Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung
Windows 8, Infektion mit Win32/Fynloski.A?

Windows 8, Infektion mit Win32/Fynloski.A?


Plagegeister aller Art und deren Bekämpfung: Windows 8, Infektion mit Win32/Fynloski.A?

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Seite 1 von 2 1 2
Alt 29.09.2013, 16:02   #1
Rupsi
 
Windows 8, Infektion mit Win32/Fynloski.A? - Standard

Windows 8, Infektion mit Win32/Fynloski.A?


Guten Tag,
seit einigen Tagen meldet Windows Defender bei mir eine Infektion mit Win32/Fynloski.A. MBAM meldet weitere Infektionen aber kein Fynloski.
An Symptomen habe ich selbst bislang wenig erkennen können, außer dass häufiger wenn ich in Firefox auf einen link klicke, dieses erst nach mehreren Malen funktioniert. Sonst kommt in etwa eine Meldung wie"Server nicht gefunden".
Da es anscheinend mit dem Defender nicht möglich ist, den Urheber zu eliminieren nun hier die Frage an jemanden, der mehr davon versteht als ich. Wie werde ich diesen Schädling wieder los?
Gmer-log:
Code:
ATTFilter
GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-09-29 16:29:20
Windows 6.2.9200  x64 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP1T1L0-3 WDC_WD3200AAJS-22RYA0 rev.12.01B01 298,09GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\TOM_AD~1\AppData\Local\Temp\kwrcyuog.sys


---- User code sections - GMER 2.1 ----

.text   C:\WINDOWS\system32\dwm.exe[984] C:\WINDOWS\system32\PSAPI.DLL!GetProcessImageFileNameA + 306                                       000007ff5781177a 4 bytes [81, 57, FF, 07]
.text   C:\WINDOWS\system32\dwm.exe[984] C:\WINDOWS\system32\PSAPI.DLL!GetProcessImageFileNameA + 314                                       000007ff57811782 4 bytes [81, 57, FF, 07]
.text   C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[864] C:\WINDOWS\SYSTEM32\MSIMG32.dll!GradientFill + 690                    000007ff53a11532 4 bytes [A1, 53, FF, 07]
.text   C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[864] C:\WINDOWS\SYSTEM32\MSIMG32.dll!GradientFill + 698                    000007ff53a1153a 4 bytes [A1, 53, FF, 07]
.text   C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[864] C:\WINDOWS\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                  000007ff53a1165a 4 bytes [A1, 53, FF, 07]
.text   C:\WINDOWS\system32\nvvsvc.exe[912] C:\WINDOWS\system32\MSIMG32.dll!GradientFill + 690                                              000007ff53a11532 4 bytes [A1, 53, FF, 07]
.text   C:\WINDOWS\system32\nvvsvc.exe[912] C:\WINDOWS\system32\MSIMG32.dll!GradientFill + 698                                              000007ff53a1153a 4 bytes [A1, 53, FF, 07]
.text   C:\WINDOWS\system32\nvvsvc.exe[912] C:\WINDOWS\system32\MSIMG32.dll!TransparentBlt + 246                                            000007ff53a1165a 4 bytes [A1, 53, FF, 07]
.text   C:\WINDOWS\system32\nvvsvc.exe[912] C:\WINDOWS\system32\PSAPI.DLL!GetProcessImageFileNameA + 306                                    000007ff5781177a 4 bytes [81, 57, FF, 07]
.text   C:\WINDOWS\system32\nvvsvc.exe[912] C:\WINDOWS\system32\PSAPI.DLL!GetProcessImageFileNameA + 314                                    000007ff57811782 4 bytes [81, 57, FF, 07]
.text   C:\WINDOWS\system32\mqsvc.exe[252] C:\WINDOWS\system32\WSOCK32.dll!recvfrom + 742                                                   000007ff50211b32 4 bytes [21, 50, FF, 07]
.text   C:\WINDOWS\system32\mqsvc.exe[252] C:\WINDOWS\system32\WSOCK32.dll!recvfrom + 750                                                   000007ff50211b3a 4 bytes [21, 50, FF, 07]
.text   C:\WINDOWS\System32\svchost.exe[1992] c:\windows\system32\WSOCK32.dll!recvfrom + 742                                                000007ff50211b32 4 bytes [21, 50, FF, 07]
.text   C:\WINDOWS\System32\svchost.exe[1992] c:\windows\system32\WSOCK32.dll!recvfrom + 750                                                000007ff50211b3a 4 bytes [21, 50, FF, 07]
.text   C:\WINDOWS\System32\svchost.exe[2248] c:\windows\system32\WSOCK32.dll!recvfrom + 742                                                000007ff50211b32 4 bytes [21, 50, FF, 07]
.text   C:\WINDOWS\System32\svchost.exe[2248] c:\windows\system32\WSOCK32.dll!recvfrom + 750                                                000007ff50211b3a 4 bytes [21, 50, FF, 07]
.text   C:\Program Files\Windows Defender\MsMpEng.exe[2544] C:\WINDOWS\system32\psapi.dll!GetProcessImageFileNameA + 306                    000007ff5781177a 4 bytes [81, 57, FF, 07]
.text   C:\Program Files\Windows Defender\MsMpEng.exe[2544] C:\WINDOWS\system32\psapi.dll!GetProcessImageFileNameA + 314                    000007ff57811782 4 bytes [81, 57, FF, 07]
.text   C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1164] C:\WINDOWS\SYSTEM32\MSIMG32.dll!GradientFill + 690                     000007ff53a11532 4 bytes [A1, 53, FF, 07]
.text   C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1164] C:\WINDOWS\SYSTEM32\MSIMG32.dll!GradientFill + 698                     000007ff53a1153a 4 bytes [A1, 53, FF, 07]
.text   C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1164] C:\WINDOWS\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                   000007ff53a1165a 4 bytes [A1, 53, FF, 07]

---- Threads - GMER 2.1 ----

Thread  C:\WINDOWS\system32\csrss.exe [572:596]                                                                                             fffff960008a85e8
Thread  C:\WINDOWS\SysWOW64\notepad.exe [4144:4152]                                                                                         0000000000470000

---- Registry - GMER 2.1 ----

Reg     HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel\RNG@RNGAuxiliarySeed                                                   -1267476665
Reg     HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch@Epoch                                                                     101329
Reg     HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules@{6CC20B6F-BCB9-4388-AF99-08346840D374}  v2.20|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Windows\System32\spoolsv.exe|Name=HP Networked Printer Installer|
Reg     HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules@{529126C3-73FC-4287-ACAF-A02B973D223B}  v2.20|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Windows\System32\spoolsv.exe|Name=HP Networked Printer Installer|

---- EOF - GMER 2.1 ----
First-Log
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-09-2013 02
Ran by Tom (ATTENTION: The logged in user is not administrator) on TOM_ADMIN-PC on 29-09-2013 14:01:47
Running from L:\Download
Windows 8 Pro (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(Hewlett-Packard Company) C:\Program Files (x86)\HP\HP Color LaserJet CM2320 MFP Series\hppfaxprintersrv.exe
(Samsung) C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
(InstallShield Software Corporation) C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe
() C:\Users\Tom\AppData\Local\Temp\cvtres.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
(Microsoft Corporation) C:\WINDOWS\SysWOW64\notepad.exe
(Mozilla Corporation) C:\Program Files (x86)\Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
(Adobe Systems, Inc.) C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13196432 2012-09-25] (Realtek Semiconductor)
HKLM\...\Run: [HP Color LaserJet CM2320 MFP Series Fax] - C:\Program Files (x86)\HP\HP Color LaserJet CM2320 MFP Series\hppfaxprintersrv.exe [3700736 2009-09-22] (Hewlett-Packard Company)
HKLM\...\RunOnce: [*WerKernelReporting] - %SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq [439488 2013-07-09] (Microsoft Corporation)
HKLM\...\Winlogon: [Userinit] C:\Windows\SysWOW64\userinit.exe,
HKCU\...\Run: [Java Updater] - C:\Users\Tom\AppData\lsass.exe [274944 2013-09-13] ()
HKCU\...\Run: [] - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844656 2013-09-04] (Samsung)
HKLM-x32\...\Run: [BCSSync] - C:\Program Files (x86)\Microsoft Office2010\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
HKLM-x32\...\Run: [EaseUS EPM tray] - C:\Program Files (x86)\EaseUS\EaseUS Partition Master 9.2.1 Home Edition\bin\EpmNews.exe [2086984 2012-11-29] (CHENGDU YIWO Tech Development Co., Ltd)
HKLM-x32\...\Run: [ISUSScheduler] - C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe [81920 2005-02-16] (InstallShield Software Corporation)
HKLM-x32\...\Run: [JMB36X IDE Setup] - C:\Windows\RaidTool\xInsIDE.exe [36864 2007-03-20] ()
HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [163000 2012-12-12] (Geek Software GmbH)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [HPUsageTracking] - C:\Program Files (x86)\HP\HP UT\bin\hppusg.exe [24576 2009-05-11] (Hewlett-Packard Company)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [Live Update 5] - C:\Program Files (x86)\MSI\Live Update 5\BootStartLiveupdate.exe [315392 2012-01-30] ()
HKLM-x32\...\Run: [KiesTrayAgent] - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311152 2013-09-04] (Samsung Electronics Co., Ltd.)
AppInit_DLLs:         [0 ] ()
AppInit_DLLs-x32:   [ ] ()
Startup: C:\Users\Tom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office2010\Office14\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.metager.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x6EEDBAB406CCCD01
SearchScopes: HKLM-x32 - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snap.do/?publisher=SnapdoEMon&dpid=SnapdoEMon&co=DE&userid=dc45f073-fe67-455e-a3b8-5331ef50cad9&searchtype=ds&q={searchTerms}
SearchScopes: HKLM-x32 - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snap.do/?publisher=SnapdoEMon&dpid=SnapdoEMon&co=DE&userid=dc45f073-fe67-455e-a3b8-5331ef50cad9&searchtype=ds&q={searchTerms}
SearchScopes: HKCU - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snap.do/?publisher=SnapdoEMon&dpid=SnapdoEMon&co=DE&userid=dc45f073-fe67-455e-a3b8-5331ef50cad9&searchtype=ds&q={searchTerms}
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snap.do/?publisher=SnapdoEMon&dpid=SnapdoEMon&co=DE&userid=dc45f073-fe67-455e-a3b8-5331ef50cad9&searchtype=ds&q={searchTerms}
SearchScopes: HKCU - {3BD44F0E-0596-4008-AEE0-45D47E3A8F0E} URL = 
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office2010\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office2010\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: No Name - {DBC80044-A445-435b-BC74-9C25C1C588A9} -  No File
Toolbar: HKLM -  No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} -  No File
Toolbar: HKLM-x32 -  No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} -  No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 0.0.0.0

FireFox:
========
FF ProfilePath: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default
FF DefaultSearchEngine: Ixquick HTTP - Deutsch
FF SelectedSearchEngine: Ixquick HTTP - Deutsch
FF Homepage: hxxp://meta.rrzn.uni-hannover.de/meta/cgi-bin/mg-perein.pl?mg_version=10&mm=and&lr=all&maxtreffer=200&time=2&hitsPerServer=2&textmenge=2&wissRank=on&sprueche=on&wikiboost=on&QuickTips=beschleuniger&synonyme=on&linkTest=no&check_time=3&dmoz=on&exalead=on&fastbot=on&wikipedia=on&yacy=on&witch=on&overture=on&nebel=on&metarss=on&Nachrichten=on&atsearch=on&suchticker=on&amidalla=on&BASE=on&portalu=on&fportal=on&clewwa=on&qsensei=on&harvest=on&premiumpresse=on&yandex=on&dest=bookmark
FF NetworkProxy: "http", "211.76.97.150"
FF NetworkProxy: "http_port", 80
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\WINDOWS\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf - f:\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf - f:\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - e:\Picasa3\npPicasa3.dll No File
FF Plugin-x32: @java.com/DTPlugin,version=1.6.0_35 - C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MI4066~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MI4066~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @real.com/nppl3260;version=15.0.4.53 - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprjplug;version=15.0.4.53 - c:\program files (x86)\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpchromebrowserrecordext;version=15.0.4.53 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprphtml5videoshim;version=15.0.4.53 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=15.0.4.53 - c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Tom\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF SearchPlugin: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\betabinariesnl.xml
FF SearchPlugin: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\eurobuchcom.xml
FF SearchPlugin: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\icqplugin-1.xml
FF SearchPlugin: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\icqplugin-2.xml
FF SearchPlugin: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\icqplugin-3.xml
FF SearchPlugin: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\icqplugin.xml
FF SearchPlugin: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\ixquick-http---deutsch.xml
FF SearchPlugin: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\mein-metager.xml
FF SearchPlugin: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\searchplugins-backup
FF SearchPlugin: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\startpage-https---deutsch.xml
FF Extension: Deutsches Wörterbuch - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\de-DE@dictionaries.addons.mozilla.org
FF Extension: Garmin Communicator - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
FF Extension: Microsoft .NET Framework Assistant - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF Extension: EPUBReader - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\{5384767E-00D9-40E9-B72F-9CC39D655D6F}
FF Extension: No Name - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\{c36177c0-224a-11da-8cd6-0800200c9a66}
FF Extension: Bitdefender QuickScan - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
FF Extension: admin - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\admin@proxy-listen.de.xpi
FF Extension: No Name - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\Extensions.rdf
FF Extension: No Name - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\installed-extensions.txt
FF Extension: optout - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\optout@google.com.xpi
FF Extension: youtubeunblocker - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\youtubeunblocker@unblocker.yt.xpi
FF HKLM-x32\...\Firefox\Extensions: [{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF Extension: RealPlayer Browser Record Plugin - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF HKLM-x32\...\Firefox\Extensions: [{ACAA314B-EEBA-48e4-AD47-84E31C44796C}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\
FF StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Firefox\firefox.exe

Chrome: 
=======
CHR HomePage: hxxp://www.google.com/
CHR DefaultSearchURL: (Google) - {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Tom\AppData\Local\Google\Chrome\Application\10.0.648.204\pdf.dll No File
CHR Plugin: (Google Gears 0.5.33.0) - C:\Users\Tom\AppData\Local\Google\Chrome\Application\10.0.648.204\gears.dll No File
CHR Plugin: (Shockwave Flash) - C:\Users\Tom\AppData\Local\Google\Chrome\Application\10.0.648.204\gcswf32.dll No File
CHR Plugin: (Foxit Reader Plugin for Mozilla) - C:\Program Files (x86)\Firefox\plugins\npFoxitReaderPlugin.dll (Foxit Software Company)
CHR Plugin: (2007 Microsoft Office system) - C:\Program Files (x86)\Firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (Google Update) - C:\Users\Tom\AppData\Local\Google\Update\1.2.183.39\npGoogleOneClick8.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Default Plug-in) - default_plugin No File
CHR HKLM-x32\...\Chrome\Extension: [abfmigjiaapipflmopkaaooigcjjdojh] - C:\Program Files (x86)\LyricsContainer\120.crx
CHR HKLM-x32\...\Chrome\Extension: [fjoijdanhaiflhibkljeklcghcmmfffh] - C:\Program Files (x86)\WebCake\WebCakeLayers.crx
CHR HKLM-x32\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Ext\rphtml5video.crx
CHR HKLM-x32\...\Chrome\Extension: [ofnnlhbgdcabppjmlijllkhekcglbjlg] - C:\Program Files (x86)\Lyrics_Monkey\128.crx

==================== Services (Whitelisted) =================

R2 BackupStack; C:\Program Files (x86)\MyPC Backup\BackupStack.exe [32808 2013-07-01] (Just Develop It)
R2 Garmin Core Update Service; C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [185688 2013-03-27] (Garmin Ltd or its subsidiaries)
R2 HPSLPSVC; C:\Users\Tom\AppData\Local\Temp\7zS3579\hpslpsvc64.dll [1039360 2012-11-14] (Hewlett-Packard Co.)
R2 lmhosts; C:\Windows\system32\svchost.exe [29696 2012-09-20] (Microsoft Corporation)
S3 Microsoft SharePoint Workspace Audit Service; C:\Program Files (x86)\Microsoft Office2010\Office14\GROOVE.EXE [30785672 2012-09-20] (Microsoft Corporation)
R2 MSMQ; C:\Windows\system32\mqsvc.exe [25088 2012-07-26] (Microsoft Corporation)
R2 NlaSvc; C:\Windows\System32\svchost.exe [29696 2012-09-20] (Microsoft Corporation)
R2 nsi; C:\Windows\system32\svchost.exe [29696 2012-09-20] (Microsoft Corporation)
R2 PMBDeviceInfoProvider; C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe [474168 2012-04-22] (Sony Corporation)
S2 SynoDrService; C:\Program Files (x86)\Synology Data Replicator  3\SynoDrServicex64.exe [380928 2010-06-02] ()
R2 TVGOnlineUpdateSvc; C:\Program Files (x86)\TVG\OnlineUpdate\OnlineUpdateSvc.exe [398128 2010-12-14] ()
R2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [471552 2012-07-26] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)
R2 WsysSvc; C:\ProgramData\eSafe\eGdpSvc.exe [301120 2013-08-25] (Wsys Co., Ltd.)

