Mail: Fax von 04589016238 geoeffnet, AVG

sumsemann · 13.11.2013, 08:22

Hallo liebe community

gestern nach einem langen Arbeitstag hatte ich eine Faxnachricht im Email-Postfach. Hab die geoeffnet, obwohl etwas verwundert, warum ich die Nachricht an meine Email gesendet bekomme; aber ich hatte auch ein Fax angekuendigt bekommen...
Na ja, hab natuerlich nicht auf die Endung geachtet und in dem Moment als ich draufclickte fiel es mir erst auf. Dachte gerade darueber nach wie ich die Ausfuehrung der Datei stoppen kann, da meldetet sich der AVG Scanner mit "Bedrohung gefunden". Habe ich gleich entfernen lassen.

Da ich mir nicht sicher war, ob wirklich alles weg ist, hatte ich noch einen Scan mit Malwarebyte gemacht und mir dabei - wie andere User vor mir - "Advanced System Protector" und "RegClean Pro" "OpenIT" und "MyBackup" eingefangen. (Jedenfalls glaube ich, dass es mit dem Download zusammenhaengt.) Gestern liessen die sich auch nicht deinstallieren, heute morgen schon. Ich hoffe, dass die nach dem Neustart auch wegbleiben.

Der Scan mit Malwarebyte gab ausser den genannten Programmen keine Anmerkungen. Mein Freund war da aber nicht so sicher und meinte dass der bestimmt noch auf dem PC hockt. Die identifizierten Bedrohungen hatte ich entfernt und der Anschliessende Scan brachte keine neuen Infizierungen.

Ich habe einen Laptop von lenovo mit Win 7 (urspruenglich XP), Firewall ist Zonealarm und Virenscanner AVG.

Was meint ihr: Hat das ausgereicht? Ist der (noch) auf dem PC? Kamen die Programme durch den Download oder durch den Trojaner/Virus auf den PC?

Die files kann ich gerne posten. Defogger bin ich grade dran, Scan Tool FRST hoert irgentwann auf, hatte ich jetzt 2 mal.

Vielen Dank
sum

schrauber · 13.11.2013, 08:50

hi,

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop ( falls noch nicht vorhanden ).

Doppelklick auf die OTL.exe
Oben findest Du ein Kästchen mit Ausgabe. Wähle bitte Minimal Ausgabe
Unter Extra Registry, wähle bitte Use SafeList
Klicke nun auf Run Scan links oben
Wenn der Scan beendet wurde werden 2 Logfiles erstellt
Poste die Logfiles hier in den Thread.

sumsemann · 13.11.2013, 09:52

Hallo schrauber,

danke fuer die schnelle Rueckmeldung.
Hier mein OTL Report (habe aber nur eine File bekommen)

Edit:
So habe es noch einmal gemacht und nun zwei Files erhalten:OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 09/11/2013 10:27:07 - Run 2
OTL by OldTimer - Version 3.2.69.0     Folder = D:\
 Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16721)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy
 
1.99 Gb Total Physical Memory | 0.90 Gb Available Physical Memory | 45.27% Memory free
3.98 Gb Paging File | 2.44 Gb Available in Paging File | 61.28% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 27.65 Gb Total Space | 0.18 Gb Free Space | 0.66% Space Free | Partition Type: NTFS
Drive D: | 46.78 Gb Total Space | 28.85 Gb Free Space | 61.67% Space Free | Partition Type: NTFS
 
Computer Name: OWNER-PC | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - D:\OTL.exe (OldTimer Tools)
PRC - C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe (Adobe Systems, Inc.)
PRC - C:\Program Files\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2013\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe (Check Point Software Technologies LTD)
PRC - C:\Program Files\CheckPoint\ZoneAlarm\zatray.exe (Check Point Software Technologies LTD)
PRC - C:\Program Files\AVG\AVG2013\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2013\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2013\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2013\avgidsagent.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\WinZipper\winzipersvc.exe (Taiwan Shui Mu Chih Ching Technology Limited.)
PRC - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.3.0\ToolbarUpdater.exe (AVG Secure Search)
PRC - C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)
PRC - C:\Program Files\CheckPoint\ZoneAlarm\ZAPrivacyService.exe (Check Point Software Technologies, Ltd.)
PRC - C:\Program Files\AVG\AVG2013\avgemcx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Program Files\OPENLiMiT\siqSEMr.exe (OPENLiMiT SignCubes GmbH)
PRC - C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe (Acresso Corporation)
PRC - C:\Program Files\Common Files\Nuance\dgnsvc.exe (Nuance Communications, Inc.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Windows\System32\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
 
 
========== Services (SafeList) ==========
 
SRV - (MozillaMaintenance) -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (vsmon) -- C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe (Check Point Software Technologies LTD)
SRV - (avgwd) -- C:\Program Files\AVG\AVG2013\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (AVGIDSAgent) -- C:\Program Files\AVG\AVG2013\avgidsagent.exe (AVG Technologies CZ, s.r.o.)
SRV - (winzipersvc) -- C:\Program Files\WinZipper\winzipersvc.exe (Taiwan Shui Mu Chih Ching Technology Limited.)
SRV - (vToolbarUpdater15.3.0) -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.3.0\ToolbarUpdater.exe (AVG Secure Search)
SRV - (sftvsa) -- C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
SRV - (sftlist) -- C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)
SRV - (ZAPrivacyService) -- C:\Program Files\CheckPoint\ZoneAlarm\ZAPrivacyService.exe (Check Point Software Technologies, Ltd.)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (TeamViewer8) -- C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (DragonSvc) -- C:\Program Files\Common Files\Nuance\dgnsvc.exe (Nuance Communications, Inc.)
SRV - (CVPND) -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)
SRV - (StorSvc) -- C:\Windows\System32\StorSvc.dll (Microsoft Corporation)
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PeerDistSvc) -- C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (VClone) -- system32\DRIVERS\VClone.sys File not found
DRV - (AVGIDSShim) -- C:\Windows\System32\drivers\avgidsshimx.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgrkx86) -- C:\Windows\System32\drivers\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avglogx) -- C:\Windows\System32\drivers\avglogx.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSDriver) -- C:\Windows\System32\drivers\avgidsdriverx.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSHX) -- C:\Windows\System32\drivers\avgidshx.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgldx86) -- C:\Windows\System32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgmfx86) -- C:\Windows\System32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (avgtp) -- C:\Windows\System32\drivers\avgtpx86.sys (AVG Technologies)
DRV - (Sftvol) -- C:\Windows\System32\drivers\Sftvollh.sys (Microsoft Corporation)
DRV - (Sftplay) -- C:\Windows\System32\drivers\Sftplaylh.sys (Microsoft Corporation)
DRV - (Sftredir) -- C:\Windows\System32\drivers\Sftredirlh.sys (Microsoft Corporation)
DRV - (Sftfs) -- C:\Windows\System32\drivers\Sftfslh.sys (Microsoft Corporation)
DRV - (Vsdatant) -- C:\Windows\System32\drivers\vsdatant.sys (Check Point Software Technologies LTD)
DRV - (Avgtdix) -- C:\Windows\System32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (vmbus) -- C:\Windows\System32\drivers\vmbus.sys (Microsoft Corporation)
DRV - (storflt) -- C:\Windows\System32\drivers\vmstorfl.sys (Microsoft Corporation)
DRV - (storvsc) -- C:\Windows\System32\drivers\storvsc.sys (Microsoft Corporation)
DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (VMBusHID) -- C:\Windows\System32\drivers\VMBusHID.sys (Microsoft Corporation)
DRV - (s3cap) -- C:\Windows\System32\drivers\vms3cap.sys (Microsoft Corporation)
DRV - (CVPNDRVA) -- C:\Windows\System32\drivers\CVPNDRVA.sys (Cisco Systems, Inc.)
DRV - (TPM) -- C:\Windows\System32\drivers\tpm.sys (Microsoft Corporation)
DRV - (netw5v32) -- C:\Windows\System32\drivers\netw5v32.sys (Intel Corporation)
DRV - (e1express) -- C:\Windows\System32\drivers\e1e6032.sys (Intel Corporation)
DRV - (silabser) -- C:\Windows\System32\drivers\silabser.sys (Silicon Laboratories)
DRV - (DNE) -- C:\Windows\System32\drivers\dne2000.sys (Deterministic Networks, Inc.)
DRV - (CVirtA) -- C:\Windows\System32\drivers\CVirtA.sys (Cisco Systems, Inc.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = 
 
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = 
 
IE - HKU\S-1-5-21-167141536-1578239192-4268729921-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
IE - HKU\S-1-5-21-167141536-1578239192-4268729921-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
IE - HKU\S-1-5-21-167141536-1578239192-4268729921-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://uk.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-167141536-1578239192-4268729921-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-GB
IE - HKU\S-1-5-21-167141536-1578239192-4268729921-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 83 45 C6 7E 64 B4 CD 01  [binary data]
IE - HKU\S-1-5-21-167141536-1578239192-4268729921-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-167141536-1578239192-4268729921-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR
IE - HKU\S-1-5-21-167141536-1578239192-4268729921-1000\..\SearchScopes\{24BF7F8D-2C49-491F-8E48-0FFDFF1F5FD8}: "URL" = hxxp://search.zonealarm.com/search?src=sp&tbid=base2013&Lan=en&q={searchTerms}&gu=a032e0599f8f440b9773e1622ad62add&tu=10GX000652B000c&sku=&tstsId=&ver=&&r=179
IE - HKU\S-1-5-21-167141536-1578239192-4268729921-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR
IE - HKU\S-1-5-21-167141536-1578239192-4268729921-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledAddons: donottrack%40checkpoint.com:2.2.5.1213
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:22.0
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw_1200112.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf: C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.45.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.45.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 24.0.1\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 24.0.1\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 24.0.1\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 24.0.1\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
 
