Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung
troj/zbotmem-b in der Sophos Quarantaene und nur manuell zu bereinigen

troj/zbotmem-b in der Sophos Quarantaene und nur manuell zu bereinigen


Log-Analyse und Auswertung: troj/zbotmem-b in der Sophos Quarantaene und nur manuell zu bereinigen

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML

Antwort
Seite 2 von 2 1 2
Alt 24.11.2013, 08:22   #16
schrauber
/// the machine
/// TB-Ausbilder
 
troj/zbotmem-b in der Sophos Quarantaene und nur manuell zu bereinigen - Standard

troj/zbotmem-b in der Sophos Quarantaene und nur manuell zu bereinigen


Kannst Du mir davon mal nen Screen machen und posten, wo an welchem Ort der gefunden wurde?

Wenns in Quarantäne ist ist es auf jeden Fall weg gesperrt
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 24.11.2013, 17:06   #17
lemot82
 
troj/zbotmem-b in der Sophos Quarantaene und nur manuell zu bereinigen - Standard

troj/zbotmem-b in der Sophos Quarantaene und nur manuell zu bereinigen


Hallo Schrauber,

wegen dieser NirCmd Adware - ich habe eben gerade nochmal Sophos vollstaendig und Malwarebytes als Quickscan durchlaufen lassen und beides wieder ohne Funde so wie gestern. Also sieht gut aus soweit, vielleicht lag es ja wirklich an der noch vorhandenen GMER exe Datei. Die hatte ich komplett vergessen, da ich die dann doch nicht installiert hatte. Mein Fehler, da bich ich auch erst drauf gekommen wegen deiner Nachfrage, vielen dank.

Und zu troj/zbotmem-b, in der Sophos Quarantaene steht leider nichts weiter zum Fundort als 'Memory'. Aber ich habe mal die Logeintraege durchforstet, leider finde ich in Sophos keine Gesamtlogs sowie Malwarebytes das ausgibt - ich hoffe es ist ok, dass die Eintraege in Englisch sind.

Ich bin zum Zeitpunkt des Fundes hin und da stehen fuer einen Zeitraum von etwa einer halben Stunde zig Eintraege mit exakt demselben Wortlaut:

Process "C:\Users\cs\AppData\Roaming\Onixi\xyqe.exe" exhibiting suspicious behaviour pattern HIPS/RegMod-014. No Action taken.

dann folgende 3 Eintraege:

Process "User Memory" belongs to virus/spyware Troj/Zbotmem-B.

File "C:\Users\cs\AppData\Roaming\Onixi\xyqe.exe belongs to virus/spyware troj/Zbotmem-B.

Registry value "HKU\S-1-5-21-3333763334-3209806367-2958437272-1001\Software\Microsoft\Windows\CurrentVersion\Run\ewhymom" belongs to virus/spyware Troj/Zbotmem-B.

dann wieder einige male:

Process "C:\Users\cs\AppData\Roaming\Onixi\xyqe.exe" exhibiting suspicious behaviour pattern HIPS/RegMod-014. No Action taken.

gefolgt von:

File "C:\Users\cs\AppData\Roaming\Onixi\xyqe.exe" could not be removed.

Registry value "HKU\S-1-5-21-3333763334-3209806367-2958437272-1001\Software\Microsoft\Windows\CurrentVersion\Run\ewhymom" has been cleaned up

Virus/spyware Troj/Zbotmem/B has been removed.

Tur mir leid, dass ich das jetzt erst gefunden habe, weil sieht schon aussagekraeftig aus und ein Pfad ist auch drin. Ich wusste bis jetzt nicht mal, dass Sophos ueberhaupt so ein Log hat. Kam alles jetzt erst durch diese Geschichte.
Auf jeden Fall steht in der letzten Zeile 'removed' (?) und wie gesagt ist alles vom Zeitpunkt des Fundes vor 2 Wochen.

Hoffentlich kann man da noch irgendetwas rauslesen. Danke und Gruesse
__________________
Alt 25.11.2013, 08:20   #18
schrauber
/// the machine
/// TB-Ausbilder
 
troj/zbotmem-b in der Sophos Quarantaene und nur manuell zu bereinigen - Standard

troj/zbotmem-b in der Sophos Quarantaene und nur manuell zu bereinigen


Dann poste mal ein frisches FRST Log bitte.
__________________
__________________
Alt 25.11.2013, 11:51   #19
lemot82
 
troj/zbotmem-b in der Sophos Quarantaene und nur manuell zu bereinigen - Standard