==================== Drivers (Whitelisted) ====================

S3 androidusb; C:\Windows\System32\Drivers\androidusb.sys [32768 2010-04-29] (Google Inc)
S3 DigiartyVirtualCDBus; C:\Windows\System32\drivers\DigiartyVirtualCDBus.sys [276256 2013-08-28] (Digiarty Software, Inc.)
R2 easycvfs; C:\WINDOWS\system32\drivers\easycvfs.sys [109960 2009-11-09] ()
S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [17480 2012-12-21] ()
S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [17480 2012-12-21] ()
S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9800 2012-12-21] ()
S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9800 2012-12-21] ()
R1 HWiNFO32; C:\Program Files (x86)\HWiNFO32\HWiNFO64A.SYS [29288 2009-05-21] (REALiX(tm))
R1 HWiNFO32; C:\Program Files (x86)\HWiNFO32\HWiNFO64A.SYS [29288 2009-05-21] (REALiX(tm))
R3 MQAC; C:\Windows\System32\drivers\mqac.sys [185856 2012-07-26] (Microsoft Corporation)
S1 NNSNAHSL; C:\Windows\System32\DRIVERS\NNSNAHSL.sys [33320 2012-10-22] (Panda Security, S.L.)
S3 NTIOLib_1_0_4; C:\Program Files (x86)\MSI\Live Update 5\NTIOLib_X64.sys [14136 2010-10-22] (MSI)
S3 NTIOLib_1_0_4; C:\Program Files (x86)\MSI\Live Update 5\NTIOLib_X64.sys [14136 2010-10-22] (MSI)
S3 NTIOLib_1_0_6; C:\Program Files (x86)\Setup Files\Ms7586v1B0\NTIOLib_X64.sys [11888 2011-01-06] (MSI)
S3 NTIOLib_1_0_6; C:\Program Files (x86)\Setup Files\Ms7586v1B0\NTIOLib_X64.sys [11888 2011-01-06] (MSI)
R3 seehcri; C:\Windows\System32\drivers\seehcri.sys [34032 2008-01-09] (Sony Ericsson Mobile Communications)
R3 SKYNET; C:\Windows\system32\DRIVERS\SkyNET_AMD64.SYS [615440 2009-09-11] (TechniSat Digital, S.A.)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [828912 2011-08-16] (Duplex Secure Ltd.)
S3 vvftav; C:\Windows\System32\drivers\vvftav.sys [300800 2007-02-02] (Vimicro Corporation)
S3 ZSMC0305; C:\Windows\System32\Drivers\usbVM305.sys [1541120 2007-03-08] (Vimicro Corporation)
U3 idsvc; 
S3 MSI_MSIBIOS_010507; \??\C:\Program Files (x86)\MSI\Live Update 5\msibios64_100507.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-29 14:01 - 2013-09-29 14:01 - 00000000 ____D C:\FRST
2013-09-27 14:21 - 2013-09-27 14:21 - 00000000 ____D C:\Users\Tom\Documents\SelfMV
2013-09-27 14:10 - 2013-09-27 14:10 - 00002018 _____ C:\Users\Public\Desktop\Samsung Kies (Lite).lnk
2013-09-27 14:10 - 2013-09-27 14:10 - 00002008 _____ C:\Users\Public\Desktop\Samsung Kies.lnk
2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\WINDOWS\LastGood.Tmp
2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Tom\Documents\samsung
2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Tom\AppData\Roaming\Samsung
2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Tom\AppData\Local\Samsung
2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Public\Documents\NativeFus_Log
2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Public\Documents\CrashDump
2013-09-27 14:08 - 2013-09-27 14:08 - 00000000 ____D C:\Program Files (x86)\MyFree Codec
2013-09-27 14:05 - 2013-09-27 14:09 - 00000000 ____D C:\ProgramData\Samsung
2013-09-27 14:05 - 2013-09-27 14:09 - 00000000 ____D C:\Program Files (x86)\Samsung
2013-09-27 14:05 - 2013-07-18 14:33 - 04659712 _____ (Dmitry Streblechenko) C:\WINDOWS\SysWOW64\Redemption.dll
2013-09-27 14:05 - 2013-07-18 14:32 - 00821824 _____ (Devguru Co., Ltd.) C:\WINDOWS\SysWOW64\dgderapi.dll
2013-09-27 13:59 - 2013-09-27 13:59 - 00001059 _____ C:\Users\Public\Desktop\DriverTuner.lnk
2013-09-27 13:59 - 2013-09-27 13:59 - 00000000 ____D C:\Program Files (x86)\DriverTuner
2013-09-27 13:54 - 2013-09-27 13:54 - 00000000 ____D C:\Users\Tom\.android
2013-09-26 10:35 - 2013-09-26 10:35 - 00000103 _____ C:\WINDOWS\ParrotFlashWiz.INI
2013-09-26 10:33 - 2013-09-26 10:33 - 00000000 ____D C:\Program Files (x86)\Parrot Software Update Tool
2013-09-23 11:12 - 2013-09-23 11:12 - 1285878931 _____ C:\WINDOWS\MEMORY.DMP
2013-09-16 20:47 - 2013-08-07 07:15 - 00144896 _____ (Microsoft Corporation) C:\WINDOWS\system32\tssdisai.dll
2013-09-15 13:06 - 2013-09-15 13:07 - 00531240 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2013-09-15 10:43 - 2013-09-15 10:43 - 00005630 _____ C:\WINDOWS\PFRO.log
2013-09-14 17:15 - 2013-09-29 12:54 - 00108555 _____ C:\WINDOWS\setupact.log
2013-09-14 17:15 - 2013-09-14 17:15 - 00000000 _____ C:\WINDOWS\setuperr.log
2013-09-13 10:57 - 2013-09-29 12:22 - 01964153 _____ C:\WINDOWS\WindowsUpdate.log
2013-09-13 09:28 - 2013-09-13 09:28 - 00274944 _____ C:\Users\Tom\AppData\lsass.exe
2013-09-13 09:24 - 2013-08-16 07:41 - 00058200 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dam.sys
2013-09-13 09:24 - 2013-08-16 07:39 - 02371728 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSService.dll
2013-09-13 09:24 - 2013-08-16 07:39 - 00059416 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2013-09-13 09:24 - 2013-08-16 07:32 - 00209200 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationUI.exe
2013-09-13 09:24 - 2013-08-16 07:22 - 04917760 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppsvc.exe
2013-09-13 09:24 - 2013-08-16 07:22 - 00040448 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe
2013-09-13 09:24 - 2013-08-16 07:21 - 03275776 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2013-09-13 09:24 - 2013-08-16 07:21 - 01621504 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll
2013-09-13 09:24 - 2013-08-16 07:21 - 01164288 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll
2013-09-13 09:24 - 2013-08-16 07:21 - 00773120 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2013-09-13 09:24 - 2013-08-16 07:21 - 00688640 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll
2013-09-13 09:24 - 2013-08-16 07:21 - 00368640 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppwinob.dll
2013-09-13 09:24 - 2013-08-16 07:21 - 00252416 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll
2013-09-13 09:24 - 2013-08-16 07:21 - 00204800 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSClient.dll
2013-09-13 09:24 - 2013-08-16 07:21 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll
2013-09-13 09:24 - 2013-08-16 07:21 - 00183808 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSSync.dll
2013-09-13 09:24 - 2013-08-16 07:21 - 00174592 _____ (Microsoft Corporation) C:\WINDOWS\system32\storewuauth.dll
2013-09-13 09:24 - 2013-08-16 07:21 - 00163840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2013-09-13 09:24 - 2013-08-16 07:21 - 00142848 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll
2013-09-13 09:24 - 2013-08-16 07:21 - 00120320 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppc.dll
2013-09-13 09:24 - 2013-08-16 07:21 - 00099328 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll
2013-09-13 09:24 - 2013-08-16 07:21 - 00081408 _____ (Microsoft Corporation) C:\WINDOWS\system32\setupcln.dll
2013-09-13 09:24 - 2013-08-16 07:21 - 00049664 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups.dll
2013-09-13 09:24 - 2013-08-16 07:21 - 00049152 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups2.dll
2013-09-13 09:24 - 2013-08-16 07:20 - 00105984 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinSetupUI.dll
2013-09-13 09:24 - 2013-08-16 00:43 - 00628736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2013-09-13 09:24 - 2013-08-16 00:43 - 00562688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll
2013-09-13 09:24 - 2013-08-16 00:43 - 00167424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSClient.dll
2013-09-13 09:24 - 2013-08-16 00:43 - 00159232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSSync.dll
2013-09-13 09:24 - 2013-08-16 00:43 - 00143872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.dll
2013-09-13 09:24 - 2013-08-16 00:43 - 00126976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll
2013-09-13 09:24 - 2013-08-16 00:43 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2013-09-13 09:24 - 2013-08-16 00:43 - 00084992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll
2013-09-13 09:24 - 2013-08-16 00:43 - 00083968 _____ C:\WINDOWS\SysWOW64\OEMLicense.dll
2013-09-13 09:24 - 2013-08-16 00:43 - 00035328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe
2013-09-13 09:24 - 2013-08-16 00:43 - 00020992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wups.dll
2013-09-13 09:24 - 2013-08-16 00:42 - 00091648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sppc.dll
2013-09-13 09:24 - 2013-08-16 00:42 - 00076800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\setupcln.dll
2013-09-13 09:23 - 2013-08-21 06:12 - 02241024 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2013-09-13 09:23 - 2013-08-21 06:12 - 00051712 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2013-09-13 09:23 - 2013-08-21 06:11 - 19246592 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2013-09-13 09:23 - 2013-08-21 06:11 - 15404544 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2013-09-13 09:23 - 2013-08-21 06:11 - 03959296 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2013-09-13 09:23 - 2013-08-21 06:11 - 02647040 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2013-09-13 09:23 - 2013-08-21 06:11 - 01365504 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2013-09-13 09:23 - 2013-08-21 06:11 - 00915968 _____ (Microsoft Corporation) C:\WINDOWS\system32\uxtheme.dll
2013-09-13 09:23 - 2013-08-21 06:11 - 00855552 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2013-09-13 09:23 - 2013-08-21 06:11 - 00603136 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2013-09-13 09:23 - 2013-08-21 06:11 - 00136704 _____ (Microsoft Corporation) C:\WINDOWS\system32\iesysprep.dll
2013-09-13 09:23 - 2013-08-21 06:11 - 00067072 _____ (Microsoft Corporation) C:\WINDOWS\system32\iesetup.dll
2013-09-13 09:23 - 2013-08-21 06:11 - 00053760 _____ (Microsoft Corporation) C:\WINDOWS\system32\UXInit.dll
2013-09-13 09:23 - 2013-08-21 06:11 - 00053760 _____ (Microsoft Corporation) C:\WINDOWS\system32\jsproxy.dll
2013-09-13 09:23 - 2013-08-21 06:11 - 00039936 _____ (Microsoft Corporation) C:\WINDOWS\system32\iernonce.dll
2013-09-13 09:23 - 2013-08-21 04:34 - 02706432 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.tlb
2013-09-13 09:23 - 2013-08-21 04:06 - 01767936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2013-09-13 09:23 - 2013-08-21 04:06 - 01141248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2013-09-13 09:23 - 2013-08-21 04:06 - 00044032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UXInit.dll
2013-09-13 09:23 - 2013-08-21 04:05 - 14332928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2013-09-13 09:23 - 2013-08-21 04:05 - 13761024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2013-09-13 09:23 - 2013-08-21 04:05 - 02876928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2013-09-13 09:23 - 2013-08-21 04:05 - 02048000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2013-09-13 09:23 - 2013-08-21 04:05 - 00690688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2013-09-13 09:23 - 2013-08-21 04:05 - 00493056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2013-09-13 09:23 - 2013-08-21 04:05 - 00109056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iesysprep.dll
2013-09-13 09:23 - 2013-08-21 04:05 - 00061440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iesetup.dll
2013-09-13 09:23 - 2013-08-21 04:05 - 00039936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jsproxy.dll
2013-09-13 09:23 - 2013-08-21 04:05 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iernonce.dll
2013-09-13 09:23 - 2013-08-21 03:43 - 02706432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.tlb
2013-09-13 09:23 - 2013-08-21 01:52 - 00534528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\uxtheme.dll
2013-09-13 09:23 - 2013-08-03 06:30 - 04038144 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2013-09-12 22:38 - 2013-09-12 22:38 - 00001604 _____ C:\Users\Public\Desktop\Angry Birds Star Wars.lnk
2013-09-11 21:10 - 2013-07-09 10:04 - 00120144 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\msgpioclx.sys
2013-09-11 21:10 - 2013-07-09 08:18 - 00439488 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe
2013-09-11 21:10 - 2013-07-09 06:25 - 00385768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe
2013-09-11 21:10 - 2013-07-09 00:46 - 00414208 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanconn.dll
2013-09-11 21:10 - 2013-07-09 00:46 - 00370688 _____ (Microsoft Corporation) C:\WINDOWS\system32\Wwanadvui.dll
2013-09-11 21:10 - 2013-07-06 02:16 - 01025024 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll
2013-09-11 21:10 - 2013-07-03 02:23 - 00778752 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleaut32.dll
2013-09-11 21:10 - 2013-07-03 02:22 - 02839552 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll
2013-09-11 21:10 - 2013-07-03 02:22 - 01300480 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32.dll
2013-09-11 21:10 - 2013-07-03 02:11 - 00551424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleaut32.dll
2013-09-11 21:10 - 2013-07-03 02:11 - 00268800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.BackgroundTransfer.dll
2013-09-11 21:10 - 2013-07-03 02:10 - 02273792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll
2013-09-11 21:10 - 2013-06-29 08:15 - 00195416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys
2013-09-11 21:10 - 2013-06-29 08:15 - 00125784 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpsd.sys
2013-09-11 21:10 - 2013-06-29 07:43 - 00327512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Classpnp.sys
2013-09-11 21:10 - 2013-06-25 00:54 - 00447488 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll
2013-09-11 21:10 - 2013-06-25 00:54 - 00263680 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmsvc.dll
2013-09-11 21:10 - 2013-06-25 00:54 - 00074240 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmcsp.dll
2013-09-11 21:10 - 2013-06-19 07:36 - 00183808 _____ (Microsoft Corporation) C:\WINDOWS\system32\winmmbase.dll
2013-09-11 21:10 - 2013-06-19 07:36 - 00115712 _____ (Microsoft Corporation) C:\WINDOWS\system32\winmm.dll
2013-09-11 21:10 - 2013-06-19 00:38 - 00160256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmmbase.dll
2013-09-11 21:10 - 2013-06-19 00:38 - 00125440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmm.dll
2013-09-11 21:10 - 2013-06-12 01:26 - 00230912 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinSCard.dll
2013-09-11 21:10 - 2013-06-10 23:17 - 00096512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wfplwfs.sys
2013-09-11 21:10 - 2013-06-10 21:15 - 01156096 _____ (Microsoft Corporation) C:\WINDOWS\system32\IKEEXT.DLL
2013-09-11 21:10 - 2013-06-10 21:15 - 00723968 _____ (Microsoft Corporation) C:\WINDOWS\system32\BFE.DLL
2013-09-11 21:10 - 2013-06-10 21:15 - 00381952 _____ (Microsoft Corporation) C:\WINDOWS\system32\FWPUCLNT.DLL
2013-09-11 21:10 - 2013-06-06 10:03 - 00119040 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBSTOR.SYS
2013-09-11 21:09 - 2013-07-09 05:57 - 00245760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LocationApi.dll
2013-09-11 21:09 - 2013-07-09 00:46 - 00543744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanmm.dll
2013-09-11 21:09 - 2013-07-09 00:45 - 00312832 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationApi.dll
2013-09-11 21:09 - 2013-07-03 02:23 - 00391168 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.BackgroundTransfer.dll
2013-09-11 21:09 - 2013-07-02 00:08 - 00387583 _____ C:\WINDOWS\system32\ApnDatabase.xml
2013-09-11 21:09 - 2013-07-01 00:30 - 00067072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\openfiles.exe
2013-09-11 21:09 - 2013-07-01 00:29 - 00077312 _____ (Microsoft Corporation) C:\WINDOWS\system32\openfiles.exe
2013-09-11 21:09 - 2013-06-29 03:12 - 01022464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32.dll
2013-09-11 21:09 - 2013-06-26 05:01 - 00321536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\udfs.sys
2013-09-11 21:09 - 2013-06-12 01:43 - 00154112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinSCard.dll
2013-09-11 21:09 - 2013-06-10 21:16 - 00888832 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshwfp.dll
2013-09-11 21:09 - 2013-06-10 21:10 - 00702464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nshwfp.dll
2013-09-11 21:09 - 2013-06-10 21:10 - 00245248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FWPUCLNT.DLL
2013-09-11 21:09 - 2013-04-03 01:37 - 00025088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cryptdlg.dll
2013-09-11 21:09 - 2013-04-03 01:12 - 00030720 _____ (Microsoft Corporation) C:\WINDOWS\system32\cryptdlg.dll
2013-09-11 21:09 - 2013-03-22 05:49 - 02382336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\esent.dll
2013-09-11 21:09 - 2013-03-22 00:47 - 02851840 _____ (Microsoft Corporation) C:\WINDOWS\system32\esent.dll
2013-09-11 21:09 - 2013-03-02 10:23 - 00375808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ReAgent.dll
2013-09-11 21:09 - 2013-03-02 04:44 - 01011200 _____ (Microsoft Corporation) C:\WINDOWS\system32\reseteng.dll
2013-09-11 21:09 - 2012-12-15 06:55 - 00443392 _____ (Microsoft Corporation) C:\WINDOWS\system32\ReAgent.dll
2013-09-11 21:09 - 2012-11-03 07:26 - 00132096 _____ (Microsoft Corporation) C:\WINDOWS\system32\sysreset.exe
2013-09-11 21:09 - 2012-11-03 07:25 - 00945152 _____ (Microsoft Corporation) C:\WINDOWS\system32\resetengmig.dll
2013-09-11 21:09 - 2012-10-24 05:25 - 00026624 _____ (Microsoft Corporation) C:\WINDOWS\system32\ReAgentc.exe
2013-09-11 21:09 - 2012-10-24 05:25 - 00013312 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcalua.exe
2013-09-11 21:09 - 2012-10-24 05:24 - 00405504 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcasvc.dll
2013-09-11 21:09 - 2012-10-24 05:24 - 00031232 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcadm.dll
2013-09-11 21:09 - 2012-10-24 05:05 - 00011776 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcaevts.dll
2013-09-11 21:09 - 2012-10-24 04:48 - 00024064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ReAgentc.exe
2013-09-09 10:23 - 2013-06-09 21:59 - 00216064 _____ C:\WINDOWS\SysWOW64\gcapi_dll.dll
2013-09-01 16:29 - 2013-09-01 16:29 - 00000000 ____D C:\WINDOWS\SysWOW64\fstrainer2011
2013-09-01 16:29 - 2008-01-03 19:19 - 00581632 _____ (Adobe Systems, Inc.) C:\WINDOWS\SysWOW64\Control.dll
2013-09-01 16:29 - 2004-12-07 10:09 - 00347136 _____ C:\WINDOWS\SysWOW64\unicows.pdb
2013-09-01 16:29 - 2004-08-04 07:21 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msado27.tlb
2013-09-01 16:29 - 2004-03-08 21:00 - 00152848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comdlg32.ocx
2013-09-01 14:49 - 2013-09-09 10:36 - 00000942 _____ C:\Users\Public\Desktop\calibre 64bit - E-book management.lnk
2013-09-01 14:49 - 2013-09-09 10:36 - 00000000 ____D C:\Program Files\Calibre2
2013-09-01 14:49 - 2013-09-01 18:42 - 00000000 ____D C:\Users\Tom\AppData\Local\calibre-cache
2013-08-30 16:11 - 2013-08-30 16:11 - 00000000 ____D C:\Users\TomAdminPW_Ur\AppData\Roaming\Apple Computer

==================== One Month Modified Files and Folders =======

2013-09-29 14:02 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\system32\sru
2013-09-29 14:01 - 2013-09-29 14:01 - 00000000 ____D C:\FRST
2013-09-29 13:21 - 2012-08-15 10:55 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2013-09-29 13:01 - 2012-07-26 12:27 - 00863478 _____ C:\WINDOWS\system32\perfh007.dat
2013-09-29 13:01 - 2012-07-26 12:27 - 00197036 _____ C:\WINDOWS\system32\perfc007.dat
2013-09-29 13:01 - 2012-07-26 09:28 - 02029610 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2013-09-29 13:00 - 2013-08-25 14:40 - 00000000 ____D C:\ProgramData\eSafe
2013-09-29 12:57 - 2009-07-14 04:34 - 00001106 _____ C:\WINDOWS\win.ini
2013-09-29 12:54 - 2013-09-14 17:15 - 00108555 _____ C:\WINDOWS\setupact.log
2013-09-29 12:54 - 2013-01-02 02:50 - 00000000 ____D C:\ProgramData\NVIDIA
2013-09-29 12:54 - 2012-07-26 09:22 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2013-09-29 12:22 - 2013-09-13 10:57 - 01964153 _____ C:\WINDOWS\WindowsUpdate.log
2013-09-27 17:54 - 2013-02-26 22:16 - 00000000 ____D C:\Users\Tom\AppData\Roaming\Simple Sudoku
2013-09-27 17:20 - 2013-03-18 16:32 - 00013213 _____ C:\Users\Tom\Desktop\Wasserverbrauch.xlsx
2013-09-27 17:10 - 2013-03-18 16:19 - 00015297 _____ C:\Users\Tom\Desktop\Stromverbrauch.xlsx
2013-09-27 14:41 - 2012-12-02 22:30 - 00000000 ____D C:\Users\Tom\AppData\Roaming\MyPhoneExplorer
2013-09-27 14:21 - 2013-09-27 14:21 - 00000000 ____D C:\Users\Tom\Documents\SelfMV
2013-09-27 14:10 - 2013-09-27 14:10 - 00002018 _____ C:\Users\Public\Desktop\Samsung Kies (Lite).lnk
2013-09-27 14:10 - 2013-09-27 14:10 - 00002008 _____ C:\Users\Public\Desktop\Samsung Kies.lnk
2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\WINDOWS\LastGood.Tmp
2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Tom\Documents\samsung
2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Tom\AppData\Roaming\Samsung
2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Tom\AppData\Local\Samsung
2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Public\Documents\NativeFus_Log
2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Public\Documents\CrashDump
2013-09-27 14:09 - 2013-09-27 14:05 - 00000000 ____D C:\ProgramData\Samsung
2013-09-27 14:09 - 2013-09-27 14:05 - 00000000 ____D C:\Program Files (x86)\Samsung
2013-09-27 14:08 - 2013-09-27 14:08 - 00000000 ____D C:\Program Files (x86)\MyFree Codec
2013-09-27 14:05 - 2010-01-24 03:50 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-09-27 13:59 - 2013-09-27 13:59 - 00001059 _____ C:\Users\Public\Desktop\DriverTuner.lnk
2013-09-27 13:59 - 2013-09-27 13:59 - 00000000 ____D C:\Program Files (x86)\DriverTuner
2013-09-27 13:54 - 2013-09-27 13:54 - 00000000 ____D C:\Users\Tom\.android
2013-09-27 13:54 - 2013-01-02 02:54 - 00000000 ____D C:\Users\Tom
2013-09-27 13:54 - 2012-12-02 22:30 - 00002073 _____ C:\Users\Public\Desktop\MyPhoneExplorer.lnk
2013-09-27 13:54 - 2012-12-02 22:30 - 00000000 ____D C:\Program Files (x86)\MyPhoneExplorer
2013-09-26 11:27 - 2013-06-01 13:54 - 00000000 ____D C:\Users\Tom\Desktop\Calibre
2013-09-26 10:45 - 2012-09-09 20:42 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-26 10:35 - 2013-09-26 10:35 - 00000103 _____ C:\WINDOWS\ParrotFlashWiz.INI
2013-09-26 10:33 - 2013-09-26 10:33 - 00000000 ____D C:\Program Files (x86)\Parrot Software Update Tool
2013-09-25 17:58 - 2011-03-22 23:38 - 00000000 ____D C:\Users\Tom\AppData\Roaming\Foxit Software
2013-09-23 11:12 - 2013-09-23 11:12 - 1285878931 _____ C:\WINDOWS\MEMORY.DMP
2013-09-23 11:12 - 2013-01-12 07:48 - 00000000 ____D C:\WINDOWS\Minidump
2013-09-23 09:50 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\AUInstallAgent
2013-09-19 01:26 - 2013-01-10 23:02 - 00694232 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2013-09-19 01:26 - 2013-01-10 23:02 - 00078296 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-18 16:22 - 2013-06-05 11:18 - 00322048 ___SH C:\Users\Tom\Desktop\Thumbs.db
2013-09-18 16:22 - 2013-02-06 22:20 - 00000000 ____D C:\Users\Tom\Desktop\KabelBW
2013-09-15 15:57 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\rescache
2013-09-15 15:38 - 2013-02-23 11:24 - 00000586 _____ C:\Users\Public\Desktop\mkvmerge GUI.lnk
2013-09-15 13:07 - 2013-09-15 13:06 - 00531240 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2013-09-15 10:43 - 2013-09-15 10:43 - 00005630 _____ C:\WINDOWS\PFRO.log
2013-09-15 01:14 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\WinStore
2013-09-15 01:14 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\PolicyDefinitions
2013-09-15 00:05 - 2010-06-01 00:58 - 00000000 ____D C:\Users\Tom\AppData\Local\QuickPar
2013-09-14 17:15 - 2013-09-14 17:15 - 00000000 _____ C:\WINDOWS\setuperr.log
2013-09-14 11:57 - 2010-06-01 01:01 - 00018944 _____ C:\Users\Tom\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-09-14 03:02 - 2010-05-09 20:21 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-09-13 11:06 - 2013-08-19 11:05 - 00000000 ____D C:\WINDOWS\system32\MRT
2013-09-13 11:03 - 2009-10-14 07:12 - 79143768 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2013-09-13 09:58 - 2013-08-25 14:42 - 00000834 _____ C:\Users\Public\Desktop\CCleaner.lnk
2013-09-13 09:58 - 2013-08-25 14:42 - 00000000 ____D C:\Program Files\CCleaner
2013-09-13 09:28 - 2013-09-13 09:28 - 00274944 _____ C:\Users\Tom\AppData\lsass.exe
2013-09-13 09:05 - 2012-07-26 07:38 - 00000000 ____D C:\WINDOWS\system32\oobe
2013-09-12 22:38 - 2013-09-12 22:38 - 00001604 _____ C:\Users\Public\Desktop\Angry Birds Star Wars.lnk
2013-09-12 22:38 - 2013-07-05 12:47 - 00000000 ____D C:\Users\Tom\AppData\Roaming\Rovio Entertainment Ltd
2013-09-10 15:45 - 2013-05-04 21:34 - 00000000 ____D C:\Users\Tom\Documents\Settlers7
2013-09-09 10:36 - 2013-09-01 14:49 - 00000942 _____ C:\Users\Public\Desktop\calibre 64bit - E-book management.lnk
2013-09-09 10:36 - 2013-09-01 14:49 - 00000000 ____D C:\Program Files\Calibre2
2013-09-08 14:07 - 2013-08-25 14:40 - 00000000 ____D C:\Program Files (x86)\MyPC Backup
2013-09-02 16:17 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\system32\NDF
2013-09-01 18:42 - 2013-09-01 14:49 - 00000000 ____D C:\Users\Tom\AppData\Local\calibre-cache
2013-09-01 16:29 - 2013-09-01 16:29 - 00000000 ____D C:\WINDOWS\SysWOW64\fstrainer2011
2013-09-01 16:29 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\SysWOW64\Macromed
2013-09-01 16:29 - 2012-07-10 13:44 - 00000000 ____D C:\WINDOWS\SysWOW64\Adobe
2013-09-01 14:41 - 2013-02-17 20:48 - 00000000 ____D C:\Users\TomAdminPW_Ur\AppData\Roaming\SpeedProject
2013-08-30 16:11 - 2013-08-30 16:11 - 00000000 ____D C:\Users\TomAdminPW_Ur\AppData\Roaming\Apple Computer

Files to move or delete:
====================
C:\ProgramData\hpe5F3.dll


Some content of TEMP:
====================
C:\Users\Tom\AppData\Local\Temp\Checkupdate.exe
C:\Users\Tom\AppData\Local\Temp\cvtres.exe
C:\Users\Tom\AppData\Local\Temp\Foxit Reader Updater.exe
C:\Users\Tom\AppData\Local\Temp\gcapi_dll.dll
C:\Users\Tom\AppData\Local\Temp\gtapi_signed.dll


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== End Of Log ============================
Addition-file
Code:
ATTFilter
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.09.29.05

Windows 8 x64 NTFS
Internet Explorer 10.0.9200.16688
Tom_Admin :: TOM_ADMIN-PC [Administrator]

29.09.2013 16:50:10
MBAM-log-2013-09-29 (16-56-22).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: Heuristiks/Extra | P2P
Durchsuchte Objekte: 38762
Laufzeit: 5 Minute(n), 11 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 2
HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C} (PUP.Optional.OptimzerPro.A) -> Keine Aktion durchgeführt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WsysControl (Trojan.Staser) -> Keine Aktion durchgeführt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 4
C:\ProgramData\eSafe\eGdpSvc.exe (Trojan.Staser) -> Keine Aktion durchgeführt.
C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.exe (PUP.Optional.Tarma.A) -> Keine Aktion durchgeführt.
C:\ProgramData\Tarma Installer\{C4ED781C-7394-4906-AAFF-D6AB64FF7C38}\Setup.exe (PUP.Optional.Tarma.A) -> Keine Aktion durchgeführt.
C:\Users\Tom\AppData\Local\Temp\cvtres.exe (Riskware.Exit) -> Keine Aktion durchgeführt.

(Ende)
MBAM-Log:
Code:
ATTFilter
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.09.29.05

Windows 8 x64 NTFS
Internet Explorer 10.0.9200.16688
Tom_Admin :: TOM_ADMIN-PC [Administrator]

29.09.2013 16:50:10
MBAM-log-2013-09-29 (16-56-22).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: Heuristiks/Extra | P2P
Durchsuchte Objekte: 38762
Laufzeit: 5 Minute(n), 11 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 2
HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C} (PUP.Optional.OptimzerPro.A) -> Keine Aktion durchgeführt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WsysControl (Trojan.Staser) -> Keine Aktion durchgeführt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 4
C:\ProgramData\eSafe\eGdpSvc.exe (Trojan.Staser) -> Keine Aktion durchgeführt.
C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.exe (PUP.Optional.Tarma.A) -> Keine Aktion durchgeführt.
C:\ProgramData\Tarma Installer\{C4ED781C-7394-4906-AAFF-D6AB64FF7C38}\Setup.exe (PUP.Optional.Tarma.A) -> Keine Aktion durchgeführt.
C:\Users\Tom\AppData\Local\Temp\cvtres.exe (Riskware.Exit) -> Keine Aktion durchgeführt.

(Ende)

Alt 29.09.2013, 16:25   #2
aharonov
/// TB-Ausbilder
 
Windows 8, Infektion mit Win32/Fynloski.A? - Standard

Windows 8, Infektion mit Win32/Fynloski.A?


Hallo,

schauen wir mal:


Schritt 1

Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).



Schritt 2

Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.




Schritt 3

Starte noch einmal FRST.
  • Ändere keine der Voreinstellungen und drücke auf Scan.
  • Wenn der Scan abgeschlossen ist, werden ein neues Logfile FRST.txt erstellt und auf dem Desktop gespeichert.
  • Poste den Inhalt dieses Logfiles bitte hier in deinen Thread.