[2013/10/08 05:42:12 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Owner\AppData\Roaming\Mozilla\Extensions
[2013/11/08 18:16:37 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\h68r321a.default\extensions
[2013/01/12 12:27:06 | 000,000,000 | ---D | M] (ZoneAlarm Do Not Track) -- C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\h68r321a.default\extensions\donottrack@checkpoint.com
[2012/08/22 15:49:13 | 000,077,464 | ---- | M] () (No name found) -- C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\h68r321a.default\extensions\ciuvo-extension@billiger.de.xpi
[2013/01/12 12:23:48 | 000,007,919 | ---- | M] () (No name found) -- C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\h68r321a.default\extensions\donottrack@checkpoint.com\chrome\content\ff\view_expiry.js
[2013/10/05 23:50:07 | 000,001,302 | ---- | M] () -- C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\h68r321a.default\searchplugins\searchgol.xml
[2013/10/05 23:50:28 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\Extensions
[2013/07/03 08:28:15 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\browser\extensions
[2013/07/03 08:28:15 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}{google:pageClassification}sugkey={google:suggestAPIKeyParameter},
CHR - Extension: Google Docs = C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0\
CHR - Extension: Google Drive = C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: Google-Suche = C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: Google Wallet = C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0\
CHR - Extension: Google Mail = C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\
 
O1 HOSTS File: ([2009/06/10 22:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (no name) - {2A841F7A-A014-4DA5-B6D9-8B913DFB7A8C} - No CLSID value found.
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (no name) - {438FAE3E-BDEF-44D3-AB8B-0C7C8350DF59} - No CLSID value found.
O3 - HKU\S-1-5-21-167141536-1578239192-4268729921-1000\..\Toolbar\WebBrowser: (no name) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - No CLSID value found.
O4 - HKLM..\Run: [AVG_UI] C:\Program Files\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [ZoneAlarm] C:\Program Files\CheckPoint\ZoneAlarm\zatray.exe (Check Point Software Technologies LTD)
O4 - HKU\S-1-5-21-167141536-1578239192-4268729921-1000..\Run: [ISUSPM] C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe (Acresso Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7EB67409-46F2-4DDB-9285-BB57803D27C1}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\linkscanner - No CLSID value found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013/11/09 08:29:06 | 000,000,000 | ---D | C] -- C:\FRST
[2013/11/08 18:20:29 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Thunderbird
[2013/11/08 16:47:53 | 000,000,000 | ---D | C] -- C:\Users\Owner\AppData\Roaming\Malwarebytes
[2013/11/08 16:46:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013/11/08 16:46:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013/11/08 16:46:56 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2013/11/08 16:45:51 | 000,000,000 | ---D | C] -- C:\Program Files\MyPC Backup
[2013/11/08 16:45:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced System Protector
[2013/11/08 16:45:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Systweak
[2013/11/08 16:43:44 | 000,000,000 | ---D | C] -- C:\Users\Owner\AppData\Roaming\Systweak
[2013/11/08 16:42:58 | 000,000,000 | ---D | C] -- C:\Users\Owner\AppData\Roaming\DigitalSite
[2013/10/22 16:50:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
[2013/10/17 16:05:35 | 000,175,016 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\javaw.exe
[2013/10/17 16:05:35 | 000,174,504 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\java.exe
[2013/10/17 16:05:35 | 000,094,632 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\WindowsAccessBridge.dll
[2013/10/17 16:05:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
[2013/10/13 17:29:26 | 000,000,000 | --SD | C] -- C:\Users\Owner\Documents\Eigene Datenquellen
[2013/10/11 15:07:06 | 002,706,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2013/10/11 15:07:05 | 002,876,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2013/10/11 15:07:04 | 000,039,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2013/10/11 15:07:03 | 000,391,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2013/10/11 15:07:03 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll
[2013/10/11 15:07:02 | 000,493,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2013/10/11 15:07:02 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll
[2013/10/11 15:07:02 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RegisterIEPKEYs.exe
[2013/10/11 15:07:02 | 000,042,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe
[2013/10/11 15:07:02 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll
[2013/10/11 11:11:42 | 000,055,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\hidclass.sys
[2013/10/11 11:11:42 | 000,025,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\hidparse.sys
[2013/10/10 23:05:44 | 000,284,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\usbport.sys
[2013/10/10 23:05:44 | 000,006,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\usbd.sys
[2013/10/10 21:18:31 | 000,434,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\scavengeui.dll
[2013/10/10 21:18:19 | 000,102,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PresentationCFFRasterizerNative_v0300.dll
[2013/10/10 21:18:16 | 003,969,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2013/10/10 21:18:16 | 003,914,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[2013/10/10 21:18:16 | 000,619,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tdh.dll
[2013/10/10 21:18:14 | 000,295,424 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll
[2013/10/10 21:18:14 | 000,070,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\fontsub.dll
[2013/10/10 21:18:14 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll
[2013/10/10 21:18:14 | 000,010,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dciman32.dll
[2013/10/10 21:16:56 | 002,348,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
 
========== Files - Modified Within 30 Days ==========
 
[2013/11/09 09:48:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013/11/09 09:43:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/11/09 09:43:00 | 000,000,292 | ---- | M] () -- C:\Windows\tasks\DigitalSite.job
[2013/11/09 09:01:09 | 000,002,092 | ---- | M] () -- C:\Users\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Thunderbird.lnk
[2013/11/09 07:01:13 | 000,014,032 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/11/09 07:01:13 | 000,014,032 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/11/09 06:59:58 | 000,629,128 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013/11/09 06:59:58 | 000,111,022 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013/11/09 06:53:27 | 000,000,880 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/11/09 06:53:14 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013/11/09 06:53:12 | 1603,084,288 | -HS- | M] () -- C:\hiberfil.sys
[2013/11/08 18:09:40 | 309,324,176 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2013/11/08 17:43:07 | 000,000,096 | ---- | M] () -- C:\Users\Owner\AppData\Roaming\WB.CFG
[2013/11/05 14:55:35 | 000,075,746 | ---- | M] () -- C:\Users\Owner\Desktop\DB BAHN - Verbindungen - Ihre Auskunft.pdf
[2013/10/26 20:47:31 | 000,334,452 | ---- | M] () -- C:\Users\Owner\Desktop\TDL11_KurzleitfadenPR_110301.pdf
[2013/10/24 07:59:09 | 000,844,479 | ---- | M] () -- C:\Users\Owner\Desktop\LPM_Präsentation.pdf
[2013/10/22 16:50:44 | 000,000,987 | ---- | M] () -- C:\Users\Public\Desktop\AVG 2013.lnk
[2013/10/12 00:05:04 | 000,412,720 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2013/10/11 09:31:52 | 000,002,261 | ---- | M] () -- C:\Users\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2013/10/11 09:31:51 | 000,002,237 | ---- | M] () -- C:\Users\Owner\Desktop\Google Chrome.lnk
 
========== Files Created - No Company Name ==========
 
[2013/11/08 17:43:07 | 000,000,096 | ---- | C] () -- C:\Users\Owner\AppData\Roaming\WB.CFG
[2013/11/08 16:45:06 | 000,017,136 | ---- | C] () -- C:\Windows\System32\sasnative32.exe
[2013/11/08 16:43:27 | 000,000,292 | ---- | C] () -- C:\Windows\tasks\DigitalSite.job
[2013/11/05 14:55:33 | 000,075,746 | ---- | C] () -- C:\Users\Owner\Desktop\DB BAHN - Verbindungen - Ihre Auskunft.pdf
[2013/10/26 20:47:26 | 000,334,452 | ---- | C] () -- C:\Users\Owner\Desktop\TDL11_KurzleitfadenPR_110301.pdf
[2013/10/24 07:59:08 | 000,844,479 | ---- | C] () -- C:\Users\Owner\Desktop\LPM_Präsentation.pdf
[2013/10/11 09:31:51 | 000,002,237 | ---- | C] () -- C:\Users\Owner\Desktop\Google Chrome.lnk
[2013/05/14 10:18:15 | 000,030,050 | ---- | C] () -- C:\Users\Owner\SIGNIERTdatei.p7m
[2013/05/14 10:17:50 | 000,024,453 | ---- | C] () -- C:\Users\Owner\datei.html
[2013/05/14 09:31:46 | 000,000,512 | ---- | C] () -- C:\Windows\System32\siqP11.dll.sig
[2013/05/01 12:43:48 | 000,065,536 | ---- | C] () -- C:\Windows\System32\EZTW32.DLL
[2012/07/07 19:58:49 | 000,001,835 | ---- | C] () -- C:\Users\Owner\AppData\Roaming\SAS7_000.DAT
[2012/06/18 07:52:51 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2007/11/20 13:14:04 | 000,000,300 | ---- | C] () -- C:\Users\Owner\jSign.ini
 
========== ZeroAccess Check ==========
 
[2009/07/14 05:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013/07/26 02:55:59 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009/07/14 02:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2013/01/11 09:52:08 | 000,000,000 | ---D | M] -- C:\Users\Default\AppData\Roaming\TuneUp Software
[2013/01/11 09:52:08 | 000,000,000 | ---D | M] -- C:\Users\Default User\AppData\Roaming\TuneUp Software
[2012/11/12 19:23:05 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\APP_NAME_NON_STRING
[2013/10/07 06:42:41 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\AVG
[2012/12/13 08:03:43 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\AVG2013
[2013/06/29 08:22:25 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\CheckPoint
[2013/11/08 18:44:19 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\DigitalSite
[2013/05/14 10:06:32 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\eVergabe
[2013/05/23 07:13:06 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\Foxit Software
[2013/10/09 20:19:24 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\Notepad++
[2012/06/16 13:20:12 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\Nuance
[2013/10/23 22:52:07 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\SoftGrid Client
[2013/11/08 18:44:19 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\Systweak
[2012/11/14 11:48:15 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\Thunderbird
[2012/05/28 13:30:01 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\TP
[2013/06/28 09:54:05 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\WinZipper
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 241 bytes -> C:\ProgramData\TEMP:0FF263E8
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:0B4227B4

< End of report >

--- --- ---
und Extas:OTL Logfile:

Code:

ATTFilter

OTL Extras logfile created on: 09/11/2013 10:27:07 - Run 2
OTL by OldTimer - Version 3.2.69.0     Folder = D:\
 Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16721)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy
 
