| |
| |||||||
Log-Analyse und Auswertung: eGdpSvc.exe/ Maleware, Adware in C:\ProgramData\eSafe gefundenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
22.11.2013, 19:37
| #1 |
| |  eGdpSvc.exe/ Maleware, Adware in C:\ProgramData\eSafe gefunden Guten Abend, ich wende mich an euch, weil ich offensichtlich eine Maleware bzw. Adware auf dem Laptop habe und ich mich nicht gut mit sowas auskenne und Hilfe für die Entfernung des Programms benötige. Eingeschlichen hat es sich schon, ich hab auf eigentlich jeder Webseite grün unterstrichene Wörter als Link und es gehen auch oft "einach so" neue Fenster auf in denen dann Werbung aufpoppt. Ich hoffe, es ist "nur" nervige Werbung und nicht noch was dramatischeres. Avira - ich habe nur die kostenlose Version - hat es mir gemeldet. Das Programm "eGdpSvc.exe" ist in der Quarantäne. Das Programm "E:\wBee.exe'" war auf einem USB Stick, von dort gleich in die Quarantäne und dann aus der Quarantäne raus entfernt. (Auf dem USB Stick ist es gelöscht.) Ich habe alles so gut wie möglich nach eurer Anweisung versucht zu erledigen. Leider weiß ich nicht, wie ich euch die Log Dateien zur Verfügung stellen soll - einfach in den Text kopieren ?! Als Anhang soll es ja möglichst nicht sein. Vielen Dank im Voraus !! eure Janoschi Also hier dann Avira: Ausgeführte Aktion: Zugriff verweigern 15.11.2013 20:26 [Echtzeit-Scanner] Malware gefunden In der Datei 'E:\wBee.exe' wurde ein Virus oder unerwünschtes Programm 'TR/Spy.1126912.2' [trojan] gefunden. Ausgeführte Aktion: Zugriff verweigern 15.11.2013 20:17 [Echtzeit-Scanner] Malware gefunden In der Datei 'E:\wBee.exe' wurde ein Virus oder unerwünschtes Programm 'TR/Spy.1126912.2' [trojan] gefunden. Ausgeführte Aktion: Zugriff verweigern 15.11.2013 20:17 [Echtzeit-Scanner] Malware gefunden In der Datei 'E:\wBee.exe' wurde ein Virus oder unerwünschtes Programm 'TR/Spy.1126912.2' [trojan] gefunden. Ausgeführte Aktion: Zugriff verweigern 15.11.2013 20:15 [Echtzeit-Scanner] Malware gefunden In der Datei 'E:\wBee.exe' wurde ein Virus oder unerwünschtes Programm 'TR/Spy.1126912.2' [trojan] gefunden. Ausgeführte Aktion: Zugriff verweigern 08.11.2013 20:16 [System-Scanner] Malware gefunden Die Datei 'C:\ProgramData\eSafe\eGdpSvc.exe' enthielt einen Virus oder unerwünschtes Programm 'Adware/ELEX.W' [adware]. Durchgeführte Aktion(en): Beim Versuch eine Sicherungskopie der Datei anzulegen ist ein Fehler aufgetreten und die Datei wurde nicht gelöscht. Fehlernummer: 26004. Die Quelldatei konnte nicht gefunden werden. Es wird versucht die Aktion mit Hilfe der ARK Library durchzuführen. Die Datei konnte nicht ins Quarantäneverzeichnis verschoben werden! Die Datei existiert nicht! 08.11.2013 20:12 [Echtzeit-Scanner] Malware gefunden In der Datei 'C:\ProgramData\eSafe\eGdpSvc.exe' wurde ein Virus oder unerwünschtes Programm 'ADWARE/ELEX.W' [adware] gefunden. Ausgeführte Aktion: Zugriff verweigern defogger_disable: defogger_disable by jpshortstuff (23.02.10.1) Log created at 18:44 on 22/11/2013 (****) Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers... -=E.O.F=- FRST Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-11-2013 01 Ran by ****_ (ATTENTION: The logged in user is not administrator) on ****-PC on 22-11-2013 18:48:36 Running from C:\Users\****_\Desktop Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 10 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Intel Corporation) C:\Windows\system32\igfxsrvc.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Acer Incorporated) C:\Program Files (x86)\Acer\Acer VCM\AcerVCM.exe (OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe (Egis Technology Inc. ) C:\Program Files\Acer ProShield\EgisTSR.exe (Ask) C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Intel Corporation) C:\Windows\system32\igfxext.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps.exe (Mozilla Corporation) C:\****\Freeware\Firefox\firefox.exe (Mozilla Corporation) C:\****\Freeware\Firefox\plugin-container.