Whilokii Virus entfernen

schrauber · 25.10.2013, 11:43

Frisches FRST log bitte

scrooge75 · 25.10.2013, 18:34

Hier ist das neue Scanlog-File:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 23-10-2013 01
Ran by Markus.Ortlieb (administrator) on BIB-LORTLIEBM on 25-10-2013 19:33:07
Running from C:\Users\Markus.Ortlieb\Downloads\FRST
Microsoft Windows 7 Enterprise  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Microsoft Corporation) c:\Program Files\Microsoft Security Client\MsMpEng.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\STacSV.exe
(Broadcom Corporation) C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe
(Broadcom Corporation) C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\aestsrv.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Microsoft Corporation) C:\Windows\system32\CISVC.EXE
(Cisco Systems, Inc.) C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
(Dell Inc.) C:\Program Files\Dell\SysMgt\dataeng\bin\dsm_sa_eventmgr32.exe
(Dell Inc.) C:\Program Files\Dell\SysMgt\dataeng\bin\dsm_sa_datamgr32.exe
(Brio) C:\Program Files\FolderSize\FolderSizeSvc.exe
(Teruten) C:\Windows\system32\FsUsbExService.Exe
(iPass, Inc.) C:\Program Files\iPass\iPassConnect\iPassPeriodicUpdateService.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
(O2Micro International) C:\Windows\system32\DRIVERS\o2flash.exe
() C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
(Dell Inc.) C:\Program Files\Dell\Dell System Manager\DCPSysMgrSvc.exe
(iPass, Inc.) C:\Program Files\iPass\iPassConnect\iPassPeriodicUpdateApp.exe
(Microsoft Corporation) c:\Program Files\Microsoft Security Client\NisSrv.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
(shbox.de) C:\Program Files\FreePDF_XP\fpassist.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
() C:\Program Files\STMicroelectronics\AccelerometerP11\FF_Protection.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe
(Cisco WebEx LLC) C:\Program Files\WebEx\Productivity Tools\PTIM.exe
(Microsoft Corporation) C:\Users\Markus.Ortlieb\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Dell Inc.) C:\Program Files\Dell\Dell System Manager\DCPSysMgr.exe
() C:\Program Files\WISO\Steuersoftware 2012\mshaktuell.exe
(Cisco WebEx LLC) C:\PROGRA~1\WebEx\PRODUC~1\ptSrv.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\HidFind.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apntex.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
(Intel Corporation) C:\Windows\system32\igfxext.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Microsoft Corporation) C:\Windows\CCM\CcmExec.exe
(Microsoft Corporation) C:\Windows\CCM\RemCtrl\CmRcService.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Microsoft Corporation) C:\Windows\CCM\SCNotification.exe
(Microsoft Corporation.) C:\Program Files\Microsoft\BingBar\7.2.241.0\SeaPort.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
(Yahoo! Inc.) C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
(Yahoo! Inc.) C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
(Microsoft Corporation) C:\Windows\system32\UI0Detect.exe
(RealNetworks, Inc.) C:\Program Files\Real\RealPlayer\update\realsched.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Mirko Böer) C:\privat\Pw\AmP.exe
(Google) C:\Users\Markus.Ortlieb\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [FreePDF Assistant] - C:\Program Files\FreePDF_XP\fpassist.exe [370176 2010-06-17] (shbox.de)
HKLM\...\Run: [Apoint] - C:\Program Files\DellTPad\Apoint.exe [505720 2011-10-04] (Alps Electric Co., Ltd.)
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray.exe [536668 2011-10-04] (IDT, Inc.)
HKLM\...\Run: [IAStorIcon] - C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2010-11-06] (Intel Corporation)
HKLM\...\Run: [FreeFallProtection] - C:\Program Files\STMicroelectronics\AccelerometerP11\FF_Protection.exe [686704 2011-02-15] ()
HKLM\...\Run: [KiesTrayAgent] - C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [310128 2013-02-13] (Samsung Electronics Co., Ltd.)
HKLM\...\Run: [TkBellExe] - C:\Program Files\Real\RealPlayer\Update\realsched.exe [295512 2013-03-19] (RealNetworks, Inc.)
HKLM\...\Run: [MSC] - c:\Program Files\Microsoft Security Client\msseces.exe [947152 2013-01-27] (Microsoft Corporation)
HKLM\...\Run: [Communicator] - C:\Program Files\Microsoft Lync\communicator.exe [12107944 2013-05-30] (Microsoft Corporation)
HKLM\...\Run: [HP Software Update] - C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM\...\Run: [] - [x]
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-10] (Adobe Systems Incorporated)
HKCU\...\Run: [Messenger (Yahoo!)] - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe [6591800 2012-02-22] (Yahoo! Inc.)
HKCU\...\Run: [KiesTrayAgent] - C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [310128 2013-02-13] (Samsung Electronics Co., Ltd.)
HKCU\...\Run: [KiesPDLR] - C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844144 2013-02-13] (Samsung)
HKCU\...\Run: [Google Update] - C:\Users\Markus.Ortlieb\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2012-07-02] (Google Inc.)
HKCU\...\Run: [KiesPreload] - C:\Program Files\Samsung\Kies\Kies.exe [1509232 2013-02-13] (Samsung)
HKCU\...\Run: [] - C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844144 2013-02-13] (Samsung)
HKCU\...\Run: [PTIM.exe] - C:\Program Files\WebEx\Productivity Tools\PTIM.exe [419344 2013-05-30] (Cisco WebEx LLC)
HKCU\...\Run: [SkyDrive] - C:\Users\Markus.Ortlieb\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe [257136 2013-10-21] (Microsoft Corporation)
HKCU\...\Runonce: [Uninstall C:\Users\Markus.Ortlieb\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910] - C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Markus.Ortlieb\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910"
HKCU\...\Policies\system: [RunLogonScriptSync] 1
HKCU\...\Policies\system: [HideLogonScripts] 0
HKCU\...\Policies\Explorer: [HideSCAHealth] 1
MountPoints2: {b8300e74-bc9d-11df-ba19-806e6f6e6963} - D:\SMS\bin\i386\TSMBAutorun.exe
Startup: C:\Users\Markus.Ortlieb\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://intranet.kavo.de
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://intranet.kavo.de
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.de
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {84630365-439B-4036-955B-F475B3233C24} URL = 
BHO: Bing Bar Helper - {1dad3af3-ef2f-4f64-ac4b-11789189fcb6} - C:\Program Files\Microsoft\BingBar\7.2.241.0\BingExt.dll (Microsoft Corporation.)
BHO: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Lync\OCHelper.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: WebEx Productivity Tools - {90E2BA2E-DD1B-4cde-9134-7A8B86D33CA7} - C:\Program Files\WebEx\Productivity Tools\ptonecli.dll (Cisco WebEx LLC)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: PETN - {C480F23A-1BA8-4106-B43E-DA48F2914C70} - C:\Users\Markus.Ortlieb\AppData\Local\TidyNetwork\petn.dll No File
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - WebEx Productivity Tools - {90E2BA2E-DD1B-4cde-9134-7A8B86D33CA7} - C:\Program Files\WebEx\Productivity Tools\ptonecli.dll (Cisco WebEx LLC)
Toolbar: HKLM - Bing Bar - {eec0f710-38b5-4aba-99bf-ec87564a4e13} - C:\Program Files\Microsoft\BingBar\7.2.241.0\BingExt.dll (Microsoft Corporation.)
DPF: {12193C65-F0E1-4DD1-AD4E-DB73C6911014} file:///C:/Users/Markus.Ortlieb/Downloads/DCS-942L_2523(EU)/Mydlink/activeX/DCP.cab
DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} hxxp://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
DPF: {721700FE-7F0E-49C5-BDED-CA92B7CB1245} https://eu.mydlink.com/8D/activeX//dcsclictrl.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_25-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0025-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_25-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_25-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} https://danaher.webex.com/client/WBXclient-T27L10NSP32EP1-13926/webex/ieatgpc1.cab
Handler: saphtmlp - {D1F8BD1E-7967-11D2-B43A-006094B9EADB} - c:\sapgui\sapgui\saphtmlp.dll (SAP, Walldorf)
Handler: sapr3 - {D1F8BD1E-7967-11D2-B43A-006094B9EADB} - c:\sapgui\sapgui\saphtmlp.dll (SAP, Walldorf)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Markus.Ortlieb\AppData\Roaming\Mozilla\Firefox\Profiles\a94om3cg.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw_1168638.dll (Adobe Systems, Inc.)
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf - C:\PROGRAM FILES\FOXIT SOFTWARE\FOXIT READER\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf - C:\PROGRAM FILES\FOXIT SOFTWARE\FOXIT READER\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin: @google.com/npPicasa3,version=3.0.0 - C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 - C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @real.com/nppl3260;version=16.0.1.18 - C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlchromebrowserrecordext;version=1.3.1 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlhtml5videoshim;version=1.3.1 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlpepperflashvideoshim;version=1.3.1 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprpplugin;version=16.0.1.18 - C:\Program Files\Real\RealPlayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin: @realnetworks.com/npdlplugin;version=1 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin - C:\Users\Markus.Ortlieb\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin HKCU: @talk.google.com/O1DPlugin - C:\Users\Markus.Ortlieb\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
FF Plugin HKCU: @talk.google.com/O3DPlugin - C:\Users\Markus.Ortlieb\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Markus.Ortlieb\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Markus.Ortlieb\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin.dll (Amazon.com, Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: FoxClocks - C:\Users\Markus.Ortlieb\AppData\Roaming\Mozilla\Firefox\Profiles\a94om3cg.default\Extensions\{d37dc5d0-431d-44e5-8c91-49419370caa1}
FF Extension: No Name - C:\Users\Markus.Ortlieb\AppData\Roaming\Mozilla\Firefox\Profiles\a94om3cg.default\Extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}.xpi
FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext

========================== Services (Whitelisted) =================

R2 CcmExec; C:\Windows\CCM\CcmExec.exe [1090656 2012-11-21] (Microsoft Corporation)
R2 CmRcService; C:\Windows\CCM\RemCtrl\CmRcService.exe [470112 2012-11-21] (Microsoft Corporation)
R2 Credential Vault Host Control Service; C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe [826272 2010-10-25] (Broadcom Corporation)
R2 Credential Vault Host Storage; C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe [32160 2010-10-25] (Broadcom Corporation)
R2 CVPND; C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe [1528616 2010-09-27] (Cisco Systems, Inc.)
R2 dcevt32; C:\Program Files\Dell\SysMgt\dataeng\bin\dsm_sa_eventmgr32.exe [136248 2013-05-13] (Dell Inc.)
R2 dcpsysmgrsvc; C:\Program Files\Dell\Dell System Manager\DCPSysMgrSvc.exe [390000 2011-07-28] (Dell Inc.)
R2 dcstor32; C:\Program Files\Dell\SysMgt\dataeng\bin\dsm_sa_datamgr32.exe [185912 2013-05-13] (Dell Inc.)
S2 dsiasrv; C:\Program Files\Dell\SysMgt\dsia\bin\DsiaSrv32.exe [149560 2012-09-25] (Dell Inc.)
R2 FolderSize; C:\Program Files\FolderSize\FolderSizeSvc.exe [116224 2010-04-06] (Brio)
R2 HPSLPSVC; C:\Users\Markus.Ortlieb\AppData\Local\Temp\7zS661D\hpslpsvc32.dll [701288 2013-07-19] (Hewlett-Packard Co.)
S3 iPassConnectEngine; C:\Program Files\iPass\iPassConnect\iPassConnectEngine.exe [1712128 2008-09-26] (iPass, Inc.)
R3 iPassPeriodicUpdateApp; C:\Program Files\iPass\iPassConnect\iPassPeriodicUpdateApp.exe [155648 2008-09-01] (iPass, Inc.)
R2 iPassPeriodicUpdateService; C:\Program Files\iPass\iPassConnect\iPassPeriodicUpdateService.exe [98304 2008-09-01] (iPass, Inc.)
S3 lpasvc; C:\Program Files\Microsoft Policy Platform\policyHost.exe [48744 2012-08-02] (Microsoft Corporation)
S3 lppsvc; C:\Program Files\Microsoft Policy Platform\policyHost.exe [48744 2012-08-02] (Microsoft Corporation)
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [20456 2013-01-27] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [295232 2013-01-27] (Microsoft Corporation)
R2 O2FLASH; C:\Windows\system32\DRIVERS\o2flash.exe [72296 2011-10-04] (O2Micro International)
R2 RealNetworks Downloader Resolver Service; C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-03-06] ()
S3 smstsmgr; C:\Windows\CCM\TSManager.exe [275536 2012-11-21] (Microsoft Corporation)
R2 STacSV; C:\Program Files\IDT\WDM\STacSV.exe [274514 2011-10-04] (IDT, Inc.)