Bitte poste in deiner nächsten Antwort:
  • Log von Adwcleaner
  • Log von Combofix
  • Log von FRST
__________________

__________________
Alt 29.09.2013, 17:41   #3
Rupsi
 
Windows 8, Infektion mit Win32/Fynloski.A? - Standard

Windows 8, Infektion mit Win32/Fynloski.A?


So. Hier sind die Ergebnisse bislang:

AdwCleanerR0.txt:
Code:
ATTFilter
# AdwCleaner v3.005 - Bericht erstellt am 29/09/2013 um 17:36:22
# Updated 22/09/2013 von Xplode
# Betriebssystem : Windows 8 Pro  (64 bits)
# Benutzername : Tom_Admin - TOM_ADMIN-PC
# Gestartet von : L:\Download\adwcleaner.exe
# Option : Suchen

***** [ Dienste ] *****

Dienst Gefunden : BackupStack

***** [ Dateien / Ordner ] *****

Datei Gefunden : C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\icqplugin.xml
Datei Gefunden : C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\icqplugin-1.xml
Datei Gefunden : C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\icqplugin-2.xml
Datei Gefunden : C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\icqplugin-3.xml
Datei Gefunden : C:\Users\Tom_Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk
Datei Gefunden : C:\Users\Tom_Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m5mhonw7.default\user.js
Datei Gefunden : C:\Users\Tom_Admin\Desktop\MyPC Backup.lnk
Ordner Gefunden C:\Program Files (x86)\Common Files\337
Ordner Gefunden C:\Program Files (x86)\MyPC Backup
Ordner Gefunden C:\Program Files (x86)\MyPC Backup 
Ordner Gefunden C:\ProgramData\eSafe
Ordner Gefunden C:\ProgramData\Tarma Installer
Ordner Gefunden C:\Users\Tom\AppData\Local\PackageAware
Ordner Gefunden C:\Users\Tom_Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPC Backup
Ordner Gefunden C:\Users\Tom_Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPC Backup 
Ordner Gefunden C:\Users\TomAdminPW_Ur\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gefunden C:\Users\TomAdminPW_Ur\AppData\Roaming\WebCake

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gefunden : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\Lyrics_Monkey
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\secman.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{A0B10EBE-4E51-4CAE-949B-E6B9E7D68CEA}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{F511AFDB-726E-4458-90E7-1ECB97406544}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{FB684D26-01F4-4D9D-87CB-F486BEBA56DC}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Schlüssel Gefunden : HKLM\Software\Conduit
Schlüssel Gefunden : HKLM\Software\Desksvc
Schlüssel Gefunden : HKLM\Software\eSafeSecControl
Schlüssel Gefunden : HKLM\SOFTWARE\Google\Chrome\Extensions\abfmigjiaapipflmopkaaooigcjjdojh
Schlüssel Gefunden : HKLM\SOFTWARE\Google\Chrome\Extensions\fjoijdanhaiflhibkljeklcghcmmfffh
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WSysControl
Schlüssel Gefunden : HKLM\Software\PIP
Schlüssel Gefunden : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\DeskSvc
Schlüssel Gefunden : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WsysSvc
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\DomaIQ
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C4ED781C-7394-4906-AAFF-D6AB64FF7C38}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyPC Backup
Wert Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Wert Gefunden : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{ACAA314B-EEBA-48E4-AD47-84E31C44796C}]
Wert Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]

***** [ Browser ] *****

-\\ Internet Explorer v10.0.9200.16688
AdwCleanerS0.txt
Code:
ATTFilter
# AdwCleaner v3.005 - Bericht erstellt am 29/09/2013 um 17:43:01
# Updated 22/09/2013 von Xplode
# Betriebssystem : Windows 8 Pro  (64 bits)
# Benutzername : Tom_Admin - TOM_ADMIN-PC
# Gestartet von : L:\Download\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****

Dienst Gelöscht : BackupStack

***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\eSafe
Ordner Gelöscht : C:\ProgramData\Tarma Installer
[!] Ordner Gelöscht : C:\Program Files (x86)\MyPC Backup 
[!] Ordner Gelöscht : C:\Program Files (x86)\MyPC Backup
Ordner Gelöscht : C:\Program Files (x86)\Common Files\337
Ordner Gelöscht : C:\Users\Tom_Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPC Backup 
Ordner Gelöscht : C:\Users\Tom\AppData\Local\PackageAware
Ordner Gelöscht : C:\Users\TomAdminPW_Ur\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\TomAdminPW_Ur\AppData\Roaming\WebCake
Datei Gelöscht : C:\Users\Tom_Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk
Datei Gelöscht : C:\Users\Tom_Admin\Desktop\MyPC Backup.lnk
Datei Gelöscht : C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\icqplugin.xml
Datei Gelöscht : C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\icqplugin-1.xml
Datei Gelöscht : C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\icqplugin-2.xml
Datei Gelöscht : C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\icqplugin-3.xml
Datei Gelöscht : C:\Users\Tom_Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m5mhonw7.default\user.js

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{ACAA314B-EEBA-48E4-AD47-84E31C44796C}]
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\abfmigjiaapipflmopkaaooigcjjdojh
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\fjoijdanhaiflhibkljeklcghcmmfffh
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\secman.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASMANCS
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\DeskSvc
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WsysSvc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A0B10EBE-4E51-4CAE-949B-E6B9E7D68CEA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F511AFDB-726E-4458-90E7-1ECB97406544}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FB684D26-01F4-4D9D-87CB-F486BEBA56DC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Wert Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Schlüssel Gelöscht : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Lyrics_Monkey
Schlüssel Gelöscht : HKLM\Software\Conduit
Schlüssel Gelöscht : HKLM\Software\Desksvc
Schlüssel Gelöscht : HKLM\Software\eSafeSecControl
Schlüssel Gelöscht : HKLM\Software\PIP
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WSysControl
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\DomaIQ
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C4ED781C-7394-4906-AAFF-D6AB64FF7C38}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyPC Backup

***** [ Browser ] *****

-\\ Internet Explorer v10.0.9200.16688

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Search [Default_Search_URL]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Search [SearchAssistant]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\SearchUrl [Default]

-\\ Mozilla Firefox v23.0.1 (de)

[ Datei : C:\Users\Tom_Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m5mhonw7.default\prefs.js ]


[ Datei : C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\prefs.js ]

Zeile gelöscht : user_pref("icqtoolbar.allowSendURL", false);
Zeile gelöscht : user_pref("icqtoolbar.engineVerified", false);
Zeile gelöscht : user_pref("icqtoolbar.hiddenElements", "itb_options");
Zeile gelöscht : user_pref("icqtoolbar.history", "dofus%20kimbo||gamescon||dofus%20minotoror||falk||dofus%20%22hysterical%20judge%22||dofus%20%22hysterischer%20Richter%22||%22Navigon%208110%22||test%20navigationsger%C[...]
Zeile gelöscht : user_pref("icqtoolbar.numberOfSearches", 0);
Zeile gelöscht : user_pref("icqtoolbar.previousFFVersion", "3.0.11");
Zeile gelöscht : user_pref("icqtoolbar.skip_default_search", "no");
Zeile gelöscht : user_pref("icqtoolbar.suggestions", false);
Zeile gelöscht : user_pref("icqtoolbar.uninstStatSent", true);
Zeile gelöscht : user_pref("icqtoolbar.uniqueID", "123645397012364545701236477613276");
Zeile gelöscht : user_pref("icqtoolbar.usageStatstTimestamp", 1247346703);
Zeile gelöscht : user_pref("icqtoolbar.xmlEnableSuggestions", false);
Zeile gelöscht : user_pref("icqtoolbar.xmlLanguage", "de");

[ Datei : C:\Users\Max\AppData\Roaming\Mozilla\Firefox\Profiles\7v8f41d4.default\prefs.js ]


*************************

AdwCleaner[R0].txt - [7838 octets] - [29/09/2013 17:36:22]
AdwCleaner[S0].txt - [7028 octets] - [29/09/2013 17:43:01]

########## EOF - \AdwCleaner\AdwCleaner[S0].txt - [7088 octets] ##########
FRST.txt

FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-09-2013 02
Ran by Tom (ATTENTION: The logged in user is not administrator) on TOM_ADMIN-PC on 29-09-2013 18:35:18
Running from C:\Users\Tom\Desktop\Trojan
Windows 8 Pro (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Hewlett-Packard Company) C:\Program Files (x86)\HP\HP Color LaserJet CM2320 MFP Series\hppfaxprintersrv.exe
(Samsung) C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
(InstallShield Software Corporation) C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe
(Hewlett-Packard Company) C:\Program Files (x86)\HP\HP UT\bin\hppusg.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
(Microsoft Corporation) C:\WINDOWS\SysWOW64\notepad.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13196432 2012-09-25] (Realtek Semiconductor)
HKLM\...\Run: [HP Color LaserJet CM2320 MFP Series Fax] - C:\Program Files (x86)\HP\HP Color LaserJet CM2320 MFP Series\hppfaxprintersrv.exe [3700736 2009-09-22] (Hewlett-Packard Company)
HKLM\...\Run: [combofix] - C:\ComboFix\CF31833.3XE /c C:\ComboFix\Combobatch.bat
HKLM\...\RunOnce: [*WerKernelReporting] - %SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq [439488 2013-07-09] (Microsoft Corporation)
HKLM\...\Runonce: [combofix] - C:\ComboFix\CF31833.3XE /c C:\ComboFixCombobatch.bat
HKLM\...\runonceex: [flags] - 8
HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware ] - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation)
HKCU\...\Run: [Java Updater] - C:\Users\Tom\AppData\lsass.exe [274944 2013-09-13] ()
HKCU\...\Run: [] - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844656 2013-09-04] (Samsung)
HKLM-x32\...\Run: [BCSSync] - C:\Program Files (x86)\Microsoft Office2010\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
HKLM-x32\...\Run: [EaseUS EPM tray] - C:\Program Files (x86)\EaseUS\EaseUS Partition Master 9.2.1 Home Edition\bin\EpmNews.exe [2086984 2012-11-29] (CHENGDU YIWO Tech Development Co., Ltd)
HKLM-x32\...\Run: [ISUSScheduler] - C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe [81920 2005-02-16] (InstallShield Software Corporation)
HKLM-x32\...\Run: [JMB36X IDE Setup] - C:\Windows\RaidTool\xInsIDE.exe [36864 2007-03-20] ()
HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [163000 2012-12-12] (Geek Software GmbH)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [HPUsageTracking] - C:\Program Files (x86)\HP\HP UT\bin\hppusg.exe [24576 2009-05-11] (Hewlett-Packard Company)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [Live Update 5] - C:\Program Files (x86)\MSI\Live Update 5\BootStartLiveupdate.exe [315392 2012-01-30] ()
HKLM-x32\...\Run: [KiesTrayAgent] - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311152 2013-09-04] (Samsung Electronics Co., Ltd.)
AppInit_DLLs:         [0 ] ()
Startup: C:\Users\Tom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office2010\Office14\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.metager.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x6EEDBAB406CCCD01
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snap.do/?publisher=SnapdoEMon&dpid=SnapdoEMon&co=DE&userid=dc45f073-fe67-455e-a3b8-5331ef50cad9&searchtype=ds&q={searchTerms}
SearchScopes: HKCU - {3BD44F0E-0596-4008-AEE0-45D47E3A8F0E} URL = 
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office2010\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office2010\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: No Name - {DBC80044-A445-435b-BC74-9C25C1C588A9} -  No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 0.0.0.0

FireFox:
========
FF ProfilePath: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default
FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\WINDOWS\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf - f:\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf - f:\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - e:\Picasa3\npPicasa3.dll No File
FF Plugin-x32: @java.com/DTPlugin,version=1.6.0_35 - C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MI4066~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MI4066~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @real.com/nppl3260;version=15.0.4.53 - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprjplug;version=15.0.4.53 - c:\program files (x86)\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpchromebrowserrecordext;version=15.0.4.53 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprphtml5videoshim;version=15.0.4.53 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=15.0.4.53 - c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Tom\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF SearchPlugin: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\betabinariesnl.xml
FF SearchPlugin: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\eurobuchcom.xml
FF SearchPlugin: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\ixquick-http---deutsch.xml
FF SearchPlugin: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\mein-metager.xml
FF SearchPlugin: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\searchplugins-backup
FF SearchPlugin: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\startpage-https---deutsch.xml
FF Extension: Deutsches Wörterbuch - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\de-DE@dictionaries.addons.mozilla.org
FF Extension: Garmin Communicator - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
FF Extension: Microsoft .NET Framework Assistant - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF Extension: EPUBReader - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\{5384767E-00D9-40E9-B72F-9CC39D655D6F}
FF Extension: No Name - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\{c36177c0-224a-11da-8cd6-0800200c9a66}
FF Extension: Bitdefender QuickScan - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
FF Extension: admin - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\admin@proxy-listen.de.xpi
FF Extension: No Name - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\Extensions.rdf
FF Extension: No Name - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\installed-extensions.txt
FF Extension: optout - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\optout@google.com.xpi
FF Extension: youtubeunblocker - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\youtubeunblocker@unblocker.yt.xpi
FF HKLM-x32\...\Firefox\Extensions: [{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF Extension: RealPlayer Browser Record Plugin - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Firefox\firefox.exe

Chrome: 
=======
CHR HomePage: hxxp://www.google.com/
CHR DefaultSearchURL: (Google) - {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Tom\AppData\Local\Google\Chrome\Application\10.0.648.204\pdf.dll No File
CHR Plugin: (Google Gears 0.5.33.0) - C:\Users\Tom\AppData\Local\Google\Chrome\Application\10.0.648.204\gears.dll No File
CHR Plugin: (Shockwave Flash) - C:\Users\Tom\AppData\Local\Google\Chrome\Application\10.0.648.204\gcswf32.dll No File
CHR Plugin: (Foxit Reader Plugin for Mozilla) - C:\Program Files (x86)\Firefox\plugins\npFoxitReaderPlugin.dll (Foxit Software Company)
CHR Plugin: (2007 Microsoft Office system) - C:\Program Files (x86)\Firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (Google Update) - C:\Users\Tom\AppData\Local\Google\Update\1.2.183.39\npGoogleOneClick8.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Default Plug-in) - default_plugin No File
CHR HKLM-x32\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Ext\rphtml5video.crx
CHR HKLM-x32\...\Chrome\Extension: [ofnnlhbgdcabppjmlijllkhekcglbjlg] - C:\Program Files (x86)\Lyrics_Monkey\128.crx

==================== Services (Whitelisted) =================

R2 Garmin Core Update Service; C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [185688 2013-03-27] (Garmin Ltd or its subsidiaries)
R2 HPSLPSVC; C:\Users\Tom\AppData\Local\Temp\7zS3579\hpslpsvc64.dll [1039360 2012-11-14] (Hewlett-Packard Co.)
R2 lmhosts; C:\Windows\system32\svchost.exe [29696 2012-09-20] (Microsoft Corporation)
S3 Microsoft SharePoint Workspace Audit Service; C:\Program Files (x86)\Microsoft Office2010\Office14\GROOVE.EXE [30785672 2012-09-20] (Microsoft Corporation)
R2 MSMQ; C:\Windows\system32\mqsvc.exe [25088 2012-07-26] (Microsoft Corporation)
R2 NlaSvc; C:\Windows\System32\svchost.exe [29696 2012-09-20] (Microsoft Corporation)
R2 nsi; C:\Windows\system32\svchost.exe [29696 2012-09-20] (Microsoft Corporation)
R2 PMBDeviceInfoProvider; C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe [474168 2012-04-22] (Sony Corporation)
S2 SynoDrService; C:\Program Files (x86)\Synology Data Replicator  3\SynoDrServicex64.exe [380928 2010-06-02] ()
R2 TVGOnlineUpdateSvc; C:\Program Files (x86)\TVG\OnlineUpdate\OnlineUpdateSvc.exe [398128 2010-12-14] ()
R2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [471552 2012-07-26] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