1.99 Gb Total Physical Memory | 0.90 Gb Available Physical Memory | 45.27% Memory free
3.98 Gb Paging File | 2.44 Gb Available in Paging File | 61.28% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 27.65 Gb Total Space | 0.18 Gb Free Space | 0.66% Space Free | Partition Type: NTFS
Drive D: | 46.78 Gb Total Space | 28.85 Gb Free Space | 61.67% Space Free | Partition Type: NTFS
 
Computer Name: OWNER-PC | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-167141536-1578239192-4268729921-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
http [open] -- Reg Error: Key error.
https [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- "C:\Program Files\File Type Assistant\tsassist.exe" "%1" (Trusted Software ApS)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{09D8C92E-2A34-4739-9064-5036C1BA54DA}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{0F5E16F3-649F-41C1-BC13-2684AE9463B4}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{10619E3E-A39F-4865-83C2-3F27CC708C2B}" = rport=139 | protocol=6 | dir=out | app=system | 
"{1BA8BFDB-4F73-4431-BD7B-753BFB4F8B16}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{29761FC8-3DFE-46C8-A2A9-C379E94F3137}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{34ED0FD6-EF26-42E0-B42B-C2420A7054B9}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{43D423D4-CA68-4430-84CD-27F7A5B78BBE}" = rport=137 | protocol=17 | dir=out | app=system | 
"{49C704EA-FACD-4B02-8588-33510B4BACFB}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{4F1321F1-94DC-4C1D-82F0-63DE418EFE11}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{5192CA0E-D1E1-43EB-A8E7-407CD164CE47}" = rport=445 | protocol=6 | dir=out | app=system | 
"{5479E36C-ACEC-434B-AE2E-26D9EBDD052C}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{56B35BA3-9D3E-44DF-A694-CE3DC4B24271}" = lport=445 | protocol=6 | dir=in | app=system | 
"{5E8280D2-CF4D-4817-AC7E-9DB81D1EEDA0}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{609DA35E-C718-4803-873F-3F6D357AC7B5}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{680CC5F1-106B-4BD5-80AD-5492BDC7FEAF}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{7226F440-0815-47BD-B32A-E9CB38CCF54D}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{7D233DEA-ECEA-4617-B7BD-2CBF1D60687C}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{8308A177-BA97-41CC-AF8E-2BE9405D38B4}" = lport=138 | protocol=17 | dir=in | app=system | 
"{834044AF-EA82-4259-941C-293C85FAE69C}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{A1702E2C-A328-418D-8776-2083E40DE803}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{ADCC8B8E-CD3D-492E-818C-1C70CC9A5538}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{B2FE1C6F-42AB-4387-AC0F-8942FFCA50D1}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{B586E300-9516-41D5-A671-7FB2EE6F9FFB}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{BBACB9AA-A60E-48E7-BA68-685A08F4046A}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{C264A00C-9C4F-4E72-9B75-07846A5FB3DB}" = lport=137 | protocol=17 | dir=in | app=system | 
"{C8088D64-B520-4085-AEBA-0719DF2746A6}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe | 
"{D4ACF1BF-3AA0-4680-A5E8-4E74C742E7BC}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{DF4329CF-E0EB-4F89-BAA3-94CD19AE2A38}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{E576AC86-74D0-4C6A-94FF-7AFB94A22109}" = lport=139 | protocol=6 | dir=in | app=system | 
"{E7009222-F864-4CA6-A597-6023DF655E91}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{F623C341-AC99-4353-993F-7338001900F7}" = rport=138 | protocol=17 | dir=out | app=system | 
"{FF4C285F-FCFA-46EE-AA13-B1B7326D8168}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{033734EF-73CC-45E2-97FB-AFC39A4200D3}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version8\teamviewer.exe | 
"{0EC356A3-A484-4582-A83F-AB03A08CBA25}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | 
"{2FBC0203-B0E4-4362-B0C9-5ED622CC3EA6}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{37081223-EDC6-455C-A9DC-2037E6457CDD}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{39BAD359-66A0-485F-8B36-3B6D19EE0A30}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version8\teamviewer_service.exe | 
"{39C90B49-52B8-4BFA-80A7-86F656D22313}" = protocol=6 | dir=in | app=c:\program files\avg\avg2013\avgemcx.exe | 
"{3FEDAE9D-F616-4B47-BBD6-1C106A14774E}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{40514336-D627-4EC2-928D-9494A3485D8D}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{43052F2D-8E7D-4BF3-81BB-D212517839F3}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{4C25B498-1169-4B3F-9B68-D3A59AEDABB2}" = protocol=17 | dir=in | app=c:\program files\avg\avg2013\avgemcx.exe | 
"{4F382FE0-C1EC-4C08-A364-998D60C578F7}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{500F6F91-A16E-456B-9A24-21DDB1224254}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{5F170A21-D8AF-419B-8DDD-E4E170C4B72C}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{632A55EB-BB04-42AB-AE06-911096669088}" = dir=in | app=c:\users\owner\appdata\local\microsoft\skydrive\skydrive.exe | 
"{6C127AB8-3F97-4B60-9ACF-64424E2E6B6F}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{6D9890C5-9188-46B2-9AA5-441B6337B33F}" = protocol=17 | dir=in | app=c:\program files\avg\avg2013\avgdiagex.exe | 
"{757FC4C0-A04F-49CB-8CA1-8ACA7EAF8977}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version8\teamviewer_service.exe | 
"{76179FA8-00EB-4C4D-AB10-D22D1E576E70}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{784F93AE-A8CD-4B82-978B-7A80E0084DCD}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{A19367BF-9179-4DDD-BA8E-6AFE9C2322A4}" = protocol=6 | dir=in | app=c:\program files\avg\avg2013\avgnsx.exe | 
"{A8148C22-9D90-4CBC-ACD5-70C991497218}" = protocol=6 | dir=out | app=system | 
"{B2C7D8CD-6AD8-4E97-A278-87BB181D4270}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{C8FE77EC-0E5D-442A-B75C-364DC465BEC4}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{CCF9B7D4-9FB2-4B9E-935B-7C674FBB178F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{CFB2B497-A672-4585-BF1F-591D3C407DC0}" = protocol=17 | dir=in | app=c:\program files\avg\avg2013\avgmfapx.exe | 
"{D20ED0FF-6E85-4D71-ABA2-1129F19DC8D6}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version8\teamviewer.exe | 
"{D61481E6-387D-401B-905D-4B0B6808F9D3}" = protocol=17 | dir=in | app=c:\program files\avg\avg2013\avgnsx.exe | 
"{D65E71EA-30FF-4DA5-8F19-57CC02F331FC}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{DEE8AD4A-7760-41BD-8385-EBCF68AEFB03}" = protocol=6 | dir=in | app=c:\program files\avg\avg2013\avgmfapx.exe | 
"{F1C9C255-E075-4A3E-96B8-044C85DA6119}" = protocol=6 | dir=in | app=c:\program files\avg\avg2013\avgdiagex.exe | 
"{F6137487-6E2C-4FDF-883B-E1DBA96DD7AC}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{F657E5DF-FDAC-41BD-9932-4EA1D9DFEC02}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{F8A8B210-01DA-4A99-93A9-D37AFEA5CCCF}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{FE2E1441-67D7-4418-851E-3A051C24D92F}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{21E247D4-5E27-4BEA-AA4D-19A81203FE2A}" = Cisco Systems VPN Client 5.0.06.0160
"{26A24AE4-039D-4CA4-87B4-2F83217025FF}" = Java 7 Update 45
"{337EDB0F-8505-4D14-9948-3A8A3D52CFCB}" = ZoneAlarm Security
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D305D7A-CD45-4876-94E6-F24FEB1690A3}" = ZoneAlarm Firewall
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A5A427F-BA39-4BF0-9999-9A47FBE60C9F}" = Visual C++ 9.0 Runtime for Dragon NaturallySpeaking
"{515EE4A3-6C80-4D56-824B-DF234DC50F74}" = SignCubes comdlg32.msm Update
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{6280C3D1-00A3-4E79-BDF6-98332A29B706}" = AVG 2013
"{631E66F3-5BCC-4FF8-9F42-95AF0BFA38B7}" = AVG 2013
"{7451FD2D-1A23-4E67-92CD-8EDDD1846917}" = AVG PC TuneUp Language Pack (de-DE)
"{78E43A83-DD74-499F-AF9E-47F9E15EBFE1}" = SignCubes comct232.msm Update
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ULTIMATER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ULTIMATER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ULTIMATER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ULTIMATER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ULTIMATER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ULTIMATER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ULTIMATER_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ULTIMATER_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ULTIMATER_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ULTIMATER_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ULTIMATER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ULTIMATER_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ULTIMATER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ULTIMATER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-006D-0409-0000-0000000FF1CE}" = Microsoft Office Click-to-Run 2010
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{90140011-0066-0409-0000-0000000FF1CE}" = Microsoft Office Starter 2010 - English
"{91120000-002E-0000-0000-0000000FF1CE}" = Microsoft Office Ultimate 2007
"{91120000-002E-0000-0000-0000000FF1CE}_ULTIMATER_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{98286BC7-AD4C-424A-9BB9-F87A26D88CAF}" = SignCubes comct323.msm Update
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A27E7EAE-6E50-40B6-A03B-3F4792E240EC}" = SignCubes comctl32.msm Update
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-A95000000001}" = Adobe Reader 9.5.0 - Deutsch
"{EFFA53BC-8C04-2E21-3D90-A13B1697B0CA}" = Dragon NaturallySpeaking 11
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 12.0
"AVG" = AVG 2013
"Foxit Reader_is1" = Foxit Reader
"Free YouTube Download_is1" = Free YouTube Download version 3.2.13.925
"Google Chrome" = Google Chrome
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.75.0.1300
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox 22.0 (x86 en-US)" = Mozilla Firefox 22.0 (x86 en-US)
"Mozilla Thunderbird 24.0.1 (x86 en-US)" = Mozilla Thunderbird 24.0.1 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Notepad++" = Notepad++
"Office14.Click2Run" = Microsoft Office Click-to-Run 2010
"Power Management Driver" = ThinkPad Power Management Driver
"SignCubes" = OPENLiMiT(R) SignCubes 2.5.0.4 ReaderDeu
"SLABCOMM&10C4&EA60" = Silicon Laboratories CP210x USB to UART Bridge (Driver Removal)
"TeamViewer 8" = TeamViewer 8
"Trusted Software Assistant_is1" = File Type Assistant
"ULTIMATER" = Microsoft Office Ultimate 2007
"WinRAR archiver" = WinRAR 4.20 (32-bit)
"ZoneAlarm Do Not Track Add-on_is1" = ZoneAlarm Do Not Track Add-on 2.2.5.1213
"ZoneAlarm Free Firewall" = ZoneAlarm Free Firewall
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-167141536-1578239192-4268729921-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Amazon Kindle" = Amazon Kindle
"SkyDriveSetup.exe" = Microsoft SkyDrive
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 23/07/2013 04:40:46 | Computer Name = Owner-PC | Source = ESENT | ID = 490
Description = DllHost (2476) WebCacheLocal: An attempt to open the file "C:\Users\Owner\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat"
 for read / write access failed with system error 32 (0x00000020): "The process 
cannot access the file because it is being used by another process. ".  The open
 file operation will fail with error -1032 (0xfffffbf8).
 