troj/zbotmem-b in der Sophos Quarantaene und nur manuell zu bereinigen


gerne, hier einmal FRST


FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-11-2013
Ran by cs (administrator) on TOSHIBA on 25-11-2013 11:42:45
Running from C:\Users\cs\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Client Firewall\SCFManager.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Client Firewall\SCFService.exe
(SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Alcor Micro Corp.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\Power Saver\TPwrMain.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\FlashCards\TCrdMain.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\TECO\Teco.exe
(TOSHIBA Corporation) C:\Windows\System32\ThpSrv.exe
(Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(Toshiba) C:\Program Files\Toshiba\TOSHIBA Places Icon Utility\TosDIMonitor.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
() C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe
(TOSHIBA Corporation) C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
(Research In Motion Limited) C:\Program Files (x86)\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(TOSHIBA Corporation) C:\Windows\System32\ThpSrv.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(TOSHIBA Corporation) C:\Program Files\Toshiba\TECO\TecoService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(TOSHIBA Corporation) C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\TPHM\TPCHSrv.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\TOSHIBA HDD SSD Alert\TosSENotify.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\TPHM\TPCHWMsg.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_152.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_152.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SmartAudio] - C:\Program Files\CONEXANT\SAII\SACpl.exe [1654400 2012-02-22] (Conexant Systems, Inc.)
HKLM\...\Run: [SRS Premium Sound HD] - C:\Program Files\SRS Labs\SRS Control Panel\SRS_Premium_Sound_HD.zip [223180 2012-03-22] ()
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2867984 2011-12-23] (Synaptics Incorporated)
HKLM\...\Run: [AmIcoSinglun64] - C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [378968 2011-12-21] (Alcor Micro Corp.)
HKLM\...\Run: [TPwrMain] - C:\Program Files\Toshiba\Power Saver\TPwrMain.exe [590256 2011-09-23] (TOSHIBA Corporation)
HKLM\...\Run: [TCrdMain] - C:\Program Files\Toshiba\FlashCards\TCrdMain.exe [989056 2011-12-14] (TOSHIBA Corporation)
HKLM\...\Run: [Teco] - C:\Program Files\Toshiba\TECO\Teco.exe [1548208 2011-11-24] (TOSHIBA Corporation)
HKLM\...\Run: [TosWaitSrv] - C:\Program Files\Toshiba\TPHM\TosWaitSrv.exe [712096 2011-12-14] (TOSHIBA Corporation)
HKLM\...\Run: [ThpSrv] - C:\windows\system32\thpsrv /logon
HKLM\...\Run: [TosSENotify] - C:\Program Files\Toshiba\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [710560 2011-11-26] (TOSHIBA Corporation)
HKLM\...\Run: [TosVolRegulator] - C:\Program Files\Toshiba\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation)
HKLM\...\Run: [Toshiba TEMPRO] - C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe [1546720 2011-02-10] (Toshiba Europe GmbH)
HKLM\...\Run: [Toshiba Registration] - C:\Program Files\Toshiba\Registration\ToshibaReminder.exe [150992 2012-05-11] (Toshiba Europe GmbH)
HKLM\...\Run: [HotKeysCmds] - C:\windows\system32\hkcmd.exe [ ] ()
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM-x32\...\Run: [NBAgent] - C:\Program Files (x86)\Nero\Nero 11\Nero BackItUp\NBAgent.exe [1492264 2011-11-18] (Nero AG)
HKLM-x32\...\Run: [ITSecMng] - C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe [80840 2011-04-02] (TOSHIBA CORPORATION)
HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-02-27] (Intel Corporation)
HKLM-x32\...\Run: [ToshibaServiceStation] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe [1298816 2011-07-12] (TOSHIBA Corporation)
HKLM-x32\...\Run: [Sophos AutoUpdate Monitor] - C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe [900160 2012-07-06] (Sophos Limited)
HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [DivXMediaServer] - C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2013-01-30] (DivX, LLC)
HKLM-x32\...\Run: [DivXUpdate] - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1263952 2013-02-13] ()
HKLM-x32\...\Run: [BlackBerryAutoUpdate] - C:\Program Files (x86)\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe [623888 2009-05-12] (Research In Motion Limited)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-09-05] (Adobe Systems Incorporated)
HKU\Default\...\Run: [TOPI.EXE] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\TOPI.exe [847960 2012-03-06] (TOSHIBA)
HKU\Default User\...\Run: [TOPI.EXE] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\TOPI.exe [847960 2012-03-06] (TOSHIBA)
AppInit_DLLs: C:\Program Files (x86)\Sophos\Sophos Anti-Virus\sophos_detoured_x64.dll [218256 2013-10-09] (Sophos Limited)
AppInit_DLLs-x32: C:\PROGRA~2\Sophos\SOPHOS~1\sophos_detoured.dll,C:\PROGRA~2\Sophos\SOPHOS~1\SOPHOS~1.DLL [221840 2013-10-09] (Sophos Limited)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.ixquick.com/
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - DefaultScope {BCF0B725-3877-4033-BE68-92718645BF7E} URL = 
SearchScopes: HKCU - {BCF0B725-3877-4033-BE68-92718645BF7E} URL = 
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: TOSHIBA Media Controller Plug-in - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\x64\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: TOSHIBA Media Controller Plug-in - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog9 01 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [87616] (Sophos Limited)
Winsock: Catalog9 02 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [87616] (Sophos Limited)
Winsock: Catalog9 03 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [87616] (Sophos Limited)
Winsock: Catalog9 04 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [87616] (Sophos Limited)
Winsock: Catalog9 05 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [87616] (Sophos Limited)
Winsock: Catalog9 06 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [87616] (Sophos Limited)
Winsock: Catalog9 07 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [87616] (Sophos Limited)
Winsock: Catalog9 08 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [87616] (Sophos Limited)
Winsock: Catalog9 19 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [87616] (Sophos Limited)
Winsock: Catalog9-x64 01 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [127040] (Sophos Limited)
Winsock: Catalog9-x64 02 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [127040] (Sophos Limited)
Winsock: Catalog9-x64 03 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [127040] (Sophos Limited)
Winsock: Catalog9-x64 04 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [127040] (Sophos Limited)
Winsock: Catalog9-x64 05 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [127040] (Sophos Limited)
Winsock: Catalog9-x64 06 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [127040] (Sophos Limited)
Winsock: Catalog9-x64 07 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [127040] (Sophos Limited)
Winsock: Catalog9-x64 08 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [127040] (Sophos Limited)
Winsock: Catalog9-x64 19 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [127040] (Sophos Limited)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\cs\AppData\Roaming\Mozilla\Firefox\Profiles\qs20zjet.default
FF Homepage: https://www.ixquick.com/
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_9_900_152.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_152.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @Nero.com/KM - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5

==================== Services (Whitelisted) =================

R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [127320 2012-03-15] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [162648 2012-03-15] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 SAVAdminService; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe [216640 2012-11-12] (Sophos Limited)
R2 SAVService; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe [139840 2012-06-15] (Sophos Limited)
R2 Sophos AutoUpdate Service; C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe [232512 2012-07-06] (Sophos Limited)
R2 Sophos Client Firewall; C:\Program Files (x86)\Sophos\Sophos Client Firewall\SCFService.exe [89112 2011-10-19] (Sophos Limited)
R2 Sophos Client Firewall Manager; C:\Program Files (x86)\Sophos\Sophos Client Firewall\SCFManager.exe [150552 2011-10-19] (Sophos Limited)
R2 swi_service; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe [2869824 2012-11-12] (Sophos Limited)
S2 swi_update_64; C:\ProgramData\Sophos\Web Intelligence\swi_update_64.exe [1998400 2012-11-12] (Sophos Limited)
S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [112080 2011-02-10] (Toshiba Europe GmbH)