S3 androidusb; C:\Windows\System32\Drivers\androidusb.sys [32768 2010-04-29] (Google Inc)
S3 DigiartyVirtualCDBus; C:\Windows\System32\drivers\DigiartyVirtualCDBus.sys [276256 2013-08-28] (Digiarty Software, Inc.)
R2 easycvfs; C:\WINDOWS\system32\drivers\easycvfs.sys [109960 2009-11-09] ()
S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [17480 2012-12-21] ()
S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [17480 2012-12-21] ()
S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9800 2012-12-21] ()
S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9800 2012-12-21] ()
R1 HWiNFO32; C:\Program Files (x86)\HWiNFO32\HWiNFO64A.SYS [29288 2009-05-21] (REALiX(tm))
R1 HWiNFO32; C:\Program Files (x86)\HWiNFO32\HWiNFO64A.SYS [29288 2009-05-21] (REALiX(tm))
R3 MQAC; C:\Windows\System32\drivers\mqac.sys [185856 2012-07-26] (Microsoft Corporation)
S1 NNSNAHSL; C:\Windows\System32\DRIVERS\NNSNAHSL.sys [33320 2012-10-22] (Panda Security, S.L.)
S3 NTIOLib_1_0_4; C:\Program Files (x86)\MSI\Live Update 5\NTIOLib_X64.sys [14136 2010-10-22] (MSI)
S3 NTIOLib_1_0_4; C:\Program Files (x86)\MSI\Live Update 5\NTIOLib_X64.sys [14136 2010-10-22] (MSI)
S3 NTIOLib_1_0_6; C:\Program Files (x86)\Setup Files\Ms7586v1B0\NTIOLib_X64.sys [11888 2011-01-06] (MSI)
S3 NTIOLib_1_0_6; C:\Program Files (x86)\Setup Files\Ms7586v1B0\NTIOLib_X64.sys [11888 2011-01-06] (MSI)
R3 seehcri; C:\Windows\System32\drivers\seehcri.sys [34032 2008-01-09] (Sony Ericsson Mobile Communications)
R3 SKYNET; C:\Windows\system32\DRIVERS\SkyNET_AMD64.SYS [615440 2009-09-11] (TechniSat Digital, S.A.)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [828912 2011-08-16] (Duplex Secure Ltd.)
S3 vvftav; C:\Windows\System32\drivers\vvftav.sys [300800 2007-02-02] (Vimicro Corporation)
S3 ZSMC0305; C:\Windows\System32\Drivers\usbVM305.sys [1541120 2007-03-08] (Vimicro Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
U3 idsvc; 
S3 MSI_MSIBIOS_010507; \??\C:\Program Files (x86)\MSI\Live Update 5\msibios64_100507.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-29 17:53 - 2013-09-29 18:01 - 00000000 ___SD C:\ComboFix
2013-09-29 17:49 - 2013-09-29 17:49 - 00000000 ____D C:\Users\Tom\Desktop\Trojan
2013-09-29 16:47 - 2013-09-29 16:47 - 00001125 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-29 16:47 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2013-09-29 14:13 - 2013-09-29 14:47 - 00000000 ____D C:\WINDOWS\erdnt
2013-09-29 14:13 - 2013-09-29 14:13 - 00000000 ____D C:\Qoobox
2013-09-29 14:13 - 2011-06-26 08:45 - 00256000 _____ C:\WINDOWS\PEV.exe
2013-09-29 14:13 - 2010-11-07 19:20 - 00208896 _____ C:\WINDOWS\MBR.exe
2013-09-29 14:13 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\WINDOWS\NIRCMD.exe
2013-09-29 14:13 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\WINDOWS\SWREG.exe
2013-09-29 14:13 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\WINDOWS\SWSC.exe
2013-09-29 14:13 - 2000-08-31 02:00 - 00212480 _____ (SteelWerX) C:\WINDOWS\SWXCACLS.exe
2013-09-29 14:13 - 2000-08-31 02:00 - 00098816 _____ C:\WINDOWS\sed.exe
2013-09-29 14:13 - 2000-08-31 02:00 - 00080412 _____ C:\WINDOWS\grep.exe
2013-09-29 14:13 - 2000-08-31 02:00 - 00068096 _____ C:\WINDOWS\zip.exe
2013-09-29 14:07 - 2013-09-29 14:07 - 05130789 ____R (Swearware) C:\Users\Tom\Desktop\ComboFix.exe
2013-09-29 14:01 - 2013-09-29 14:01 - 00000000 ____D C:\FRST
2013-09-27 14:21 - 2013-09-27 14:21 - 00000000 ____D C:\Users\Tom\Documents\SelfMV
2013-09-27 14:10 - 2013-09-27 14:10 - 00002018 _____ C:\Users\Public\Desktop\Samsung Kies (Lite).lnk
2013-09-27 14:10 - 2013-09-27 14:10 - 00002008 _____ C:\Users\Public\Desktop\Samsung Kies.lnk
2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\WINDOWS\LastGood.Tmp
2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Tom\Documents\samsung
2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Tom\AppData\Roaming\Samsung
2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Tom\AppData\Local\Samsung
2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Public\Documents\NativeFus_Log
2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Public\Documents\CrashDump
2013-09-27 14:08 - 2013-09-27 14:08 - 00000000 ____D C:\Program Files (x86)\MyFree Codec
2013-09-27 14:05 - 2013-09-27 14:09 - 00000000 ____D C:\ProgramData\Samsung
2013-09-27 14:05 - 2013-09-27 14:09 - 00000000 ____D C:\Program Files (x86)\Samsung
2013-09-27 14:05 - 2013-07-18 14:33 - 04659712 _____ (Dmitry Streblechenko) C:\WINDOWS\SysWOW64\Redemption.dll
2013-09-27 14:05 - 2013-07-18 14:32 - 00821824 _____ (Devguru Co., Ltd.) C:\WINDOWS\SysWOW64\dgderapi.dll
2013-09-27 13:59 - 2013-09-27 13:59 - 00001059 _____ C:\Users\Public\Desktop\DriverTuner.lnk
2013-09-27 13:59 - 2013-09-27 13:59 - 00000000 ____D C:\Program Files (x86)\DriverTuner
2013-09-27 13:54 - 2013-09-27 13:54 - 00000000 ____D C:\Users\Tom\.android
2013-09-26 10:35 - 2013-09-26 10:35 - 00000103 _____ C:\WINDOWS\ParrotFlashWiz.INI
2013-09-26 10:33 - 2013-09-26 10:33 - 00000000 ____D C:\Program Files (x86)\Parrot Software Update Tool
2013-09-23 11:12 - 2013-09-23 11:12 - 1285878931 _____ C:\WINDOWS\MEMORY.DMP
2013-09-16 20:47 - 2013-08-07 07:15 - 00144896 _____ (Microsoft Corporation) C:\WINDOWS\system32\tssdisai.dll
2013-09-15 13:06 - 2013-09-15 13:07 - 00531240 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2013-09-15 10:43 - 2013-09-29 18:30 - 00008026 _____ C:\WINDOWS\PFRO.log
2013-09-14 17:15 - 2013-09-29 18:30 - 00213135 _____ C:\WINDOWS\setupact.log
2013-09-14 17:15 - 2013-09-14 17:15 - 00000000 _____ C:\WINDOWS\setuperr.log
2013-09-13 10:57 - 2013-09-29 15:30 - 01972589 _____ C:\WINDOWS\WindowsUpdate.log
2013-09-13 09:28 - 2013-09-13 09:28 - 00274944 _____ C:\Users\Tom\AppData\lsass.exe
2013-09-13 09:24 - 2013-08-16 07:41 - 00058200 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dam.sys
2013-09-13 09:24 - 2013-08-16 07:39 - 02371728 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSService.dll
2013-09-13 09:24 - 2013-08-16 07:39 - 00059416 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2013-09-13 09:24 - 2013-08-16 07:32 - 00209200 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationUI.exe
2013-09-13 09:24 - 2013-08-16 07:22 - 04917760 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppsvc.exe
2013-09-13 09:24 - 2013-08-16 07:22 - 00040448 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe
2013-09-13 09:24 - 2013-08-16 07:21 - 03275776 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2013-09-13 09:24 - 2013-08-16 07:21 - 01621504 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll
2013-09-13 09:24 - 2013-08-16 07:21 - 01164288 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll
2013-09-13 09:24 - 2013-08-16 07:21 - 00773120 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2013-09-13 09:24 - 2013-08-16 07:21 - 00688640 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll
2013-09-13 09:24 - 2013-08-16 07:21 - 00368640 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppwinob.dll
2013-09-13 09:24 - 2013-08-16 07:21 - 00252416 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll
2013-09-13 09:24 - 2013-08-16 07:21 - 00204800 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSClient.dll
2013-09-13 09:24 - 2013-08-16 07:21 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll
2013-09-13 09:24 - 2013-08-16 07:21 - 00183808 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSSync.dll
2013-09-13 09:24 - 2013-08-16 07:21 - 00174592 _____ (Microsoft Corporation) C:\WINDOWS\system32\storewuauth.dll
2013-09-13 09:24 - 2013-08-16 07:21 - 00163840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2013-09-13 09:24 - 2013-08-16 07:21 - 00142848 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll
2013-09-13 09:24 - 2013-08-16 07:21 - 00120320 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppc.dll
2013-09-13 09:24 - 2013-08-16 07:21 - 00099328 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll
2013-09-13 09:24 - 2013-08-16 07:21 - 00081408 _____ (Microsoft Corporation) C:\WINDOWS\system32\setupcln.dll
2013-09-13 09:24 - 2013-08-16 07:21 - 00049664 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups.dll
2013-09-13 09:24 - 2013-08-16 07:21 - 00049152 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups2.dll
2013-09-13 09:24 - 2013-08-16 07:20 - 00105984 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinSetupUI.dll
2013-09-13 09:24 - 2013-08-16 00:43 - 00628736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2013-09-13 09:24 - 2013-08-16 00:43 - 00562688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll
2013-09-13 09:24 - 2013-08-16 00:43 - 00167424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSClient.dll
2013-09-13 09:24 - 2013-08-16 00:43 - 00159232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSSync.dll
2013-09-13 09:24 - 2013-08-16 00:43 - 00143872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.dll
2013-09-13 09:24 - 2013-08-16 00:43 - 00126976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll
2013-09-13 09:24 - 2013-08-16 00:43 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2013-09-13 09:24 - 2013-08-16 00:43 - 00084992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll
2013-09-13 09:24 - 2013-08-16 00:43 - 00083968 _____ C:\WINDOWS\SysWOW64\OEMLicense.dll
2013-09-13 09:24 - 2013-08-16 00:43 - 00035328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe
2013-09-13 09:24 - 2013-08-16 00:43 - 00020992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wups.dll
2013-09-13 09:24 - 2013-08-16 00:42 - 00091648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sppc.dll
2013-09-13 09:24 - 2013-08-16 00:42 - 00076800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\setupcln.dll
2013-09-13 09:23 - 2013-08-21 06:12 - 02241024 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2013-09-13 09:23 - 2013-08-21 06:12 - 00051712 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2013-09-13 09:23 - 2013-08-21 06:11 - 19246592 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2013-09-13 09:23 - 2013-08-21 06:11 - 15404544 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2013-09-13 09:23 - 2013-08-21 06:11 - 03959296 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2013-09-13 09:23 - 2013-08-21 06:11 - 02647040 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2013-09-13 09:23 - 2013-08-21 06:11 - 01365504 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2013-09-13 09:23 - 2013-08-21 06:11 - 00915968 _____ (Microsoft Corporation) C:\WINDOWS\system32\uxtheme.dll
2013-09-13 09:23 - 2013-08-21 06:11 - 00855552 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2013-09-13 09:23 - 2013-08-21 06:11 - 00603136 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2013-09-13 09:23 - 2013-08-21 06:11 - 00136704 _____ (Microsoft Corporation) C:\WINDOWS\system32\iesysprep.dll
2013-09-13 09:23 - 2013-08-21 06:11 - 00067072 _____ (Microsoft Corporation) C:\WINDOWS\system32\iesetup.dll
2013-09-13 09:23 - 2013-08-21 06:11 - 00053760 _____ (Microsoft Corporation) C:\WINDOWS\system32\UXInit.dll
2013-09-13 09:23 - 2013-08-21 06:11 - 00053760 _____ (Microsoft Corporation) C:\WINDOWS\system32\jsproxy.dll
2013-09-13 09:23 - 2013-08-21 06:11 - 00039936 _____ (Microsoft Corporation) C:\WINDOWS\system32\iernonce.dll
2013-09-13 09:23 - 2013-08-21 04:34 - 02706432 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.tlb
2013-09-13 09:23 - 2013-08-21 04:06 - 01767936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2013-09-13 09:23 - 2013-08-21 04:06 - 01141248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2013-09-13 09:23 - 2013-08-21 04:06 - 00044032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UXInit.dll
2013-09-13 09:23 - 2013-08-21 04:05 - 14332928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2013-09-13 09:23 - 2013-08-21 04:05 - 13761024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2013-09-13 09:23 - 2013-08-21 04:05 - 02876928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2013-09-13 09:23 - 2013-08-21 04:05 - 02048000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2013-09-13 09:23 - 2013-08-21 04:05 - 00690688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2013-09-13 09:23 - 2013-08-21 04:05 - 00493056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2013-09-13 09:23 - 2013-08-21 04:05 - 00109056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iesysprep.dll
2013-09-13 09:23 - 2013-08-21 04:05 - 00061440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iesetup.dll
2013-09-13 09:23 - 2013-08-21 04:05 - 00039936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jsproxy.dll
2013-09-13 09:23 - 2013-08-21 04:05 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iernonce.dll
2013-09-13 09:23 - 2013-08-21 03:43 - 02706432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.tlb
2013-09-13 09:23 - 2013-08-21 01:52 - 00534528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\uxtheme.dll
2013-09-13 09:23 - 2013-08-03 06:30 - 04038144 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2013-09-12 22:38 - 2013-09-12 22:38 - 00001604 _____ C:\Users\Public\Desktop\Angry Birds Star Wars.lnk
2013-09-11 21:10 - 2013-07-09 10:04 - 00120144 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\msgpioclx.sys
2013-09-11 21:10 - 2013-07-09 08:18 - 00439488 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe
2013-09-11 21:10 - 2013-07-09 06:25 - 00385768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe
2013-09-11 21:10 - 2013-07-09 00:46 - 00414208 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanconn.dll
2013-09-11 21:10 - 2013-07-09 00:46 - 00370688 _____ (Microsoft Corporation) C:\WINDOWS\system32\Wwanadvui.dll
2013-09-11 21:10 - 2013-07-06 02:16 - 01025024 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll
2013-09-11 21:10 - 2013-07-03 02:23 - 00778752 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleaut32.dll
2013-09-11 21:10 - 2013-07-03 02:22 - 02839552 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll
2013-09-11 21:10 - 2013-07-03 02:22 - 01300480 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32.dll
2013-09-11 21:10 - 2013-07-03 02:11 - 00551424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleaut32.dll
2013-09-11 21:10 - 2013-07-03 02:11 - 00268800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.BackgroundTransfer.dll
2013-09-11 21:10 - 2013-07-03 02:10 - 02273792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll
2013-09-11 21:10 - 2013-06-29 08:15 - 00195416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys
2013-09-11 21:10 - 2013-06-29 08:15 - 00125784 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpsd.sys
2013-09-11 21:10 - 2013-06-29 07:43 - 00327512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Classpnp.sys
2013-09-11 21:10 - 2013-06-25 00:54 - 00447488 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll
2013-09-11 21:10 - 2013-06-25 00:54 - 00263680 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmsvc.dll
2013-09-11 21:10 - 2013-06-25 00:54 - 00074240 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmcsp.dll
2013-09-11 21:10 - 2013-06-19 07:36 - 00183808 _____ (Microsoft Corporation) C:\WINDOWS\system32\winmmbase.dll
2013-09-11 21:10 - 2013-06-19 07:36 - 00115712 _____ (Microsoft Corporation) C:\WINDOWS\system32\winmm.dll
2013-09-11 21:10 - 2013-06-19 00:38 - 00160256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmmbase.dll
2013-09-11 21:10 - 2013-06-19 00:38 - 00125440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmm.dll
2013-09-11 21:10 - 2013-06-12 01:26 - 00230912 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinSCard.dll
2013-09-11 21:10 - 2013-06-10 23:17 - 00096512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wfplwfs.sys
2013-09-11 21:10 - 2013-06-10 21:15 - 01156096 _____ (Microsoft Corporation) C:\WINDOWS\system32\IKEEXT.DLL
2013-09-11 21:10 - 2013-06-10 21:15 - 00723968 _____ (Microsoft Corporation) C:\WINDOWS\system32\BFE.DLL
2013-09-11 21:10 - 2013-06-10 21:15 - 00381952 _____ (Microsoft Corporation) C:\WINDOWS\system32\FWPUCLNT.DLL
2013-09-11 21:10 - 2013-06-06 10:03 - 00119040 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBSTOR.SYS
2013-09-11 21:09 - 2013-07-09 05:57 - 00245760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LocationApi.dll
2013-09-11 21:09 - 2013-07-09 00:46 - 00543744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanmm.dll
2013-09-11 21:09 - 2013-07-09 00:45 - 00312832 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationApi.dll
2013-09-11 21:09 - 2013-07-03 02:23 - 00391168 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.BackgroundTransfer.dll
2013-09-11 21:09 - 2013-07-02 00:08 - 00387583 _____ C:\WINDOWS\system32\ApnDatabase.xml
2013-09-11 21:09 - 2013-07-01 00:30 - 00067072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\openfiles.exe
2013-09-11 21:09 - 2013-07-01 00:29 - 00077312 _____ (Microsoft Corporation) C:\WINDOWS\system32\openfiles.exe
2013-09-11 21:09 - 2013-06-29 03:12 - 01022464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32.dll
2013-09-11 21:09 - 2013-06-26 05:01 - 00321536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\udfs.sys
2013-09-11 21:09 - 2013-06-12 01:43 - 00154112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinSCard.dll
2013-09-11 21:09 - 2013-06-10 21:16 - 00888832 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshwfp.dll
2013-09-11 21:09 - 2013-06-10 21:10 - 00702464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nshwfp.dll
2013-09-11 21:09 - 2013-06-10 21:10 - 00245248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FWPUCLNT.DLL
2013-09-11 21:09 - 2013-04-03 01:37 - 00025088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cryptdlg.dll
2013-09-11 21:09 - 2013-04-03 01:12 - 00030720 _____ (Microsoft Corporation) C:\WINDOWS\system32\cryptdlg.dll
2013-09-11 21:09 - 2013-03-22 05:49 - 02382336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\esent.dll
2013-09-11 21:09 - 2013-03-22 00:47 - 02851840 _____ (Microsoft Corporation) C:\WINDOWS\system32\esent.dll
2013-09-11 21:09 - 2013-03-02 10:23 - 00375808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ReAgent.dll
2013-09-11 21:09 - 2013-03-02 04:44 - 01011200 _____ (Microsoft Corporation) C:\WINDOWS\system32\reseteng.dll
2013-09-11 21:09 - 2012-12-15 06:55 - 00443392 _____ (Microsoft Corporation) C:\WINDOWS\system32\ReAgent.dll
2013-09-11 21:09 - 2012-11-03 07:26 - 00132096 _____ (Microsoft Corporation) C:\WINDOWS\system32\sysreset.exe
2013-09-11 21:09 - 2012-11-03 07:25 - 00945152 _____ (Microsoft Corporation) C:\WINDOWS\system32\resetengmig.dll
2013-09-11 21:09 - 2012-10-24 05:25 - 00026624 _____ (Microsoft Corporation) C:\WINDOWS\system32\ReAgentc.exe
2013-09-11 21:09 - 2012-10-24 05:25 - 00013312 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcalua.exe
2013-09-11 21:09 - 2012-10-24 05:24 - 00405504 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcasvc.dll
2013-09-11 21:09 - 2012-10-24 05:24 - 00031232 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcadm.dll
2013-09-11 21:09 - 2012-10-24 05:05 - 00011776 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcaevts.dll
2013-09-11 21:09 - 2012-10-24 04:48 - 00024064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ReAgentc.exe
2013-09-09 10:23 - 2013-06-09 21:59 - 00216064 _____ C:\WINDOWS\SysWOW64\gcapi_dll.dll
2013-09-01 16:29 - 2013-09-01 16:29 - 00000000 ____D C:\WINDOWS\SysWOW64\fstrainer2011
2013-09-01 16:29 - 2008-01-03 19:19 - 00581632 _____ (Adobe Systems, Inc.) C:\WINDOWS\SysWOW64\Control.dll
2013-09-01 16:29 - 2004-12-07 10:09 - 00347136 _____ C:\WINDOWS\SysWOW64\unicows.pdb
2013-09-01 16:29 - 2004-08-04 07:21 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msado27.tlb
2013-09-01 16:29 - 2004-03-08 21:00 - 00152848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comdlg32.ocx
2013-09-01 14:49 - 2013-09-09 10:36 - 00000942 _____ C:\Users\Public\Desktop\calibre 64bit - E-book management.lnk
2013-09-01 14:49 - 2013-09-09 10:36 - 00000000 ____D C:\Program Files\Calibre2
2013-09-01 14:49 - 2013-09-01 18:42 - 00000000 ____D C:\Users\Tom\AppData\Local\calibre-cache
2013-08-30 16:11 - 2013-08-30 16:11 - 00000000 ____D C:\Users\TomAdminPW_Ur\AppData\Roaming\Apple Computer

==================== One Month Modified Files and Folders =======

2013-09-29 18:33 - 2009-07-14 04:34 - 00001106 _____ C:\WINDOWS\win.ini
2013-09-29 18:30 - 2013-09-15 10:43 - 00008026 _____ C:\WINDOWS\PFRO.log
2013-09-29 18:30 - 2013-09-14 17:15 - 00213135 _____ C:\WINDOWS\setupact.log
2013-09-29 18:30 - 2013-01-02 02:50 - 00000000 ____D C:\ProgramData\NVIDIA
2013-09-29 18:30 - 2012-07-26 09:22 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2013-09-29 18:23 - 2012-08-15 10:55 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2013-09-29 18:01 - 2013-09-29 17:53 - 00000000 ___SD C:\ComboFix
2013-09-29 18:00 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\system32\sru
2013-09-29 17:50 - 2012-07-26 12:27 - 00863478 _____ C:\WINDOWS\system32\perfh007.dat
2013-09-29 17:50 - 2012-07-26 12:27 - 00197036 _____ C:\WINDOWS\system32\perfc007.dat
2013-09-29 17:50 - 2012-07-26 09:28 - 02029610 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2013-09-29 17:49 - 2013-09-29 17:49 - 00000000 ____D C:\Users\Tom\Desktop\Trojan
2013-09-29 17:44 - 2013-08-25 14:40 - 00000000 ____D C:\Program Files (x86)\MyPC Backup
2013-09-29 17:35 - 2013-06-01 13:54 - 00000000 ____D C:\Users\Tom\Desktop\Calibre
2013-09-29 16:47 - 2013-09-29 16:47 - 00001125 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-29 16:47 - 2012-09-09 20:42 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-29 16:16 - 2013-01-02 02:54 - 00000000 ____D C:\Users\Tom_Admin
2013-09-29 15:30 - 2013-09-13 10:57 - 01972589 _____ C:\WINDOWS\WindowsUpdate.log
2013-09-29 14:47 - 2013-09-29 14:13 - 00000000 ____D C:\WINDOWS\erdnt
2013-09-29 14:13 - 2013-09-29 14:13 - 00000000 ____D C:\Qoobox
2013-09-29 14:07 - 2013-09-29 14:07 - 05130789 ____R (Swearware) C:\Users\Tom\Desktop\ComboFix.exe
2013-09-29 14:01 - 2013-09-29 14:01 - 00000000 ____D C:\FRST
2013-09-27 17:54 - 2013-02-26 22:16 - 00000000 ____D C:\Users\Tom\AppData\Roaming\Simple Sudoku
2013-09-27 17:20 - 2013-03-18 16:32 - 00013213 _____ C:\Users\Tom\Desktop\Wasserverbrauch.xlsx
2013-09-27 17:10 - 2013-03-18 16:19 - 00015297 _____ C:\Users\Tom\Desktop\Stromverbrauch.xlsx
2013-09-27 14:41 - 2012-12-02 22:30 - 00000000 ____D C:\Users\Tom\AppData\Roaming\MyPhoneExplorer
2013-09-27 14:21 - 2013-09-27 14:21 - 00000000 ____D C:\Users\Tom\Documents\SelfMV
2013-09-27 14:10 - 2013-09-27 14:10 - 00002018 _____ C:\Users\Public\Desktop\Samsung Kies (Lite).lnk
2013-09-27 14:10 - 2013-09-27 14:10 - 00002008 _____ C:\Users\Public\Desktop\Samsung Kies.lnk
2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\WINDOWS\LastGood.Tmp
2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Tom\Documents\samsung
2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Tom\AppData\Roaming\Samsung
2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Tom\AppData\Local\Samsung
2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Public\Documents\NativeFus_Log
2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Public\Documents\CrashDump
2013-09-27 14:09 - 2013-09-27 14:05 - 00000000 ____D C:\ProgramData\Samsung
2013-09-27 14:09 - 2013-09-27 14:05 - 00000000 ____D C:\Program Files (x86)\Samsung
2013-09-27 14:08 - 2013-09-27 14:08 - 00000000 ____D C:\Program Files (x86)\MyFree Codec
2013-09-27 14:05 - 2010-01-24 03:50 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-09-27 13:59 - 2013-09-27 13:59 - 00001059 _____ C:\Users\Public\Desktop\DriverTuner.lnk
2013-09-27 13:59 - 2013-09-27 13:59 - 00000000 ____D C:\Program Files (x86)\DriverTuner
2013-09-27 13:54 - 2013-09-27 13:54 - 00000000 ____D C:\Users\Tom\.android
2013-09-27 13:54 - 2013-01-02 02:54 - 00000000 ____D C:\Users\Tom
2013-09-27 13:54 - 2012-12-02 22:30 - 00002073 _____ C:\Users\Public\Desktop\MyPhoneExplorer.lnk
2013-09-27 13:54 - 2012-12-02 22:30 - 00000000 ____D C:\Program Files (x86)\MyPhoneExplorer
2013-09-26 11:47 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\AUInstallAgent
2013-09-26 10:35 - 2013-09-26 10:35 - 00000103 _____ C:\WINDOWS\ParrotFlashWiz.INI
2013-09-26 10:33 - 2013-09-26 10:33 - 00000000 ____D C:\Program Files (x86)\Parrot Software Update Tool
2013-09-25 17:58 - 2011-03-22 23:38 - 00000000 ____D C:\Users\Tom\AppData\Roaming\Foxit Software
2013-09-23 11:12 - 2013-09-23 11:12 - 1285878931 _____ C:\WINDOWS\MEMORY.DMP
2013-09-23 11:12 - 2013-01-12 07:48 - 00000000 ____D C:\WINDOWS\Minidump
2013-09-19 01:26 - 2013-01-10 23:02 - 00694232 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2013-09-19 01:26 - 2013-01-10 23:02 - 00078296 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-18 16:22 - 2013-06-05 11:18 - 00322048 ___SH C:\Users\Tom\Desktop\Thumbs.db
2013-09-18 16:22 - 2013-02-06 22:20 - 00000000 ____D C:\Users\Tom\Desktop\KabelBW
2013-09-15 15:57 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\rescache
2013-09-15 15:38 - 2013-02-23 11:24 - 00000586 _____ C:\Users\Public\Desktop\mkvmerge GUI.lnk
2013-09-15 13:07 - 2013-09-15 13:06 - 00531240 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2013-09-15 01:14 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\WinStore
2013-09-15 01:14 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\PolicyDefinitions
2013-09-15 00:05 - 2010-06-01 00:58 - 00000000 ____D C:\Users\Tom\AppData\Local\QuickPar
2013-09-14 17:15 - 2013-09-14 17:15 - 00000000 _____ C:\WINDOWS\setuperr.log
2013-09-14 11:57 - 2010-06-01 01:01 - 00018944 _____ C:\Users\Tom\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-09-14 03:02 - 2010-05-09 20:21 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-09-13 11:06 - 2013-08-19 11:05 - 00000000 ____D C:\WINDOWS\system32\MRT
2013-09-13 11:03 - 2009-10-14 07:12 - 79143768 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2013-09-13 09:58 - 2013-08-25 14:42 - 00000834 _____ C:\Users\Public\Desktop\CCleaner.lnk
2013-09-13 09:58 - 2013-08-25 14:42 - 00000000 ____D C:\Program Files\CCleaner
2013-09-13 09:28 - 2013-09-13 09:28 - 00274944 _____ C:\Users\Tom\AppData\lsass.exe
2013-09-13 09:05 - 2012-07-26 07:38 - 00000000 ____D C:\WINDOWS\system32\oobe
2013-09-12 22:38 - 2013-09-12 22:38 - 00001604 _____ C:\Users\Public\Desktop\Angry Birds Star Wars.lnk
2013-09-12 22:38 - 2013-07-05 12:47 - 00000000 ____D C:\Users\Tom\AppData\Roaming\Rovio Entertainment Ltd
2013-09-10 15:45 - 2013-05-04 21:34 - 00000000 ____D C:\Users\Tom\Documents\Settlers7
2013-09-09 10:36 - 2013-09-01 14:49 - 00000942 _____ C:\Users\Public\Desktop\calibre 64bit - E-book management.lnk
2013-09-09 10:36 - 2013-09-01 14:49 - 00000000 ____D C:\Program Files\Calibre2
2013-09-02 16:17 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\system32\NDF
2013-09-01 18:42 - 2013-09-01 14:49 - 00000000 ____D C:\Users\Tom\AppData\Local\calibre-cache
2013-09-01 16:29 - 2013-09-01 16:29 - 00000000 ____D C:\WINDOWS\SysWOW64\fstrainer2011
2013-09-01 16:29 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\SysWOW64\Macromed
2013-09-01 16:29 - 2012-07-10 13:44 - 00000000 ____D C:\WINDOWS\SysWOW64\Adobe
2013-09-01 14:41 - 2013-02-17 20:48 - 00000000 ____D C:\Users\TomAdminPW_Ur\AppData\Roaming\SpeedProject
2013-08-30 16:11 - 2013-08-30 16:11 - 00000000 ____D C:\Users\TomAdminPW_Ur\AppData\Roaming\Apple Computer

Some content of TEMP:
====================
C:\Users\Tom\AppData\Local\Temp\cvtres.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== End Of Log ============================
--- --- ---

--- --- ---


Frage: existiert hier auf dem Board ein Donate-Button?
__________________
Alt 29.09.2013, 19:00   #4
aharonov
/// TB-Ausbilder
 
Windows 8, Infektion mit Win32/Fynloski.A? - Standard

Windows 8, Infektion mit Win32/Fynloski.A?


Hallo,

hast du auch noch das Log von Combofix? (Bisher ist nur AdwCleaner und FRST vorhanden.)

Zitat:
Frage: existiert hier auf dem Board ein Donate-Button?
Ja, das existiert: http://www.trojaner-board.de/79994-s...ndenkonto.html
__________________
cheers,
Leo

Alt 29.09.2013, 19:04   #5
Rupsi
 
Windows 8, Infektion mit Win32/Fynloski.A? - Standard

Windows 8, Infektion mit Win32/Fynloski.A?


Ups..

Hier das Log von Combofix:
Code:
ATTFilter
ComboFix 13-09-28.02 - Tom_Admin 29.09.2013  17:55:20.2.4 - x64
Microsoft Windows 8 Pro  6.2.9200.0.1252.49.1031.18.8183.6498 [GMT 2:00]
ausgeführt von:: C:\Users\Tom\Desktop\Trojan\ComboFix.exe
AV: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}


Alt 29.09.2013, 19:08   #6
aharonov
/// TB-Ausbilder
 
Windows 8, Infektion mit Win32/Fynloski.A? - Standard

Windows 8, Infektion mit Win32/Fynloski.A?


Das sind nur die ersten paar Zeilen davon und somit sehr unvollständig.
Sieht das Log tatsächlich so aus?
Andernfalls poste es bitte nochmals komplett.
__________________
--> Windows 8, Infektion mit Win32/Fynloski.A?

Alt 29.09.2013, 19:10   #7
Rupsi
 
Windows 8, Infektion mit Win32/Fynloski.A? - Standard

Windows 8, Infektion mit Win32/Fynloski.A?


Das log sieht tatsächlich so aus :-(

Alt 29.09.2013, 19:19   #8
aharonov
/// TB-Ausbilder
 
Windows 8, Infektion mit Win32/Fynloski.A? - Standard

Windows 8, Infektion mit Win32/Fynloski.A?


Kannst du Combofix nochmals nach der Anleitung ausführen? (Zuvor die bestehende combofix.exe löschen und neu herunterladen.)
__________________
cheers,
Leo

Alt 29.09.2013, 19:58   #9
Rupsi
 
Windows 8, Infektion mit Win32/Fynloski.A? - Standard

Windows 8, Infektion mit Win32/Fynloski.A?