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_152.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_152.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] () HKLM\...\Run: [IntelTBRunOnce] - C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs [4526 2010-10-08] () HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2697512 2011-02-17] (Synaptics Incorporated) HKLM\...\Run: [ProShieldTSR] - C:\Program Files\Acer ProShield\EgisTSR.exe [165936 2011-06-04] (Egis Technology Inc. ) HKLM\...\Run: [Power Management] - C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [1831528 2011-05-10] (Acer Incorporated) HKLM\...\Runonce: [MSPCLOCK] - rundll32.exe streamci,StreamingDeviceSetup {97ebaacc-95bd-11d0-a3ea-00a0c9223196},{53172480-4791-11D0-A5D6-28DB04C10000},{53172480-4791-11D0-A5D6-28DB04C10000} HKLM\...\Runonce: [MSPQM] - rundll32.exe streamci,StreamingDeviceSetup {DDF4358E-BB2C-11D0-A42F-00A0C9223196},{97EBAACB-95BD-11D0-A3EA-00A0C9223196},{97EBAACB-95BD-11D0-A3EA-00A0C9223196} HKLM\...\Runonce: [MSKSSRV] - rundll32.exe streamci,StreamingDeviceSetup {96E080C7-143C-11D1-B40F-00A0C9223196},{3C0D501A-140B-11D1-B40F-00A0C9223196},{3C0D501A-140B-11D1-B40F-00A0C9223196} HKLM\...\Runonce: [MSTEE.CxTransform] - rundll32.exe streamci,StreamingDeviceSetup {cfd669f1-9bc2-11d0-8299-0000f822fe8a},{CF1DDA2C-9743-11D0-A3EE-00A0C9223196},{CF1DDA2C-9743-11D0-A3EE-00A0C9223196},C:\Windows\inf\ksfilter.inf,MSTEE.Interface.Install HKLM\...\Runonce: [MSTEE.Splitter] - rundll32.exe streamci,StreamingDeviceSetup {cfd669f1-9bc2-11d0-8299-0000f822fe8a},{0A4252A0-7E70-11D0-A5D6-28DB04C10000},{0A4252A0-7E70-11D0-A5D6-28DB04C10000},C:\Windows\inf\ksfilter.inf,MSTEE.Interface.Install HKLM-x32\...\Runonce: [installer.{44B9733D-FE3E-48DE-90C5-85DF91E7B6B6}] - "C:\Windows\system32\RunDll32.EXE" "C:\Program Files\NVIDIA Corporation\Installer2\installer.{44B9733D-FE3E-48DE-90C5-85DF91E7B6B6}\NVI2.DLL",Resume C:\Program Files\NVIDIA Corporation\Installer2\installer.{44B9733D-FE3E-48DE-90C5-85DF91E7B6B6}\setup.CFG [x] HKLM-x32\...\RunOnce: [installer.{10ABBECF-8472-4559-90C6-43784F7EA594}] - "C:\Windows\system32\RunDll32.EXE" "C:\Program Files\NVIDIA Corporation\Installer2\installer.{10ABBECF-8472-4559-90C6-43784F7EA594}\NVI2.DLL",Resume C:\Program Files\NVIDIA Corporation\Installer2\installer.{10ABBECF-8472-4559-90C6-43784F7EA594}\setup.CFG [4073760 2013-09-19] (NVIDIA Corporation) HKLM-x32\...\Runonce: [freem4atomp3converterzxvb] - [x] Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKLM-x32\...\Run: [Norton Online Backup] - C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-02] (Symantec Corporation) HKLM-x32\...\Run: [BackupManagerTray] - C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe [297280 2011-04-24] (NTI Corporation) HKLM-x32\...\Run: [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe [1110096 2011-07-01] (Dritek System Inc.) HKLM-x32\...\Run: [ZoneAlarm Installer] - "C:\Program Files (x86)\CheckPoint\Install\Launcher.exe" "C:\Program Files (x86)\CheckPoint\Install\Install.exe" /r /c "C:\Program Files (x86)\CheckPoint\Install\Install.xml" HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated) HKLM-x32\...\Run: [NBAgent] - C:\Program Files (x86)\Nero\Nero 11\Nero BackItUp\NBAgent.exe [1485096 2011-07-15] (Nero AG) HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.) HKLM-x32\...\Run: [] - [x] HKLM-x32\...