==================== Drivers (Whitelisted) ====================

R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [28416 2008-05-20] (Research In Motion Limited)
R3 RimVSerPort; C:\Windows\System32\DRIVERS\RimSerial_AMD64.sys [31744 2009-01-09] (Research in Motion Ltd)
R1 SAVOnAccess; C:\Windows\System32\DRIVERS\savonaccess.sys [144672 2012-04-24] (Sophos Limited)
R1 scfdriver; C:\windows\system32\Drivers\scfdriver.sys [102688 2011-08-25] (Sophos Limited)
R1 scfndis; C:\Windows\System32\DRIVERS\scfndis.sys [55072 2011-08-25] (Sophos Limited)
R3 SmbDrv; C:\Windows\System32\DRIVERS\Smb_driver.sys [21264 2011-12-23] (Synaptics Incorporated)
S4 SophosBootDriver; C:\Windows\System32\DRIVERS\SophosBootDriver.sys [25608 2011-08-25] (Sophos Plc)
S3 Tosrfcom; No ImagePath
U5 AppMgmt; C:\Windows\system32\svchost.exe [27648 2011-03-01] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-11-25 11:42 - 2013-11-25 11:43 - 00017709 _____ C:\Users\cs\Desktop\FRST.txt
2013-11-25 11:42 - 2013-11-25 11:42 - 00000000 ____D C:\FRST
2013-11-25 11:41 - 2013-11-25 11:41 - 01958440 _____ (Farbar) C:\Users\cs\Desktop\FRST64.exe
2013-11-25 11:29 - 2013-11-25 11:29 - 00000056 _____ C:\windows\setupact.log
2013-11-25 11:29 - 2013-11-25 11:29 - 00000000 _____ C:\windows\setuperr.log
2013-11-24 17:31 - 2013-11-24 17:31 - 00116440 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2013-11-24 17:29 - 2013-11-24 17:53 - 00000000 ____D C:\Users\cs\Desktop\mbar
2013-11-24 14:21 - 2013-11-24 14:21 - 00001990 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk
2013-11-22 14:58 - 2013-11-22 15:44 - 00014062 _____ C:\Users\cs\Desktop\Charts081213.txt
2013-11-20 21:47 - 2013-11-20 21:47 - 00000000 ____D C:\Users\cs\AppData\Local\Macromedia
2013-11-20 14:36 - 2013-11-20 14:38 - 00002753 _____ C:\DelFix.txt
2013-11-20 14:33 - 2013-11-23 10:47 - 00000000 ___SD C:\32788R22FWJFW
2013-11-18 13:48 - 2013-11-22 14:59 - 00006374 _____ C:\Users\cs\Desktop\Charts011213.txt
2013-11-18 12:12 - 2013-11-18 12:12 - 00000000 ____D C:\ProgramData\Oracle
2013-11-18 12:11 - 2013-11-18 12:11 - 00264616 _____ (Oracle Corporation) C:\windows\SysWOW64\javaws.exe
2013-11-18 12:11 - 2013-11-18 12:11 - 00175016 _____ (Oracle Corporation) C:\windows\SysWOW64\javaw.exe
2013-11-18 12:11 - 2013-11-18 12:11 - 00174504 _____ (Oracle Corporation) C:\windows\SysWOW64\java.exe
2013-11-18 12:11 - 2013-11-18 12:11 - 00096168 _____ (Oracle Corporation) C:\windows\SysWOW64\WindowsAccessBridge-32.dll
2013-11-18 11:05 - 2013-11-20 14:37 - 00000000 ____D C:\windows\ERUNT
2013-11-18 10:33 - 2013-11-18 10:56 - 00000000 ____D C:\AdwCleaner
2013-11-17 18:24 - 2013-11-17 18:24 - 00000000 ____D C:\ProgramData\Toshiba
2013-11-17 18:23 - 2013-11-17 18:23 - 00000000 ____D C:\Users\cs\AppData\Roaming\Toshiba
2013-11-17 17:59 - 2013-11-17 18:10 - 00000000 ____D C:\windows\erdnt
2013-11-17 15:09 - 2013-11-17 15:10 - 00003839 _____ C:\Users\cs\Desktop\Schritte1.txt
2013-11-17 14:53 - 2013-11-17 16:31 - 00001418 _____ C:\Users\cs\Desktop\TrPost.txt
2013-11-17 06:25 - 2013-11-18 12:10 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-17 06:25 - 2013-11-17 06:26 - 00000000 ____D C:\Users\cs\AppData\Roaming\Mozilla
2013-11-17 06:25 - 2013-11-17 06:25 - 00001122 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-11-17 06:25 - 2013-11-17 06:25 - 00000000 ____D C:\Users\cs\AppData\Local\Mozilla
2013-11-17 06:25 - 2013-11-17 06:25 - 00000000 ____D C:\ProgramData\Mozilla
2013-11-17 06:25 - 2013-11-17 06:25 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-11-17 06:23 - 2013-11-17 06:24 - 00282904 _____ (Mozilla) C:\Users\cs\Downloads\Firefox Setup Stub 25.0.1.exe
2013-11-17 06:06 - 2013-11-24 23:54 - 00000830 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2013-11-17 06:06 - 2013-11-20 21:17 - 00003768 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2013-11-15 16:32 - 2013-11-24 17:53 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-11-15 16:31 - 2013-11-24 17:30 - 00091352 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2013-11-15 16:28 - 2013-11-15 16:28 - 12576792 _____ (Malwarebytes Corp.) C:\Users\cs\Downloads\mbar-1.07.0.1007.exe
2013-11-15 13:45 - 2013-11-18 13:50 - 00006264 _____ C:\Users\cs\Desktop\Charts241113.txt
2013-11-14 15:31 - 2013-10-12 08:45 - 02241536 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2013-11-14 15:31 - 2013-10-12 08:45 - 01364992 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2013-11-14 15:31 - 2013-10-12 08:45 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2013-11-14 15:31 - 2013-10-12 08:43 - 19269632 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2013-11-14 15:31 - 2013-10-12 08:43 - 15404544 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2013-11-14 15:31 - 2013-10-12 08:43 - 03959808 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2013-11-14 15:31 - 2013-10-12 08:43 - 02648576 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2013-11-14 15:31 - 2013-10-12 08:43 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2013-11-14 15:31 - 2013-10-12 08:43 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2013-11-14 15:31 - 2013-10-12 08:43 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2013-11-14 15:31 - 2013-10-12 08:43 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