Sir, Yes Sir ;-)

So. Nun ist sie da.
Zuvor lief wohl ComboFix gar nicht zuende. Der Rechner hatte wohl einen Neustart gemacht. Ich hatte es nicht gesehen, da ich den Lauf nicht vor dem Bildschirm verfolgt habe.

Code:
ATTFilter
ComboFix 13-09-28.02 - Tom_Admin 29.09.2013  20:25:23.3.4 - x64
Microsoft Windows 8 Pro  6.2.9200.0.1252.49.1031.18.8183.6587 [GMT 2:00]
ausgeführt von:: c:\users\Tom\Desktop\Trojan\ComboFix.exe
AV: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\FireFox\plugin-container.exe
c:\program files (x86)\FireFox\uninstall\helper.exe
c:\program files (x86)\FireFox\updater.exe
c:\users\Tom\AppData\Roaming\chrtmp
c:\users\Tom\AppData\Roaming\dclogs
c:\users\Tom\AppData\Roaming\dclogs\2013-09-29-1.dc
c:\users\Tom\AppData\Roaming\inst.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-08-28 bis 2013-09-29  ))))))))))))))))))))))))))))))
.
.
2013-09-29 18:32 . 2013-09-29 18:32	--------	d-----w-	c:\users\UpdatusUser\AppData\Local\temp
2013-09-29 18:32 . 2013-09-29 18:32	--------	d-----w-	c:\users\TomAdminPW_Ur\AppData\Local\temp
2013-09-29 18:32 . 2013-09-29 18:32	--------	d-----w-	c:\users\Tom_Admin\AppData\Local\temp
2013-09-29 18:32 . 2013-09-29 18:32	--------	d-----w-	c:\users\Max\AppData\Local\temp
2013-09-29 18:32 . 2013-09-29 18:32	--------	d-----w-	c:\users\DefaultAppPool\AppData\Local\temp
2013-09-29 18:32 . 2013-09-29 18:32	--------	d-----w-	c:\users\Default\AppData\Local\temp
2013-09-29 16:33 . 2013-09-29 16:33	76232	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{4990ED62-4329-48A1-B089-52FD3C187F84}\offreg.dll
2013-09-29 14:47 . 2013-09-29 14:47	--------	d-----w-	c:\users\Tom_Admin\AppData\Roaming\Malwarebytes
2013-09-29 14:47 . 2013-04-04 12:50	25928	----a-w-	c:\windows\system32\drivers\mbam.sys
2013-09-29 12:01 . 2013-09-29 12:01	--------	d-----w-	C:\FRST
2013-09-29 10:22 . 2013-09-05 05:32	9694160	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{4990ED62-4329-48A1-B089-52FD3C187F84}\mpengine.dll
2013-09-27 12:10 . 2013-09-27 12:10	--------	d-----w-	c:\users\Tom\AppData\Local\Samsung
2013-09-27 12:10 . 2013-09-27 12:10	--------	d-----w-	c:\users\Tom\AppData\Roaming\Samsung
2013-09-27 12:10 . 2013-09-27 12:10	--------	d-----w-	c:\windows\LastGood.Tmp
2013-09-27 12:08 . 2013-09-27 12:08	--------	d-----w-	c:\program files (x86)\MyFree Codec
2013-09-27 12:05 . 2013-07-18 12:33	4659712	----a-w-	c:\windows\SysWow64\Redemption.dll
2013-09-27 12:05 . 2013-07-18 12:32	821824	----a-w-	c:\windows\SysWow64\dgderapi.dll
2013-09-27 12:05 . 2013-09-27 12:09	--------	d-----w-	c:\program files (x86)\Samsung
2013-09-27 12:05 . 2013-09-27 12:09	--------	d-----w-	c:\programdata\Samsung
2013-09-27 12:03 . 2013-09-27 12:03	--------	d-----w-	c:\users\Tom_Admin\AppData\Local\Downloaded Installations
2013-09-27 11:59 . 2013-09-27 11:59	--------	d-----w-	c:\users\Tom_Admin\AppData\Local\DriverTuner
2013-09-27 11:59 . 2013-09-27 11:59	--------	d-----w-	c:\program files (x86)\DriverTuner
2013-09-27 11:54 . 2013-09-27 11:54	--------	d-----w-	c:\users\Tom\.android
2013-09-26 08:33 . 2013-09-26 08:33	--------	d-----w-	c:\program files (x86)\Parrot Software Update Tool
2013-09-16 18:47 . 2013-08-07 05:15	144896	----a-w-	c:\windows\system32\tssdisai.dll
2013-09-13 07:23 . 2013-08-21 04:11	19246592	----a-w-	c:\windows\system32\mshtml.dll
2013-09-11 19:09 . 2013-07-09 03:57	245760	----a-w-	c:\windows\SysWow64\LocationApi.dll
2013-09-09 08:23 . 2013-06-09 19:59	216064	----a-w-	c:\windows\SysWow64\gcapi_dll.dll
2013-09-09 08:23 . 2013-09-09 08:23	--------	d-----w-	c:\users\Tom_Admin\AppData\Roaming\Foxit Software
2013-09-01 14:29 . 2013-09-01 14:29	--------	d-----w-	c:\windows\SysWow64\fstrainer2011
2013-09-01 14:29 . 2008-01-03 17:19	581632	----a-w-	c:\windows\SysWow64\Control.dll
2013-09-01 14:29 . 2004-03-08 19:00	152848	----a-w-	c:\windows\SysWow64\comdlg32.ocx
2013-09-01 14:29 . 2004-08-04 05:21	81920	----a-w-	c:\windows\SysWow64\msado27.tlb
2013-09-01 12:49 . 2013-09-01 16:42	--------	d-----w-	c:\users\Tom\AppData\Local\calibre-cache
2013-09-01 12:49 . 2013-09-09 08:36	--------	d-----w-	c:\program files\Calibre2
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-09-29 16:30 . 2013-01-02 00:53	4194304	----a-w-	c:\windows\ServiceProfiles\NetworkService\msmqlog.bin
2013-09-18 23:26 . 2013-01-10 21:02	78296	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-09-18 23:26 . 2013-01-10 21:02	694232	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2013-09-13 09:03 . 2009-10-14 05:12	79143768	----a-w-	c:\windows\system32\MRT.exe
2013-09-05 17:00 . 2013-03-09 09:10	17536	----a-w-	c:\programdata\Microsoft\windowssampling\Sqm\Manifest\Sqm3.bin
2013-08-28 19:13 . 2013-08-28 19:13	276256	----a-w-	c:\windows\system32\drivers\DigiartyVirtualCDBus.sys
2013-08-20 05:02 . 2013-08-20 05:02	204568	----a-w-	c:\windows\system32\drivers\ssudmdm.sys
2013-08-20 05:02 . 2013-08-20 05:02	103576	----a-w-	c:\windows\system32\drivers\ssudbus.sys
2013-07-18 12:32 . 2013-07-18 12:32	90112	----a-w-	c:\windows\MAMCityDownload.ocx
2013-07-18 12:32 . 2013-07-18 12:32	330240	----a-w-	c:\windows\MASetupCaller.dll
2013-07-18 12:32 . 2013-07-18 12:32	30568	----a-w-	c:\windows\MusiccityDownload.exe
2013-07-18 12:32 . 2013-07-18 12:32	974848	----a-w-	c:\windows\SysWow64\cis-2.4.dll
2013-07-18 12:32 . 2013-07-18 12:32	81920	----a-w-	c:\windows\SysWow64\issacapi_bs-2.3.dll
2013-07-18 12:32 . 2013-07-18 12:32	65536	----a-w-	c:\windows\SysWow64\issacapi_pe-2.3.dll
2013-07-18 12:32 . 2013-07-18 12:32	57344	----a-w-	c:\windows\SysWow64\MTXSYNCICON.dll
2013-07-18 12:32 . 2013-07-18 12:32	57344	----a-w-	c:\windows\SysWow64\MK_Lyric.dll
2013-07-18 12:32 . 2013-07-18 12:32	57344	----a-w-	c:\windows\SysWow64\issacapi_se-2.3.dll
2013-07-18 12:32 . 2013-07-18 12:32	569344	----a-w-	c:\windows\SysWow64\muzdecode.ax
2013-07-18 12:32 . 2013-07-18 12:32	491520	----a-w-	c:\windows\SysWow64\muzapp.dll
2013-07-18 12:32 . 2013-07-18 12:32	49152	----a-w-	c:\windows\SysWow64\MaJGUILib.dll
2013-07-18 12:32 . 2013-07-18 12:32	45320	----a-w-	c:\windows\SysWow64\MAMACExtract.dll
2013-07-18 12:32 . 2013-07-18 12:32	45056	----a-w-	c:\windows\SysWow64\MaXMLProto.dll
2013-07-18 12:32 . 2013-07-18 12:32	45056	----a-w-	c:\windows\SysWow64\MACXMLProto.dll
2013-07-18 12:32 . 2013-07-18 12:32	40960	----a-w-	c:\windows\SysWow64\MTTELECHIP.dll
2013-07-18 12:32 . 2013-07-18 12:32	352256	----a-w-	c:\windows\SysWow64\MSLUR71.dll
2013-07-18 12:32 . 2013-07-18 12:32	258048	----a-w-	c:\windows\SysWow64\muzoggsp.ax
2013-07-18 12:32 . 2013-07-18 12:32	245760	----a-w-	c:\windows\SysWow64\MSCLib.dll
2013-07-18 12:32 . 2013-07-18 12:32	24576	----a-w-	c:\windows\SysWow64\MASetupCleaner.exe
2013-07-18 12:32 . 2013-07-18 12:32	200704	----a-w-	c:\windows\SysWow64\muzwmts.dll
2013-07-18 12:32 . 2013-07-18 12:32	172032	----a-w-	c:\windows\SysWow64\muzapp.exe
2013-07-18 12:32 . 2013-07-18 12:32	155648	----a-w-	c:\windows\SysWow64\MSFLib.dll
2013-07-18 12:32 . 2013-07-18 12:32	143360	----a-w-	c:\windows\SysWow64\3DAudio.ax
2013-07-18 12:32 . 2013-07-18 12:32	135168	----a-w-	c:\windows\SysWow64\muzaf1.dll
2013-07-18 12:32 . 2013-07-18 12:32	131072	----a-w-	c:\windows\SysWow64\muzmpgsp.ax
2013-07-18 12:32 . 2013-07-18 12:32	122880	----a-w-	c:\windows\SysWow64\muzeffect.ax
2013-07-18 12:32 . 2013-07-18 12:32	118784	----a-w-	c:\windows\SysWow64\MaDRM.dll
2013-07-18 12:32 . 2013-07-18 12:32	110592	----a-w-	c:\windows\SysWow64\muzmp4sp.ax
2013-07-13 06:18 . 2013-08-16 21:22	337408	----a-w-	c:\windows\system32\wintrust.dll
2013-07-13 06:16 . 2013-08-16 21:22	1889280	----a-w-	c:\windows\system32\crypt32.dll
2013-07-13 06:16 . 2013-08-16 21:22	68096	----a-w-	c:\windows\system32\cryptsvc.dll
2013-07-13 06:15 . 2013-08-16 21:22	98304	----a-w-	c:\windows\system32\apprepsync.dll
2013-07-13 06:15 . 2013-08-16 21:22	124416	----a-w-	c:\windows\system32\apprepapi.dll
2013-07-13 04:24 . 2013-08-16 21:22	261120	----a-w-	c:\windows\SysWow64\wintrust.dll
2013-07-13 04:23 . 2013-08-16 21:22	1568256	----a-w-	c:\windows\SysWow64\crypt32.dll
2013-07-13 04:23 . 2013-08-16 21:22	87040	----a-w-	c:\windows\SysWow64\apprepapi.dll
2013-07-13 04:23 . 2013-08-16 21:22	74240	----a-w-	c:\windows\SysWow64\apprepsync.dll
2013-07-09 06:07 . 2013-08-16 21:22	2233168	----a-w-	c:\windows\system32\drivers\tcpip.sys
2013-07-02 00:44 . 2013-08-16 21:22	36288	----a-w-	c:\windows\system32\drivers\WdBoot.sys
2013-07-01 22:08 . 2013-08-16 21:22	247216	----a-w-	c:\windows\system32\drivers\WdFilter.sys
2012-05-11 12:16 . 2012-05-11 12:16	171520	----a-w-	c:\program files (x86)\Common Files\dsfOggDemux2.dll
2011-04-18 20:51 . 2011-04-18 20:51	653136	----a-w-	c:\program files (x86)\Common Files\MSVCR90.dll
2011-04-18 20:51 . 2011-04-18 20:51	569680	----a-w-	c:\program files (x86)\Common Files\MSVCP90.dll
2011-01-12 00:00 . 2011-01-12 00:00	30208	----a-w-	c:\program files (x86)\Common Files\wmpinfo.dll
2011-01-12 00:00 . 2011-01-12 00:00	240128	----a-w-	c:\program files (x86)\Common Files\dsfVorbisDecoder.dll
2011-01-12 00:00 . 2011-01-12 00:00	146944	----a-w-	c:\program files (x86)\Common Files\dsfFLACDecoder.dll
2011-01-12 00:00 . 2011-01-12 00:00	221184	----a-w-	c:\program files (x86)\Common Files\dsfFLACEncoder.dll
2011-01-12 00:00 . 2011-01-12 00:00	204800	----a-w-	c:\program files (x86)\Common Files\dsfNativeFLACSource.dll
2010-12-16 19:39 . 2010-12-16 19:39	302592	----a-w-	c:\program files (x86)\Common Files\webmmux.dll
2010-12-16 19:39 . 2010-12-16 19:39	701440	----a-w-	c:\program files (x86)\Common Files\vp8encoder.dll
2010-12-16 19:39 . 2010-12-16 19:39	412672	----a-w-	c:\program files (x86)\Common Files\vp8decoder.dll
2010-12-16 19:39 . 2010-12-16 19:39	292352	----a-w-	c:\program files (x86)\Common Files\webmsplit.dll
2006-05-03 10:06	163328	--sha-r-	c:\windows\SysWOW64\flvDX.dll
2007-02-21 11:47	31232	--sha-r-	c:\windows\SysWOW64\msfDX.dll
2008-03-16 13:30	216064	--sha-r-	c:\windows\SysWOW64\nbDX.dll
2010-01-06 22:00	107520	--sha-r-	c:\windows\SysWOW64\TAKDSDecoder.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"KiesPreload"="c:\program files (x86)\Samsung\Kies\Kies.exe" [2013-09-04 1564528]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"BCSSync"="c:\program files (x86)\Microsoft Office2010\Office14\BCSSync.exe" [2010-03-13 91520]
"EaseUS EPM tray"="c:\program files (x86)\EaseUS\EaseUS Partition Master 9.2.1 Home Edition\bin\EpmNews.exe" [2012-11-29 2086984]
"ISUSScheduler"="c:\program files (x86)\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 81920]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2007-03-20 36864]
"PDFPrint"="c:\program files (x86)\PDF24\pdf24.exe" [2012-12-12 163000]
"HPUsageTracking"="c:\program files (x86)\HP\HP UT\bin\hppusg.exe" [2009-05-11 24576]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888]
"Live Update 5"="c:\program files (x86)\MSI\Live Update 5\BootStartLiveupdate.exe" [2012-01-30 315392]
"KiesTrayAgent"="c:\program files (x86)\Samsung\Kies\KiesTrayAgent.exe" [2013-09-04 311152]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
" Malwarebytes Anti-Malware "="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2013-04-04 532040]
.
c:\users\Tom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files (x86)\Microsoft Office2010\Office14\ONENOTEM.EXE /tsr [2013-6-25 228552]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\StartUp\
HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableCursorSuppression"= 1 (0x1)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLinkedConnections"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R1 NNSNAHSL;Network Activity Hook Server LightWeight Filter Driver;c:\windows\system32\DRIVERS\NNSNAHSL.sys;c:\windows\SYSNATIVE\DRIVERS\NNSNAHSL.sys [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R2 SynoDrService;SynoDrService;c:\program files (x86)\Synology Data Replicator  3\SynoDrServicex64.exe;c:\program files (x86)\Synology Data Replicator  3\SynoDrServicex64.exe [x]
R3 androidusb;ADB Interface Driver;c:\windows\System32\Drivers\androidusb.sys;c:\windows\SYSNATIVE\Drivers\androidusb.sys [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 DigiartyVirtualCDBus;Digiarty Virtual Driver;c:\windows\system32\drivers\DigiartyVirtualCDBus.sys;c:\windows\SYSNATIVE\drivers\DigiartyVirtualCDBus.sys [x]
R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys;c:\windows\SYSNATIVE\epmntdrv.sys [x]
R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys;c:\windows\SYSNATIVE\EuGdiDrv.sys [x]
R3 HPFXFAX;HPFXFAX;c:\windows\system32\drivers\hpfx64fax.sys;c:\windows\SYSNATIVE\drivers\hpfx64fax.sys [x]
R3 MSI_MSIBIOS_010507;MSI_MSIBIOS_010507;c:\program files (x86)\MSI\Live Update 5\msibios64_100507.sys;c:\program files (x86)\MSI\Live Update 5\msibios64_100507.sys [x]
R3 NTIOLib_1_0_4;NTIOLib_1_0_4;c:\program files (x86)\MSI\Live Update 5\NTIOLib_X64.sys;c:\program files (x86)\MSI\Live Update 5\NTIOLib_X64.sys [x]
R3 NTIOLib_1_0_6;NTIOLib_1_0_6;c:\program files (x86)\Setup Files\Ms7586v1B0\NTIOLib_X64.sys;c:\program files (x86)\Setup Files\Ms7586v1B0\NTIOLib_X64.sys [x]
R3 Olympus DVR Service;Olympus DVR Service;c:\program files (x86)\Common Files\Olympus Shared\DeviceManager\olydvrsv.exe;c:\program files (x86)\Common Files\Olympus Shared\DeviceManager\olydvrsv.exe [x]
R3 pcouffin;VSO Software pcouffin;c:\windows\system32\Drivers\pcouffin.sys;c:\windows\SYSNATIVE\Drivers\pcouffin.sys [x]
R3 Sony PC Companion;Sony PC Companion;c:\program files (x86)\Sony\Sony PC Companion\PCCService.exe;c:\program files (x86)\Sony\Sony PC Companion\PCCService.exe [x]
R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 vvftav;vvftav;c:\windows\system32\drivers\vvftav.sys;c:\windows\SYSNATIVE\drivers\vvftav.sys [x]
R3 WUDFWpdMtp;WUDFWpdMtp;c:\windows\system32\DRIVERS\WUDFRd.sys;c:\windows\SYSNATIVE\DRIVERS\WUDFRd.sys [x]
R3 ZSMC0305;USB PC Camera VC305;c:\windows\system32\Drivers\usbVM305.sys;c:\windows\SYSNATIVE\Drivers\usbVM305.sys [x]
R4 sptd;sptd;c:\windows\System32\Drivers\sptd.sys;c:\windows\SYSNATIVE\Drivers\sptd.sys [x]
S1 HWiNFO32;HWiNFO32 Kernel Driver;c:\program files (x86)\HWiNFO32\HWiNFO64A.SYS;c:\program files (x86)\HWiNFO32\HWiNFO64A.SYS [x]
S2 acedrv11;acedrv11;c:\windows\system32\drivers\acedrv11.sys;c:\windows\SYSNATIVE\drivers\acedrv11.sys [x]
S2 easycvfs;easyClient DriveOnWeb File System;c:\windows\system32\drivers\easycvfs.sys;c:\windows\SYSNATIVE\drivers\easycvfs.sys [x]
S2 Garmin Core Update Service;Garmin Core Update Service;c:\program files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe;c:\program files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [x]
S2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe;c:\program files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 TVGOnlineUpdateSvc;TVG OnlineUpdate-Service;c:\program files (x86)\TVG\OnlineUpdate\OnlineUpdateSvc.exe;c:\program files (x86)\TVG\OnlineUpdate\OnlineUpdateSvc.exe [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\System32\drivers\seehcri.sys;c:\windows\SYSNATIVE\drivers\seehcri.sys [x]
S3 SKYNET;TechniSat DVB-PC TV Star PCI;c:\windows\system32\DRIVERS\SkyNET_AMD64.SYS;c:\windows\SYSNATIVE\DRIVERS\SkyNET_AMD64.SYS [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
apphost	REG_MULTI_SZ   	apphostsvc
iissvcs	REG_MULTI_SZ   	w3svc was
hpdevmgmt	REG_MULTI_SZ   	hpqcxs08 hpqddsvc
.
Inhalt des "geplante Tasks" Ordners
.
2013-09-29 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-09 16:21]
.
2013-07-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-06-15 23:04]
.
2013-07-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-06-15 23:04]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2012-09-25 13196432]
"HP Color LaserJet CM2320 MFP Series Fax"="c:\program files (x86)\HP\HP Color LaserJet CM2320 MFP Series\hppfaxprintersrv.exe" [2009-09-22 3700736]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"*WerKernelReporting"="c:\windows\SYSTEM32\WerFault.exe" [2013-07-09 439488]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uSearchAssistant = hxxp://www.google.com
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: An OneNote s&enden - c:\progra~2\MI4066~1\Office14\ONBttnIE.dll/105
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MI4066~1\Office14\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
Trusted Zone: paypal.com
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\Tom_Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m5mhonw7.default\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-KiesAirMessage - c:\program files (x86)\Samsung\Kies\KiesAirMessage.exe
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
AddRemove-AquaSoft DiaShow 7 Ultimate - c:\programdata\{C408D0B2-D2DE-46C9-9628-D4E335EC4EB6}\Setup.exe
AddRemove-Mozilla Firefox 23.0.1 (x86 de) - c:\program files (x86)\Firefox\uninstall\helper.exe
AddRemove-Picasa 3 - e:\picasa3\Uninstall.exe
AddRemove-{2FAA2415-618E-4EC0-8253-3CDA076C84D6} - c:\programdata\{C408D0B2-D2DE-46C9-9628-D4E335EC4EB6}\Setup.exe
AddRemove-TeamSpeak 3 Client - c:\users\Tom\AppData\Local\TeamSpeak 3 Client\uninstall.exe
AddRemove-UnityWebPlayer - c:\users\Tom_Admin\AppData\Local\Unity\WebPlayer\Uninstall.exe
AddRemove-{8DC910CD-8EE3-4ffc-A4EB-9B02701059C4} - c:\users\Tom_Admin\Music\uninstaller.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e96d-e325-11ce-bfc1-08002be10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
@SACL=(02 0000)
.
Zeit der Fertigstellung: 2013-09-29  20:41:29
ComboFix-quarantined-files.txt  2013-09-29 18:41
.
Vor Suchlauf: 24 Verzeichnis(se), 23.432.044.544 Bytes frei
Nach Suchlauf: 32 Verzeichnis(se), 23.027.625.984 Bytes frei
.
- - End Of File - - 02AC84A423A6A769912F17BEF88F90BA
A36C5E4F47E84449FF07ED3517B43A31
Firefox stürzt inzwischen übreigens immer wieder ab

Alt 29.09.2013, 20:13   #10
aharonov
/// TB-Ausbilder
 
Windows 8, Infektion mit Win32/Fynloski.A? - Standard

Windows 8, Infektion mit Win32/Fynloski.A?


Ok, und jetzt nochmals frische FRST-Logs:
(Deinstalliere den Firefox mal und installiere ihn dann neu.)


Starte noch einmal FRST.
  • Setze bei Optional Scan den Haken bei Addition.txt und drücke Scan.
  • Wenn der Scan abgeschlossen ist, werden zwei neue Logfiles FRST.txt und Addition.txt erstellt und auf dem Desktop gespeichert.
  • Poste den Inhalt dieser beiden Logfiles bitte hier in deinen Thread.
__________________
cheers,
Leo

Alt 29.09.2013, 20:21   #11
Rupsi
 
Windows 8, Infektion mit Win32/Fynloski.A? - Standard

Windows 8, Infektion mit Win32/Fynloski.A?


Ich wollte Firefox deinstallieren, doch er weigert sich deinstalliert zu werden :-(

Alt 29.09.2013, 20:24   #12
aharonov
/// TB-Ausbilder
 
Windows 8, Infektion mit Win32/Fynloski.A? - Standard

Windows 8, Infektion mit Win32/Fynloski.A?


Klappt es nach dem hier?



Combofix-Skript
WARNUNG für die MITLESER:
Folgendes ComboFix Skript ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!