==================== Drivers (Whitelisted) ====================

R3 Acceler; C:\Windows\System32\DRIVERS\accelern.sys [44144 2011-10-04] (ST Microelectronics)
R3 BTWAMPFL; C:\Windows\System32\DRIVERS\btwampfl.sys [300584 2011-11-14] (Broadcom Corporation.)
R0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-14] (Microsoft Corporation)
S3 CVirtA; C:\Windows\System32\DRIVERS\CVirtA.sys [5275 2007-01-18] (Cisco Systems, Inc.)
R2 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [308859 2010-09-27] (Cisco Systems, Inc.)
R3 cvusbdrv; C:\Windows\System32\Drivers\cvusbdrv.sys [33832 2011-10-04] (Broadcom Corporation)
S3 d554gps; C:\Windows\system32\drivers\d554gps.sys [87592 2011-10-04] (Ericsson AB)
R3 dcdbas; C:\Windows\System32\DRIVERS\dcdbas32.sys [32872 2013-03-11] (Dell Inc.)
R3 DNE; C:\Windows\System32\DRIVERS\dne2000.sys [131984 2008-11-16] (Deterministic Networks, Inc.)
R3 e1cexpress; C:\Windows\System32\DRIVERS\e1c6232.sys [358224 2012-08-10] (Intel Corporation)
S3 ecnssndis; C:\Windows\System32\Drivers\wwanuss.sys [23592 2011-10-04] (Ericsson AB)
S3 ecnssndisfltr; C:\Windows\System32\Drivers\wwanussf.sys [26152 2011-10-04] (Ericsson AB)
R3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [37344 2013-02-05] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
S3 Mbm3CBus; C:\Windows\system32\drivers\Mbm3CBus.sys [361032 2011-10-04] (MCCI Corporation)
S3 Mbm3DevMt; C:\Windows\system32\drivers\Mbm3DevMt.sys [396872 2011-10-04] (MCCI Corporation)
S3 MEI; C:\Windows\system32\drivers\HECI.sys [41088 2011-10-04] (Intel Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [195296 2013-01-20] (Microsoft Corporation)
R3 NETwNs32; C:\Windows\System32\DRIVERS\NETwNs32.sys [7517696 2011-08-03] (Intel Corporation)
S3 nwdelgobi3kfilter; C:\Windows\system32\drivers\nwdelgobi3kfilter.sys [27264 2011-10-04] (Novatel Wireless Inc)
S3 nwdelserial; C:\Windows\system32\drivers\nwdelserial.sys [191488 2011-10-04] (Novatel Wireless Inc.)
R3 O2MDFRDR; C:\Windows\System32\DRIVERS\O2MDFw7.sys [60904 2011-10-04] (O2Micro )
S3 O2MDRRDR; C:\Windows\system32\drivers\O2MDRw7.sys [62440 2011-10-04] (O2Micro )
R3 O2SDJRDR; C:\Windows\System32\DRIVERS\o2sdjw7.sys [63976 2011-10-04] (O2Micro )
R3 prepdrvr; C:\Windows\System32\DRIVERS\prepdrv.sys [20840 2012-11-21] (Microsoft Corporation)
R0 stdcfltn; C:\Windows\System32\DRIVERS\stdcfltn.sys [17904 2011-07-15] (ST Microelectronics)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-10-25 12:33 - 2013-10-25 12:33 - 00001118 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-10-25 12:33 - 2013-10-25 12:33 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-10-25 12:33 - 2013-10-25 12:33 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-10-25 12:32 - 2013-10-25 12:32 - 00281896 _____ (Mozilla) C:\Users\Markus.Ortlieb\Downloads\Firefox Setup Stub 24.0.exe
2013-10-24 15:24 - 2013-10-24 15:24 - 00891167 _____ C:\Users\Markus.Ortlieb\Downloads\SecurityCheck.exe
2013-10-24 14:57 - 2013-10-24 14:57 - 00110168 _____ C:\23.10.2013.one
2013-10-24 13:10 - 2013-10-24 13:10 - 02347384 _____ (ESET) C:\Users\Markus.Ortlieb\Downloads\esetsmartinstaller_enu.exe
2013-10-23 14:39 - 2013-10-23 14:39 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-10-23 14:39 - 2013-10-23 14:39 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-10-23 14:39 - 2013-10-23 14:39 - 00174504 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-10-23 14:39 - 2013-10-23 14:39 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2013-10-23 14:39 - 2013-10-23 14:39 - 00000000 ____D C:\Program Files\Java
2013-10-23 09:58 - 2013-10-23 09:58 - 00000772 _____ C:\Users\Markus.Ortlieb\Desktop\JRT.txt
2013-10-23 09:09 - 2013-10-23 09:09 - 01033335 _____ (Thisisu) C:\Users\Markus.Ortlieb\Downloads\JRT(1).exe
2013-10-23 09:00 - 2013-10-23 09:00 - 01060070 _____ C:\Users\Markus.Ortlieb\Downloads\adwcleaner(1).exe
2013-10-23 08:58 - 2013-10-25 19:33 - 00000000 ____D C:\Users\Markus.Ortlieb\Downloads\FRST
2013-10-22 17:27 - 2013-10-22 17:27 - 00073342 _____ C:\Users\Markus.Ortlieb\Downloads\FRST.txt
2013-10-22 17:27 - 2013-10-22 17:27 - 00019499 _____ C:\Users\Markus.Ortlieb\Downloads\Addition.txt
2013-10-22 17:26 - 2013-10-22 17:26 - 00000000 ____D C:\FRST
2013-10-22 17:22 - 2013-10-22 17:22 - 00000000 ____D C:\Windows\ERUNT
2013-10-22 16:23 - 2013-10-22 16:23 - 00001080 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-10-22 16:23 - 2013-10-22 16:23 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-10-22 16:23 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-10-22 16:22 - 2013-10-22 16:22 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Markus.Ortlieb\Downloads\mbam-setup-1.75.0.1300.exe
2013-10-21 09:40 - 2013-10-23 09:50 - 00000000 ___RD C:\Users\Markus.Ortlieb\SkyDrive
2013-10-21 09:40 - 2013-10-21 09:40 - 00002178 _____ C:\Users\Markus.Ortlieb\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft SkyDrive.lnk
2013-10-21 09:40 - 2013-10-21 09:40 - 00002091 _____ C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft SkyDrive.lnk
2013-10-21 09:40 - 2013-10-21 09:40 - 00002091 _____ C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft SkyDrive.lnk
2013-10-21 09:40 - 2013-10-21 09:40 - 00000000 ____D C:\Users\Markus.Ortlieb\AppData\Local\Windows Live
2013-10-21 09:40 - 2013-10-21 09:40 - 00000000 ____D C:\ProgramData\Microsoft SkyDrive