\Run: [ApnUpdater] - C:\Program Files (x86)\Ask.com\Updater\Updater.exe [1644680 2013-02-08] (Ask) HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-05] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-10-23] (Apple Inc.) AppInit_DLLs: C:\Windows\system32\nvinitx.dll [ ] () AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll [ ] () Lsa: [Notification Packages] scecli EgisPwdFilter EgisDSPwdFilter Startup: C:\Users\****_\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://acer.msn.com HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.dosearches.com/?utm_source=b&utm_medium=smt&utm_campaign=eXQ&utm_content=hp&from=smt&uid=HitachiXHTS545050B9A300_120326PBN406P7KK5R1EX&ts=1382867998 HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.dosearches.com/?utm_source=b&utm_medium=smt&utm_campaign=eXQ&utm_content=hp&from=smt&uid=HitachiXHTS545050B9A300_120326PBN406P7KK5R1EX&ts=1382867998 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.dosearches.com/?utm_source=b&utm_medium=smt&utm_campaign=eXQ&utm_content=hp&from=smt&uid=HitachiXHTS545050B9A300_120326PBN406P7KK5R1EX&ts=1382867998 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.dosearches.com/?utm_source=b&utm_medium=smt&utm_campaign=eXQ&utm_content=hp&from=smt&uid=HitachiXHTS545050B9A300_120326PBN406P7KK5R1EX&ts=1382867998 StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.dosearches.com/?utm_source=b&utm_medium=smt&utm_campaign=eXQ&utm_content=sc&from=smt&uid=HitachiXHTS545050B9A300_120326PBN406P7KK5R1EX&ts=1382867998 SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.dosearches.com/web/?utm_source=b&utm_medium=smt&utm_campaign=eXQ&utm_content=ds&from=smt&uid=HitachiXHTS545050B9A300_120326PBN406P7KK5R1EX&ts=1382867998&type=default&q={ searchTerms} SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.dosearches.com/web/?utm_source=b&utm_medium=smt&utm_campaign=eXQ&utm_content=ds&from=smt&uid=HitachiXHTS545050B9A300_120326PBN406P7KK5R1EX&ts=1382867998&type=default&q={ searchTerms} SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.dosearches.com/web/?utm_source=b&utm_medium=smt&utm_campaign=eXQ&utm_content=ds&from=smt&uid=HitachiXHTS545050B9A300_120326PBN406P7KK5R1EX&ts=1382867998&type=default&q={ searchTerms} SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.dosearches.com/web/?utm_source=b&utm_medium=smt&utm_campaign=eXQ&utm_content=ds&from=smt&uid=HitachiXHTS545050B9A300_120326PBN406P7KK5R1EX&ts=1382867998&type=default&q={ searchTerms} SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: a2zLyrics-16 - {11111111-1111-1111-1111-110411411168} - C:\Program Files (x86)\a2zLyrics-16\a2zLyrics-16-bho64.dll (dealscompare) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: a2zLyrics-16 - {11111111-1111-1111-1111-110411411168} - C:\Program Files (x86)\a2zLyrics-16\a2zLyrics-16-bho.dll (dealscompare) BHO-x32: EgisPBIE Sign-in Helper - {7B51CCBE-4AF9-44A6-BDAB-D7F7E4C4E6F9} - C:\Program Files\Acer ProShield\x86\EgisPBIE.dll (Egis Technology Inc.) BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) BHO-x32: Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) Toolbar: HKLM-x32 - Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\****_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default FF SearchEngineOrder.1: Ask.com FF SelectedSearchEngine: Google FF Homepage: https://www.google.de/ FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_152.dll () FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_152.dll () FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @checkpoint.com/FFApi - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\npFFApi.dll No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @Nero.com/KM - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Extension: a2zLyrics-16 - C:\Users\****_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\Extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com FF HKLM-x32\...\Firefox\Extensions: [{41ecbc0b-34d5-4cd4-935f-253a30e2cb7e}] - C:\Program Files\Acer ProShield\FFExt FF Extension: Online Accounts Extension - C:\Program Files\Acer ProShield\FFExt FF HKLM-x32\...\Firefox\Extensions: [{d4da7309-b89a-45ec-8ebb-cfb2ae13618b}] - C:\Program Files\Acer ProShield\FFExt20 FF Extension: Online Accounts Extension - C:\Program Files\Acer ProShield\FFExt20 FF HKLM-x32\...