  • Lösche die vorhandene Combofix.exe von deinem Desktop und lade das Programm von folgenden Download-Spiegel neu herunter: Link
  • Speichere es erneut auf dem Desktop (nicht woanders hin, das ist wichtig)!
  • Drücke die Windows + R Taste --> notepad (hinein schreiben) --> OK
  • Kopiere nun den Text aus der folgenden Codebox komplett in das leere Textdokument.
    Code:
    ATTFilter
    DeQuarantine::
C:\Qoobox\Quarantine\C\program files (x86)\FireFox
Quit::
  • Speichere dies als CFScript.txt auf deinem Desktop.
  • Wichtig: Stelle deine Anti Viren Software temporär ab. Dies kann ComboFix nämlich bei der Arbeit behindern.
    Danach wieder anstellen nicht vergessen!
  • Schließe alle laufenden Programme damit ComboFix ungehindert arbeiten kann.
  • Ziehe CFScript.txt in die ComboFix.exe wie in diesem Bild:
  • Mache nichts am Computer, bewege nicht die Maus über das ComboFix-Fenster oder klicke in dieses hinein. Dies kann dazu führen, dass ComboFix sich aufhängt.
  • Wenn ComboFix fertig ist wird es ein Log erstellen: C:\ComboFix.txt
    Bitte füge es hier als Antwort (in CODE-Tags mit dem #-Button des Editors) ein.

Hinweis:
Suspect:: und Collect::
Falls im Skript diese Anweisungen enthalten sind, sollen Dateien zur Analyse eingeschickt werden. Es erscheint eine Message-Box, nachdem Combofix fertig ist. Klicke OK und folge den Aufforderungen/Anweisungen, um die Dateien hochzuladen. Teile mir unbedingt mit, ob der Upload geklappt hat!

__________________
cheers,
Leo

Alt 29.09.2013, 20:37   #13
Rupsi
 
Windows 8, Infektion mit Win32/Fynloski.A? - Standard

Windows 8, Infektion mit Win32/Fynloski.A?


Firfox geht inzwischen gar nicht mehr aber hier das log von FRST:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-09-2013 02
Ran by Tom_Admin (administrator) on TOM_ADMIN-PC on 29-09-2013 21:27:36
Running from C:\Users\Tom\Desktop\Trojan
Windows 8 Pro (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\WINDOWS\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\WINDOWS\system32\nvvsvc.exe
(Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe
(Microsoft Corporation) C:\WINDOWS\system32\dashost.exe
(Microsoft Corporation) C:\WINDOWS\SysWOW64\svchost.exe
(Microsoft Corporation) C:\WINDOWS\system32\mqsvc.exe
(Sony Corporation) C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe
() C:\Program Files (x86)\TVG\OnlineUpdate\OnlineUpdateSvc.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Microsoft Corporation) C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(Microsoft Corporation) C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Hewlett-Packard Company) C:\Program Files (x86)\HP\HP Color LaserJet CM2320 MFP Series\hppfaxprintersrv.exe
(Samsung) C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
(InstallShield Software Corporation) C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
() C:\Users\Tom\AppData\Local\Temp\cvtres.exe
(Microsoft Corporation) C:\WINDOWS\SysWOW64\notepad.exe
(SWE Sven Ritter) C:\Program Files\SpeedProject\SpeedCommander 14\SpeedCommander.exe
(SWE Sven Ritter) C:\Program Files\SpeedProject\SpeedCommander 14\LuaHelper.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13196432 2012-09-25] (Realtek Semiconductor)
HKLM\...\Run: [HP Color LaserJet CM2320 MFP Series Fax] - C:\Program Files (x86)\HP\HP Color LaserJet CM2320 MFP Series\hppfaxprintersrv.exe [3700736 2009-09-22] (Hewlett-Packard Company)
HKLM\...\RunOnce: [*WerKernelReporting] - %SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq [439488 2013-07-09] (Microsoft Corporation)
HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware ] - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation)
HKCU\...\Run: [KiesPreload] - C:\Program Files (x86)\Samsung\Kies\Kies.exe [1564528 2013-09-04] (Samsung)
HKLM-x32\...\Run: [BCSSync] - C:\Program Files (x86)\Microsoft Office2010\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
HKLM-x32\...\Run: [EaseUS EPM tray] - C:\Program Files (x86)\EaseUS\EaseUS Partition Master 9.2.1 Home Edition\bin\EpmNews.exe [2086984 2012-11-29] (CHENGDU YIWO Tech Development Co., Ltd)
HKLM-x32\...\Run: [ISUSScheduler] - C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe [81920 2005-02-16] (InstallShield Software Corporation)
HKLM-x32\...\Run: [JMB36X IDE Setup] - C:\Windows\RaidTool\xInsIDE.exe [36864 2007-03-20] ()
HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [163000 2012-12-12] (Geek Software GmbH)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [HPUsageTracking] - C:\Program Files (x86)\HP\HP UT\bin\hppusg.exe [24576 2009-05-11] (Hewlett-Packard Company)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [Live Update 5] - C:\Program Files (x86)\MSI\Live Update 5\BootStartLiveupdate.exe [315392 2012-01-30] ()
HKLM-x32\...\Run: [KiesTrayAgent] - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311152 2013-09-04] (Samsung Electronics Co., Ltd.)
HKU\TomAdminPW_Ur\...\Run: [GarminExpressTrayApp] - C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [1098072 2013-03-27] (Garmin Ltd or its subsidiaries)
HKU\UpdatusUser\...\RunOnce: [WAB Migrate] - C:\Program Files\Windows Mail\wab.exe [516096 2012-07-26] (Microsoft Corporation)
Startup: C:\Users\Tom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office2010\Office14\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xBC7CC5332A8FCD01
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office2010\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office2010\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: No Name - {DBC80044-A445-435b-BC74-9C25C1C588A9} -  No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 0.0.0.0

FireFox:
========
FF ProfilePath: C:\Users\Tom_Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m5mhonw7.default
FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\WINDOWS\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf - f:\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf - f:\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - e:\Picasa3\npPicasa3.dll No File
FF Plugin-x32: @java.com/DTPlugin,version=1.6.0_35 - C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MI4066~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MI4066~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @real.com/nppl3260;version=15.0.4.53 - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprjplug;version=15.0.4.53 - c:\program files (x86)\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpchromebrowserrecordext;version=15.0.4.53 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprphtml5videoshim;version=15.0.4.53 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=15.0.4.53 - c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Extension: Battlefield Heroes Updater - C:\Users\Tom_Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m5mhonw7.default\Extensions\battlefieldheroespatcher@ea.com
FF HKLM-x32\...\Firefox\Extensions: [{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF Extension: RealPlayer Browser Record Plugin - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF HKCU\...\Firefox\Extensions: [lrcsmonkey@lrcsmonkey.net] - C:\Program Files (x86)\Lyrics_Monkey\128.xpi
FF StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Firefox\firefox.exe

==================== Services (Whitelisted) =================

R2 Garmin Core Update Service; C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [185688 2013-03-27] (Garmin Ltd or its subsidiaries)
R2 HPSLPSVC; C:\Users\Tom\AppData\Local\Temp\7zS3579\hpslpsvc64.dll [1039360 2012-11-14] (Hewlett-Packard Co.)
S3 Microsoft SharePoint Workspace Audit Service; C:\Program Files (x86)\Microsoft Office2010\Office14\GROOVE.EXE [30785672 2012-09-20] (Microsoft Corporation)
R2 MSMQ; C:\Windows\system32\mqsvc.exe [25088 2012-07-26] (Microsoft Corporation)
R2 PMBDeviceInfoProvider; C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe [474168 2012-04-22] (Sony Corporation)
S2 SynoDrService; C:\Program Files (x86)\Synology Data Replicator  3\SynoDrServicex64.exe [380928 2010-06-02] ()
R2 TVGOnlineUpdateSvc; C:\Program Files (x86)\TVG\OnlineUpdate\OnlineUpdateSvc.exe [398128 2010-12-14] ()
R2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [471552 2012-07-26] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

S3 androidusb; C:\Windows\System32\Drivers\androidusb.sys [32768 2010-04-29] (Google Inc)
S3 DigiartyVirtualCDBus; C:\Windows\System32\drivers\DigiartyVirtualCDBus.sys [276256 2013-08-28] (Digiarty Software, Inc.)
R2 easycvfs; C:\WINDOWS\system32\drivers\easycvfs.sys [109960 2009-11-09] ()
S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [17480 2012-12-21] ()
S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [17480 2012-12-21] ()
S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9800 2012-12-21] ()
S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9800 2012-12-21] ()
R1 HWiNFO32; C:\Program Files (x86)\HWiNFO32\HWiNFO64A.SYS [29288 2009-05-21] (REALiX(tm))
R1 HWiNFO32; C:\Program Files (x86)\HWiNFO32\HWiNFO64A.SYS [29288 2009-05-21] (REALiX(tm))
R3 MQAC; C:\Windows\System32\drivers\mqac.sys [185856 2012-07-26] (Microsoft Corporation)
S1 NNSNAHSL; C:\Windows\System32\DRIVERS\NNSNAHSL.sys [33320 2012-10-22] (Panda Security, S.L.)
S3 NTIOLib_1_0_4; C:\Program Files (x86)\MSI\Live Update 5\NTIOLib_X64.sys [14136 2010-10-22] (MSI)
S3 NTIOLib_1_0_4; C:\Program Files (x86)\MSI\Live Update 5\NTIOLib_X64.sys [14136 2010-10-22] (MSI)
S3 NTIOLib_1_0_6; C:\Program Files (x86)\Setup Files\Ms7586v1B0\NTIOLib_X64.sys [11888 2011-01-06] (MSI)
S3 NTIOLib_1_0_6; C:\Program Files (x86)\Setup Files\Ms7586v1B0\NTIOLib_X64.sys [11888 2011-01-06] (MSI)
R3 seehcri; C:\Windows\System32\drivers\seehcri.sys [34032 2008-01-09] (Sony Ericsson Mobile Communications)
R3 SKYNET; C:\Windows\system32\DRIVERS\SkyNET_AMD64.SYS [615440 2009-09-11] (TechniSat Digital, S.A.)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [828912 2011-08-16] (Duplex Secure Ltd.)
S3 vvftav; C:\Windows\System32\drivers\vvftav.sys [300800 2007-02-02] (Vimicro Corporation)
S3 ZSMC0305; C:\Windows\System32\Drivers\usbVM305.sys [1541120 2007-03-08] (Vimicro Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
U3 idsvc; 
S3 MSI_MSIBIOS_010507; \??\C:\Program Files (x86)\MSI\Live Update 5\msibios64_100507.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-29 21:13 - 2013-09-29 21:13 - 22537616 _____ (Mozilla) C:\Users\Tom\Downloads\Firefox Setup 24.0.exe
2013-09-29 20:41 - 2013-09-29 20:41 - 00020983 _____ C:\ComboFix.txt
2013-09-29 20:41 - 2013-09-29 20:41 - 00001454 _____ C:\Users\Tom_Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-09-29 20:41 - 2013-09-29 20:41 - 00000000 ____D C:\Users\Tom_Admin\AppData\Local\Packages
2013-09-29 20:22 - 2013-09-29 20:22 - 05130789 _____ (Swearware) C:\Users\Tom\Downloads\ComboFix.exe
2013-09-29 17:49 - 2013-09-29 21:27 - 00000000 ____D C:\Users\Tom\Desktop\Trojan
2013-09-29 16:47 - 2013-09-29 16:47 - 00001125 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-29 16:47 - 2013-09-29 16:47 - 00000000 ____D C:\Users\Tom_Admin\AppData\Roaming\Malwarebytes
2013-09-29 16:47 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2013-09-29 16:16 - 2013-09-29 16:16 - 00000000 _____ C:\Users\Tom_Admin\defogger_reenable
2013-09-29 14:13 - 2013-09-29 20:41 - 00000000 ____D C:\Qoobox
2013-09-29 14:13 - 2013-09-29 20:38 - 00000000 ____D C:\WINDOWS\erdnt
2013-09-29 14:13 - 2011-06-26 08:45 - 00256000 _____ C:\WINDOWS\PEV.exe
2013-09-29 14:13 - 2010-11-07 19:20 - 00208896 _____ C:\WINDOWS\MBR.exe
2013-09-29 14:13 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\WINDOWS\NIRCMD.exe
2013-09-29 14:13 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\WINDOWS\SWREG.exe
2013-09-29 14:13 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\WINDOWS\SWSC.exe
2013-09-29 14:13 - 2000-08-31 02:00 - 00212480 _____ (SteelWerX) C:\WINDOWS\SWXCACLS.exe
2013-09-29 14:13 - 2000-08-31 02:00 - 00098816 _____ C:\WINDOWS\sed.exe
2013-09-29 14:13 - 2000-08-31 02:00 - 00080412 _____ C:\WINDOWS\grep.exe
2013-09-29 14:13 - 2000-08-31 02:00 - 00068096 _____ C:\WINDOWS\zip.exe
2013-09-29 14:07 - 2013-09-29 14:07 - 05130789 ____R (Swearware) C:\Users\Tom\Desktop\ComboFix.exe
2013-09-29 14:01 - 2013-09-29 14:01 - 00000000 ____D C:\FRST
2013-09-27 14:21 - 2013-09-27 14:21 - 00000000 ____D C:\Users\Tom\Documents\SelfMV
2013-09-27 14:10 - 2013-09-27 14:10 - 00002018 _____ C:\Users\Public\Desktop\Samsung Kies (Lite).lnk
2013-09-27 14:10 - 2013-09-27 14:10 - 00002008 _____ C:\Users\Public\Desktop\Samsung Kies.lnk
2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\WINDOWS\LastGood.Tmp
2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Tom\Documents\samsung
2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Tom\AppData\Roaming\Samsung
2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Tom\AppData\Local\Samsung
2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Public\Documents\NativeFus_Log
2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Public\Documents\CrashDump
2013-09-27 14:08 - 2013-09-27 14:08 - 00000000 ____D C:\Program Files (x86)\MyFree Codec
2013-09-27 14:05 - 2013-09-27 14:09 - 00000000 ____D C:\ProgramData\Samsung
2013-09-27 14:05 - 2013-09-27 14:09 - 00000000 ____D C:\Program Files (x86)\Samsung
2013-09-27 14:05 - 2013-07-18 14:33 - 04659712 _____ (Dmitry Streblechenko) C:\WINDOWS\SysWOW64\Redemption.dll
2013-09-27 14:05 - 2013-07-18 14:32 - 00821824 _____ (Devguru Co., Ltd.) C:\WINDOWS\SysWOW64\dgderapi.dll
2013-09-27 14:03 - 2013-09-27 14:03 - 00000000 ____D C:\Users\Tom_Admin\AppData\Local\Downloaded Installations
2013-09-27 13:59 - 2013-09-27 13:59 - 00003328 _____ C:\WINDOWS\System32\Tasks\DriverTuner Startup
2013-09-27 13:59 - 2013-09-27 13:59 - 00001059 _____ C:\Users\Public\Desktop\DriverTuner.lnk
2013-09-27 13:59 - 2013-09-27 13:59 - 00000000 ____D C:\Users\Tom_Admin\AppData\Local\DriverTuner
2013-09-27 13:59 - 2013-09-27 13:59 - 00000000 ____D C:\Program Files (x86)\DriverTuner
2013-09-27 13:54 - 2013-09-27 13:54 - 00000000 ____D C:\Users\Tom\.android
2013-09-26 10:35 - 2013-09-26 10:35 - 00000103 _____ C:\WINDOWS\ParrotFlashWiz.INI
2013-09-26 10:33 - 2013-09-26 10:33 - 00000000 ____D C:\Program Files (x86)\Parrot Software Update Tool
2013-09-23 11:12 - 2013-09-23 11:12 - 1285878931 _____ C:\WINDOWS\MEMORY.DMP
2013-09-23 11:12 - 2013-09-23 11:12 - 00296000 _____ C:\WINDOWS\Minidump\092313-40466-01.dmp
2013-09-23 09:48 - 2013-09-23 09:48 - 00000426 _____ C:\Users\Tom_Admin\Desktop\Range Extender Settings.txt
2013-09-16 20:47 - 2013-08-07 07:15 - 00144896 _____ (Microsoft Corporation) C:\WINDOWS\system32\tssdisai.dll
2013-09-15 13:06 - 2013-09-15 13:07 - 00531240 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2013-09-15 10:43 - 2013-09-29 20:44 - 00008578 _____ C:\WINDOWS\PFRO.log
2013-09-14 17:15 - 2013-09-29 20:44 - 00234051 _____ C:\WINDOWS\setupact.log
2013-09-14 17:15 - 2013-09-14 17:15 - 00000000 _____ C:\WINDOWS\setuperr.log
2013-09-13 10:57 - 2013-09-29 21:02 - 01994993 _____ C:\WINDOWS\WindowsUpdate.log
2013-09-13 10:07 - 2013-09-13 10:07 - 00080878 _____ C:\Users\Tom_Admin\Documents\cc_20130913_100737.reg
2013-09-13 09:54 - 2013-09-13 09:55 - 04454952 _____ (Piriform Ltd) C:\Users\Tom_Admin\Downloads\ccsetup405.exe
2013-09-13 09:28 - 2013-09-13 09:28 - 00274944 _____ C:\Users\Tom\AppData\lsass.exe
2013-09-13 09:24 - 2013-08-16 07:41 - 00058200 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dam.sys
2013-09-13 09:24 - 2013-08-16 07:39 - 02371728 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSService.dll
2013-09-13 09:24 - 2013-08-16 07:39 - 00059416 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2013-09-13 09:24 - 2013-08-16 07:32 - 00209200 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationUI.exe
2013-09-13 09:24 - 2013-08-16 07:22 - 04917760 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppsvc.exe
2013-09-13 09:24 - 2013-08-16 07:22 - 00040448 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe
2013-09-13 09:24 - 2013-08-16 07:21 - 03275776 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2013-09-13 09:24 - 2013-08-16 07:21 - 01621504 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll
2013-09-13 09:24 - 2013-08-16 07:21 - 01164288 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll
2013-09-13 09:24 - 2013-08-16 07:21 - 00773120 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2013-09-13 09:24 - 2013-08-16 07:21 - 00688640 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll
2013-09-13 09:24 - 2013-08-16 07:21 - 00368640 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppwinob.dll
2013-09-13 09:24 - 2013-08-16 07:21 - 00252416 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll
2013-09-13 09:24 - 2013-08-16 07:21 - 00204800 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSClient.dll
2013-09-13 09:24 - 2013-08-16 07:21 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll
2013-09-13 09:24 - 2013-08-16 07:21 - 00183808 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSSync.dll
2013-09-13 09:24 - 2013-08-16 07:21 - 00174592 _____ (Microsoft Corporation) C:\WINDOWS\system32\storewuauth.dll
2013-09-13 09:24 - 2013-08-16 07:21 - 00163840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2013-09-13 09:24 - 2013-08-16 07:21 - 00142848 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll
2013-09-13 09:24 - 2013-08-16 07:21 - 00120320 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppc.dll
2013-09-13 09:24 - 2013-08-16 07:21 - 00099328 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll
2013-09-13 09:24 - 2013-08-16 07:21 - 00081408 _____ (Microsoft Corporation) C:\WINDOWS\system32\setupcln.dll
2013-09-13 09:24 - 2013-08-16 07:21 - 00049664 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups.dll
2013-09-13 09:24 - 2013-08-16 07:21 - 00049152 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups2.dll
2013-09-13 09:24 - 2013-08-16 07:20 - 00105984 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinSetupUI.dll
2013-09-13 09:24 - 2013-08-16 00:43 - 00628736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2013-09-13 09:24 - 2013-08-16 00:43 - 00562688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll
2013-09-13 09:24 - 2013-08-16 00:43 - 00167424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSClient.dll
2013-09-13 09:24 - 2013-08-16 00:43 - 00159232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSSync.dll
2013-09-13 09:24 - 2013-08-16 00:43 - 00143872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.dll
2013-09-13 09:24 - 2013-08-16 00:43 - 00126976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll
2013-09-13 09:24 - 2013-08-16 00:43 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2013-09-13 09:24 - 2013-08-16 00:43 - 00084992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll
2013-09-13 09:24 - 2013-08-16 00:43 - 00083968 _____ C:\WINDOWS\SysWOW64\OEMLicense.dll
2013-09-13 09:24 - 2013-08-16 00:43 - 00035328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe
2013-09-13 09:24 - 2013-08-16 00:43 - 00020992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wups.dll
2013-09-13 09:24 - 2013-08-16 00:42 - 00091648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sppc.dll
2013-09-13 09:24 - 2013-08-16 00:42 - 00076800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\setupcln.dll
2013-09-13 09:23 - 2013-08-21 06:12 - 02241024 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2013-09-13 09:23 - 2013-08-21 06:12 - 00051712 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2013-09-13 09:23 - 2013-08-21 06:11 - 19246592 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2013-09-13 09:23 - 2013-08-21 06:11 - 15404544 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2013-09-13 09:23 - 2013-08-21 06:11 - 03959296 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2013-09-13 09:23 - 2013-08-21 06:11 - 02647040 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2013-09-13 09:23 - 2013-08-21 06:11 - 01365504 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2013-09-13 09:23 - 2013-08-21 06:11 - 00915968 _____ (Microsoft Corporation) C:\WINDOWS\system32\uxtheme.dll
2013-09-13 09:23 - 2013-08-21 06:11 - 00855552 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2013-09-13 09:23 - 2013-08-21 06:11 - 00603136 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2013-09-13 09:23 - 2013-08-21 06:11 - 00136704 _____ (Microsoft Corporation) C:\WINDOWS\system32\iesysprep.dll
2013-09-13 09:23 - 2013-08-21 06:11 - 00067072 _____ (Microsoft Corporation) C:\WINDOWS\system32\iesetup.dll
2013-09-13 09:23 - 2013-08-21 06:11 - 00053760 _____ (Microsoft Corporation) C:\WINDOWS\system32\UXInit.dll
2013-09-13 09:23 - 2013-08-21 06:11 - 00053760 _____ (Microsoft Corporation) C:\WINDOWS\system32\jsproxy.dll
2013-09-13 09:23 - 2013-08-21 06:11 - 00039936 _____ (Microsoft Corporation) C:\WINDOWS\system32\iernonce.dll
2013-09-13 09:23 - 2013-08-21 04:34 - 02706432 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.tlb
2013-09-13 09:23 - 2013-08-21 04:06 - 01767936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2013-09-13 09:23 - 2013-08-21 04:06 - 01141248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2013-09-13 09:23 - 2013-08-21 04:06 - 00044032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UXInit.dll
2013-09-13 09:23 - 2013-08-21 04:05 - 14332928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2013-09-13 09:23 - 2013-08-21 04:05 - 13761024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2013-09-13 09:23 - 2013-08-21 04:05 - 02876928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2013-09-13 09:23 - 2013-08-21 04:05 - 02048000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2013-09-13 09:23 - 2013-08-21 04:05 - 00690688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2013-09-13 09:23 - 2013-08-21 04:05 - 00493056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2013-09-13 09:23 - 2013-08-21 04:05 - 00109056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iesysprep.dll
2013-09-13 09:23 - 2013-08-21 04:05 - 00061440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iesetup.dll
2013-09-13 09:23 - 2013-08-21 04:05 - 00039936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jsproxy.dll
2013-09-13 09:23 - 2013-08-21 04:05 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iernonce.dll
2013-09-13 09:23 - 2013-08-21 03:43 - 02706432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.tlb
2013-09-13 09:23 - 2013-08-21 01:52 - 00534528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\uxtheme.dll
2013-09-13 09:23 - 2013-08-03 06:30 - 04038144 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2013-09-12 22:38 - 2013-09-12 22:38 - 00001604 _____ C:\Users\Public\Desktop\Angry Birds Star Wars.lnk
2013-09-11 21:10 - 2013-07-09 10:04 - 00120144 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\msgpioclx.sys
2013-09-11 21:10 - 2013-07-09 08:18 - 00439488 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe
2013-09-11 21:10 - 2013-07-09 06:25 - 00385768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe
2013-09-11 21:10 - 2013-07-09 00:46 - 00414208 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanconn.dll
2013-09-11 21:10 - 2013-07-09 00:46 - 00370688 _____ (Microsoft Corporation) C:\WINDOWS\system32\Wwanadvui.dll
2013-09-11 21:10 - 2013-07-06 02:16 - 01025024 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll
2013-09-11 21:10 - 2013-07-03 02:23 - 00778752 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleaut32.dll
2013-09-11 21:10 - 2013-07-03 02:22 - 02839552 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll
2013-09-11 21:10 - 2013-07-03 02:22 - 01300480 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32.dll
2013-09-11 21:10 - 2013-07-03 02:11 - 00551424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleaut32.dll
2013-09-11 21:10 - 2013-07-03 02:11 - 00268800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.BackgroundTransfer.dll
2013-09-11 21:10 - 2013-07-03 02:10 - 02273792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll
2013-09-11 21:10 - 2013-06-29 08:15 - 00195416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys
2013-09-11 21:10 - 2013-06-29 08:15 - 00125784 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpsd.sys
2013-09-11 21:10 - 2013-06-29 07:43 - 00327512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Classpnp.sys
2013-09-11 21:10 - 2013-06-25 00:54 - 00447488 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll
2013-09-11 21:10 - 2013-06-25 00:54 - 00263680 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmsvc.dll
2013-09-11 21:10 - 2013-06-25 00:54 - 00074240 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmcsp.dll
2013-09-11 21:10 - 2013-06-19 07:36 - 00183808 _____ (Microsoft Corporation) C:\WINDOWS\system32\winmmbase.dll
2013-09-11 21:10 - 2013-06-19 07:36 - 00115712 _____ (Microsoft Corporation) C:\WINDOWS\system32\winmm.dll
2013-09-11 21:10 - 2013-06-19 00:38 - 00160256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmmbase.dll
2013-09-11 21:10 - 2013-06-19 00:38 - 00125440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmm.dll
2013-09-11 21:10 - 2013-06-12 01:26 - 00230912 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinSCard.dll
2013-09-11 21:10 - 2013-06-10 23:17 - 00096512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wfplwfs.sys
2013-09-11 21:10 - 2013-06-10 21:15 - 01156096 _____ (Microsoft Corporation) C:\WINDOWS\system32\IKEEXT.DLL
2013-09-11 21:10 - 2013-06-10 21:15 - 00723968 _____ (Microsoft Corporation) C:\WINDOWS\system32\BFE.DLL
2013-09-11 21:10 - 2013-06-10 21:15 - 00381952 _____ (Microsoft Corporation) C:\WINDOWS\system32\FWPUCLNT.DLL
2013-09-11 21:10 - 2013-06-06 10:03 - 00119040 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBSTOR.SYS
2013-09-11 21:09 - 2013-07-09 05:57 - 00245760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LocationApi.dll
2013-09-11 21:09 - 2013-07-09 00:46 - 00543744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanmm.dll
2013-09-11 21:09 - 2013-07-09 00:45 - 00312832 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationApi.dll
2013-09-11 21:09 - 2013-07-03 02:23 - 00391168 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.BackgroundTransfer.dll
2013-09-11 21:09 - 2013-07-02 00:08 - 00387583 _____ C:\WINDOWS\system32\ApnDatabase.xml
2013-09-11 21:09 - 2013-07-01 00:30 - 00067072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\openfiles.exe
2013-09-11 21:09 - 2013-07-01 00:29 - 00077312 _____ (Microsoft Corporation) C:\WINDOWS\system32\openfiles.exe
2013-09-11 21:09 - 2013-06-29 03:12 - 01022464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32.dll
2013-09-11 21:09 - 2013-06-26 05:01 - 00321536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\udfs.sys
2013-09-11 21:09 - 2013-06-12 01:43 - 00154112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinSCard.dll
2013-09-11 21:09 - 2013-06-10 21:16 - 00888832 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshwfp.dll
2013-09-11 21:09 - 2013-06-10 21:10 - 00702464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nshwfp.dll
2013-09-11 21:09 - 2013-06-10 21:10 - 00245248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FWPUCLNT.DLL
2013-09-11 21:09 - 2013-04-03 01:37 - 00025088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cryptdlg.dll
2013-09-11 21:09 - 2013-04-03 01:12 - 00030720 _____ (Microsoft Corporation) C:\WINDOWS\system32\cryptdlg.dll
2013-09-11 21:09 - 2013-03-22 05:49 - 02382336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\esent.dll
2013-09-11 21:09 - 2013-03-22 00:47 - 02851840 _____ (Microsoft Corporation) C:\WINDOWS\system32\esent.dll
2013-09-11 21:09 - 2013-03-02 10:23 - 00375808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ReAgent.dll
2013-09-11 21:09 - 2013-03-02 04:44 - 01011200 _____ (Microsoft Corporation) C:\WINDOWS\system32\reseteng.dll
2013-09-11 21:09 - 2012-12-15 06:55 - 00443392 _____ (Microsoft Corporation) C:\WINDOWS\system32\ReAgent.dll
2013-09-11 21:09 - 2012-11-03 07:26 - 00132096 _____ (Microsoft Corporation) C:\WINDOWS\system32\sysreset.exe
2013-09-11 21:09 - 2012-11-03 07:25 - 00945152 _____ (Microsoft Corporation) C:\WINDOWS\system32\resetengmig.dll
2013-09-11 21:09 - 2012-10-24 05:25 - 00026624 _____ (Microsoft Corporation) C:\WINDOWS\system32\ReAgentc.exe
2013-09-11 21:09 - 2012-10-24 05:25 - 00013312 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcalua.exe
2013-09-11 21:09 - 2012-10-24 05:24 - 00405504 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcasvc.dll
2013-09-11 21:09 - 2012-10-24 05:24 - 00031232 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcadm.dll
2013-09-11 21:09 - 2012-10-24 05:05 - 00011776 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcaevts.dll
2013-09-11 21:09 - 2012-10-24 04:48 - 00024064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ReAgentc.exe
2013-09-09 10:23 - 2013-09-09 10:23 - 00000000 ____D C:\Users\Tom_Admin\AppData\Roaming\Foxit Software
2013-09-09 10:23 - 2013-06-09 21:59 - 00216064 _____ C:\WINDOWS\SysWOW64\gcapi_dll.dll
2013-09-01 16:29 - 2013-09-01 16:29 - 00000650 _____ C:\Users\Tom_Admin\Desktop\Führerschein Trainer 2012.lnk
2013-09-01 16:29 - 2013-09-01 16:29 - 00000000 ____D C:\WINDOWS\SysWOW64\fstrainer2011
2013-09-01 16:29 - 2008-01-03 19:19 - 00581632 _____ (Adobe Systems, Inc.) C:\WINDOWS\SysWOW64\Control.dll
2013-09-01 16:29 - 2004-12-07 10:09 - 00347136 _____ C:\WINDOWS\SysWOW64\unicows.pdb
2013-09-01 16:29 - 2004-08-04 07:21 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msado27.tlb
2013-09-01 16:29 - 2004-03-08 21:00 - 00152848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comdlg32.ocx
2013-09-01 14:49 - 2013-09-09 10:36 - 00000942 _____ C:\Users\Public\Desktop\calibre 64bit - E-book management.lnk
2013-09-01 14:49 - 2013-09-09 10:36 - 00000000 ____D C:\Program Files\Calibre2
2013-09-01 14:49 - 2013-09-01 18:42 - 00000000 ____D C:\Users\Tom\AppData\Local\calibre-cache
2013-09-01 14:42 - 2013-09-01 14:42 - 00036256 _____ C:\Users\TomAdminPW_Ur\Documents\cc_20130901_144221.reg
2013-09-01 14:37 - 2013-09-01 14:37 - 00001848 _____ C:\Users\TomAdminPW_Ur\Desktop\SpeedCommanderPortable.lnk
2013-09-01 14:34 - 2013-09-01 14:34 - 00292514 _____ C:\Users\TomAdminPW_Ur\Documents\cc_20130901_143447.reg
2013-08-30 16:11 - 2013-08-30 16:11 - 00000000 ____D C:\Users\TomAdminPW_Ur\AppData\Roaming\Apple Computer