2013-11-14 15:31 - 2013-10-12 08:43 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2013-11-14 15:31 - 2013-10-12 08:43 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2013-11-14 15:31 - 2013-10-12 08:43 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2013-11-14 15:31 - 2013-10-12 07:03 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2013-11-14 15:31 - 2013-10-12 07:03 - 01138176 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2013-11-14 15:31 - 2013-10-12 07:02 - 14355968 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2013-11-14 15:31 - 2013-10-12 07:02 - 13761024 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2013-11-14 15:31 - 2013-10-12 07:02 - 02877952 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2013-11-14 15:31 - 2013-10-12 07:02 - 02049024 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2013-11-14 15:31 - 2013-10-12 07:02 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2013-11-14 15:31 - 2013-10-12 07:02 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2013-11-14 15:31 - 2013-10-12 07:02 - 00391168 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2013-11-14 15:31 - 2013-10-12 07:02 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll
2013-11-14 15:31 - 2013-10-12 07:02 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2013-11-14 15:31 - 2013-10-12 07:02 - 00039424 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2013-11-14 15:31 - 2013-10-12 07:02 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2013-11-14 15:31 - 2013-10-12 06:35 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2013-11-14 15:31 - 2013-10-12 06:08 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2013-11-14 15:31 - 2013-10-12 05:44 - 00089600 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe
2013-11-14 15:31 - 2013-10-12 05:15 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe
2013-11-14 14:57 - 2013-11-14 14:57 - 00001084 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-11-14 14:57 - 2013-11-14 14:57 - 00000000 ____D C:\Users\cs\AppData\Roaming\Malwarebytes
2013-11-14 14:57 - 2013-11-14 14:57 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-14 14:57 - 2013-11-14 14:57 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-11-14 14:57 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2013-11-14 14:55 - 2013-11-14 14:55 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\cs\Downloads\mbam-setup-1.75.0.1300.exe
2013-11-14 14:10 - 2013-10-05 20:25 - 01474048 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll
2013-11-14 14:10 - 2013-10-05 19:57 - 01168384 _____ (Microsoft Corporation) C:\windows\SysWOW64\crypt32.dll
2013-11-14 14:09 - 2013-10-03 02:23 - 00404480 _____ (Microsoft Corporation) C:\windows\system32\gdi32.dll
2013-11-14 14:09 - 2013-10-03 02:00 - 00311808 _____ (Microsoft Corporation) C:\windows\SysWOW64\gdi32.dll
2013-11-14 14:09 - 2013-09-28 01:09 - 00497152 _____ (Microsoft Corporation) C:\windows\system32\Drivers\afd.sys
2013-11-14 14:09 - 2013-09-25 02:26 - 00154560 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
2013-11-14 14:09 - 2013-09-25 02:26 - 00095680 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys
2013-11-14 14:09 - 2013-09-25 02:23 - 00135680 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll
2013-11-14 14:09 - 2013-09-25 02:23 - 00028672 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll
2013-11-14 14:09 - 2013-09-25 02:23 - 00028160 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll
2013-11-14 14:09 - 2013-09-25 02:22 - 00340992 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2013-11-14 14:09 - 2013-09-25 02:21 - 01447936 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
2013-11-14 14:09 - 2013-09-25 02:21 - 00307200 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll
2013-11-14 14:09 - 2013-09-25 01:58 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\sspicli.dll
2013-11-14 14:09 - 2013-09-25 01:57 - 00247808 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
2013-11-14 14:09 - 2013-09-25 01:57 - 00022016 _____ (Microsoft Corporation) C:\windows\SysWOW64\secur32.dll
2013-11-14 14:09 - 2013-09-25 01:56 - 00220160 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncrypt.dll
2013-11-14 14:09 - 2013-09-25 01:03 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe
2013-11-14 14:09 - 2013-07-04 12:18 - 00458712 _____ (Microsoft Corporation) C:\windows\system32\Drivers\cng.sys
2013-11-14 14:07 - 2013-10-04 02:28 - 00190464 _____ (Microsoft Corporation) C:\windows\system32\SmartcardCredentialProvider.dll
2013-11-14 14:07 - 2013-10-04 02:25 - 00197120 _____ (Microsoft Corporation) C:\windows\system32\credui.dll
2013-11-14 14:07 - 2013-10-04 02:24 - 01930752 _____ (Microsoft Corporation) C:\windows\system32\authui.dll
2013-11-14 14:07 - 2013-10-04 01:58 - 00152576 _____ (Microsoft Corporation) C:\windows\SysWOW64\SmartcardCredentialProvider.dll
2013-11-14 14:07 - 2013-10-04 01:56 - 01796096 _____ (Microsoft Corporation) C:\windows\SysWOW64\authui.dll
2013-11-14 14:07 - 2013-10-04 01:56 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\credui.dll
2013-11-14 14:06 - 2013-10-12 02:30 - 00830464 _____ (Microsoft Corporation) C:\windows\system32\nshwfp.dll
2013-11-14 14:06 - 2013-10-12 02:29 - 00859648 _____ (Microsoft Corporation) C:\windows\system32\IKEEXT.DLL
2013-11-14 14:06 - 2013-10-12 02:29 - 00324096 _____ (Microsoft Corporation) C:\windows\system32\FWPUCLNT.DLL
2013-11-14 14:06 - 2013-10-12 02:03 - 00656896 _____ (Microsoft Corporation) C:\windows\SysWOW64\nshwfp.dll
2013-11-14 14:06 - 2013-10-12 02:01 - 00216576 _____ (Microsoft Corporation) C:\windows\SysWOW64\FWPUCLNT.DLL
2013-11-09 14:59 - 2013-11-09 15:14 - 00000000 ____D C:\Users\cs\AppData\Roaming\Sepo