\Firefox\Extensions: [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}] - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK FF StartMenuInternet: FIREFOX.EXE - C:\****\Freeware\Firefox\firefox.exe hxxp://www.dosearches.com/?utm_source=b&utm_medium=smt&utm_campaign=eXQ&utm_content=sc&from=smt&uid=HitachiXHTS545050B9A300_120326PBN406P7KK5R1EX&ts=1382867998 ==================== Services (Whitelisted) ================= R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-05] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-05] (Avira Operations GmbH & Co. KG) R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-05] (Avira Operations GmbH & Co. KG) R2 EgisTec Ticket Service; C:\Program Files\Common Files\EgisTec\Services\EgisTicketService.exe [212016 2011-06-04] (Egis Technology Inc. ) R2 lmhosts; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) R2 NlaSvc; C:\Windows\System32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-02] (Symantec Corporation) R2 nsi; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [256832 2011-04-24] (NTI Corporation) R2 RS_Service; C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe [260640 2010-01-30] (Acer Incorporated) ==================== Drivers (Whitelisted) ==================== R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-05] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-09-05] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-03-29] (Avira Operations GmbH & Co. KG) S3 s217bus; C:\Windows\System32\DRIVERS\s217bus.sys [108072 2007-11-02] (MCCI Corporation) S3 s217mdfl; C:\Windows\System32\DRIVERS\s217mdfl.sys [19496 2007-11-02] (MCCI Corporation) S3 s217mdm; C:\Windows\System32\DRIVERS\s217mdm.sys [145448 2007-11-02] (MCCI Corporation) S3 s217nd5; C:\Windows\System32\DRIVERS\s217nd5.sys [33832 2007-11-02] (MCCI Corporation) S3 s217obex; C:\Windows\System32\DRIVERS\s217obex.sys [124968 2007-11-02] (MCCI Corporation) S3 s217unic; C:\Windows\System32\DRIVERS\s217unic.sys [138792 2007-11-02] (MCCI) S4 nvkflt; system32\DRIVERS\nvkflt.sys [x] S4 nvlddmkm; system32\DRIVERS\nvlddmkm.sys [x] S4 nvpciflt; \SystemRoot\system32\DRIVERS\nvpciflt.sys [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-11-22 18:48 - 2013-11-22 18:49 - 00015473 _____ C:\Users\****_\Desktop\FRST.txt 2013-11-22 18:47 - 2013-11-22 18:47 - 00000000 ____D C:\FRST 2013-11-22 18:46 - 2013-11-22 18:46 - 01958070 _____ (Farbar) C:\Users\****_\Desktop\FRST64.exe 2013-11-22 18:44 - 2013-11-22 18:44 - 00000472 _____ C:\Users\****_\Desktop\defogger_disable.log 2013-11-22 18:44 - 2013-11-22 18:44 - 00000000 _____ C:\Users\****\defogger_reenable 2013-11-22 18:40 - 2013-11-22 18:40 - 00000000 ____D C:\Users\****_\Desktop\Neuer Ordner 2013-11-22 18:40 - 2013-11-22 18:40 - 00000000 ____D C:\Users\****_\Desktop\Anti Virus 2013-11-22 18:33 - 2013-11-22 18:33 - 105757824 _____ C:\Windows\SysWOW64\脫쫪b 2013-11-16 13:35 - 2013-11-16 13:35 - 00377856 _____ C:\Users\****_\Desktop\gmer_2.1.19163.exe 2013-11-16 13:34 - 2013-11-16 13:34 - 00050477 _____ C:\Users\****_\Desktop\Defogger.exe 2013-11-15 23:22 - 2013-10-12 09:45 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2013-11-15 23:22 - 2013-10-12 09:45 - 01364992 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2013-11-15 23:22 - 2013-10-12 09:45 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2013-11-15 23:22 - 2013-10-12 09:43 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2013-11-15 23:22 - 2013-10-12 09:43 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2013-11-15 23:22 - 2013-10-12 09:43 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2013-11-15 23:22 - 2013-10-12 09:43 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2013-11-15 23:22 - 2013-10-12 09:43 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2013-11-15 23:22 - 2013-10-12 09:43 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2013-11-15 23:22 - 2013-10-12 09:43 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2013-11-15 23:22 - 2013-10-12 09:43 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2013-11-15 23:22 - 2013-10-12 09:43 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2013-11-15 