Error - 23/07/2013 04:40:56 | Computer Name = Owner-PC | Source = ESENT | ID = 490
Description = DllHost (2476) WebCacheLocal: An attempt to open the file "C:\Users\Owner\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat"
 for read / write access failed with system error 32 (0x00000020): "The process 
cannot access the file because it is being used by another process. ".  The open
 file operation will fail with error -1032 (0xfffffbf8).
 
Error - 23/07/2013 04:41:06 | Computer Name = Owner-PC | Source = ESENT | ID = 490
Description = DllHost (2476) WebCacheLocal: An attempt to open the file "C:\Users\Owner\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat"
 for read / write access failed with system error 32 (0x00000020): "The process 
cannot access the file because it is being used by another process. ".  The open
 file operation will fail with error -1032 (0xfffffbf8).
 
Error - 23/07/2013 04:41:16 | Computer Name = Owner-PC | Source = ESENT | ID = 490
Description = DllHost (2476) WebCacheLocal: An attempt to open the file "C:\Users\Owner\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat"
 for read / write access failed with system error 32 (0x00000020): "The process 
cannot access the file because it is being used by another process. ".  The open
 file operation will fail with error -1032 (0xfffffbf8).
 
Error - 23/07/2013 04:41:26 | Computer Name = Owner-PC | Source = ESENT | ID = 490
Description = DllHost (2476) WebCacheLocal: An attempt to open the file "C:\Users\Owner\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat"
 for read / write access failed with system error 32 (0x00000020): "The process 
cannot access the file because it is being used by another process. ".  The open
 file operation will fail with error -1032 (0xfffffbf8).
 
Error - 23/07/2013 04:41:36 | Computer Name = Owner-PC | Source = ESENT | ID = 490
Description = DllHost (2476) WebCacheLocal: An attempt to open the file "C:\Users\Owner\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat"
 for read / write access failed with system error 32 (0x00000020): "The process 
cannot access the file because it is being used by another process. ".  The open
 file operation will fail with error -1032 (0xfffffbf8).
 
Error - 23/07/2013 04:41:46 | Computer Name = Owner-PC | Source = ESENT | ID = 490
Description = DllHost (2476) WebCacheLocal: An attempt to open the file "C:\Users\Owner\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat"
 for read / write access failed with system error 32 (0x00000020): "The process 
cannot access the file because it is being used by another process. ".  The open
 file operation will fail with error -1032 (0xfffffbf8).
 
Error - 23/07/2013 04:41:56 | Computer Name = Owner-PC | Source = ESENT | ID = 490
Description = DllHost (2476) WebCacheLocal: An attempt to open the file "C:\Users\Owner\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat"
 for read / write access failed with system error 32 (0x00000020): "The process 
cannot access the file because it is being used by another process. ".  The open
 file operation will fail with error -1032 (0xfffffbf8).
 
Error - 23/07/2013 04:42:07 | Computer Name = Owner-PC | Source = ESENT | ID = 490
Description = DllHost (2476) WebCacheLocal: An attempt to open the file "C:\Users\Owner\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat"
 for read / write access failed with system error 32 (0x00000020): "The process 
cannot access the file because it is being used by another process. ".  The open
 file operation will fail with error -1032 (0xfffffbf8).
 
Error - 25/07/2013 07:11:26 | Computer Name = Owner-PC | Source = Application Error | ID = 1000
Description = Faulting application name: EXCEL.EXE, version: 12.0.6665.5003, time
 stamp: 0x5061d2a8  Faulting module name: ntdll.dll, version: 6.1.7601.17725, time
 stamp: 0x4ec49b60  Exception code: 0xc0000374  Fault offset: 0x000c380b  Faulting process
 id: 0xa00  Faulting application start time: 0x01ce892792ccedea  Faulting application
 path: C:\Program Files\Microsoft Office\Office12\EXCEL.EXE  Faulting module path:
 C:\Windows\SYSTEM32\ntdll.dll  Report Id: f1e6b190-f51a-11e2-bae8-0016d339d377
 
[ Media Center Events ]
Error - 12/06/2012 09:20:57 | Computer Name = Owner-PC | Source = MCUpdate | ID = 0
Description = 14:20:57 - Error connecting to the internet.  14:20:57 -     Unable 
to contact server..  
 
[ OSession Events ]
Error - 02/09/2012 05:36:53 | Computer Name = Owner-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
 12.0.6661.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 92
 seconds with 0 seconds of active time.  This session ended with a crash.
 
Error - 02/09/2012 06:58:44 | Computer Name = Owner-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
 12.0.6661.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 3801
 seconds with 3180 seconds of active time.  This session ended with a crash.
 
Error - 02/09/2012 08:43:18 | Computer Name = Owner-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
 12.0.6661.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 6081
 seconds with 2280 seconds of active time.  This session ended with a crash.
 
Error - 02/09/2012 13:29:17 | Computer Name = Owner-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
 12.0.6661.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 280
 seconds with 60 seconds of active time.  This session ended with a crash.
 
[ System Events ]
Error - 08/11/2013 13:45:27 | Computer Name = Owner-PC | Source = Service Control Manager | ID = 7006
Description = The ScRegSetValueExW call failed for FailureActions with the following
 error:   %%5
 
Error - 08/11/2013 13:48:10 | Computer Name = Owner-PC | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
   cdrom  VClone
 
Error - 08/11/2013 14:04:53 | Computer Name = Owner-PC | Source = BROWSER | ID = 8032
Description = 
 
Error - 08/11/2013 16:47:36 | Computer Name = Owner-PC | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
 response from the TeamViewer8 service.
 
Error - 08/11/2013 18:27:25 | Computer Name = Owner-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installation Failure: Windows failed to install the following update
 with error 0x80070643: Internet Explorer 11 for Windows 7.
 
Error - 08/11/2013 18:27:26 | Computer Name = Owner-PC | Source = Service Control Manager | ID = 7006
Description = The ScRegSetValueExW call failed for FailureActions with the following
 error:   %%5
 
Error - 09/11/2013 01:54:04 | Computer Name = Owner-PC | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
   cdrom  VClone
 
Error - 09/11/2013 02:15:57 | Computer Name = Owner-PC | Source = Service Control Manager | ID = 7034
Description = The Computer Backup (MyPC Backup) service terminated unexpectedly.
  It has done this 1 time(s).
 
Error - 09/11/2013 04:31:03 | Computer Name = Owner-PC | Source = bowser | ID = 8003
Description = 
 
Error - 09/11/2013 04:52:05 | Computer Name = Owner-PC | Source = BROWSER | ID = 8032
Description = 
 
 
< End of report >

--- --- ---

schrauber · 13.11.2013, 16:01

hi,

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

sumsemann · 14.11.2013, 07:11

Hallo schrauber,

Danke dir nochmals!!
Combofix ist komplett durchgelaufen und ich habe die log file erstellt. Die sieht so aus:

Code:

ATTFilter

ComboFix 13-11-12.01 - Owner 09/11/2013  19:09:51.2.2 - x86
Microsoft Windows 7 Professional   6.1.7601.1.1252.44.1033.18.2038.1180 [GMT 1:00]
Running from: c:\users\Owner\Desktop\ComboFix.exe
AV: AVG AntiVirus Free Edition 2013 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
FW: ZoneAlarm Free Firewall Firewall *Disabled* {E6380B7E-D4B2-19F1-083E-56486607704B}
SP: AVG AntiVirus Free Edition 2013 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Created a new restore point
.
.
(((((((((((((((((((((((((   Files Created from 2013-10-09 to 2013-11-09  )))))))))))))))))))))))))))))))
.
.
2013-11-09 18:19 . 2013-11-09 18:19	--------	d-----w-	c:\users\Default\AppData\Local\temp
2013-11-09 17:52 . 2013-11-09 17:52	--------	d-----w-	c:\users\Owner\AppData\Roaming\Windows Net Data
2013-11-09 07:29 . 2013-11-09 07:29	--------	d-----w-	C:\FRST
2013-11-08 17:20 . 2013-11-09 08:01	--------	d-----w-	c:\program files\Mozilla Thunderbird
2013-11-08 15:47 . 2013-11-08 15:47	--------	d-----w-	c:\users\Owner\AppData\Roaming\Malwarebytes
2013-11-08 15:46 . 2013-11-08 15:46	--------	d-----w-	c:\programdata\Malwarebytes
2013-11-08 15:45 . 2013-11-09 06:16	--------	d-----w-	c:\program files\MyPC Backup
2013-11-08 15:45 . 2013-11-08 17:44	--------	d-----w-	c:\programdata\Systweak
2013-11-08 15:45 . 2012-07-25 11:03	17136	----a-w-	c:\windows\system32\sasnative32.exe
2013-11-08 15:43 . 2013-11-08 17:44	--------	d-----w-	c:\users\Owner\AppData\Roaming\Systweak
2013-11-08 15:42 . 2013-11-08 17:44	--------	d-----w-	c:\users\Owner\AppData\Roaming\DigitalSite
2013-10-17 15:05 . 2013-10-08 05:50	94632	----a-w-	c:\windows\system32\WindowsAccessBridge.dll
2013-10-11 14:06 . 2013-09-22 23:54	770648	----a-w-	c:\program files\Internet Explorer\iexplore.exe
2013-10-11 14:06 . 2013-09-22 23:28	1767936	----a-w-	c:\windows\system32\wininet.dll
2013-10-11 10:11 . 2013-07-03 03:36	55808	----a-w-	c:\windows\system32\drivers\hidclass.sys
2013-10-11 10:11 . 2013-07-03 03:36	25728	----a-w-	c:\windows\system32\drivers\hidparse.sys
2013-10-10 22:05 . 2013-09-04 01:15	258560	----a-w-	c:\windows\system32\drivers\usbhub.sys
2013-10-10 22:05 . 2013-09-04 01:14	76288	----a-w-	c:\windows\system32\drivers\usbccgp.sys
2013-10-10 22:05 . 2013-09-04 01:14	284672	----a-w-	c:\windows\system32\drivers\usbport.sys
2013-10-10 22:05 . 2013-09-04 01:14	43008	----a-w-	c:\windows\system32\drivers\usbehci.sys
2013-10-10 22:05 . 2013-09-04 01:14	20480	----a-w-	c:\windows\system32\drivers\usbohci.sys
2013-10-10 22:05 . 2013-09-04 01:14	24064	----a-w-	c:\windows\system32\drivers\usbuhci.sys
2013-10-10 22:05 . 2013-09-04 01:14	6016	----a-w-	c:\windows\system32\drivers\usbd.sys
2013-10-10 20:16 . 2013-08-28 01:04	2348544	----a-w-	c:\windows\system32\win32k.sys
2013-10-10 20:16 . 2013-07-04 11:57	205824	----a-w-	c:\windows\system32\WebClnt.dll
2013-10-10 20:16 . 2013-07-04 11:51	81920	----a-w-	c:\windows\system32\davclnt.dll
2013-10-10 20:16 . 2013-07-04 09:48	115712	----a-w-	c:\windows\system32\drivers\mrxdav.sys
2013-10-10 20:16 . 2013-07-12 10:07	86016	----a-w-	c:\windows\system32\drivers\usbcir.sys
2013-10-10 20:16 . 2013-06-25 22:56	527064	----a-w-	c:\windows\system32\drivers\Wdf01000.sys
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-10-09 05:48 . 2012-06-16 13:15	71048	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2013-10-09 05:48 . 2012-06-16 13:15	692616	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2013-10-08 05:51 . 2012-07-13 21:01	873384	----a-w-	c:\windows\system32\npDeployJava1.dll
2013-10-08 05:51 . 2012-07-13 21:01	796072	----a-w-	c:\windows\system32\deployJava1.dll
2013-09-09 23:34 . 2013-09-09 23:34	22328	----a-w-	c:\windows\system32\drivers\avgidsshimx.sys
2013-09-04 23:43 . 2013-09-04 23:43	39224	----a-w-	c:\windows\system32\drivers\avgrkx86.sys
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2012-08-29 19:03	220608	----a-w-	c:\users\Owner\AppData\Local\Microsoft\SkyDrive\16.4.6010.0727\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2012-08-29 19:03	220608	----a-w-	c:\users\Owner\AppData\Local\Microsoft\SkyDrive\16.4.6010.0727\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2012-08-29 19:03	220608	----a-w-	c:\users\Owner\AppData\Local\Microsoft\SkyDrive\16.4.6010.0727\SkyDriveShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM"="c:\programdata\FLEXnet\Connect\11\ISUSPM.exe" [2011-06-06 222496]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-23 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-23 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-23 150552]
"AVG_UI"="c:\program files\AVG\AVG2013\avgui.exe" [2013-09-22 4411952]
"ZoneAlarm"="c:\program files\CheckPoint\ZoneAlarm\zatray.exe" [2013-08-12 73832]
.
c:\users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE /tsr [2009-2-26 97680]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
OpenLimit AutoStart.lnk - c:\program files\OPENLiMiT\siqSEMr.exe -a [2013-5-14 645048]
VPN Client.lnk - c:\windows\Installer\{21E247D4-5E27-4BEA-AA4D-19A81203FE2A}\Icon3E5562ED7.ico -user_logon [2013-3-10 6144]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	autocheck autochk *\0\0sdnclean.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"DNS7reminder"="d:\nuance\NaturallySpeaking11\Ereg\Ereg.exe" -r "c:\programdata\Nuance\NaturallySpeaking11\Ereg.ini"
"SCLicense"=
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
.
R3 silabser;CP210x USB to UART Bridge Driver;c:\windows\system32\DRIVERS\silabser.sys [2009-06-05 62592]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
S0 AVGIDSHX;AVGIDSHX;c:\windows\system32\DRIVERS\avgidshx.sys [2013-07-19 60216]
S0 Avglogx;AVG Logging Driver;c:\windows\system32\DRIVERS\avglogx.sys [2013-07-19 246072]
S0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx86.sys [2013-09-04 39224]
S1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdriverx.sys [2013-07-19 208184]
S1 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\avgidsshimx.sys [2013-09-09 22328]
S1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx86.sys [2013-07-19 171320]
S1 Avgtdix;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdix.sys [2013-03-21 182072]
S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx86.sys [2013-06-27 37664]
S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2013\avgidsagent.exe [2013-07-04 4939312]
S2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2013\avgwdsvc.exe [2013-07-23 283136]
S2 cvhsvc;Client Virtualization Handler;c:\program files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2013-04-22 822504]
S2 DragonSvc;Dragon Service;c:\program files\Common Files\Nuance\dgnsvc.exe [2011-06-05 296808]
S2 sftlist;Application Virtualization Client;c:\program files\Microsoft Application Virtualization Client\sftlist.exe [2013-06-26 523944]
S2 vToolbarUpdater15.3.0;vToolbarUpdater15.3.0;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\15.3.0\ToolbarUpdater.exe [2013-06-27 1598128]
S2 winzipersvc;WinZiper service;c:\program files\WinZipper\winzipersvc.exe [2013-06-28 424104]
S2 ZAPrivacyService;ZoneAlarm Privacy Service;c:\program files\CheckPoint\ZoneAlarm\ZAPrivacyService.exe [2013-06-18 54160]
S3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2013-06-26 583848]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2013-06-26 197800]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2013-06-26 24232]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2013-06-26 20136]
S3 sftvsa;Application Virtualization Service Agent;c:\program files\Microsoft Application Virtualization Client\sftvsa.exe [2013-06-26 207528]
S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]
S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]
S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-10-19 07:45	1185744	----a-w-	c:\program files\Google\Chrome\Application\30.0.1599.101\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2013-11-09 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-16 05:48]
.
2013-11-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-07-06 18:10]
.
2013-11-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-07-06 18:10]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\h68r321a.default\
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-SLABCOMM&10C4&EA60 - c:\windows\system32\Silabs\DriverUninstaller.exe VCP CP210x Cardinal\SLABCOMM&10C4&EA60
AddRemove-{3ED2CDEC-D1BA-45F4-A524-12A1FF68135D} - c:\users\Owner\AppData\Local\{A0FE8EF8-F360-49B7-9660-46163A1206B1}\buchwaltersetup.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_9_900_117_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_9_900_117_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2013-11-09  19:24:20
ComboFix-quarantined-files.txt  2013-11-09 18:24
.
Pre-Run: 81,137,664 bytes free
Post-Run: 787,574,784 bytes free
.
- - End Of File - - 3A06A7AAFCFA5AB700F2665AB3663A0D
A36C5E4F47E84449FF07ED3517B43A31

Oh

ich habe grade gesehen, dass sich die Systemzeit umgestellt hatte auf ein paar Tage zurueck.

Sollte ich den Scanner dann nochmals durchlaufenlassen, falls der die aktuellen Dateien nicht erfasst hatte? Oder macht de Scanner das automatisch?

Viele Gruesse
Sum

schrauber · 14.11.2013, 13:46

passt schon so

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

sumsemann · 15.11.2013, 00:10

Hallo schrauber,

da bin ich ja beruhigt, wenn das so passt.

Hier die Log von Malwarebytes im Quick-Scan:

Code:

ATTFilter

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2013.11.14.09

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 10.0.9200.16736
Owner :: OWNER-PC [administrator]

14/11/2013 22:29:28
mbam-log-2013-11-14 (22-29-28).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled: 
Objects scanned: 200869
Time elapsed: 11 minute(s), 50 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 1
HKLM\SOFTWARE\IMINENT (PUP.Optional.Iminent.A) -> Quarantined and deleted successfully.

Registry Values Detected: 1
HKLM\Software\Iminent|RefererId (PUP.Optional.Iminent.A) -> Data: 678 -> Quarantined and deleted successfully.