==================== One Month Modified Files and Folders =======

2013-11-25 11:43 - 2013-11-25 11:42 - 00017709 _____ C:\Users\cs\Desktop\FRST.txt
2013-11-25 11:42 - 2013-11-25 11:42 - 00000000 ____D C:\FRST
2013-11-25 11:41 - 2013-11-25 11:41 - 01958440 _____ (Farbar) C:\Users\cs\Desktop\FRST64.exe
2013-11-25 11:37 - 2009-07-14 04:45 - 00024400 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-25 11:37 - 2009-07-14 04:45 - 00024400 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-25 11:34 - 2012-07-28 09:20 - 01272453 _____ C:\windows\WindowsUpdate.log
2013-11-25 11:30 - 2012-07-28 09:25 - 00000828 _____ C:\windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job
2013-11-25 11:29 - 2013-11-25 11:29 - 00000056 _____ C:\windows\setupact.log
2013-11-25 11:29 - 2013-11-25 11:29 - 00000000 _____ C:\windows\setuperr.log
2013-11-25 11:29 - 2012-09-23 15:10 - 00000142 _____ C:\windows\ODBC.INI
2013-11-25 11:29 - 2009-07-14 05:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-11-24 23:54 - 2013-11-17 06:06 - 00000830 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2013-11-24 22:46 - 2013-02-14 20:04 - 00105318 _____ C:\Users\cs\Desktop\Trial.txt
2013-11-24 17:53 - 2013-11-24 17:29 - 00000000 ____D C:\Users\cs\Desktop\mbar
2013-11-24 17:53 - 2013-11-15 16:32 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-11-24 17:31 - 2013-11-24 17:31 - 00116440 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2013-11-24 17:30 - 2013-11-15 16:31 - 00091352 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2013-11-24 15:55 - 2012-07-28 09:25 - 00000830 _____ C:\windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job
2013-11-24 14:22 - 2012-09-23 14:19 - 00000000 ____D C:\Users\cs\AppData\Local\Adobe
2013-11-24 14:21 - 2013-11-24 14:21 - 00001990 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk
2013-11-24 14:21 - 2012-05-11 00:00 - 00000000 ____D C:\ProgramData\Adobe
2013-11-24 14:21 - 2012-05-11 00:00 - 00000000 ____D C:\Program Files (x86)\Adobe
2013-11-24 12:43 - 2013-10-05 06:47 - 00000000 _____ C:\windows\system32\vireng.log
2013-11-23 10:47 - 2013-11-20 14:33 - 00000000 ___SD C:\32788R22FWJFW
2013-11-22 15:44 - 2013-11-22 14:58 - 00014062 _____ C:\Users\cs\Desktop\Charts081213.txt
2013-11-22 14:59 - 2013-11-18 13:48 - 00006374 _____ C:\Users\cs\Desktop\Charts011213.txt
2013-11-20 22:45 - 2009-07-14 03:20 - 00000000 ____D C:\windows\rescache
2013-11-20 21:47 - 2013-11-20 21:47 - 00000000 ____D C:\Users\cs\AppData\Local\Macromedia
2013-11-20 21:17 - 2013-11-17 06:06 - 00003768 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2013-11-20 21:17 - 2012-05-10 23:59 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2013-11-20 21:17 - 2012-05-10 23:59 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-11-20 14:38 - 2013-11-20 14:36 - 00002753 _____ C:\DelFix.txt
2013-11-20 14:37 - 2013-11-18 11:05 - 00000000 ____D C:\windows\ERUNT
2013-11-20 14:32 - 2012-09-23 13:09 - 00000000 ____D C:\Users\cs
2013-11-19 10:59 - 2012-09-28 06:54 - 00000000 ____D C:\Users\cs\AppData\Local\Sophos
2013-11-18 13:50 - 2013-11-15 13:45 - 00006264 _____ C:\Users\cs\Desktop\Charts241113.txt
2013-11-18 12:12 - 2013-11-18 12:12 - 00000000 ____D C:\ProgramData\Oracle
2013-11-18 12:11 - 2013-11-18 12:11 - 00264616 _____ (Oracle Corporation) C:\windows\SysWOW64\javaws.exe
2013-11-18 12:11 - 2013-11-18 12:11 - 00175016 _____ (Oracle Corporation) C:\windows\SysWOW64\javaw.exe
2013-11-18 12:11 - 2013-11-18 12:11 - 00174504 _____ (Oracle Corporation) C:\windows\SysWOW64\java.exe
2013-11-18 12:11 - 2013-11-18 12:11 - 00096168 _____ (Oracle Corporation) C:\windows\SysWOW64\WindowsAccessBridge-32.dll
2013-11-18 12:11 - 2012-05-10 23:48 - 00000000 ____D C:\Program Files (x86)\Java
2013-11-18 12:10 - 2013-11-17 06:25 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-18 10:56 - 2013-11-18 10:33 - 00000000 ____D C:\AdwCleaner
2013-11-18 10:56 - 2013-03-15 22:49 - 00000000 ____D C:\Users\cs\AppData\Roaming\Uniblue
2013-11-18 10:56 - 2013-03-15 22:49 - 00000000 ____D C:\Program Files (x86)\Uniblue
2013-11-17 18:24 - 2013-11-17 18:24 - 00000000 ____D C:\ProgramData\Toshiba
2013-11-17 18:23 - 2013-11-17 18:23 - 00000000 ____D C:\Users\cs\AppData\Roaming\Toshiba
2013-11-17 18:12 - 2009-07-14 03:20 - 00000000 __RHD C:\Users\Default
2013-11-17 18:11 - 2012-09-23 13:09 - 00000000 ___RD C:\Users\cs\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-11-17 18:11 - 2012-07-28 09:57 - 00000000 ____D C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-11-17 18:11 - 2012-07-28 09:57 - 00000000 ____D C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-11-17 18:10 - 2013-11-17 17:59 - 00000000 ____D C:\windows\erdnt
2013-11-17 18:09 - 2009-07-14 02:34 - 00000215 _____ C:\windows\system.ini
2013-11-17 16:31 - 2013-11-17 14:53 - 00001418 _____ C:\Users\cs\Desktop\TrPost.txt
2013-11-17 15:10 - 2013-11-17 15:09 - 00003839 _____ C:\Users\cs\Desktop\Schritte1.txt
2013-11-17 14:50 - 2012-10-01 04:47 - 00000000 ____D C:\__Chr
2013-11-17 06:26 - 2013-11-17 06:25 - 00000000 ____D C:\Users\cs\AppData\Roaming\Mozilla
2013-11-17 06:25 - 2013-11-17 06:25 - 00001122 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-11-17 06:25 - 2013-11-17 06:25 - 00000000 ____D C:\Users\cs\AppData\Local\Mozilla
2013-11-17 06:25 - 2013-11-17 06:25 - 00000000 ____D C:\ProgramData\Mozilla
2013-11-17 06:25 - 2013-11-17 06:25 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-11-17 06:24 - 2013-11-17 06:23 - 00282904 _____ (Mozilla) C:\Users\cs\Downloads\Firefox Setup Stub 25.0.1.exe
2013-11-16 11:28 - 2009-07-14 05:08 - 00032620 _____ C:\windows\Tasks\SCHEDLGU.TXT
2013-11-15 16:28 - 2013-11-15 16:28 - 12576792 _____ (Malwarebytes Corp.) C:\Users\cs\Downloads\mbar-1.07.0.1007.exe
2013-11-15 13:35 - 2012-05-11 08:24 - 00000000 ____D C:\windows\Panther
2013-11-14 15:31 - 2012-10-18 18:54 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-11-14 14:57 - 2013-11-14 14:57 - 00001084 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-11-14 14:57 - 2013-11-14 14:57 - 00000000 ____D C:\Users\cs\AppData\Roaming\Malwarebytes
2013-11-14 14:57 - 2013-11-14 14:57 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-14 14:57 - 2013-11-14 14:57 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-11-14 14:55 - 2013-11-14 14:55 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\cs\Downloads\mbam-setup-1.75.0.1300.exe
2013-11-11 05:50 - 2010-11-21 03:27 - 00267936 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe
2013-11-09 17:39 - 2012-05-10 23:59 - 00000000 ____D C:\windows\SysWOW64\Macromed
2013-11-09 17:39 - 2012-05-10 23:59 - 00000000 ____D C:\windows\system32\Macromed
2013-11-09 17:39 - 2010-11-21 07:16 - 00000000 ___RD C:\Users\Public\Recorded TV
2013-11-09 17:39 - 2009-07-14 03:20 - 00000000 ____D C:\windows\registration
2013-11-09 15:14 - 2013-11-09 14:59 - 00000000 ____D C:\Users\cs\AppData\Roaming\Sepo
2013-11-06 20:14 - 2012-11-16 10:12 - 00000000 ____D C:\Users\cs\AppData\Local\CutePDF Writer
2013-11-04 07:50 - 2012-09-23 15:52 - 00009189 _____ C:\Users\cs\Desktop\Notes.txt
2013-11-02 10:09 - 2009-07-14 05:13 - 00726444 _____ C:\windows\system32\PerfStringBackup.INI

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-11-20 15:56

==================== End Of Log ============================
--- --- ---

--- --- ---


und Addition

Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24-11-2013
Ran by cs at 2013-11-25 11:44:07
Running from C:\Users\cs\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Sophos Anti-Virus (Enabled - Up to date) {65FBD860-96D8-75EF-C7ED-7BE27E6C498A}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Sophos Anti-Virus (Enabled - Up to date) {DE9A3984-B0E2-7A61-FD5D-409005EB0337}
FW: Sophos Client Firewall (Enabled) {5DC05945-DCB7-74B7-ECB2-D2D780BF0EF1}