23:22 - 2013-10-12 08:03 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2013-11-15 23:22 - 2013-10-12 08:03 - 01138176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2013-11-15 23:22 - 2013-10-12 08:02 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2013-11-15 23:22 - 2013-10-12 08:02 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2013-11-15 23:22 - 2013-10-12 08:02 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2013-11-15 23:22 - 2013-10-12 08:02 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2013-11-15 23:22 - 2013-10-12 08:02 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2013-11-15 23:22 - 2013-10-12 08:02 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2013-11-15 23:22 - 2013-10-12 08:02 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll 2013-11-15 23:22 - 2013-10-12 08:02 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2013-11-15 23:22 - 2013-10-12 08:02 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2013-11-15 23:22 - 2013-10-12 08:02 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2013-11-15 23:22 - 2013-10-12 07:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2013-11-15 23:22 - 2013-10-12 07:08 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2013-11-15 23:22 - 2013-10-12 06:44 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe 2013-11-15 23:22 - 2013-10-12 06:15 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe 2013-11-15 23:21 - 2013-10-12 09:43 - 19269632 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2013-11-15 23:21 - 2013-10-12 09:43 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2013-11-15 23:21 - 2013-10-12 08:02 - 14355968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2013-11-15 20:21 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll 2013-11-15 20:21 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL 2013-11-15 20:21 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL 2013-11-15 20:21 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll 2013-11-15 20:21 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL 2013-11-15 20:21 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll 2013-11-15 20:21 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll 2013-11-15 20:21 - 2013-10-04 03:28 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll 2013-11-15 20:21 - 2013-10-04 03:25 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll 2013-11-15 20:21 - 2013-10-04 03:24 - 01930752 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll 2013-11-15 20:21 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SmartcardCredentialProvider.dll 2013-11-15 20:21 - 2013-10-04 02:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll 2013-11-15 20:21 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credui.dll 2013-11-15 20:21 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll 2013-11-15 20:21 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll 2013-11-15 20:21 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys 2013-11-15 20:21 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2013-11-15 20:21 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys 2013-11-15 20:21 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll 2013-11-15 20:21 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll 2013-11-15 20:21 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll 2013-11-15 20:21 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2013-11-15 20:21 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2013-11-15 20:21 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll 2013-11-15 20:21 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2013-11-15 20:21 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2013-11-15 20:21 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2013-11-15 20:21 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll 2013-11-15 20:21 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe 2013-11-15 20:21 