==================== One Month Modified Files and Folders =======

2013-09-29 21:27 - 2013-09-29 17:49 - 00000000 ____D C:\Users\Tom\Desktop\Trojan
2013-09-29 21:22 - 2009-07-14 04:34 - 00001106 _____ C:\WINDOWS\win.ini
2013-09-29 21:21 - 2012-08-15 10:55 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2013-09-29 21:13 - 2013-09-29 21:13 - 22537616 _____ (Mozilla) C:\Users\Tom\Downloads\Firefox Setup 24.0.exe
2013-09-29 21:02 - 2013-09-13 10:57 - 01994993 _____ C:\WINDOWS\WindowsUpdate.log
2013-09-29 21:00 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\system32\sru
2013-09-29 20:51 - 2013-01-02 10:05 - 00003598 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1318767841-1341867437-3819663778-1003
2013-09-29 20:44 - 2013-09-15 10:43 - 00008578 _____ C:\WINDOWS\PFRO.log
2013-09-29 20:44 - 2013-09-14 17:15 - 00234051 _____ C:\WINDOWS\setupact.log
2013-09-29 20:44 - 2013-01-02 02:50 - 00000000 ____D C:\ProgramData\NVIDIA
2013-09-29 20:44 - 2012-07-26 09:22 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2013-09-29 20:42 - 2010-01-24 03:21 - 00000000 ___RD C:\Users\Tom_Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-29 20:42 - 2010-01-24 03:21 - 00000000 ___RD C:\Users\Tom_Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-29 20:41 - 2013-09-29 20:41 - 00020983 _____ C:\ComboFix.txt
2013-09-29 20:41 - 2013-09-29 20:41 - 00001454 _____ C:\Users\Tom_Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-09-29 20:41 - 2013-09-29 20:41 - 00000000 ____D C:\Users\Tom_Admin\AppData\Local\Packages
2013-09-29 20:41 - 2013-09-29 14:13 - 00000000 ____D C:\Qoobox
2013-09-29 20:38 - 2013-09-29 14:13 - 00000000 ____D C:\WINDOWS\erdnt
2013-09-29 20:32 - 2012-07-26 07:26 - 00000215 _____ C:\WINDOWS\system.ini
2013-09-29 20:30 - 2013-08-17 10:39 - 00000000 ____D C:\Program Files (x86)\Firefox!
2013-09-29 20:22 - 2013-09-29 20:22 - 05130789 _____ (Swearware) C:\Users\Tom\Downloads\ComboFix.exe
2013-09-29 17:50 - 2012-07-26 12:27 - 00863478 _____ C:\WINDOWS\system32\perfh007.dat
2013-09-29 17:50 - 2012-07-26 12:27 - 00197036 _____ C:\WINDOWS\system32\perfc007.dat
2013-09-29 17:50 - 2012-07-26 09:28 - 02029610 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2013-09-29 17:44 - 2013-08-25 14:40 - 00000000 ____D C:\Program Files (x86)\MyPC Backup
2013-09-29 17:35 - 2013-06-01 13:54 - 00000000 ____D C:\Users\Tom\Desktop\Calibre
2013-09-29 16:47 - 2013-09-29 16:47 - 00001125 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-29 16:47 - 2013-09-29 16:47 - 00000000 ____D C:\Users\Tom_Admin\AppData\Roaming\Malwarebytes
2013-09-29 16:47 - 2012-09-09 20:42 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-29 16:16 - 2013-09-29 16:16 - 00000000 _____ C:\Users\Tom_Admin\defogger_reenable
2013-09-29 16:16 - 2013-01-02 02:54 - 00000000 ____D C:\Users\Tom_Admin
2013-09-29 14:47 - 2012-07-26 07:26 - 93847552 _____ C:\WINDOWS\system32\config\SOFTWARE.bak
2013-09-29 14:47 - 2012-07-26 07:26 - 14680064 _____ C:\WINDOWS\system32\config\SYSTEM.bak
2013-09-29 14:47 - 2012-07-26 07:26 - 00786432 _____ C:\WINDOWS\system32\config\DEFAULT.bak
2013-09-29 14:47 - 2012-07-26 07:26 - 00262144 _____ C:\WINDOWS\system32\config\SECURITY.bak
2013-09-29 14:47 - 2012-07-26 07:26 - 00262144 _____ C:\WINDOWS\system32\config\SAM.bak
2013-09-29 14:07 - 2013-09-29 14:07 - 05130789 ____R (Swearware) C:\Users\Tom\Desktop\ComboFix.exe
2013-09-29 14:01 - 2013-09-29 14:01 - 00000000 ____D C:\FRST
2013-09-29 12:59 - 2012-07-26 10:08 - 05734400 _____ C:\WINDOWS\system32\config\DRIVERS.bak
2013-09-27 17:54 - 2013-02-26 22:16 - 00000000 ____D C:\Users\Tom\AppData\Roaming\Simple Sudoku
2013-09-27 17:20 - 2013-03-18 16:32 - 00013213 _____ C:\Users\Tom\Desktop\Wasserverbrauch.xlsx
2013-09-27 17:10 - 2013-03-18 16:19 - 00015297 _____ C:\Users\Tom\Desktop\Stromverbrauch.xlsx
2013-09-27 14:41 - 2012-12-02 22:30 - 00000000 ____D C:\Users\Tom\AppData\Roaming\MyPhoneExplorer
2013-09-27 14:21 - 2013-09-27 14:21 - 00000000 ____D C:\Users\Tom\Documents\SelfMV
2013-09-27 14:10 - 2013-09-27 14:10 - 00002018 _____ C:\Users\Public\Desktop\Samsung Kies (Lite).lnk
2013-09-27 14:10 - 2013-09-27 14:10 - 00002008 _____ C:\Users\Public\Desktop\Samsung Kies.lnk
2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\WINDOWS\LastGood.Tmp
2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Tom\Documents\samsung
2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Tom\AppData\Roaming\Samsung
2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Tom\AppData\Local\Samsung
2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Public\Documents\NativeFus_Log
2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Public\Documents\CrashDump
2013-09-27 14:09 - 2013-09-27 14:05 - 00000000 ____D C:\ProgramData\Samsung
2013-09-27 14:09 - 2013-09-27 14:05 - 00000000 ____D C:\Program Files (x86)\Samsung
2013-09-27 14:08 - 2013-09-27 14:08 - 00000000 ____D C:\Program Files (x86)\MyFree Codec
2013-09-27 14:05 - 2010-01-24 03:50 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-09-27 14:03 - 2013-09-27 14:03 - 00000000 ____D C:\Users\Tom_Admin\AppData\Local\Downloaded Installations
2013-09-27 13:59 - 2013-09-27 13:59 - 00003328 _____ C:\WINDOWS\System32\Tasks\DriverTuner Startup
2013-09-27 13:59 - 2013-09-27 13:59 - 00001059 _____ C:\Users\Public\Desktop\DriverTuner.lnk
2013-09-27 13:59 - 2013-09-27 13:59 - 00000000 ____D C:\Users\Tom_Admin\AppData\Local\DriverTuner
2013-09-27 13:59 - 2013-09-27 13:59 - 00000000 ____D C:\Program Files (x86)\DriverTuner
2013-09-27 13:54 - 2013-09-27 13:54 - 00000000 ____D C:\Users\Tom\.android
2013-09-27 13:54 - 2013-01-02 02:54 - 00000000 ____D C:\Users\Tom
2013-09-27 13:54 - 2012-12-02 22:30 - 00002073 _____ C:\Users\Public\Desktop\MyPhoneExplorer.lnk
2013-09-27 13:54 - 2012-12-02 22:30 - 00000000 ____D C:\Program Files (x86)\MyPhoneExplorer
2013-09-26 11:47 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\AUInstallAgent
2013-09-26 10:35 - 2013-09-26 10:35 - 00000103 _____ C:\WINDOWS\ParrotFlashWiz.INI
2013-09-26 10:33 - 2013-09-26 10:33 - 00000000 ____D C:\Program Files (x86)\Parrot Software Update Tool
2013-09-25 17:58 - 2011-03-22 23:38 - 00000000 ____D C:\Users\Tom\AppData\Roaming\Foxit Software
2013-09-23 11:12 - 2013-09-23 11:12 - 1285878931 _____ C:\WINDOWS\MEMORY.DMP
2013-09-23 11:12 - 2013-09-23 11:12 - 00296000 _____ C:\WINDOWS\Minidump\092313-40466-01.dmp
2013-09-23 11:12 - 2013-01-12 07:48 - 00000000 ____D C:\WINDOWS\Minidump
2013-09-23 09:48 - 2013-09-23 09:48 - 00000426 _____ C:\Users\Tom_Admin\Desktop\Range Extender Settings.txt
2013-09-19 01:26 - 2013-01-10 23:02 - 00694232 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2013-09-19 01:26 - 2013-01-10 23:02 - 00078296 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-18 16:22 - 2013-06-05 11:18 - 00322048 ___SH C:\Users\Tom\Desktop\Thumbs.db
2013-09-18 16:22 - 2013-02-06 22:20 - 00000000 ____D C:\Users\Tom\Desktop\KabelBW
2013-09-15 15:57 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\rescache
2013-09-15 15:38 - 2013-02-23 11:24 - 00000586 _____ C:\Users\Public\Desktop\mkvmerge GUI.lnk
2013-09-15 13:07 - 2013-09-15 13:06 - 00531240 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2013-09-15 01:14 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\WinStore
2013-09-15 01:14 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\PolicyDefinitions
2013-09-15 00:05 - 2010-06-01 00:58 - 00000000 ____D C:\Users\Tom\AppData\Local\QuickPar
2013-09-14 17:15 - 2013-09-14 17:15 - 00000000 _____ C:\WINDOWS\setuperr.log
2013-09-14 11:57 - 2010-06-01 01:01 - 00018944 _____ C:\Users\Tom\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-09-14 03:02 - 2010-05-09 20:21 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-09-13 11:06 - 2013-08-19 11:05 - 00000000 ____D C:\WINDOWS\system32\MRT
2013-09-13 11:03 - 2009-10-14 07:12 - 79143768 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2013-09-13 10:07 - 2013-09-13 10:07 - 00080878 _____ C:\Users\Tom_Admin\Documents\cc_20130913_100737.reg
2013-09-13 09:58 - 2013-08-25 14:42 - 00000834 _____ C:\Users\Public\Desktop\CCleaner.lnk
2013-09-13 09:58 - 2013-08-25 14:42 - 00000000 ____D C:\Program Files\CCleaner
2013-09-13 09:55 - 2013-09-13 09:54 - 04454952 _____ (Piriform Ltd) C:\Users\Tom_Admin\Downloads\ccsetup405.exe
2013-09-13 09:28 - 2013-09-13 09:28 - 00274944 _____ C:\Users\Tom\AppData\lsass.exe
2013-09-13 09:06 - 2012-07-26 07:26 - 00524288 ___SH C:\WINDOWS\system32\config\BBI
2013-09-13 09:05 - 2012-07-26 07:38 - 00000000 ____D C:\WINDOWS\system32\oobe
2013-09-12 22:38 - 2013-09-12 22:38 - 00001604 _____ C:\Users\Public\Desktop\Angry Birds Star Wars.lnk
2013-09-12 22:38 - 2013-07-05 12:47 - 00000000 ____D C:\Users\Tom\AppData\Roaming\Rovio Entertainment Ltd
2013-09-10 18:21 - 2013-01-31 10:20 - 00003772 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2013-09-10 15:45 - 2013-05-04 21:34 - 00000000 ____D C:\Users\Tom\Documents\Settlers7
2013-09-09 10:36 - 2013-09-01 14:49 - 00000942 _____ C:\Users\Public\Desktop\calibre 64bit - E-book management.lnk
2013-09-09 10:36 - 2013-09-01 14:49 - 00000000 ____D C:\Program Files\Calibre2
2013-09-09 10:23 - 2013-09-09 10:23 - 00000000 ____D C:\Users\Tom_Admin\AppData\Roaming\Foxit Software
2013-09-02 16:17 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\system32\NDF
2013-09-01 18:42 - 2013-09-01 14:49 - 00000000 ____D C:\Users\Tom\AppData\Local\calibre-cache
2013-09-01 16:29 - 2013-09-01 16:29 - 00000650 _____ C:\Users\Tom_Admin\Desktop\Führerschein Trainer 2012.lnk
2013-09-01 16:29 - 2013-09-01 16:29 - 00000000 ____D C:\WINDOWS\SysWOW64\fstrainer2011
2013-09-01 16:29 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\SysWOW64\Macromed
2013-09-01 16:29 - 2012-07-10 13:44 - 00000000 ____D C:\WINDOWS\SysWOW64\Adobe
2013-09-01 16:29 - 2010-12-03 17:21 - 00000000 ____D C:\Users\Tom_Admin\AppData\Roaming\Macromedia
2013-09-01 16:29 - 2010-12-03 17:21 - 00000000 ____D C:\Users\Tom_Admin\AppData\Roaming\Adobe
2013-09-01 14:42 - 2013-09-01 14:42 - 00036256 _____ C:\Users\TomAdminPW_Ur\Documents\cc_20130901_144221.reg
2013-09-01 14:41 - 2013-02-17 20:48 - 00000000 ____D C:\Users\TomAdminPW_Ur\AppData\Roaming\SpeedProject
2013-09-01 14:37 - 2013-09-01 14:37 - 00001848 _____ C:\Users\TomAdminPW_Ur\Desktop\SpeedCommanderPortable.lnk
2013-09-01 14:34 - 2013-09-01 14:34 - 00292514 _____ C:\Users\TomAdminPW_Ur\Documents\cc_20130901_143447.reg
2013-09-01 14:29 - 2013-02-17 20:51 - 00003600 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1318767841-1341867437-3819663778-1004
2013-08-30 16:11 - 2013-08-30 16:11 - 00000000 ____D C:\Users\TomAdminPW_Ur\AppData\Roaming\Apple Computer
2013-08-30 16:11 - 2011-03-30 11:05 - 00000000 ___RD C:\Users\TomAdminPW_Ur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-08-30 16:11 - 2011-03-30 11:05 - 00000000 ___RD C:\Users\TomAdminPW_Ur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools

Some content of TEMP:
====================
C:\Users\Tom\AppData\Local\temp\cvtres.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-29 18:50

==================== End Of Log ============================
--- --- ---
Alt 29.09.2013, 20:46   #14
aharonov
/// TB-Ausbilder
 
Windows 8, Infektion mit Win32/Fynloski.A? - Standard

Windows 8, Infektion mit Win32/Fynloski.A?


Mit dem Firefox klappt auch nach dem CFScript aus obigem Post nichts mehr?
__________________
cheers,
Leo

Alt 29.09.2013, 21:07   #15
Rupsi
 
Windows 8, Infektion mit Win32/Fynloski.A? - Standard

Windows 8, Infektion mit Win32/Fynloski.A?


Firefox scheint wieder zu gehen.