==================== Installed Programs ======================

ActiveX-kontroll för fjärranslutningar för Windows Live Mesh (x32 Version: 15.4.5722.2)
Adobe AIR (x32 Version: 2.0.3.13070)
Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.152)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.152)
Adobe Reader XI (11.0.04) (x32 Version: 11.0.04)
Alcor Micro USB Card Reader (x32 Version: 4.3.17.00279)
Atheros Bluetooth Filter Driver Package (Version: 1.0.0.12)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (x32 Version: 2.0.12.13)
Atheros Driver Installation Program (x32 Version: 9.2)
BBC iPlayer Desktop (x32 Version: 3.0.7)
BlackBerry Desktop Software 5.0 (x32 Version: 5.0.0.8)
BlackBerry® Media Sync (x32 Version: 2.0.20)
Bluetooth Stack for Windows by Toshiba (Version: v9.00.00(T))
CCleaner (Version: 3.22)
Conexant HD Audio (Version: 8.51.2.64)
CutePDF Writer 3.0 (Version:  3.0)
D3DX10 (x32 Version: 15.4.2368.0902)
DivX Setup (x32 Version: 2.6.1.24)
High-Definition Video Playback (x32 Version: 11.1.10500.2.65)
Intel(R) Manageability Engine Firmware Recovery Agent (x32 Version: 1.0.0.35342)
Intel(R) Management Engine Components (x32 Version: 8.0.4.1441)
Intel(R) Processor Graphics (x32 Version: 8.15.10.2752)
Intel(R) Rapid Storage Technology (x32 Version: 11.0.0.1032)
Intel(R) USB 3.0 eXtensible Host Controller Driver (x32 Version: 1.0.4.220)
Intel® Trusted Connect Service Client (Version: 1.23.605.1)
Java 7 Update 45 (x32 Version: 7.0.450)
Java Auto Updater (x32 Version: 2.1.9.8)
Junk Mail filter update (x32 Version: 15.4.3502.0922)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
Mesh Runtime (x32 Version: 15.4.5722.2)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Office 2007 Service Pack 3 (SP3) (x32)
Microsoft Office 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Access MUI (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Access Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Excel MUI (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Groove MUI (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Groove Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office InfoPath MUI (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000)
Microsoft Office OneNote MUI (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Outlook MUI (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (Spanish) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proofing (English) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32)
Microsoft Office Publisher MUI (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Shared 64-bit MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Word MUI (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Silverlight (Version: 5.1.20913.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Mozilla Firefox 25.0.1 (x86 en-US) (x32 Version: 25.0.1)
Mozilla Maintenance Service (x32 Version: 25.0.1)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT_amd64 (x32 Version: 15.4.2862.0708)
MSXML 4.0 SP3 Parser (KB2721691) (x32 Version: 4.30.2114.0)
MSXML 4.0 SP3 Parser (KB2758694) (x32 Version: 4.30.2117.0)
MSXML 4.0 SP3 Parser (x32 Version: 4.30.2100.0)
Nero 11 Essentials (x32 Version: 11.0.00300)
Nero 11 Kwik Themes Basic (x32 Version: 11.0.11200.12.0)
Nero BackItUp 11 (x32 Version: 6.0.18000.19.100)
Nero BackItUp 11 Help (CHM) (x32 Version: 11.0.10200)
Nero Backup Drivers (Version: 1.0.11100.8.0)
Nero BurnRights 11 (x32 Version: 5.0.10300.4.100)
Nero BurnRights 11 Help (CHM) (x32 Version: 11.0.10100)
Nero ControlCenter 11 (x32 Version: 11.0.12700.0.27)
Nero ControlCenter 11 Help (CHM) (x32 Version: 11.0.10300)
Nero Core Components 11 (x32 Version: 11.0.15500.1.16)
Nero Express 11 (x32 Version: 11.0.11900.24.100)
Nero Express 11 Help (CHM) (x32 Version: 11.0.10300)
Nero Kwik Media (x32 Version: 1.10.24800.146.100)
Nero Kwik Media Help (CHM) (x32 Version: 11.0.10200)
Nero RescueAgent 11 (x32 Version: 4.0.10600.10.100)
Nero RescueAgent 11 Help (CHM) (x32 Version: 11.0.10400)
Nero Update (x32 Version: 11.0.11400.27.0)
nero.prerequisites.msi (x32 Version: 11.0.20008)
PlayReady PC Runtime amd64 (Version: 1.3.0)
Premium Sound HD (Version: 1.12.1800)
Skype™ 5.10 (x32 Version: 5.10.116)
Sophos Anti-Virus (x32 Version: 10.0.11)
Sophos AutoUpdate (x32 Version: 2.7.4.317)
Sophos Client Firewall (x32 Version: 2.9.1)
Synaptics Pointing Device Driver (Version: 15.3.39.0)
TOSHIBA Assist (x32 Version: 4.2.3.1)
TOSHIBA Disc Creator (Version: 2.1.0.11 for x64)
TOSHIBA eco Utility (Version: 1.3.10.64)
TOSHIBA Hardware Setup (Version: 4.11.03.00)
TOSHIBA Hardware Setup (x32 Version: 4.11.03.00)
TOSHIBA HDD Protection (Version: 2.2.2.15)
TOSHIBA HDD/SSD Alert (Version: 3.1.64.11)
Toshiba Manuals (x32 Version: 10.04)
TOSHIBA Media Controller (x32 Version: 1.0.87.5)
TOSHIBA Media Controller Plug-in (x32 Version: 1.0.7.7)
TOSHIBA Online Product Information (x32 Version: 4.02.0000)
TOSHIBA PC Health Monitor (Version: 1.7.15.64)
TOSHIBA Places Icon Utility (x32 Version: 1.1.1.4)
TOSHIBA Recovery Media Creator (x32 Version: 2.1.6.52020009)
TOSHIBA Recovery Media Creator Reminder (x32 Version: 1.1.0.0)
TOSHIBA Resolution+ Plug-in for Windows Media Player (x32 Version: 1.1.2004)
TOSHIBA Service Station (x32 Version: 2.2.13)
TOSHIBA Sleep Utility (x32 Version: 1.4.0022.000104)
TOSHIBA Supervisor Password (Version: 4.11.03.00)
TOSHIBA Supervisor Password (x32 Version: 4.11.03.00)
TOSHIBA TEMPRO (x32 Version: 3.35)
TOSHIBA Value Added Package (Version: 1.6.0021.640203)
TOSHIBA Value Added Package (x32 Version: 1.6.0021.640203)
TOSHIBA Web Camera Application (x32 Version: 2.0.3.35)
Update for 2007 Microsoft Office System (KB967642) (x32)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3)
Update for Microsoft Office 2007 Help for Common Features (KB963673) (x32)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32)
Update for Microsoft Office Access 2007 Help (KB963663) (x32)
Update for Microsoft Office Excel 2007 Help (KB963678) (x32)
Update for Microsoft Office Infopath 2007 Help (KB963662) (x32)
Update for Microsoft Office OneNote 2007 Help (KB963670) (x32)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (x32)
Update for Microsoft Office Outlook 2007 Help (KB963677) (x32)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2825642) 32-Bit Edition (x32)
Update for Microsoft Office Powerpoint 2007 Help (KB963669) (x32)
Update for Microsoft Office Publisher 2007 Help (KB963667) (x32)
Update for Microsoft Office Script Editor Help (KB963671) (x32)
Update for Microsoft Office Word 2007 Help (KB963665) (x32)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0)
welcome (x32 Version: 11.0.22500.0.0)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3538.0513)
Windows Live Fotogalleri (x32 Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0)
Windows Live Installer (x32 Version: 15.4.3502.0922)
Windows Live Language Selector (Version: 15.4.3538.0513)
Windows Live Mail (x32 Version: 15.4.3502.0922)
Windows Live Mesh (x32 Version: 15.4.3502.0922)
Windows Live Mesh ActiveX Control for Remote Connections (x32 Version: 15.4.5722.2)
Windows Live Mesh ActiveX-kontroll for eksterne tilkoblinger (x32 Version: 15.4.5722.2)
Windows Live Mesh ActiveX-objekt til fjernforbindelser (x32 Version: 15.4.5722.2)
Windows Live Meshin etäyhteyksien ActiveX-komponentti (x32 Version: 15.4.5722.2)
Windows Live Messenger (x32 Version: 15.4.3538.0513)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (x32 Version: 15.4.3502.0922)
Windows Live Photo Common (x32 Version: 15.4.3502.0922)
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922)
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109)
Windows Live Remote Client (Version: 15.4.5722.2)
Windows Live Remote Client Resources (Version: 15.4.5722.2)
Windows Live Remote Service (Version: 15.4.5722.2)
Windows Live Remote Service Resources (Version: 15.4.5722.2)
Windows Live SOXE (x32 Version: 15.4.3502.0922)
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922)
Windows Live UX Platform (x32 Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109)
Windows Live Writer (x32 Version: 15.4.3502.0922)
Windows Live Writer Resources (x32 Version: 15.4.3502.0922)
Windows Liven asennustyökalu (x32 Version: 15.4.3502.0922)
Windows Liven sähköposti (x32 Version: 15.4.3502.0922)
Windows Liven valokuvavalikoima (x32 Version: 15.4.3502.0922)