2013-10-21 09:40 - 2013-10-21 09:40 - 00000000 ____D C:\Program Files\Microsoft SkyDrive
2013-10-21 09:40 - 2013-10-21 09:40 - 00000000 ____D C:\Program Files\Common Files\Windows Live
2013-10-21 09:27 - 2013-10-21 09:27 - 01245168 _____ (Microsoft Corporation) C:\Users\Markus.Ortlieb\Downloads\wlsetup-web.exe
2013-10-20 18:38 - 2013-10-20 18:38 - 00001088 _____ C:\Users\Markus.Ortlieb\Desktop\PC Speed Maximizer.lnk
2013-10-20 18:38 - 2013-10-20 18:38 - 00000000 ____D C:\Users\Markus.Ortlieb\AppData\Roaming\0D0S1L2Z1P1B
2013-10-20 18:37 - 2013-10-20 18:37 - 00602112 _____ (OldTimer Tools) C:\Users\Markus.Ortlieb\Downloads\OTL(1).exe
2013-10-18 15:38 - 2013-10-18 15:38 - 00000000 ____D C:\Users\Public\Documents\CrashDump
2013-10-17 00:46 - 2013-10-17 00:46 - 00000000 _____ C:\Users\Markus.Ortlieb\Downloads\uPlayer.msi
2013-10-17 00:45 - 2013-10-17 00:45 - 00000000 ____D C:\Users\Markus.Ortlieb\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Word Layers
2013-10-17 00:44 - 2013-10-17 00:44 - 00590496 _____ C:\Users\Markus.Ortlieb\Downloads\uplayermediaplayer-setup.exe
2013-10-14 01:40 - 2013-10-14 01:40 - 00053091 _____ C:\Users\Markus.Ortlieb\Downloads\LCR_Analysis_by_Factory.xlsx
2013-10-14 01:14 - 2013-10-14 01:40 - 00010422 _____ C:\Users\Markus.Ortlieb\Downloads\99q29jC88dwMhs8s8jCGCy8M2lCyG22q4j9wGlj4.xls
2013-10-12 19:27 - 2013-09-11 08:37 - 45341303 ____N C:\Users\Markus.Ortlieb\Downloads\20130911_163716.mp4
2013-10-12 19:27 - 2013-07-07 06:04 - 229688525 ____N C:\Users\Markus.Ortlieb\Downloads\20130707_150206.mp4
2013-10-12 19:27 - 2013-07-01 06:56 - 04693888 ____N C:\Users\Markus.Ortlieb\Downloads\20130701_145626.mp4
2013-10-12 19:26 - 2013-08-11 14:43 - 314465633 ____N C:\Users\Markus.Ortlieb\Downloads\20130811_224051.mp4
2013-10-12 19:17 - 2013-10-12 19:17 - 00000000 ____D C:\Users\Markus.Ortlieb\Documents\Freemake
2013-10-11 10:41 - 2013-10-11 10:41 - 00235008 _____ C:\Windows\Minidump\101113-19578-01.dmp
2013-10-03 20:53 - 2013-10-03 20:53 - 00059120 _____ C:\Windows\system32\CcmFramework.ini
2013-10-03 20:53 - 2013-10-03 20:53 - 00000621 _____ C:\Windows\system32\CcmFramework.h
2013-10-03 20:52 - 2013-10-03 20:52 - 00000000 ____D C:\Windows\ms
2013-10-01 20:11 - 2013-05-13 13:22 - 02727456 _____ (Dell Inc.) C:\Windows\omsacntl.exe
2013-10-01 20:11 - 2013-05-13 13:22 - 00325664 _____ (Dell Inc.) C:\Windows\hapint.exe
2013-10-01 20:11 - 2013-05-13 13:21 - 00117280 _____ (Dell Inc.) C:\Windows\dciwds32.exe
2013-10-01 20:11 - 2013-05-13 13:21 - 00080928 _____ (Dell Inc.) C:\Windows\dcmdev32.exe
2013-10-01 20:11 - 2013-05-13 13:20 - 00282144 _____ (Dell Inc.) C:\Windows\dchcfg32.exe
2013-10-01 20:11 - 2013-05-13 13:20 - 00231456 _____ (Dell Inc.) C:\Windows\system32\dchcfl32.dll
2013-10-01 20:11 - 2013-05-13 13:19 - 00385056 _____ (Dell Inc.) C:\Windows\system32\dchbas32.dll
2013-10-01 20:11 - 2013-05-13 13:19 - 00272416 _____ (Dell Inc.) C:\Windows\system32\dchapi32.dll
2013-10-01 15:40 - 2013-10-01 15:40 - 00000000 ____D C:\Users\Markus.Ortlieb\Documents\Mein Steuer-Sparbuch Heute
2013-10-01 14:21 - 2013-04-17 09:02 - 01230336 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2013-10-01 11:24 - 2013-10-01 11:24 - 00033488 _____ C:\Users\Markus.Ortlieb\Downloads\qwwC8wGhjMq28w48yCvwshsyGjqh8jqlM94j9qd4.xls
2013-10-01 10:09 - 2013-10-01 10:12 - 06795264 _____ C:\Users\Markus.Ortlieb\Downloads\Tracker 9-30-13-20130930-165911.xls
2013-09-30 14:12 - 2013-09-30 14:12 - 00001998 _____ C:\Users\Public\Desktop\Adobe Reader X.lnk
2013-09-30 14:11 - 2013-09-30 14:11 - 00000000 ____D C:\Program Files\Common Files\Adobe
2013-09-30 14:11 - 2013-09-30 14:11 - 00000000 ____D C:\Program Files\Adobe
2013-09-27 15:54 - 2013-09-27 15:54 - 00047104 _____ C:\Users\Markus.Ortlieb\Downloads\DHR LCR Country List-20120523.xls
2013-09-27 12:01 - 2013-09-27 12:14 - 00163840 _____ C:\Users\Markus.Ortlieb\Downloads\Staff%2520schdule%2520SW%25202013_09_16-20130924-092920.xls
2013-09-27 10:51 - 2012-10-17 04:04 - 00580712 ____H (Hewlett-Packard Co.) C:\Windows\system32\HPDiscoPM5512.dll
2013-09-26 15:37 - 2013-09-26 15:37 - 02338824 _____ C:\Users\Markus.Ortlieb\Downloads\hppiw.exe
2013-09-26 11:42 - 2013-09-26 11:42 - 00000000 ____D C:\Scans
2013-09-26 11:26 - 2013-09-27 10:51 - 00001189 _____ C:\Users\Public\Desktop\Shop für Zubehör - HP Officejet 6500 E710a-f.lnk
2013-09-26 11:08 - 2013-09-27 10:36 - 00002027 _____ C:\Users\Markus.Ortlieb\Desktop\HPPSDr.lnk
2013-09-26 11:08 - 2013-09-26 11:08 - 06064264 _____ C:\Users\Markus.Ortlieb\Downloads\HPPSdr.exe
2013-09-26 11:07 - 2013-09-26 11:07 - 00000333 _____ C:\Users\Markus.Ortlieb\Desktop\HP Druckerdiagnosetools.url
2013-09-26 10:59 - 2013-09-26 10:59 - 00002257 _____ C:\Users\Public\Desktop\HP Officejet 6500 E710n-z.lnk
2013-09-26 10:59 - 2013-09-26 10:59 - 00001189 _____ C:\Users\Public\Desktop\Shop für Zubehör - HP Officejet 6500 E710n-z.lnk
2013-09-26 10:59 - 2012-10-17 04:04 - 00580712 ____N (Hewlett-Packard Co.) C:\Windows\system32\HPDiscoPM5412.dll
2013-09-26 09:56 - 2013-09-26 09:56 - 00001235 _____ C:\Users\Markus.Ortlieb\Desktop\Revo Uninstaller.lnk
2013-09-26 09:56 - 2013-09-26 09:56 - 00000000 ____D C:\Program Files\VS Revo Group
2013-09-26 08:46 - 2013-09-26 08:46 - 00000000 ____D C:\Users\Markus.Ortlieb\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte

