Optional.OpenCandy Fertig Die Reihenfolge ist hier entscheidend.
Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
07.09.2013, 22:02
| #9 |
| | Windows 7: PUP.Optional.OpenCandy Hallo Schrauber, ganz herzlichen Dank für Deine hervorragende Hilfestellung. Das Biest ist weg!  Allerdings: - Beim Neustart erscheint jedes Mal die Einblendung "IAStorIcon funktioniert nicht mehr - Es wird nach einer Lösung für das Problem gesucht". Die Lösung bleibt aus. - In meinem Avira Antivir Premium ist der Email Schutz gestoppt (Echtzeit-Scanner und Browser-Schutz werden als aktiviert angezeigt) und lässt sich partout nicht aktivieren. Im Wartungscenter der Taskleiste erscheint eine wichtige Meldung: "Avira Desktop aktivieren (Wichtig)". Im Wartungscenter, Sicherheit, Virenschutz erscheint Avira Desktop als deaktiviert. All meine Versuche der Aktivierung laufen ins Leere. Gruß, treverer |
|
09.09.2013, 05:15
| #10 | ||
| /// the machine /// TB-Ausbilder | Windows 7: PUP.Optional.OpenCandyZitat:
Zitat:
 Lesestoff:Warum wir Avira nicht mehr empfehlen Avira liefert seit einiger Zeit mit der Standardinstallation die Ask Toolbar mit aus. Diese Toolbar ist Voraussetzung dafür, dass der Webguard zuverlässig funktioniert. Die Ask Toolbar ist dafür bekannt, dass sie das Surfverhalten des Benutzers ausspioniert, um damit in letzter Konsequenz Geld zu verdienen. Daher wird von uns auf diesem Board als "schädlich" eingestuft. Mehr Informationen. Eine Sicherheitsfirma, die dem Benutzer praktisch ungefragt schädliche Software "unterjubelt", scheidet für uns daher aus. Wir empfehlen daher allen Nutzern von Avira aufgrund dieser Geschäftspraktik, der teilweise äußerst schlechten Erkennungsrate und der überaus nervtötenden Werbung Avira zu deinstallieren und auf ein alternatives Produkt auszuweichen. Solltest du dich zu einem Wechsel entscheiden, empfehlen wir dir nach der Deinstallation mit dem Avira-Cleaner alle Reste zu entfernen. Wenn Du für Avira bezahlt hast installier es neu, ansonsten wechsel auf was anständiges
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
10.09.2013, 09:12
| #11 |
| | Windows 7: PUP.Optional.OpenCandy Hallo Schrauber  , nochmals ganz herzlichen Dank, wie Du mir geholfen hast, meinem Notebook den PUP auszutreiben. Mein Avira Antivirus Premium funktioniert wieder einwandfrei, nachdem ich es neu installiert habe. Eure Kritik an dem Programm ist voll berechtigt; aber ich habe es gekauft. Konsequenterweise habe ich bei der Installation (wie auch schon früher) die maledeite Ask-Toolbar abgewählt. Das Problem mit IAStorIcon besteht weiter. Wie kann ich welche Software neu installieren? Wenn ich es recht sehe, stammt das Teil von Intel und befindet sich im Startmenü. Vielen Dank auch für Deine sehr nützlichen Ratschläge. Bei meiner Infektion hat sich jedoch wieder mal gezeigt, dass es keinen absolut sicheren Schutz vor Schadsoftware gibt. Was mal wieder nur beweist - totsicher ist allein der Tod. Ganz ausschließen wird man eine Infektion wohl nie können, allerdings sie weitestgehend im Vorfeld vermeiden. - Windows Updates sind bei mir automatisch eingestellt; - Avira Antivirus war stets up-to-date; - Von MalwareBytes habe ich die Kaufversion mit Hintergrundwächter installiert; - WOT habe ich drauf und vermeide konsequent URLs anzuklicken, vor denen WOT warnt; - Temp Files bereinige ich regelmäßig mit der bordeigenen Datenträgerbereinigung und mit CCleaner, von dessen Registry Cleaner ich jedoch die Finger lasse; - Deine Don'ts habe ich schon immer beherzigt; - neu habe ich jetzt WinPatrol installiert. Schönen Gruß, treverer |
|
10.09.2013, 11:07
| #12 | |
| /// the machine /// TB-Ausbilder | Windows 7: PUP.Optional.OpenCandyZitat:
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
11.09.2013, 14:52
| #13 |
| | Windows 7: PUP.Optional.OpenCandy Hallo Schrauber, ich hoffe, ich nerve Dich nicht, wenn ich erneut wegen Intel(R) Control Center (x32 Version: 1.2.1.1007) nachfrage. Ich habe keinen blassen Schimmer, woher ich das Teil zur Neuinstallation kriegen kann. Weder auf der Homepage von Intel noch auf einer anderen vertrauenswürdigen Seite fand ich die Software. Beim Googeln taucht sie im Zusammenhang mit Systembereinigungen in unzähligen Logfiles v.a. im Farbar Recovery Scan Tool auf. Was tut der IAStorIcon-Prozess und ist er wichtig? Ich bin grad ziemlich hilflos.  Gruß, treverer |
|
11.09.2013, 19:33
| #14 |
| /// the machine /// TB-Ausbilder | Windows 7: PUP.Optional.OpenCandy
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
11.09.2013, 21:59
| #15 |
| | Windows 7: PUP.Optional.OpenCandy Herzlichen Dank und Gruß  treverer |
|
| Themen zu Windows 7: PUP.Optional.OpenCandy |
| .dll, administrator, adobe, antivirus, avira, canon, diagnostics, error, excel, explorer, farbar, farbar recovery scan tool, flash player, home, homepage, installation, launch, neustart, nvidia, opera, picasa, plug-in, realtek, registry, rundll, scan, schädling, secunia psi, services.exe, software, svchost.exe, unlock, windows, winlogon.exe, wsearch |
Linear-Darstellung