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

2. Hier der Report vom AdwCleaner:

Code:

ATTFilter

# AdwCleaner v3.012 - Report created 14/11/2013 at 22:56:55
# Updated 11/11/2013 by Xplode
# Operating System : Windows 7 Professional Service Pack 1 (32 bits)
# Username : Owner - OWNER-PC
# Running from : C:\Users\Owner\Desktop\adwcleaner.exe
# Option : Clean

***** [ Services ] *****

Service Deleted : winzipersvc

***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\Systweak
Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced System Protector
Folder Deleted : C:\Program Files\MyPC Backup
Folder Deleted : C:\Program Files\WinZipper
Folder Deleted : C:\Program Files\Common Files\AVG Secure Search
Folder Deleted : C:\Users\Owner\AppData\Local\filetypeassistant
Folder Deleted : C:\Users\Owner\AppData\Roaming\CheckPoint\ZoneAlarm LTD Toolbar
Folder Deleted : C:\Users\Owner\AppData\Roaming\digitalsite
Folder Deleted : C:\Users\Owner\AppData\Roaming\Systweak
Folder Deleted : C:\Users\Owner\AppData\Roaming\Windows Net Data
Folder Deleted : C:\Users\Owner\AppData\Roaming\WinZipper
Folder Deleted : C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\h68r321a.default\Extensions\EFGLQA@78ETGYN-0W7FN789T87.COM
File Deleted : C:\Program Files\Mozilla Firefox\browser\searchplugins\avg-secure-search.xml
File Deleted : C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\h68r321a.default\searchplugins\searchgol.xml
File Deleted : C:\Windows\System32\Tasks\Advanced System Protector
File Deleted : C:\Windows\System32\Tasks\Advanced System Protector_startup
File Deleted : C:\Windows\System32\Tasks\Desk 365 RunAsStdUser

***** [ Shortcuts ] *****


***** [ Registry ] *****

[#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{4AF4846F-AFB1-48CD-B9B5-8F2116538AC1}
[#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4AF4846F-AFB1-48CD-B9B5-8F2116538AC1}
[#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E004E76F-7F0B-4A8E-B71E-5EC7377C0703}
[#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{E004E76F-7F0B-4A8E-B71E-5EC7377C0703}
[#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{12625CDD-8B48-435C-8B68-701A985CA5A9}
[#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{12625CDD-8B48-435C-8B68-701A985CA5A9}
Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ApnSetup_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ApnSetup_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Key Deleted : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\DeskSvc
Key Deleted : HKLM\SOFTWARE\a57dddde23fed17
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4277F7CF-0000-46CF-BA49-D624465C4BAB}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{408CFAD9-8F13-4747-8EC7-770A339C7237}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{483830EE-A4CD-4B71-B0A3-3D82E62A6909}
Key Deleted : HKCU\Software\dsiteproducts
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKCU\Software\systweak
Key Deleted : HKLM\Software\hdcode
Key Deleted : HKLM\Software\systweak
Key Deleted : HKLM\Software\winzipersvc
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Iminent

***** [ Browsers ] *****

-\\ Internet Explorer v10.0.9200.16736


-\\ Mozilla Firefox v22.0 (en-US)

[ File : C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\h68r321a.default\prefs.js ]

Line Deleted : user_pref("extensions.crossrider.bic", "13f89f5d52c6eb8c390f709822ac8871");
Line Deleted : user_pref("extensions.searchgol.admin", false);
Line Deleted : user_pref("extensions.searchgol.aflt", "babsst");
Line Deleted : user_pref("extensions.searchgol.appId", "{4277F7CF-0000-46CF-BA49-D624465C4BAB}");
Line Deleted : user_pref("extensions.searchgol.autoRvrt", "false");
Line Deleted : user_pref("extensions.searchgol.dfltLng", "en");
Line Deleted : user_pref("extensions.searchgol.excTlbr", false);
Line Deleted : user_pref("extensions.searchgol.ffxUnstlRst", false);
Line Deleted : user_pref("extensions.searchgol.id", "aa34f31f0000000000000016d339d377");
Line Deleted : user_pref("extensions.searchgol.instlDay", "15983");
Line Deleted : user_pref("extensions.searchgol.instlRef", "sst");
Line Deleted : user_pref("extensions.searchgol.newTab", false);
Line Deleted : user_pref("extensions.searchgol.prdct", "searchgol");
Line Deleted : user_pref("extensions.searchgol.prtnrId", "searchgol");
Line Deleted : user_pref("extensions.searchgol.rvrt", "false");
Line Deleted : user_pref("extensions.searchgol.smplGrp", "none");
Line Deleted : user_pref("extensions.searchgol.tlbrId", "base");
Line Deleted : user_pref("extensions.searchgol.tlbrSrchUrl", "");
Line Deleted : user_pref("extensions.searchgol.vrsn", "1.8.16.19");
Line Deleted : user_pref("extensions.searchgol.vrsnTs", "1.8.16.190:50:05");
Line Deleted : user_pref("extensions.searchgol.vrsni", "1.8.16.19");
Line Deleted : user_pref("extensions.toolbar.mindspark._65Members_.initialized", true);
Line Deleted : user_pref("extensions.toolbar.mindspark._65Members_.installation.contextKey", "");
Line Deleted : user_pref("extensions.toolbar.mindspark._65Members_.installation.installDate", "2013062810");
Line Deleted : user_pref("extensions.toolbar.mindspark._65Members_.installation.partnerId", "^Y6^xdm043^YY^de");
Line Deleted : user_pref("extensions.toolbar.mindspark._65Members_.installation.partnerSubId", "swissconverter");
Line Deleted : user_pref("extensions.toolbar.mindspark._65Members_.installation.success", true);
Line Deleted : user_pref("extensions.toolbar.mindspark._65Members_.installation.toolbarId", "7AF668E6-4562-4403-8A3C-4459CDC4078B");
Line Deleted : user_pref("extensions.toolbar.mindspark._65Members_.lastActivePing", "1372409151846");
Line Deleted : user_pref("extensions.toolbar.mindspark._65Members_.options.defaultSearch", false);
Line Deleted : user_pref("extensions.toolbar.mindspark._65Members_.options.homePageEnabled", false);
Line Deleted : user_pref("extensions.toolbar.mindspark._65Members_.options.keywordEnabled", false);
Line Deleted : user_pref("extensions.toolbar.mindspark._65Members_.options.tabEnabled", false);
Line Deleted : user_pref("extensions.toolbar.mindspark.lastInstalled", "fromdoctopdf@mindspark.com");

-\\ Google Chrome v30.0.1599.101

[ File : C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [6752 octets] - [14/11/2013 22:54:52]
AdwCleaner[S0].txt - [6777 octets] - [14/11/2013 22:56:55]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [6837 octets] ##########

Last but least der JRT:

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.8 (11.05.2013:1)
OS: Windows 7 Professional x86
Ran by Owner on 14/11/2013 at 23:51:03.47
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-167141536-1578239192-4268729921-1000\Software\sweetim
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\backupstack_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\backupstack_rasmancs