==================== One Month Modified Files and Folders =======

2013-10-25 19:33 - 2013-10-23 08:58 - 00000000 ____D C:\Users\Markus.Ortlieb\Downloads\FRST
2013-10-25 19:22 - 2012-04-05 10:28 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-10-25 18:54 - 2012-07-02 14:26 - 00001156 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3842183496-1387694075-2723946746-6219UA.job
2013-10-25 14:54 - 2012-07-02 14:26 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3842183496-1387694075-2723946746-6219Core.job
2013-10-25 12:38 - 2012-04-05 08:43 - 00000000 ____D C:\ProgramData\Sonos,_Inc
2013-10-25 12:33 - 2013-10-25 12:33 - 00001118 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-10-25 12:33 - 2013-10-25 12:33 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-10-25 12:33 - 2013-10-25 12:33 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-10-25 12:33 - 2012-04-04 09:20 - 00000000 ____D C:\Users\Markus.Ortlieb\AppData\Roaming\Mozilla
2013-10-25 12:32 - 2013-10-25 12:32 - 00281896 _____ (Mozilla) C:\Users\Markus.Ortlieb\Downloads\Firefox Setup Stub 24.0.exe
2013-10-25 12:27 - 2012-04-03 13:10 - 00000000 ____D C:\privat
2013-10-25 10:02 - 2012-04-19 09:25 - 00000000 ____D C:\Users\Markus.Ortlieb\AppData\Local\FreePDF_XP
2013-10-24 23:16 - 2012-02-16 17:12 - 01522191 _____ C:\Windows\WindowsUpdate.log
2013-10-24 15:24 - 2013-10-24 15:24 - 00891167 _____ C:\Users\Markus.Ortlieb\Downloads\SecurityCheck.exe
2013-10-24 14:57 - 2013-10-24 14:57 - 00110168 _____ C:\23.10.2013.one
2013-10-24 13:12 - 2010-09-09 22:45 - 08141522 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-24 13:12 - 2010-08-15 20:12 - 00691622 _____ C:\Windows\system32\perfh01D.dat
2013-10-24 13:12 - 2010-08-15 20:12 - 00152192 _____ C:\Windows\system32\perfc01D.dat
2013-10-24 13:12 - 2010-08-15 20:07 - 00767960 _____ C:\Windows\system32\perfh015.dat
2013-10-24 13:12 - 2010-08-15 20:07 - 00165376 _____ C:\Windows\system32\perfc015.dat
2013-10-24 13:12 - 2010-08-15 19:52 - 00771500 _____ C:\Windows\system32\perfh013.dat
2013-10-24 13:12 - 2010-08-15 19:52 - 00162648 _____ C:\Windows\system32\perfc013.dat
2013-10-24 13:12 - 2010-08-15 19:46 - 00768096 _____ C:\Windows\system32\perfh010.dat
2013-10-24 13:12 - 2010-08-15 19:46 - 00156376 _____ C:\Windows\system32\perfc010.dat
2013-10-24 13:10 - 2013-10-24 13:10 - 02347384 _____ (ESET) C:\Users\Markus.Ortlieb\Downloads\esetsmartinstaller_enu.exe
2013-10-23 14:39 - 2013-10-23 14:39 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-10-23 14:39 - 2013-10-23 14:39 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-10-23 14:39 - 2013-10-23 14:39 - 00174504 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-10-23 14:39 - 2013-10-23 14:39 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2013-10-23 14:39 - 2013-10-23 14:39 - 00000000 ____D C:\Program Files\Java
2013-10-23 14:36 - 2012-09-10 18:15 - 00000000 ____D C:\Windows\ccmcache
2013-10-23 10:02 - 2009-07-14 06:34 - 00012048 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-23 10:02 - 2009-07-14 06:34 - 00012048 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-23 09:58 - 2013-10-23 09:58 - 00000772 _____ C:\Users\Markus.Ortlieb\Desktop\JRT.txt
2013-10-23 09:52 - 2010-09-09 22:44 - 00000568 _____ C:\Windows\SMSCFG.INI
2013-10-23 09:50 - 2013-10-21 09:40 - 00000000 ___RD C:\Users\Markus.Ortlieb\SkyDrive
2013-10-23 09:50 - 2013-09-23 16:37 - 00000000 ____D C:\Users\Markus.Ortlieb\Tracing
2013-10-23 09:49 - 2011-05-10 17:42 - 00062826 _____ C:\Windows\setupact.log
2013-10-23 09:49 - 2009-07-14 06:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-23 09:09 - 2013-10-23 09:09 - 01033335 _____ (Thisisu) C:\Users\Markus.Ortlieb\Downloads\JRT(1).exe
2013-10-23 09:00 - 2013-10-23 09:00 - 01060070 _____ C:\Users\Markus.Ortlieb\Downloads\adwcleaner(1).exe
2013-10-22 17:27 - 2013-10-22 17:27 - 00073342 _____ C:\Users\Markus.Ortlieb\Downloads\FRST.txt
2013-10-22 17:27 - 2013-10-22 17:27 - 00019499 _____ C:\Users\Markus.Ortlieb\Downloads\Addition.txt