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys 2013-10-27 11:03 - 2013-10-27 11:03 - 00000000 ____D C:\Users\****_\Neuer Ordner 2013-10-27 11:00 - 2013-11-08 20:16 - 00000000 ____D C:\ProgramData\eSafe 2013-10-27 11:00 - 2013-10-27 11:00 - 00001177 _____ C:\Users\****_\Desktop\Free M4a to MP3 Converter.lnk 2013-10-27 11:00 - 2013-10-27 10:59 - 00652020 _____ C:\Users\****\AppData\Roaming\dosearches.exe 2013-10-27 10:59 - 2013-11-22 18:34 - 00001882 _____ C:\Windows\Tasks\a2zLyrics-16-firefoxinstaller.job 2013-10-27 10:59 - 2013-11-22 18:34 - 00001342 _____ C:\Windows\Tasks\a2zLyrics-16-updater.job 2013-10-27 10:59 - 2013-11-22 18:34 - 00001248 _____ C:\Windows\Tasks\a2zLyrics-16-codedownloader.job 2013-10-27 10:59 - 2013-11-22 18:34 - 00001148 _____ C:\Windows\Tasks\a2zLyrics-16-enabler.job 2013-10-27 10:59 - 2013-10-27 10:59 - 00000000 ____D C:\Program Files (x86)\Free M4a to MP3 Converter 2013-10-27 10:59 - 2013-10-27 10:59 - 00000000 ____D C:\Program Files (x86)\a2zLyrics-16 2013-10-27 10:55 - 2013-10-27 10:55 - 05834488 _____ (ManiacTools.com ) C:\Users\****_\Downloads\m4a-to80-mp3-converter.exe 2013-10-27 10:51 - 2013-10-27 10:52 - 00000000 ____D C:\Output 2013-10-27 10:49 - 2013-10-27 10:49 - 03624560 _____ (hxxp://www.MP4ToMP3Converter.net ) C:\Users\****_\Downloads\mp4tomp3-304.exe 2013-10-27 10:48 - 2013-10-27 10:48 - 00000000 ____D C:\Users\****_\AppData\Roaming\Mp3tag 2013-10-27 10:20 - 2013-10-27 11:03 - 00000000 ____D C:\Users\****_\Desktop\Musik Backup 2013-10-27 2013-10-27 09:48 - 2013-10-27 09:48 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_netaapl64_01009.Wdf 2013-10-27 09:38 - 2013-10-27 09:39 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2013-10-27 09:38 - 2013-10-27 09:39 - 00000000 ____D C:\Program Files\iTunes 2013-10-27 09:38 - 2013-10-27 09:38 - 00000000 ____D C:\Program Files\iPod 2013-10-23 18:53 - 2013-10-23 19:12 - 258366720 _____ (NVIDIA Corporation) C:\Users\****_\Downloads\331.58-notebook-win8-win7-64bit-international-whql.exe ==================== One Month Modified Files and Folders ======= 2013-11-22 18:49 - 2013-11-22 18:48 - 00015473 _____ C:\Users\****_\Desktop\FRST.txt 2013-11-22 18:47 - 2013-11-22 18:47 - 00000000 ____D C:\FRST 2013-11-22 18:46 - 2013-11-22 18:46 - 01958070 _____ (Farbar) C:\Users\****_\Desktop\FRST64.exe 2013-11-22 18:44 - 2013-11-22 18:44 - 00000472 _____ C:\Users\****_\Desktop\defogger_disable.log 2013-11-22 18:44 - 2013-11-22 18:44 - 00000000 _____ C:\Users\****\defogger_reenable 2013-11-22 18:44 - 2012-12-19 02:21 - 00000000 ____D C:\Users\**** 2013-11-22 18:40 - 2013-11-22 18:40 - 00000000 ____D C:\Users\****_\Desktop\Neuer Ordner 2013-11-22 18:40 - 2013-11-22 18:40 - 00000000 ____D C:\Users\****_\Desktop\Anti Virus 2013-11-22 18:39 - 2009-07-14 05:45 - 00016752 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-11-22 18:39 - 2009-07-14 05:45 - 00016752 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-11-22 18:37 - 2012-04-23 23:07 - 00696870 _____ C:\Windows\system32\perfh007.dat 2013-11-22 18:37 - 2012-04-23 23:07 - 00148134 _____ C:\Windows\system32\perfc007.dat 2013-11-22 18:37 - 2009-07-14 06:13 - 01612484 _____ C:\Windows\system32\PerfStringBackup.INI 2013-11-22 18:36 - 2012-04-23 13:14 - 01106722 _____ C:\Windows\WindowsUpdate.log 2013-11-22 18:34 - 2013-10-27 10:59 - 00001882 _____ C:\Windows\Tasks\a2zLyrics-16-firefoxinstaller.job 2013-11-22 18:34 - 2013-10-27 10:59 - 00001342 _____ C:\Windows\Tasks\a2zLyrics-16-updater.job 2013-11-22 18:34 - 2013-10-27 10:59 - 00001248 _____ C:\Windows\Tasks\a2zLyrics-16-codedownloader.job 2013-11-22 18:34 - 2013-10-27 10:59 - 00001148 _____ C:\Windows\Tasks\a2zLyrics-16-enabler.job 2013-11-22 18:33 - 2013-11-22 18:33 - 105757824 _____ C:\Windows\SysWOW64\脫쫪b 2013-11-22 18:32 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2013-11-22 18:32 - 2009-07-14 05:51 - 00066129 _____ C:\Windows\setupact.log 2013-11-16 15:57 - 2012-12-24 13:14 