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Users\Owner\appdata\local\filetypeassistant"
Successfully deleted: [Folder] "C:\Windows\system32\ai_recyclebin"



~~~ FireFox

Emptied folder: C:\Users\Owner\AppData\Roaming\mozilla\firefox\profiles\h68r321a.default\minidumps [298 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 14/11/2013 at 23:55:09.47
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

schrauber · 15.11.2013, 18:44

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

sumsemann · 16.11.2013, 08:39

Hallo schrauber,

so hier meine neusten reports:

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=3070a3a1c8fdb0478ddb007a1c5e7f83
# engine=15904
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-11-15 08:54:26
# local_time=2013-11-15 09:54:26 (+0100, W. Europe Standard Time)
# country="United Kingdom"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1039 16777213 100 92 4386 71682850 0 0
# compatibility_mode=5893 16776574 66 85 11082086 136180057 0 0
# compatibility_mode=9217 16777214 75 4 4521355 4521355 0 0
# scanned=109239
# found=0
# cleaned=0
# scan_time=3708

Der SecurityCheck sieht bei mir so aus:

Code:

ATTFilter

 Results of screen317's Security Check version 0.99.76  
 Windows 7 Service Pack 1 x86 (UAC is enabled)  
 Internet Explorer 10  
``````````````Antivirus/Firewall Check:`````````````` 
 Windows Firewall Disabled!  
AVG AntiVirus Free Edition 2013   
 Antivirus up to date!   
`````````Anti-malware/Other Utilities Check:````````` 
 Malwarebytes Anti-Malware version 1.75.0.1300  
 AVG PC TuneUp Language Pack (de-DE) 
 Java 7 Update 45  
 Adobe Flash Player 	11.9.900.117  
 Adobe Reader 9 Adobe Reader out of Date! 
 Mozilla Firefox 22.0 Firefox out of Date!  
 Mozilla Thunderbird (24.0.1) 
 Google Chrome 30.0.1599.101  
 Google Chrome 30.0.1599.69  
````````Process Check: objlist.exe by Laurent````````  
 AVG avgwdsvc.exe 
 AVG avgrsx.exe 
 AVG avgnsx.exe 
 AVG avgemc.exe 
 CheckPoint ZoneAlarm vsmon.exe  
 CheckPoint ZoneAlarm zatray.exe  
 CheckPoint ZoneAlarm ZAPrivacyService.exe  
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C: 10% 
````````````````````End of Log``````````````````````

FRST schicke ich morgen. Irgendwie klappts mit den Updates nicht

FRST lauft leider immernoch nich durch

Der stoppt bei einer Datei die von ZoneAlarm verwendet wird.Die liegt in C:\Users\Owner\AppData\Local\Temp und heisst ~DFA036B589A3CA2737.TMP
Hatte auch mit abgeschaltetem Zonealarm versucht aber kein Erfolg

Ich schicke dir aber mal was ich schon habe:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 14-11-2013
Ran by Owner (administrator) on OWNER-PC on 16-11-2013 08:23:05
Running from C:\Users\Owner\Desktop
Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: English(US)
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(AVG Technologies CZ, s.r.o.) C:\PROGRA~1\AVG\AVG2013\avgrsx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgcsrvx.exe
(Lenovo) C:\Windows\system32\ibmpmsvc.exe
(Microsoft Corporation) C:\Windows\SYSTEM32\WISPTIS.EXE
(Check Point Software Technologies LTD) C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe
(Microsoft Corporation) C:\Windows\SYSTEM32\WISPTIS.EXE
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgwdsvc.exe
(Cisco Systems, Inc.) C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
(Nuance Communications, Inc.) C:\Program Files\Common Files\Nuance\dgnsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe
(Check Point Software Technologies, Ltd.) C:\Program Files\CheckPoint\ZoneAlarm\ZAPrivacyService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgui.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Check Point Software Technologies LTD) C:\Program Files\CheckPoint\ZoneAlarm\zatray.exe
(Acresso Corporation) C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe
(OPENLiMiT SignCubes GmbH) C:\Program Files\OPENLiMiT\siqSEMr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgnsx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgemcx.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgcfgex.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [GrooveMonitor] - C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [AVG_UI] - C:\Program Files\AVG\AVG2013\avgui.exe [4411952 2013-09-23] (AVG Technologies CZ, s.r.o.)
HKLM\...\Run: [ZoneAlarm] - C:\Program Files\CheckPoint\ZoneAlarm\zatray.exe [73832 2013-08-12] (Check Point Software Technologies LTD)
HKCU\...\Run: [ISUSPM] - C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [222496 2011-06-06] (Acresso Corporation)
Startup: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
BootExecute: autocheck autochk * sdnclean.exe

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x8345C67E64B4CD01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-GB
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {24BF7F8D-2C49-491F-8E48-0FFDFF1F5FD8} URL = hxxp://search.zonealarm.com/search?src=sp&tbid=base2013&Lan=en&q={searchTerms}&gu=a032e0599f8f440b9773e1622ad62add&tu=10GX000652B000c&sku=&tstsId=&ver=&&r=179
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Zonealarm Helper Object - {2A841F7A-A014-4DA5-B6D9-8B913DFB7A8C} -  No File
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - ZoneAlarm Security Toolbar - {438FAE3E-BDEF-44D3-AB8B-0C7C8350DF59} -  No File
Toolbar: HKCU - No Name - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} -  No File
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} -  No File
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\h68r321a.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw_1200112.dll (Adobe Systems, Inc.)
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf - C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll No File
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf - C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll No File
FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: ZoneAlarm Do Not Track - C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\h68r321a.default\Extensions\donottrack@checkpoint.com
FF Extension: ciuvo-extension - C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\h68r321a.default\Extensions\ciuvo-extension@billiger.de.xpi

Chrome: 
=======
CHR Extension: (Google Docs) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
CHR Extension: (Google Drive) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (Google Search) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: () - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\fmlgoencnlndpglbocajlimaikjohmab\background.html
CHR Extension: (Google Wallet) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0
CHR Extension: (Gmail) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1

========================== Services (Whitelisted) =================

R2 AVGIDSAgent; C:\Program Files\AVG\AVG2013\avgidsagent.exe [4939312 2013-07-04] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files\AVG\AVG2013\avgwdsvc.exe [283136 2013-07-23] (AVG Technologies CZ, s.r.o.)
R2 CVPND; C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe [1528624 2009-11-17] (Cisco Systems, Inc.)
R2 DragonSvc; C:\Program Files\Common Files\Nuance\dgnsvc.exe [296808 2011-06-05] (Nuance Communications, Inc.)
R2 vsmon; C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe [2445304 2013-08-12] (Check Point Software Technologies LTD)
R2 ZAPrivacyService; C:\Program Files\CheckPoint\ZoneAlarm\ZAPrivacyService.exe [54160 2013-06-18] (Check Point Software Technologies, Ltd.)
S2 vToolbarUpdater15.3.0; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.3.0\ToolbarUpdater.exe [x]

==================== Drivers (Whitelisted) ====================

R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdriverx.sys [208184 2013-07-20] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHX; C:\Windows\System32\DRIVERS\avgidshx.sys [60216 2013-07-20] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSShim; C:\Windows\System32\DRIVERS\avgidsshimx.sys [22328 2013-09-10] (AVG Technologies CZ, s.r.o.)
R1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [171320 2013-07-20] (AVG Technologies CZ, s.r.o.)
R0 Avglogx; C:\Windows\System32\DRIVERS\avglogx.sys [246072 2013-07-20] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx86; C:\Windows\System32\DRIVERS\avgmfx86.sys [96568 2013-07-01] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx86; C:\Windows\System32\DRIVERS\avgrkx86.sys [39224 2013-09-05] (AVG Technologies CZ, s.r.o.)
R1 Avgtdix; C:\Windows\System32\DRIVERS\avgtdix.sys [182072 2013-03-21] (AVG Technologies CZ, s.r.o.)
R1 avgtp; C:\Windows\system32\drivers\avgtpx86.sys [37664 2013-06-27] (AVG Technologies)
S3 CVirtA; C:\Windows\System32\DRIVERS\CVirtA.sys [5275 2007-01-18] (Cisco Systems, Inc.)
R2 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [308859 2009-11-17] (Cisco Systems, Inc.)
R3 DNE; C:\Windows\System32\DRIVERS\dne2000.sys [131984 2008-11-16] (Deterministic Networks, Inc.)
S3 silabser; C:\Windows\System32\DRIVERS\silabser.sys [62592 2009-06-05] (Silicon Laboratories)
R1 Vsdatant; C:\Windows\System32\DRIVERS\vsdatant.sys [455704 2013-06-13] (Check Point Software Technologies LTD)
S3 catchme; \??\C:\Users\Owner\AppData\Local\Temp\catchme.sys [x]
S0 VClone; system32\DRIVERS\VClone.sys [x]
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [48128 2009-07-14] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-11-16 08:13 - 2013-11-16 08:13 - 00000244 _____ C:\Users\Owner\Desktop\defogger_enable.log
2013-11-16 08:09 - 2013-11-16 08:09 - 00000472 _____ C:\Users\Owner\Desktop\defogger_disable.log
2013-11-16 08:08 - 2013-11-16 08:08 - 00050477 _____ C:\Users\Owner\Desktop\Defogger.exe
2013-11-16 07:26 - 2013-11-16 08:24 - 00010742 _____ C:\Users\Owner\Desktop\FRST.txt
2013-11-16 07:23 - 2013-11-16 07:23 - 01090529 _____ (Farbar) C:\Users\Owner\Desktop\FRST.exe
2013-11-15 23:38 - 2013-11-15 23:38 - 00891184 _____ C:\Users\Owner\Desktop\SecurityCheck.exe
2013-11-15 06:37 - 2013-11-16 07:21 - 00000000 ____D C:\Users\Owner\AppData\Local\FileTypeAssistant
2013-11-14 23:55 - 2013-11-14 23:55 - 00001308 _____ C:\Users\Owner\Desktop\JRT.txt
2013-11-14 23:50 - 2013-11-14 23:50 - 00000000 ____D C:\Windows\ERUNT
2013-11-14 23:05 - 2013-11-14 23:05 - 01034531 _____ (Thisisu) C:\Users\Owner\Desktop\JRT.exe
2013-11-14 22:54 - 2013-11-14 22:57 - 00000000 ____D C:\AdwCleaner
2013-11-14 22:53 - 2013-11-14 22:53 - 01085542 _____ C:\Users\Owner\Desktop\adwcleaner.exe
2013-11-13 23:26 - 2013-10-12 08:04 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-13 23:26 - 2013-10-12 08:03 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-13 23:26 - 2013-10-12 08:03 - 01138176 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-13 23:26 - 2013-10-12 08:02 - 02877952 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-13 23:26 - 2013-10-12 08:02 - 02049024 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-13 23:26 - 2013-10-12 08:02 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-13 23:26 - 2013-10-12 08:02 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-13 23:26 - 2013-10-12 08:02 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-13 23:26 - 2013-10-12 08:02 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-13 23:26 - 2013-10-12 08:02 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-13 23:26 - 2013-10-12 08:02 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-13 23:26 - 2013-10-12 08:02 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-13 23:26 - 2013-10-12 07:08 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-13 23:26 - 2013-10-12 06:15 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-13 23:25 - 2013-10-12 08:02 - 14355968 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-13 23:25 - 2013-10-12 08:02 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-09 19:24 - 2013-11-09 19:24 - 00013251 _____ C:\ComboFix.txt