2013-10-22 17:26 - 2013-10-22 17:26 - 00000000 ____D C:\FRST
2013-10-22 17:22 - 2013-10-22 17:22 - 00000000 ____D C:\Windows\ERUNT
2013-10-22 17:14 - 2010-09-10 09:35 - 00033218 _____ C:\Windows\PFRO.log
2013-10-22 17:14 - 2010-08-15 20:11 - 00000000 ____D C:\Windows\sv-SE
2013-10-22 16:23 - 2013-10-22 16:23 - 00001080 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-10-22 16:23 - 2013-10-22 16:23 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-10-22 16:22 - 2013-10-22 16:22 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Markus.Ortlieb\Downloads\mbam-setup-1.75.0.1300.exe
2013-10-21 16:42 - 2012-02-16 17:27 - 00054882 __RSH C:\ProgramData\ntuser.pol
2013-10-21 16:41 - 2012-02-16 17:10 - 00000400 _____ C:\Windows\system32\config\netlogon.ftl
2013-10-21 09:40 - 2013-10-21 09:40 - 00002178 _____ C:\Users\Markus.Ortlieb\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft SkyDrive.lnk
2013-10-21 09:40 - 2013-10-21 09:40 - 00002091 _____ C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft SkyDrive.lnk
2013-10-21 09:40 - 2013-10-21 09:40 - 00002091 _____ C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft SkyDrive.lnk
2013-10-21 09:40 - 2013-10-21 09:40 - 00000000 ____D C:\Users\Markus.Ortlieb\AppData\Local\Windows Live
2013-10-21 09:40 - 2013-10-21 09:40 - 00000000 ____D C:\ProgramData\Microsoft SkyDrive
2013-10-21 09:40 - 2013-10-21 09:40 - 00000000 ____D C:\Program Files\Microsoft SkyDrive
2013-10-21 09:40 - 2013-10-21 09:40 - 00000000 ____D C:\Program Files\Common Files\Windows Live
2013-10-21 09:40 - 2012-03-08 10:53 - 00000000 ____D C:\Users\Markus.Ortlieb
2013-10-21 09:27 - 2013-10-21 09:27 - 01245168 _____ (Microsoft Corporation) C:\Users\Markus.Ortlieb\Downloads\wlsetup-web.exe
2013-10-20 18:55 - 2012-09-19 10:40 - 00194238 _____ C:\Users\Markus.Ortlieb\Downloads\OTL.Txt
2013-10-20 18:38 - 2013-10-20 18:38 - 00001088 _____ C:\Users\Markus.Ortlieb\Desktop\PC Speed Maximizer.lnk
2013-10-20 18:38 - 2013-10-20 18:38 - 00000000 ____D C:\Users\Markus.Ortlieb\AppData\Roaming\0D0S1L2Z1P1B
2013-10-20 18:38 - 2012-07-02 14:26 - 00000000 ____D C:\Users\Markus.Ortlieb\AppData\Local\Google
2013-10-20 18:37 - 2013-10-20 18:37 - 00602112 _____ (OldTimer Tools) C:\Users\Markus.Ortlieb\Downloads\OTL(1).exe
2013-10-18 15:38 - 2013-10-18 15:38 - 00000000 ____D C:\Users\Public\Documents\CrashDump
2013-10-18 09:22 - 2012-04-05 08:48 - 00000000 ____D C:\Users\Markus.Ortlieb\AppData\Roaming\HpUpdate
2013-10-17 00:46 - 2013-10-17 00:46 - 00000000 _____ C:\Users\Markus.Ortlieb\Downloads\uPlayer.msi
2013-10-17 00:45 - 2013-10-17 00:45 - 00000000 ____D C:\Users\Markus.Ortlieb\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Word Layers
2013-10-17 00:44 - 2013-10-17 00:44 - 00590496 _____ C:\Users\Markus.Ortlieb\Downloads\uplayermediaplayer-setup.exe
2013-10-17 00:44 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Resources
2013-10-15 16:11 - 2012-03-07 08:06 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-10-14 01:40 - 2013-10-14 01:40 - 00053091 _____ C:\Users\Markus.Ortlieb\Downloads\LCR_Analysis_by_Factory.xlsx
2013-10-14 01:40 - 2013-10-14 01:14 - 00010422 _____ C:\Users\Markus.Ortlieb\Downloads\99q29jC88dwMhs8s8jCGCy8M2lCyG22q4j9wGlj4.xls
2013-10-12 19:17 - 2013-10-12 19:17 - 00000000 ____D C:\Users\Markus.Ortlieb\Documents\Freemake
2013-10-11 10:41 - 2013-10-11 10:41 - 00235008 _____ C:\Windows\Minidump\101113-19578-01.dmp
2013-10-11 10:41 - 2013-06-05 12:31 - 342290339 _____ C:\Windows\MEMORY.DMP
2013-10-11 10:41 - 2013-06-05 12:31 - 00000000 ____D C:\Windows\Minidump
2013-10-10 17:23 - 2012-04-05 10:28 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-10-10 17:23 - 2012-02-16 17:22 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-10-10 02:42 - 2012-03-08 10:53 - 00012730 __RSH C:\Users\Markus.Ortlieb\ntuser.pol
2013-10-04 03:01 - 2012-09-10 18:15 - 00000000 ____D C:\Windows\CCM
2013-10-03 20:53 - 2013-10-03 20:53 - 00059120 _____ C:\Windows\system32\CcmFramework.ini