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-11-16 15:56 - 2012-12-21 21:05 - 00000386 _____ C:\Windows\Tasks\Acer Registration - Reminder Recall task.job 2013-11-16 13:35 - 2013-11-16 13:35 - 00377856 _____ C:\Users\****_\Desktop\gmer_2.1.19163.exe 2013-11-16 13:34 - 2013-11-16 13:34 - 00050477 _____ C:\Users\****_\Desktop\Defogger.exe 2013-11-16 12:31 - 2012-12-24 13:14 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2013-11-16 12:31 - 2011-11-08 13:22 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2013-11-15 23:21 - 2013-08-18 12:06 - 00000000 ____D C:\Windows\system32\MRT 2013-11-15 23:19 - 2012-12-30 13:43 - 82896128 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2013-11-08 20:16 - 2013-10-27 11:00 - 00000000 ____D C:\ProgramData\eSafe 2013-11-03 12:12 - 2013-02-25 20:18 - 00000000 ____D C:\Users\****_\Desktop\Kontakte 2013-10-27 11:03 - 2013-10-27 11:03 - 00000000 ____D C:\Users\****_\Neuer Ordner 2013-10-27 11:03 - 2013-10-27 10:20 - 00000000 ____D C:\Users\****_\Desktop\Musik Backup 2013-10-27 2013-10-27 11:03 - 2012-12-23 22:49 - 00000000 ____D C:\Users\****_ 2013-10-27 11:00 - 2013-10-27 11:00 - 00001177 _____ C:\Users\****_\Desktop\Free M4a to MP3 Converter.lnk 2013-10-27 10:59 - 2013-10-27 11:00 - 00652020 _____ C:\Users\****\AppData\Roaming\dosearches.exe 2013-10-27 10:59 - 2013-10-27 10:59 - 00000000 ____D C:\Program Files (x86)\Free M4a to MP3 Converter 2013-10-27 10:59 - 2013-10-27 10:59 - 00000000 ____D C:\Program Files (x86)\a2zLyrics-16 2013-10-27 10:55 - 2013-10-27 10:55 - 05834488 _____ (ManiacTools.com ) C:\Users\****_\Downloads\m4a-to80-mp3-converter.exe 2013-10-27 10:52 - 2013-10-27 10:51 - 00000000 ____D C:\Output 2013-10-27 10:49 - 2013-10-27 10:49 - 03624560 _____ (hxxp://www.MP4ToMP3Converter.net ) C:\Users\****_\Downloads\mp4tomp3-304.exe 2013-10-27 10:48 - 2013-10-27 10:48 - 00000000 ____D C:\Users\****_\AppData\Roaming\Mp3tag 2013-10-27 10:11 - 2013-02-25 20:42 - 00000000 ____D C:\Users\****_\AppData\Roaming\WindSolutions 2013-10-27 10:11 - 2012-12-30 14:02 - 00000000 ____D C:\ProgramData\WindSolutions 2013-10-27 09:48 - 2013-10-27 09:48 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_netaapl64_01009.Wdf 2013-10-27 09:39 - 2013-10-27 09:38 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2013-10-27 09:39 - 2013-10-27 09:38 - 00000000 ____D C:\Program Files\iTunes 2013-10-27 09:39 - 2013-02-26 18:35 - 00001787 _____ C:\Users\Public\Desktop\iTunes.lnk 2013-10-27 09:39 - 2013-02-25 21:12 - 00000000 ____D C:\Program Files (x86)\iTunes 2013-10-27 09:38 - 2013-10-27 09:38 - 00000000 ____D C:\Program Files\iPod 2013-10-25 20:38 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache 2013-10-23 19:23 - 2012-04-23 13:20 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation 2013-10-23 19:23 - 2012-04-23 13:19 - 00000000 ____D C:\Program Files\NVIDIA Corporation 2013-10-23 19:23 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\Help 2013-10-23 19:12 - 2013-10-23 18:53 - 258366720 _____ (NVIDIA Corporation) C:\Users\****_\Downloads\331.58-notebook-win8-win7-64bit-international-whql.exe Some content of TEMP: ==================== C:\Users\****_\AppData\Local\Temp\fp_pl_pfs_installer.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ==================== End Of Log ============================ # Addition: Additional scan result of Farbar Recovery Scan Tool (x64) Version: 22-11-2013 01 Ran by ****_ at 2013-11-22 18:49:28 Running from C:\Users\****_\Desktop Boot Mode: Normal ========================================================== ==================== Security Center ======================== AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C} AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691} AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installed Programs ====================== a2zLyrics-16 (x32 Version: 1.29.153.0) Acer Backup Manager (x32 Version: 3.0.0.99) Acer Crystal Eye Webcam (x32 Version: 1.0.1710) Acer