Hier log con ComboFix
Code:
ATTFilter
ComboFix 13-09-28.02 - Tom_Admin 29.09.2013  21:42:50.4.4 - x64
Microsoft Windows 8 Pro  6.2.9200.0.1252.49.1031.18.8183.6480 [GMT 2:00]
ausgeführt von:: c:\users\Tom\Desktop\ComboFix.exe
AV: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Tom\AppData\Roaming\dclogs
c:\users\Tom\AppData\Roaming\dclogs\2013-09-29-1.dc
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-08-28 bis 2013-09-29  ))))))))))))))))))))))))))))))
.
.
2013-09-29 19:47 . 2013-09-29 19:47	--------	d-----w-	c:\users\UpdatusUser\AppData\Local\temp
2013-09-29 19:47 . 2013-09-29 19:47	--------	d-----w-	c:\users\TomAdminPW_Ur\AppData\Local\temp
2013-09-29 19:47 . 2013-09-29 19:47	--------	d-----w-	c:\users\Tom_Admin\AppData\Local\temp
2013-09-29 19:47 . 2013-09-29 19:47	--------	d-----w-	c:\users\Max\AppData\Local\temp
2013-09-29 19:47 . 2013-09-29 19:47	--------	d-----w-	c:\users\eingeschränkt\AppData\Local\temp
2013-09-29 19:47 . 2013-09-29 19:47	--------	d-----w-	c:\users\DefaultAppPool\AppData\Local\temp
2013-09-29 19:47 . 2013-09-29 19:47	--------	d-----w-	c:\users\Default\AppData\Local\temp
2013-09-29 19:47 . 2013-09-29 19:47	--------	d-----w-	c:\users\Default.migrated\AppData\Local\temp
2013-09-29 18:41 . 2013-09-29 18:41	--------	d-----w-	c:\users\Tom_Admin\AppData\Local\Packages
2013-09-29 16:33 . 2013-09-29 16:33	76232	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{4990ED62-4329-48A1-B089-52FD3C187F84}\offreg.dll
2013-09-29 14:47 . 2013-09-29 14:47	--------	d-----w-	c:\users\Tom_Admin\AppData\Roaming\Malwarebytes
2013-09-29 14:47 . 2013-04-04 12:50	25928	----a-w-	c:\windows\system32\drivers\mbam.sys
2013-09-29 12:01 . 2013-09-29 12:01	--------	d-----w-	C:\FRST
2013-09-29 10:22 . 2013-09-05 05:32	9694160	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{4990ED62-4329-48A1-B089-52FD3C187F84}\mpengine.dll
2013-09-27 12:10 . 2013-09-27 12:10	--------	d-----w-	c:\users\Tom\AppData\Local\Samsung
2013-09-27 12:10 . 2013-09-27 12:10	--------	d-----w-	c:\users\Tom\AppData\Roaming\Samsung
2013-09-27 12:10 . 2013-09-27 12:10	--------	d-----w-	c:\windows\LastGood.Tmp
2013-09-27 12:08 . 2013-09-27 12:08	--------	d-----w-	c:\program files (x86)\MyFree Codec
2013-09-27 12:05 . 2013-07-18 12:33	4659712	----a-w-	c:\windows\SysWow64\Redemption.dll
2013-09-27 12:05 . 2013-07-18 12:32	821824	----a-w-	c:\windows\SysWow64\dgderapi.dll
2013-09-27 12:05 . 2013-09-27 12:09	--------	d-----w-	c:\program files (x86)\Samsung
2013-09-27 12:05 . 2013-09-27 12:09	--------	d-----w-	c:\programdata\Samsung
2013-09-27 12:03 . 2013-09-27 12:03	--------	d-----w-	c:\users\Tom_Admin\AppData\Local\Downloaded Installations
2013-09-27 11:59 . 2013-09-27 11:59	--------	d-----w-	c:\users\Tom_Admin\AppData\Local\DriverTuner
2013-09-27 11:59 . 2013-09-27 11:59	--------	d-----w-	c:\program files (x86)\DriverTuner
2013-09-27 11:54 . 2013-09-27 11:54	--------	d-----w-	c:\users\Tom\.android
2013-09-26 08:33 . 2013-09-26 08:33	--------	d-----w-	c:\program files (x86)\Parrot Software Update Tool
2013-09-16 18:47 . 2013-08-07 05:15	144896	----a-w-	c:\windows\system32\tssdisai.dll
2013-09-13 07:23 . 2013-08-21 04:11	19246592	----a-w-	c:\windows\system32\mshtml.dll
2013-09-11 19:09 . 2013-07-09 03:57	245760	----a-w-	c:\windows\SysWow64\LocationApi.dll
2013-09-09 08:23 . 2013-06-09 19:59	216064	----a-w-	c:\windows\SysWow64\gcapi_dll.dll
2013-09-09 08:23 . 2013-09-09 08:23	--------	d-----w-	c:\users\Tom_Admin\AppData\Roaming\Foxit Software
2013-09-01 14:29 . 2013-09-01 14:29	--------	d-----w-	c:\windows\SysWow64\fstrainer2011
2013-09-01 14:29 . 2008-01-03 17:19	581632	----a-w-	c:\windows\SysWow64\Control.dll
2013-09-01 14:29 . 2004-03-08 19:00	152848	----a-w-	c:\windows\SysWow64\comdlg32.ocx
2013-09-01 14:29 . 2004-08-04 05:21	81920	----a-w-	c:\windows\SysWow64\msado27.tlb
2013-09-01 12:49 . 2013-09-01 16:42	--------	d-----w-	c:\users\Tom\AppData\Local\calibre-cache
2013-09-01 12:49 . 2013-09-09 08:36	--------	d-----w-	c:\program files\Calibre2
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-09-29 18:44 . 2013-01-02 00:53	4194304	----a-w-	c:\windows\ServiceProfiles\NetworkService\msmqlog.bin
2013-09-18 23:26 . 2013-01-10 21:02	78296	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-09-18 23:26 . 2013-01-10 21:02	694232	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2013-09-13 09:03 . 2009-10-14 05:12	79143768	----a-w-	c:\windows\system32\MRT.exe
2013-09-05 17:00 . 2013-03-09 09:10	17536	----a-w-	c:\programdata\Microsoft\windowssampling\Sqm\Manifest\Sqm3.bin
2013-08-28 19:13 . 2013-08-28 19:13	276256	----a-w-	c:\windows\system32\drivers\DigiartyVirtualCDBus.sys
2013-08-20 05:02 . 2013-08-20 05:02	204568	----a-w-	c:\windows\system32\drivers\ssudmdm.sys
2013-08-20 05:02 . 2013-08-20 05:02	103576	----a-w-	c:\windows\system32\drivers\ssudbus.sys
2013-07-18 12:32 . 2013-07-18 12:32	90112	----a-w-	c:\windows\MAMCityDownload.ocx
2013-07-18 12:32 . 2013-07-18 12:32	330240	----a-w-	c:\windows\MASetupCaller.dll
2013-07-18 12:32 . 2013-07-18 12:32	30568	----a-w-	c:\windows\MusiccityDownload.exe
2013-07-18 12:32 . 2013-07-18 12:32	974848	----a-w-	c:\windows\SysWow64\cis-2.4.dll
2013-07-18 12:32 . 2013-07-18 12:32	81920	----a-w-	c:\windows\SysWow64\issacapi_bs-2.3.dll
2013-07-18 12:32 . 2013-07-18 12:32	65536	----a-w-	c:\windows\SysWow64\issacapi_pe-2.3.dll
2013-07-18 12:32 . 2013-07-18 12:32	57344	----a-w-	c:\windows\SysWow64\MTXSYNCICON.dll
2013-07-18 12:32 . 2013-07-18 12:32	57344	----a-w-	c:\windows\SysWow64\MK_Lyric.dll
2013-07-18 12:32 . 2013-07-18 12:32	57344	----a-w-	c:\windows\SysWow64\issacapi_se-2.3.dll
2013-07-18 12:32 . 2013-07-18 12:32	569344	----a-w-	c:\windows\SysWow64\muzdecode.ax
2013-07-18 12:32 . 2013-07-18 12:32	491520	----a-w-	c:\windows\SysWow64\muzapp.dll
2013-07-18 12:32 . 2013-07-18 12:32	49152	----a-w-	c:\windows\SysWow64\MaJGUILib.dll
2013-07-18 12:32 . 2013-07-18 12:32	45320	----a-w-	c:\windows\SysWow64\MAMACExtract.dll
2013-07-18 12:32 . 2013-07-18 12:32	45056	----a-w-	c:\windows\SysWow64\MaXMLProto.dll
2013-07-18 12:32 . 2013-07-18 12:32	45056	----a-w-	c:\windows\SysWow64\MACXMLProto.dll
2013-07-18 12:32 . 2013-07-18 12:32	40960	----a-w-	c:\windows\SysWow64\MTTELECHIP.dll
2013-07-18 12:32 . 2013-07-18 12:32	352256	----a-w-	c:\windows\SysWow64\MSLUR71.dll
2013-07-18 12:32 . 2013-07-18 12:32	258048	----a-w-	c:\windows\SysWow64\muzoggsp.ax
2013-07-18 12:32 . 2013-07-18 12:32	245760	----a-w-	c:\windows\SysWow64\MSCLib.dll
2013-07-18 12:32 . 2013-07-18 12:32	24576	----a-w-	c:\windows\SysWow64\MASetupCleaner.exe
2013-07-18 12:32 . 2013-07-18 12:32	200704	----a-w-	c:\windows\SysWow64\muzwmts.dll
2013-07-18 12:32 . 2013-07-18 12:32	172032	----a-w-	c:\windows\SysWow64\muzapp.exe
2013-07-18 12:32 . 2013-07-18 12:32	155648	----a-w-	c:\windows\SysWow64\MSFLib.dll
2013-07-18 12:32 . 2013-07-18 12:32	143360	----a-w-	c:\windows\SysWow64\3DAudio.ax
2013-07-18 12:32 . 2013-07-18 12:32	135168	----a-w-	c:\windows\SysWow64\muzaf1.dll
2013-07-18 12:32 . 2013-07-18 12:32	131072	----a-w-	c:\windows\SysWow64\muzmpgsp.ax
2013-07-18 12:32 . 2013-07-18 12:32	122880	----a-w-	c:\windows\SysWow64\muzeffect.ax
2013-07-18 12:32 . 2013-07-18 12:32	118784	----a-w-	c:\windows\SysWow64\MaDRM.dll
2013-07-18 12:32 . 2013-07-18 12:32	110592	----a-w-	c:\windows\SysWow64\muzmp4sp.ax
2013-07-13 06:18 . 2013-08-16 21:22	337408	----a-w-	c:\windows\system32\wintrust.dll
2013-07-13 06:16 . 2013-08-16 21:22	1889280	----a-w-	c:\windows\system32\crypt32.dll
2013-07-13 06:16 . 2013-08-16 21:22	68096	----a-w-	c:\windows\system32\cryptsvc.dll
2013-07-13 06:15 . 2013-08-16 21:22	98304	----a-w-	c:\windows\system32\apprepsync.dll
2013-07-13 06:15 . 2013-08-16 21:22	124416	----a-w-	c:\windows\system32\apprepapi.dll
2013-07-13 04:24 . 2013-08-16 21:22	261120	----a-w-	c:\windows\SysWow64\wintrust.dll
2013-07-13 04:23 . 2013-08-16 21:22	1568256	----a-w-	c:\windows\SysWow64\crypt32.dll
2013-07-13 04:23 . 2013-08-16 21:22	87040	----a-w-	c:\windows\SysWow64\apprepapi.dll
2013-07-13 04:23 . 2013-08-16 21:22	74240	----a-w-	c:\windows\SysWow64\apprepsync.dll
2013-07-09 06:07 . 2013-08-16 21:22	2233168	----a-w-	c:\windows\system32\drivers\tcpip.sys
2013-07-02 00:44 . 2013-08-16 21:22	36288	----a-w-	c:\windows\system32\drivers\WdBoot.sys
2013-07-01 22:08 . 2013-08-16 21:22	247216	----a-w-	c:\windows\system32\drivers\WdFilter.sys
2012-05-11 12:16 . 2012-05-11 12:16	171520	----a-w-	c:\program files (x86)\Common Files\dsfOggDemux2.dll
2011-04-18 20:51 . 2011-04-18 20:51	653136	----a-w-	c:\program files (x86)\Common Files\MSVCR90.dll
2011-04-18 20:51 . 2011-04-18 20:51	569680	----a-w-	c:\program files (x86)\Common Files\MSVCP90.dll
2011-01-12 00:00 . 2011-01-12 00:00	30208	----a-w-	c:\program files (x86)\Common Files\wmpinfo.dll
2011-01-12 00:00 . 2011-01-12 00:00	240128	----a-w-	c:\program files (x86)\Common Files\dsfVorbisDecoder.dll
2011-01-12 00:00 . 2011-01-12 00:00	146944	----a-w-	c:\program files (x86)\Common Files\dsfFLACDecoder.dll
2011-01-12 00:00 . 2011-01-12 00:00	221184	----a-w-	c:\program files (x86)\Common Files\dsfFLACEncoder.dll
2011-01-12 00:00 . 2011-01-12 00:00	204800	----a-w-	c:\program files (x86)\Common Files\dsfNativeFLACSource.dll
2010-12-16 19:39 . 2010-12-16 19:39	302592	----a-w-	c:\program files (x86)\Common Files\webmmux.dll
2010-12-16 19:39 . 2010-12-16 19:39	701440	----a-w-	c:\program files (x86)\Common Files\vp8encoder.dll
2010-12-16 19:39 . 2010-12-16 19:39	412672	----a-w-	c:\program files (x86)\Common Files\vp8decoder.dll
2010-12-16 19:39 . 2010-12-16 19:39	292352	----a-w-	c:\program files (x86)\Common Files\webmsplit.dll
2006-05-03 10:06	163328	--sha-r-	c:\windows\SysWOW64\flvDX.dll
2007-02-21 11:47	31232	--sha-r-	c:\windows\SysWOW64\msfDX.dll
2008-03-16 13:30	216064	--sha-r-	c:\windows\SysWOW64\nbDX.dll
2010-01-06 22:00	107520	--sha-r-	c:\windows\SysWOW64\TAKDSDecoder.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"KiesPreload"="c:\program files (x86)\Samsung\Kies\Kies.exe" [2013-09-04 1564528]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"BCSSync"="c:\program files (x86)\Microsoft Office2010\Office14\BCSSync.exe" [2010-03-13 91520]
"EaseUS EPM tray"="c:\program files (x86)\EaseUS\EaseUS Partition Master 9.2.1 Home Edition\bin\EpmNews.exe" [2012-11-29 2086984]
"ISUSScheduler"="c:\program files (x86)\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 81920]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2007-03-20 36864]
"PDFPrint"="c:\program files (x86)\PDF24\pdf24.exe" [2012-12-12 163000]
"HPUsageTracking"="c:\program files (x86)\HP\HP UT\bin\hppusg.exe" [2009-05-11 24576]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888]
"Live Update 5"="c:\program files (x86)\MSI\Live Update 5\BootStartLiveupdate.exe" [2012-01-30 315392]
"KiesTrayAgent"="c:\program files (x86)\Samsung\Kies\KiesTrayAgent.exe" [2013-09-04 311152]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
" Malwarebytes Anti-Malware "="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2013-04-04 532040]
.
c:\users\Tom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files (x86)\Microsoft Office2010\Office14\ONENOTEM.EXE /tsr [2013-6-25 228552]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\StartUp\
HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableCursorSuppression"= 1 (0x1)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLinkedConnections"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R1 NNSNAHSL;Network Activity Hook Server LightWeight Filter Driver;c:\windows\system32\DRIVERS\NNSNAHSL.sys;c:\windows\SYSNATIVE\DRIVERS\NNSNAHSL.sys [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R2 SynoDrService;SynoDrService;c:\program files (x86)\Synology Data Replicator  3\SynoDrServicex64.exe;c:\program files (x86)\Synology Data Replicator  3\SynoDrServicex64.exe [x]
R3 androidusb;ADB Interface Driver;c:\windows\System32\Drivers\androidusb.sys;c:\windows\SYSNATIVE\Drivers\androidusb.sys [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 DigiartyVirtualCDBus;Digiarty Virtual Driver;c:\windows\system32\drivers\DigiartyVirtualCDBus.sys;c:\windows\SYSNATIVE\drivers\DigiartyVirtualCDBus.sys [x]
R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys;c:\windows\SYSNATIVE\epmntdrv.sys [x]
R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys;c:\windows\SYSNATIVE\EuGdiDrv.sys [x]
R3 HPFXFAX;HPFXFAX;c:\windows\system32\drivers\hpfx64fax.sys;c:\windows\SYSNATIVE\drivers\hpfx64fax.sys [x]
R3 MSI_MSIBIOS_010507;MSI_MSIBIOS_010507;c:\program files (x86)\MSI\Live Update 5\msibios64_100507.sys;c:\program files (x86)\MSI\Live Update 5\msibios64_100507.sys [x]
R3 NTIOLib_1_0_4;NTIOLib_1_0_4;c:\program files (x86)\MSI\Live Update 5\NTIOLib_X64.sys;c:\program files (x86)\MSI\Live Update 5\NTIOLib_X64.sys [x]
R3 NTIOLib_1_0_6;NTIOLib_1_0_6;c:\program files (x86)\Setup Files\Ms7586v1B0\NTIOLib_X64.sys;c:\program files (x86)\Setup Files\Ms7586v1B0\NTIOLib_X64.sys [x]
R3 Olympus DVR Service;Olympus DVR Service;c:\program files (x86)\Common Files\Olympus Shared\DeviceManager\olydvrsv.exe;c:\program files (x86)\Common Files\Olympus Shared\DeviceManager\olydvrsv.exe [x]
R3 pcouffin;VSO Software pcouffin;c:\windows\system32\Drivers\pcouffin.sys;c:\windows\SYSNATIVE\Drivers\pcouffin.sys [x]
R3 Sony PC Companion;Sony PC Companion;c:\program files (x86)\Sony\Sony PC Companion\PCCService.exe;c:\program files (x86)\Sony\Sony PC Companion\PCCService.exe [x]
R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 vvftav;vvftav;c:\windows\system32\drivers\vvftav.sys;c:\windows\SYSNATIVE\drivers\vvftav.sys [x]
R3 WUDFWpdMtp;WUDFWpdMtp;c:\windows\system32\DRIVERS\WUDFRd.sys;c:\windows\SYSNATIVE\DRIVERS\WUDFRd.sys [x]
R3 ZSMC0305;USB PC Camera VC305;c:\windows\system32\Drivers\usbVM305.sys;c:\windows\SYSNATIVE\Drivers\usbVM305.sys [x]
R4 sptd;sptd;c:\windows\System32\Drivers\sptd.sys;c:\windows\SYSNATIVE\Drivers\sptd.sys [x]
S1 HWiNFO32;HWiNFO32 Kernel Driver;c:\program files (x86)\HWiNFO32\HWiNFO64A.SYS;c:\program files (x86)\HWiNFO32\HWiNFO64A.SYS [x]
S2 acedrv11;acedrv11;c:\windows\system32\drivers\acedrv11.sys;c:\windows\SYSNATIVE\drivers\acedrv11.sys [x]
S2 easycvfs;easyClient DriveOnWeb File System;c:\windows\system32\drivers\easycvfs.sys;c:\windows\SYSNATIVE\drivers\easycvfs.sys [x]
S2 Garmin Core Update Service;Garmin Core Update Service;c:\program files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe;c:\program files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [x]
S2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe;c:\program files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 TVGOnlineUpdateSvc;TVG OnlineUpdate-Service;c:\program files (x86)\TVG\OnlineUpdate\OnlineUpdateSvc.exe;c:\program files (x86)\TVG\OnlineUpdate\OnlineUpdateSvc.exe [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\System32\drivers\seehcri.sys;c:\windows\SYSNATIVE\drivers\seehcri.sys [x]
S3 SKYNET;TechniSat DVB-PC TV Star PCI;c:\windows\system32\DRIVERS\SkyNET_AMD64.SYS;c:\windows\SYSNATIVE\DRIVERS\SkyNET_AMD64.SYS [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
apphost	REG_MULTI_SZ   	apphostsvc
iissvcs	REG_MULTI_SZ   	w3svc was
hpdevmgmt	REG_MULTI_SZ   	hpqcxs08 hpqddsvc
.
Inhalt des "geplante Tasks" Ordners
.
2013-09-29 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-09 16:21]
.
2013-07-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-06-15 23:04]
.
2013-07-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-06-15 23:04]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2012-09-25 13196432]
"HP Color LaserJet CM2320 MFP Series Fax"="c:\program files (x86)\HP\HP Color LaserJet CM2320 MFP Series\hppfaxprintersrv.exe" [2009-09-22 3700736]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"*WerKernelReporting"="c:\windows\SYSTEM32\WerFault.exe" [2013-07-09 439488]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uSearchAssistant = hxxp://www.google.com
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: An OneNote s&enden - c:\progra~2\MI4066~1\Office14\ONBttnIE.dll/105
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MI4066~1\Office14\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
Trusted Zone: paypal.com
TCP: DhcpNameServer = 192.168.0.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
AddRemove-AquaSoft DiaShow 7 Ultimate - c:\programdata\{C408D0B2-D2DE-46C9-9628-D4E335EC4EB6}\Setup.exe
AddRemove-Picasa 3 - e:\picasa3\Uninstall.exe
AddRemove-{2FAA2415-618E-4EC0-8253-3CDA076C84D6} - c:\programdata\{C408D0B2-D2DE-46C9-9628-D4E335EC4EB6}\Setup.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e96d-e325-11ce-bfc1-08002be10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
@SACL=(02 0000)
.
Zeit der Fertigstellung: 2013-09-29  21:50:12
ComboFix-quarantined-files.txt  2013-09-29 19:50
ComboFix2.txt  2013-09-29 18:41
.
Vor Suchlauf: 31 Verzeichnis(se), 22.968.066.048 Bytes frei
Nach Suchlauf: 32 Verzeichnis(se), 22.873.264.128 Bytes frei
.
- - End Of File - - 39B8FC94CD9BD9234DD355D57364A3EB
A36C5E4F47E84449FF07ED3517B43A31
Nein. Firefox kackt noch immer ab, wenn ich länger was daran mache bzw. bei mehreren Tabs.
Außerdem habe ich Mist gemacht. Als das Deinstallieren über die Systemsteuerung nicht ging hab ich aus Versehen Firefox aus der Liste der installierten Programme entfernt.

Antwort
Seite 1 von 2 1 2

Themen zu Windows 8, Infektion mit Win32/Fynloski.A?
defender, desktop, farbar, farbar recovery scan tool, flash player, fylnloski.a, homepage, installation, mozilla, nicht möglich, plug-in, pup.optional.optimzerpro.a, pup.optional.tarma.a, riskware.exit, samsung kies, schädling, services.exe, software, svchost.exe, synology, tarma, trojan.staser, win32/fynloski.a, win32/fynloski.a?, windows, yandex


« GVU Trojaner Win7 64 bit abgesicherter Modus geht nicht, Kaspersky WindowsUnlocker klapppt auch nicht | Trojaner,Virus,....es erstellen sich .exe Dateien in den ordnern »


Ähnliche Themen: Windows 8, Infektion mit Win32/Fynloski.A?


  1. Avast blockiert wiederholt "Infektion" Win32:Evo-gen [Susp]
    Plagegeister aller Art und deren Bekämpfung - 05.02.2015 (5)
  2. Win8.1 64-bit --- Infektion mit Win32/Gamarue.l
    Log-Analyse und Auswertung - 19.12.2014 (7)
  3. Windows 7: Avast meldete Infektion durch win32:bprotect-D
    Log-Analyse und Auswertung - 23.06.2014 (17)
  4. Avast: Infektion blockiert , Infektion: URL:Mal (bei Ebay.de)
    Plagegeister aller Art und deren Bekämpfung - 21.05.2014 (3)
  5. Windows 8.1: Trojan:Win32/Meredrop, Trojan:Win32/Malagent, Trojan:Win32/Matsnu.L und Worm:Win32/Ainslot.A
    Log-Analyse und Auswertung - 19.01.2014 (5)
  6. Infektion mit Trojaner Win32/Kryptik.BCOI von Firmenwebseite. Ist er noch auf dem PC vorhanden?
    Log-Analyse und Auswertung - 11.10.2013 (3)
  7. Windows 7: Win32.downloader.gen Infektion
    Log-Analyse und Auswertung - 03.09.2013 (10)
  8. Backdoor.Fynloski / Trojan.Agent / PUM.UserWLoad (msszfa.exe) lässt sicht nicht in Regedit löschen/ändern
    Plagegeister aller Art und deren Bekämpfung - 16.04.2013 (18)
  9. Win32: Sirefef-AHF [Trj] und Win32: Malware-gen in C:\Windows\System32\services.exe Windows 7 64bit
    Log-Analyse und Auswertung - 31.08.2012 (16)
  10. Fynloski.a ?
    Plagegeister aller Art und deren Bekämpfung - 31.07.2012 (1)
  11. Infektion mit sbcvvhost_win86 auf Windows 7
    Plagegeister aller Art und deren Bekämpfung - 02.01.2012 (10)
  12. Problem mit Windows 7 Sicherheitscenterdienst und Windows Defender, infektion?
    Plagegeister aller Art und deren Bekämpfung - 23.06.2011 (25)
  13. Infektion mit Malware u.A. Win32/Zwangi
    Plagegeister aller Art und deren Bekämpfung - 19.01.2011 (24)
  14. Malwarebytes meldung "Security.Hijack" evtl. TrojanSpy:Win32/Bebloh.A infektion
    Plagegeister aller Art und deren Bekämpfung - 14.05.2010 (19)
  15. Kaspersky löscht Infektion Win32.Refroso.zwv nicht
    Plagegeister aller Art und deren Bekämpfung - 28.12.2009 (1)
  16. Avast C:\Windows\Memory.dmp Infektion: Win32:DCom-f (Expl.)
    Log-Analyse und Auswertung - 26.11.2009 (9)
  17. WIN32.Virut.gen Infektion
    Log-Analyse und Auswertung - 08.11.2009 (3)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema Windows 8, Infektion mit Win32/Fynloski.A? - Guten Tag, seit einigen Tagen meldet Windows Defender bei mir eine Infektion mit Win32/Fynloski.A. MBAM meldet weitere Infektionen aber kein Fynloski. An Symptomen habe ich selbst bislang wenig erkennen können, - Windows 8, Infektion mit Win32/Fynloski.A?...
Archiv
Du betrachtest: Windows 8, Infektion mit Win32/Fynloski.A? auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129