==================== Restore Points  =========================

20-11-2013 14:37:41 End of disinfection
22-11-2013 12:22:00 Windows Update

==================== Hosts content: ==========================

2009-07-14 02:34 - 2013-11-17 18:09 - 00000027 ____A C:\windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {1932333D-E3F0-4C3D-9012-69351C5D5959} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2011-11-25] (Intel Corporation)
Task: {2637A22B-A305-4ED3-8BEE-306F884768CE} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-11-20] (Adobe Systems Incorporated)
Task: {3361ED9C-34B6-4601-9F05-C9D838436073} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-23] (Microsoft Corporation)
Task: {95D15B3C-4FD9-4959-B637-4E815555DDC1} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2011-11-25] (Intel Corporation)
Task: {BBB2122A-84F7-468F-BD07-34C8008A38E3} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2010-11-21] (Microsoft Corporation)
Task: {FF1D667B-2D0A-4870-B8E5-454E9D3B039D} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2012-08-22] (Piriform Ltd)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe
Task: C:\windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe

==================== Loaded Modules (whitelisted) =============

2011-08-22 22:19 - 2011-08-22 22:19 - 11204992 _____ () C:\Program Files\Toshiba\FlashCards\BlackPng.dll
2010-12-15 22:19 - 2010-12-15 22:19 - 00124320 _____ () C:\Program Files\Toshiba\TECO\MUIHelp.dll
2012-03-27 00:33 - 2012-03-27 00:33 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2012-05-11 00:25 - 2011-12-15 13:55 - 00063360 _____ () C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIInternal.XmlSerializers.dll
2011-11-26 01:51 - 2011-11-26 01:51 - 00079784 _____ () C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosIPCWraper.dll
2013-02-13 02:38 - 2013-02-13 02:38 - 00100688 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll
2012-07-28 09:25 - 2012-03-06 22:27 - 01198872 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2013-11-17 06:25 - 2013-11-13 03:39 - 03363952 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2013-11-20 21:17 - 2013-11-20 21:17 - 16237448 _____ () C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_152.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SAVService => ""="service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SAVService => ""="service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Sophos Client Firewall => ""="service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Sophos Client Firewall Manager => ""="service"

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (11/25/2013 11:31:25 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/24/2013 08:30:16 PM) (Source: Customer Experience Improvement Program) (User: )
Description: 80004005

Error: (11/24/2013 08:01:35 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/24/2013 03:26:48 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/24/2013 00:47:58 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/24/2013 00:32:04 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/24/2013 06:46:15 AM) (Source: Customer Experience Improvement Program) (User: )
Description: 80004005

Error: (11/24/2013 07:36:17 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/23/2013 10:04:02 AM) (Source: Customer Experience Improvement Program) (User: )
Description: 80004005

Error: (11/23/2013 09:16:36 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (11/24/2013 00:46:14 PM) (Source: EventLog) (User: )
Description: The previous system shutdown at 12:41:11 on ‎24/‎11/‎2013 was unexpected.

Error: (11/24/2013 00:43:18 PM) (Source: Service Control Manager) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the IKEEXT service.

Error: (11/24/2013 00:43:00 PM) (Source: SAVOnAccess) (User: )
Description: To avoid filling up the system event log, "Savservice threads busy" and similar messages will not be logged until after the service has recovered again

Error: (11/24/2013 00:43:00 PM) (Source: SAVOnAccess) (User: )
Description: Communication error between on-access driver and service for a modification of file "arddiskVolume2\Program Files (x86)\Sophos\Sophos Client Firewall\op_data.ini" by process SCFService.exe .

Error: (11/24/2013 00:43:00 PM) (Source: SAVOnAccess) (User: )
Description: SAV service threads all busy: on-access driver could not request scan for file "...Program Files (x86)\Sophos\Sophos Client Firewall\op_data.ini" (process SCFService.exe, start check timestamp [ 1cee912b5993804]).

Error: (11/24/2013 00:43:00 PM) (Source: SAVOnAccess) (User: )
Description: SAV service threads all busy: on-access driver could not request scan for file "...ft\CryptnetUrlCache\MetaData\0270780F846F08BEFE0DD8112D932FEF" (process svchost.exe, start check timestamp [ 1cee912b5993804]).

Error: (11/24/2013 00:43:00 PM) (Source: SAVOnAccess) (User: )
Description: SAV service threads all busy: on-access driver could not request scan for file "...Program Files (x86)\Sophos\Sophos Client Firewall\op_data.ini" (process SCFService.exe, start check timestamp [ 1cee912b5993804]).

Error: (11/24/2013 00:43:00 PM) (Source: SAVOnAccess) (User: )
Description: SAV service threads all busy: on-access driver could not request scan for file "...ft\CryptnetUrlCache\MetaData\0270780F846F08BEFE0DD8112D932FEF" (process svchost.exe, start check timestamp [ 1cee912b5993804]).

Error: (11/24/2013 00:43:00 PM) (Source: SAVOnAccess) (User: )
Description: Communication error between on-access driver and service for a modification of file "arddiskVolume2\Program Files (x86)\Sophos\Sophos Client Firewall\op_data.ini" by process SCFService.exe .

Error: (11/24/2013 00:43:00 PM) (Source: SAVOnAccess) (User: )
Description: Communication error between on-access driver and service for a modification of file "ocalLow\Microsoft\CryptnetUrlCache\MetaData\0270780F846F08BEFE0DD8112D932FEF" by process svchost.exe .


Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2013-11-17 18:08:44.762
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2013-11-17 18:08:44.669
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


==================== Memory info =========================== 

Percentage of memory in use: 49%
Total physical RAM: 3996.36 MB
Available physical RAM: 2025.72 MB
Total Pagefile: 7990.9 MB
Available Pagefile: 5810.5 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB

==================== Drives ================================

Drive c: (TI30878800B) (Fixed) (Total:448.8 GB) (Free:358.38 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 466 GB) (Disk ID: DEC2C14C)
Partition 1: (Active) - (Size=1 GB) - (Type=27)
Partition 2: (Not Active) - (Size=449 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=15 GB) - (Type=17)

==================== End Of Log ============================
danke fuer die hilfe und gruesse

Alt 26.11.2013, 09:36   #20
schrauber
/// the machine
/// TB-Ausbilder
 
troj/zbotmem-b in der Sophos Quarantaene und nur manuell zu bereinigen - Standard

troj/zbotmem-b in der Sophos Quarantaene und nur manuell zu bereinigen


Alles sauber, die Einträge sind weg und stehen nur noch in der Quarantäne

Fertig

Die Reihenfolge ist hier entscheidend.
  1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
  2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
    • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
    • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
    • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
  3. Downloade Dir bitte auf jeden Fall DelFix Download DelFix auf deinen Desktop:
    • Schließe alle offenen Programme.
    • Starte die delfix.exe mit einem Doppelklick.
    • Setze vor jede Funktion ein Häkchen.
    • Klicke auf Start.
    • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
    • Starte deinen Rechner abschließend neu.
  4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.



Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
  • Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
  • Windows Updates
    • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
    • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
  • Gehe sicher das die automatischen Updates aktiviert sind.
  • Software Updates
    Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
    Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.


Anti- Viren Software
  • Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.


Zusätzlicher Schutz
  • MalwareBytes Anti Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
    Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.
  • WinPatrol
    Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.


Sicheres Browsen
  • SpywareBlaster
    Eine kurze Einführung findest du Hier
  • MVPs hosts file
    Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
  • WOT (Web of trust)
    Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.


Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
  • Opera
  • Mozilla Firefox.
    • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
    • NoScript
      Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    • AdblockPlus
      Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
      Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts
  • Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
  • verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe
Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 26.11.2013, 17:27   #21
lemot82
 
troj/zbotmem-b in der Sophos Quarantaene und nur manuell zu bereinigen - Standard

troj/zbotmem-b in der Sophos Quarantaene und nur manuell zu bereinigen


Hallo, super auf die Nachricht hab' ich gewartet

den letzten Schritt mit delfix hatte ich auch so gemacht. Vielen dank fuer die Zeit und Muehe und eine Spende fuer's Board ist euch auf jeden Fall sicher! Alle Achtung was hier geleistet wird.

Zwei Frage noch bitte - ich erinnere mich, dass nach dem ESET scan im Abschlussfenster was von einem Fund/Infizierung stand. Kann man sehen was das war bzw. hing das mit dem troj/zbotmem-b zusammen?

Und ersetzt das von euch empfohlene TFC Programm Sachen wie den CCleaner?

Danke und Gruesse

Alt 27.11.2013, 10:18   #22
schrauber
/// the machine
/// TB-Ausbilder
 
troj/zbotmem-b in der Sophos Quarantaene und nur manuell zu bereinigen - Standard

troj/zbotmem-b in der Sophos Quarantaene und nur manuell zu bereinigen


Der ESET Fund wuurde mit TFC gelöscht, du kannst TFC an Stelle von CCleaner verwenden
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 27.11.2013, 15:45   #23
lemot82
 
troj/zbotmem-b in der Sophos Quarantaene und nur manuell zu bereinigen - Standard

troj/zbotmem-b in der Sophos Quarantaene und nur manuell zu bereinigen


Ok danke, werde dann ab jetzt TFC benutzen. Obwohl ich nicht gross Ahnung habe, erschien mir TFC nach dem Durchlauf doch effektiver als der CCleaner.

Spende fuer's Board ging heute raus und nochmals vielen Dank!

Alt 28.11.2013, 09:57   #24
schrauber
/// the machine
/// TB-Ausbilder
 
troj/zbotmem-b in der Sophos Quarantaene und nur manuell zu bereinigen - Standard

troj/zbotmem-b in der Sophos Quarantaene und nur manuell zu bereinigen


Gern Geschehen
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Antwort
Seite 2 von 2 1 2

Themen zu troj/zbotmem-b in der Sophos Quarantaene und nur manuell zu bereinigen
browser, desktop, device driver, email, error, excel, failed, farbar recovery scan tool, firefox 25.0.1, flash player, home, homepage, installation, mozilla, object, plug-in, problem, registry, scan, secur, security, software, starten, svchost.exe, trojaner, usb, vista, warnung, windows, wsearch


« Wichtige Sicherheitswarnung zu Ihrem Internetanschluss Abuse T-Online | Fehler bei Start von Programmen, später Absturz mit Bluescreen »


Ähnliche Themen: troj/zbotmem-b in der Sophos Quarantaene und nur manuell zu bereinigen


  1. Win 7: Sophos meldet "Troj/Miner-AB"
    Log-Analyse und Auswertung - 30.06.2015 (14)
  2. Troj/ZbotMem-B
    Plagegeister aller Art und deren Bekämpfung - 04.01.2015 (13)
  3. Windows 7: Troj/ZbotMem-B Befall?
    Log-Analyse und Auswertung - 04.01.2015 (17)
  4. Troj/ZbotMem-B fund von Sophos, manuelle Reinigung erforderlich / Windows 7
    Log-Analyse und Auswertung - 15.12.2013 (11)
  5. Sophosmeldung: Troj/ZbotMem-B im Memory
    Log-Analyse und Auswertung - 08.08.2013 (31)
  6. [Sophos] Troj/Zbot-Dhn // C:\User\*Name*\AppData\Roaming\execue.exe
    Plagegeister aller Art und deren Bekämpfung - 17.03.2013 (9)
  7. Troj/ZbotMem-B, Sophos Quarantäne-Manager fordert manuelle Bereinigung
    Log-Analyse und Auswertung - 06.02.2013 (3)
  8. Troj/ZbotMem-B // gefunden mit Sophos
    Plagegeister aller Art und deren Bekämpfung - 28.12.2012 (13)
  9. Sophos meldet im Speicher: Troj/ZbotMem-B
    Plagegeister aller Art und deren Bekämpfung - 27.11.2012 (10)
  10. pup.blubbers in quarantaene malwarebytes
    Log-Analyse und Auswertung - 21.11.2012 (63)
  11. Habe ich Troj/zbotmem-b vollständig entfernt?
    Plagegeister aller Art und deren Bekämpfung - 07.11.2012 (1)
  12. Troj/ZbotMem-B bei Scan entdeckt, nach Sophos Meldung HIPS/RegMod-014 - Was tun?
    Plagegeister aller Art und deren Bekämpfung - 24.08.2012 (16)
  13. Troj/ExpJS-EG / Troj/ZbotMem-B / Trojan.Phex.THAGen6 - BA-BA-BA-BA-BANKÜBERFALL 2012
    Plagegeister aller Art und deren Bekämpfung - 19.08.2012 (19)
  14. Sophos hat Troj/Java-CN und Mal/Generic-L gefunden
    Log-Analyse und Auswertung - 21.04.2012 (27)
  15. Trojaner Troj/ZbotMem-B Zugriff auf Bankendaten - wie bereinigen?
    Log-Analyse und Auswertung - 10.08.2011 (6)
  16. Troj/Inor-Fam wird von Sophos gemeldet
    Plagegeister aller Art und deren Bekämpfung - 10.03.2011 (1)
  17. mIRC wurm und Troj LADDER.A /Troj RAS.DLDR
    Plagegeister aller Art und deren Bekämpfung - 24.12.2004 (1)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema troj/zbotmem-b in der Sophos Quarantaene und nur manuell zu bereinigen - Kannst Du mir davon mal nen Screen machen und posten, wo an welchem Ort der gefunden wurde? Wenns in Quarantäne ist ist es auf jeden Fall weg gesperrt - troj/zbotmem-b in der Sophos Quarantaene und nur manuell zu bereinigen...
Archiv
Du betrachtest: troj/zbotmem-b in der Sophos Quarantaene und nur manuell zu bereinigen auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129