2013-10-03 20:53 - 2013-10-03 20:53 - 00000621 _____ C:\Windows\system32\CcmFramework.h
2013-10-03 20:53 - 2013-09-23 11:50 - 00009490 _____ C:\Windows\system32\InstallUtil.InstallLog
2013-10-03 20:53 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-10-03 20:52 - 2013-10-03 20:52 - 00000000 ____D C:\Windows\ms
2013-10-03 20:52 - 2013-09-23 11:49 - 00000000 ____D C:\Windows\system32\{3DA228BE-34DA-49f4-A081-66465B077429}
2013-10-01 15:40 - 2013-10-01 15:40 - 00000000 ____D C:\Users\Markus.Ortlieb\Documents\Mein Steuer-Sparbuch Heute
2013-10-01 14:21 - 2013-09-23 16:37 - 00000000 ____D C:\Program Files\Microsoft Lync
2013-10-01 14:20 - 2012-09-25 07:56 - 00000000 ____D C:\Program Files\Microsoft Security Client
2013-10-01 14:20 - 2012-09-24 15:12 - 00001945 _____ C:\Windows\epplauncher.mif
2013-10-01 11:24 - 2013-10-01 11:24 - 00033488 _____ C:\Users\Markus.Ortlieb\Downloads\qwwC8wGhjMq28w48yCvwshsyGjqh8jqlM94j9qd4.xls
2013-10-01 10:12 - 2013-10-01 10:09 - 06795264 _____ C:\Users\Markus.Ortlieb\Downloads\Tracker 9-30-13-20130930-165911.xls
2013-10-01 08:25 - 2012-04-04 09:20 - 00000000 ____D C:\Users\Markus.Ortlieb\AppData\Local\Mozilla
2013-09-30 22:35 - 2012-03-08 10:53 - 00000000 ____D C:\Users\Markus.Ortlieb\AppData\Roaming\Adobe
2013-09-30 15:45 - 2012-04-03 11:29 - 00000000 ____D C:\Procurement Europe
2013-09-30 14:12 - 2013-09-30 14:12 - 00001998 _____ C:\Users\Public\Desktop\Adobe Reader X.lnk
2013-09-30 14:11 - 2013-09-30 14:11 - 00000000 ____D C:\Program Files\Common Files\Adobe
2013-09-30 14:11 - 2013-09-30 14:11 - 00000000 ____D C:\Program Files\Adobe
2013-09-30 14:11 - 2012-02-16 17:20 - 00000000 ____D C:\Users\Default\AppData\Local\Adobe
2013-09-30 14:11 - 2012-02-16 17:20 - 00000000 ____D C:\Users\Default User\AppData\Local\Adobe
2013-09-30 14:11 - 2012-02-16 17:20 - 00000000 ____D C:\ProgramData\Adobe
2013-09-27 15:54 - 2013-09-27 15:54 - 00047104 _____ C:\Users\Markus.Ortlieb\Downloads\DHR LCR Country List-20120523.xls
2013-09-27 12:14 - 2013-09-27 12:01 - 00163840 _____ C:\Users\Markus.Ortlieb\Downloads\Staff%2520schdule%2520SW%25202013_09_16-20130924-092920.xls
2013-09-27 11:44 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\rescache
2013-09-27 10:51 - 2013-09-26 11:26 - 00001189 _____ C:\Users\Public\Desktop\Shop für Zubehör - HP Officejet 6500 E710a-f.lnk
2013-09-27 10:51 - 2012-04-05 08:47 - 00002257 _____ C:\Users\Public\Desktop\HP Officejet 6500 E710a-f.lnk
2013-09-27 10:51 - 2012-04-05 08:47 - 00000000 ____D C:\Program Files\HP
2013-09-27 10:42 - 2012-04-05 08:47 - 00000000 ____D C:\ProgramData\HP
2013-09-27 10:36 - 2013-09-26 11:08 - 00002027 _____ C:\Users\Markus.Ortlieb\Desktop\HPPSDr.lnk
2013-09-26 15:37 - 2013-09-26 15:37 - 02338824 _____ C:\Users\Markus.Ortlieb\Downloads\hppiw.exe
2013-09-26 11:42 - 2013-09-26 11:42 - 00000000 ____D C:\Scans
2013-09-26 11:26 - 2012-09-21 12:53 - 00000000 ____D C:\Program Files\Hewlett-Packard
2013-09-26 11:08 - 2013-09-26 11:08 - 06064264 _____ C:\Users\Markus.Ortlieb\Downloads\HPPSdr.exe
2013-09-26 11:07 - 2013-09-26 11:07 - 00000333 _____ C:\Users\Markus.Ortlieb\Desktop\HP Druckerdiagnosetools.url
2013-09-26 10:59 - 2013-09-26 10:59 - 00002257 _____ C:\Users\Public\Desktop\HP Officejet 6500 E710n-z.lnk
2013-09-26 10:59 - 2013-09-26 10:59 - 00001189 _____ C:\Users\Public\Desktop\Shop für Zubehör - HP Officejet 6500 E710n-z.lnk
2013-09-26 10:59 - 2009-07-14 06:52 - 00000000 ____D C:\Windows\twain_32
2013-09-26 10:12 - 2012-03-08 10:53 - 00000000 ____D C:\Users\Markus.Ortlieb\AppData\Local\Microsoft Help
2013-09-26 09:56 - 2013-09-26 09:56 - 00001235 _____ C:\Users\Markus.Ortlieb\Desktop\Revo Uninstaller.lnk
2013-09-26 09:56 - 2013-09-26 09:56 - 00000000 ____D C:\Program Files\VS Revo Group
2013-09-26 08:46 - 2013-09-26 08:46 - 00000000 ____D C:\Users\Markus.Ortlieb\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
2013-09-26 08:45 - 2009-07-14 06:33 - 00407056 _____ C:\Windows\system32\FNTCACHE.DAT