2013-11-09 18:55 - 2013-11-09 18:55 - 00000273 _____ C:\Users\Owner\Application Mover.cfg
2013-11-09 18:50 - 2013-11-09 18:50 - 01694409 _____ (Funduc Software Inc.                                        ) C:\Users\Owner\Desktop\setupam_4_2.exe
2013-11-09 17:03 - 2013-11-09 19:24 - 00000000 ____D C:\Qoobox
2013-11-09 17:03 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2013-11-09 17:03 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2013-11-09 17:03 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-11-09 17:03 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-11-09 17:03 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-11-09 17:03 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2013-11-09 17:03 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2013-11-09 17:03 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2013-11-09 17:02 - 2013-11-09 19:21 - 00000000 ____D C:\Windows\erdnt
2013-11-09 17:00 - 2013-11-09 17:00 - 05147957 ____R (Swearware) C:\Users\Owner\Desktop\ComboFix.exe
2013-11-09 11:02 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll
2013-11-09 11:02 - 2013-10-04 02:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2013-11-09 11:02 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll
2013-11-09 11:02 - 2013-10-03 02:58 - 00305152 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2013-11-09 11:02 - 2013-09-25 03:01 - 00136640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-11-09 11:02 - 2013-09-25 03:01 - 00067520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2013-11-09 11:02 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-11-09 11:02 - 2013-09-25 02:57 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2013-11-09 11:02 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2013-11-09 11:02 - 2013-09-25 02:56 - 01038848 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-11-09 11:02 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2013-11-09 11:02 - 2013-09-25 01:49 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2013-11-09 11:02 - 2013-09-25 01:49 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2013-11-09 11:02 - 2013-07-04 13:16 - 00369848 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-11-09 11:01 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2013-11-09 11:01 - 2013-10-12 03:01 - 00679424 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2013-11-09 11:01 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2013-11-09 11:01 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-11-09 08:29 - 2013-11-09 08:29 - 00000000 ____D C:\FRST
2013-11-08 23:26 - 2013-11-15 06:44 - 00009535 _____ C:\Windows\IE11_main.log
2013-11-08 18:20 - 2013-11-09 09:01 - 00000000 ____D C:\Program Files\Mozilla Thunderbird
2013-11-08 18:10 - 2013-11-08 18:10 - 00152568 _____ C:\Windows\Minidump\110813-106174-01.dmp
2013-11-08 17:43 - 2013-11-08 17:43 - 00000096 _____ C:\Users\Owner\AppData\Roaming\WB.CFG
2013-11-08 16:47 - 2013-11-08 16:47 - 00000000 ____D C:\Users\Owner\AppData\Roaming\Malwarebytes
2013-11-08 16:46 - 2013-11-08 16:46 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-08 16:45 - 2012-07-25 12:03 - 00017136 _____ C:\Windows\system32\sasnative32.exe
2013-11-08 16:32 - 2013-11-08 16:32 - 00152568 _____ C:\Windows\Minidump\110813-91010-01.dmp
2013-10-31 19:33 - 2013-10-31 19:33 - 00152568 _____ C:\Windows\Minidump\103113-95971-01.dmp
2013-10-30 11:05 - 2013-10-30 11:05 - 00152568 _____ C:\Windows\Minidump\103013-94614-01.dmp
2013-10-27 00:03 - 2013-10-27 00:03 - 00000699 _____ C:\Users\Owner\Desktop\new  3.txt
2013-10-27 00:03 - 2013-10-27 00:03 - 00000137 _____ C:\Users\Owner\Desktop\new  2.txt
2013-10-23 18:54 - 2013-10-23 18:55 - 00240128 _____ C:\Users\Owner\Desktop\Kopie von 2013_MonatsKundenadressenliste_Sep.xls
2013-10-17 16:05 - 2013-10-08 06:50 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2013-10-17 16:05 - 2013-10-08 06:46 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-10-17 16:05 - 2013-10-08 06:46 - 00174504 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-10-17 16:04 - 2013-10-17 16:05 - 00004734 _____ C:\Windows\system32\jupdate-1.7.0_45-b18.log

==================== One Month Modified Files and Folders =======

2013-11-16 08:24 - 2013-11-16 07:26 - 00010742 _____ C:\Users\Owner\Desktop\FRST.txt
2013-11-16 08:13 - 2013-11-16 08:13 - 00000244 _____ C:\Users\Owner\Desktop\defogger_enable.log
2013-11-16 08:13 - 2012-05-28 13:25 - 00000000 ____D C:\Users\Owner
2013-11-16 08:09 - 2013-11-16 08:09 - 00000472 _____ C:\Users\Owner\Desktop\defogger_disable.log
2013-11-16 08:08 - 2013-11-16 08:08 - 00050477 _____ C:\Users\Owner\Desktop\Defogger.exe
2013-11-16 07:48 - 2012-10-30 20:44 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-16 07:48 - 2009-07-14 05:34 - 00014032 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-16 07:48 - 2009-07-14 05:34 - 00014032 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-16 07:45 - 2012-05-28 13:20 - 01457823 _____ C:\Windows\WindowsUpdate.log
2013-11-16 07:43 - 2013-07-06 19:11 - 00000884 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-16 07:40 - 2013-07-06 19:11 - 00000880 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-16 07:40 - 2009-07-14 05:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-16 07:39 - 2013-08-21 06:18 - 00011500 _____ C:\Windows\setupact.log
2013-11-16 07:23 - 2013-11-16 07:23 - 01090529 _____ (Farbar) C:\Users\Owner\Desktop\FRST.exe
2013-11-16 07:21 - 2013-11-15 06:37 - 00000000 ____D C:\Users\Owner\AppData\Local\FileTypeAssistant
2013-11-15 23:38 - 2013-11-15 23:38 - 00891184 _____ C:\Users\Owner\Desktop\SecurityCheck.exe
2013-11-15 20:41 - 2012-06-16 13:39 - 00000000 ____D C:\ProgramData\MFAData
2013-11-15 06:44 - 2013-11-08 23:26 - 00009535 _____ C:\Windows\IE11_main.log
2013-11-14 23:55 - 2013-11-14 23:55 - 00001308 _____ C:\Users\Owner\Desktop\JRT.txt
2013-11-14 23:50 - 2013-11-14 23:50 - 00000000 ____D C:\Windows\ERUNT
2013-11-14 23:05 - 2013-11-14 23:05 - 01034531 _____ (Thisisu) C:\Users\Owner\Desktop\JRT.exe
2013-11-14 22:57 - 2013-11-14 22:54 - 00000000 ____D C:\AdwCleaner
2013-11-14 22:56 - 2012-06-16 14:00 - 00000000 ____D C:\Users\Owner\AppData\Roaming\CheckPoint
2013-11-14 22:53 - 2013-11-14 22:53 - 01085542 _____ C:\Users\Owner\Desktop\adwcleaner.exe
2013-11-14 19:47 - 2013-03-11 18:07 - 00000000 ____D C:\Program Files\File Type Assistant
2013-11-14 07:05 - 2012-09-02 11:11 - 00727182 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-14 06:58 - 2009-07-14 05:33 - 00409752 _____ C:\Windows\system32\FNTCACHE.DAT
2013-11-14 06:57 - 2012-06-14 10:56 - 00186634 _____ C:\Windows\PFRO.log
2013-11-13 23:38 - 2012-06-13 13:52 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-11-13 23:25 - 2013-08-14 16:24 - 00000000 ____D C:\Windows\system32\MRT
2013-11-13 23:17 - 2012-06-16 16:07 - 80340640 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-11-09 19:24 - 2013-11-09 19:24 - 00013251 _____ C:\ComboFix.txt
2013-11-09 19:24 - 2013-11-09 17:03 - 00000000 ____D C:\Qoobox
2013-11-09 19:24 - 2009-07-14 03:37 - 00000000 __RHD C:\Users\Default
2013-11-09 19:24 - 2009-07-14 03:37 - 00000000 ___RD C:\Users\Public
2013-11-09 19:21 - 2013-11-09 17:02 - 00000000 ____D C:\Windows\erdnt
2013-11-09 19:20 - 2009-07-14 03:04 - 00000215 _____ C:\Windows\system.ini
2013-11-09 19:04 - 2013-07-08 07:09 - 00045568 ___SH C:\Users\Owner\Documents\Thumbs.db
2013-11-09 18:55 - 2013-11-09 18:55 - 00000273 _____ C:\Users\Owner\Application Mover.cfg
2013-11-09 18:50 - 2013-11-09 18:50 - 01694409 _____ (Funduc Software Inc.                                        ) C:\Users\Owner\Desktop\setupam_4_2.exe
2013-11-09 18:50 - 2012-05-28 13:30 - 00109280 _____ C:\Users\Owner\AppData\Local\GDIPFONTCACHEV1.DAT
2013-11-09 18:12 - 2012-07-21 14:05 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-11-09 17:00 - 2013-11-09 17:00 - 05147957 ____R (Swearware) C:\Users\Owner\Desktop\ComboFix.exe
2013-11-09 09:01 - 2013-11-08 18:20 - 00000000 ____D C:\Program Files\Mozilla Thunderbird
2013-11-09 08:29 - 2013-11-09 08:29 - 00000000 ____D C:\FRST
2013-11-08 18:47 - 2009-07-14 05:53 - 00032620 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-11-08 18:10 - 2013-11-08 18:10 - 00152568 _____ C:\Windows\Minidump\110813-106174-01.dmp
2013-11-08 18:10 - 2012-08-17 14:33 - 00000000 ____D C:\Windows\Minidump
2013-11-08 18:09 - 2013-09-25 08:53 - 309324176 ____N C:\Windows\MEMORY.DMP
2013-11-08 17:43 - 2013-11-08 17:43 - 00000096 _____ C:\Users\Owner\AppData\Roaming\WB.CFG
2013-11-08 16:47 - 2013-11-08 16:47 - 00000000 ____D C:\Users\Owner\AppData\Roaming\Malwarebytes
2013-11-08 16:46 - 2013-11-08 16:46 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-08 16:32 - 2013-11-08 16:32 - 00152568 _____ C:\Windows\Minidump\110813-91010-01.dmp
2013-10-31 19:33 - 2013-10-31 19:33 - 00152568 _____ C:\Windows\Minidump\103113-95971-01.dmp
2013-10-30 11:05 - 2013-10-30 11:05 - 00152568 _____ C:\Windows\Minidump\103013-94614-01.dmp
2013-10-27 00:03 - 2013-10-27 00:03 - 00000699 _____ C:\Users\Owner\Desktop\new  3.txt
2013-10-27 00:03 - 2013-10-27 00:03 - 00000137 _____ C:\Users\Owner\Desktop\new  2.txt
2013-10-23 22:52 - 2012-06-12 12:02 - 00000000 ____D C:\Users\Owner\AppData\Roaming\SoftGrid Client
2013-10-23 18:55 - 2013-10-23 18:54 - 00240128 _____ C:\Users\Owner\Desktop\Kopie von 2013_MonatsKundenadressenliste_Sep.xls
2013-10-23 15:55 - 2012-06-13 13:52 - 00000000 ____D C:\Users\Owner\AppData\Local\Microsoft Help
2013-10-23 15:25 - 2009-07-14 03:37 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2013-10-22 16:50 - 2012-12-13 07:56 - 00000987 _____ C:\Users\Public\Desktop\AVG 2013.lnk
2013-10-17 16:05 - 2013-10-17 16:04 - 00004734 _____ C:\Windows\system32\jupdate-1.7.0_45-b18.log
2013-10-17 16:05 - 2013-07-03 19:36 - 00000000 ____D C:\Program Files\Java
2013-10-17 16:00 - 2013-07-03 19:22 - 00915368 _____ (Oracle Corporation) C:\Users\Owner\Downloads\jxpiinstall.exe

schrauber · 16.11.2013, 16:20

Adobe und Firefox updaten.

Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop.
Schließe nun alle offenen Programme und trenne Dich von dem Internet.
Doppelklick auf die TFC.exe und drücke auf Start.
Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen.

Fertig

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

sumsemann · 17.11.2013, 19:13

Hallo Schrauber,

alles geklappt.
Die seltsame Temp Datei ist verschwunden.

Alle Dateien sind deinstalliert und auch in der vorgegebenen Reihenfolge.

Vielen Dank fuer deine Hilfe
Viele Gruesse
sumsemann

schrauber · 18.11.2013, 10:08

Gern Geschehen

18.11.2013, 10:08	#12
schrauber /// the machine /// TB-Ausbilder	Mail: Fax von 04589016238 geoeffnet, AVG Gern Geschehen __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Mail: Fax von 04589016238 geoeffnet, AVG

Plagegeister aller Art und deren Bekämpfung: Mail: Fax von 04589016238 geoeffnet, AVG