Some content of TEMP:
====================
C:\Users\Markus.Ortlieb\AppData\Local\Temp\atgpcdec.dll
C:\Users\Markus.Ortlieb\AppData\Local\Temp\Foxit Reader Updater.exe
C:\Users\Markus.Ortlieb\AppData\Local\Temp\Foxit Updater.exe
C:\Users\Markus.Ortlieb\AppData\Local\Temp\HPInstaller.exe
C:\Users\Markus.Ortlieb\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\Markus.Ortlieb\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe
[2013-05-05 18:57] - [2012-10-18 19:40] - 0021504 ____A (Microsoft Corporation) FFB38D8AFD6F4FCA1D46D64F1EDE0B9F

C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys
[2013-05-05 18:57] - [2012-10-18 22:17] - 0246104 ____A (Microsoft Corporation) 4EDEF8AB59B089925CF9A6CFC74A4109



LastRegBack: 2013-10-21 15:12

==================== End Of Log ============================

--- --- ---

schrauber · 26.10.2013, 12:46

Fertig

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

25.10.2013, 11:43	#16
schrauber /// the machine /// TB-Ausbilder	Whilokii Virus entfernen Frisches FRST log bitte __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Whilokii Virus entfernen

Plagegeister aller Art und deren Bekämpfung: Whilokii Virus entfernen