ePower Management (x32 Version: 6.00.3007) Acer eRecovery Management (x32 Version: 5.00.3502) Acer Registration (x32 Version: 1.04.3502) Acer ScreenSaver (x32 Version: 1.1.0913.2011) Acer Updater (x32 Version: 1.02.3501) Acer VCM (x32 Version: 4.05.3501) Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.117) Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.152) Adobe Reader XI (11.0.05) - Deutsch (x32 Version: 11.0.05) Apple Application Support (x32 Version: 2.3.6) Apple Mobile Device Support (Version: 7.0.0.117) Apple Software Update (x32 Version: 2.1.3.127) Ask Toolbar (x32 Version: 1.15.18.0) Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (x32 Version: 1.0.0.36) Avira Free Antivirus (x32 Version: 13.0.0.4052) Avira SearchFree Toolbar plus Web Protection Updater (HKCU Version: 1.2.4.37268) Backup Manager V3 (x32 Version: 3.0.0.99) Bing Bar (x32 Version: 7.0.765.0) Bonjour (Version: 3.0.0.10) Bundled software uninstaller (x32) Conexant HD Audio (Version: 8.52.0.50) Corel WinDVD (x32 Version: 10.0.5.899) D3DX10 (x32 Version: 15.4.2368.0902) dm-Fotowelt (x32 Version: 5.0.4) doPDF 7.2 printer dosearches Browser Protecter (x32) eBay Worldwide (x32 Version: 2.2.0409) Fotogalerija Windows Live (x32 Version: 15.4.3502.0922) Free M4a to MP3 Converter 8.0 (x32) Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922) Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922) Galeria fotogràfica del Windows Live (x32 Version: 15.4.3502.0922) Galeria fotografii usługi Windows Live (x32 Version: 15.4.3502.0922) Galerie de photos Windows Live (x32 Version: 15.4.3502.0922) Galerie foto Windows Live (x32 Version: 15.4.3502.0922) High-Definition Video Playback (x32 Version: 11.0.12200.1.158) Identity Card (x32 Version: 1.00.3501) Install Absolute Data Protect (x32 Version: 1.0.0.42) Intel(R) Control Center (x32 Version: 1.2.1.1007) Intel(R) Management Engine Components (x32 Version: 7.0.0.1144) Intel(R) Processor Graphics (x32 Version: 8.15.10.2345) Intel(R) Rapid Storage Technology (x32 Version: 10.6.0.1002) IrfanView (remove only) (x32 Version: 4.35) iTunes (Version: 11.1.2.32) Junk Mail filter update (x32 Version: 15.4.3502.0922) Launch Manager (x32 Version: 6.0.8s1) Mesh Runtime (x32 Version: 15.4.5722.2) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319) Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319) Microsoft .NET Framework 4 Extended (Version: 4.0.30319) Microsoft Application Error Reporting (Version: 12.0.6015.5000) Microsoft Office 2010 (x32 Version: 14.0.4763.1000) Microsoft Silverlight (Version: 5.1.20913.0) Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (x32 Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219) Mozilla Firefox 17.0.1 (x86 de) (x32 Version: 17.0.1) Mozilla Firefox 25.0.1 (x86 de) (HKCU Version: 25.0.1) Mozilla Maintenance Service (x32 Version: 17.0.1) Mp3tag v2.53 (x32 Version: v2.53) MSVCRT (x32 Version: 15.4.2862.0708) MSVCRT_amd64 (x32 Version: 15.4.2862.0708) MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0) MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0) Nero 11 (x32 Version: 11.0.10100) Nero 11 Cliparts (x32 Version: 11.0.10600.6.0) Nero 11 Disc Menus 1 (x32 Version: 11.0.10600.5.0) Nero 11 Disc Menus 2 (x32 Version: 11.0.10600.5.0) Nero 11 Disc Menus 3 (x32 Version: 11.0.10600.5.0) Nero 11 Disc Menus Basic (x32 Version: 11.0.10600.5.0) Nero 11 Effects Basic (x32 Version: 11.0.10600.6.0) Nero 11 Image Samples (x32 Version: 11.0.10600.5.0) Nero 11 Kwik Themes 1 (x32 Version: 11.0.10600.5.0) Nero 11 Kwik Themes 2 (x32 Version: 11.0.10600.5.0) Nero 11 Kwik Themes Basic (x32 Version: 11.0.10600.5.0) Nero 11 PiP Effects Basic (x32 Version: 11.0.10600.6.0) Nero 11 Video Samples (x32 Version: 11.0.10600.5.0) Nero Audio Pack 1 (x32 Version: 11.0.11500.110.0) Nero BackItUp 11 (x32 Version: 6.0.10700.6.100) Nero BackItUp 11 Help (CHM) (x32 Version: 11.0.10000) Nero Backup Drivers (Version: 1.0.10000.1.0) Nero Burning ROM 11 (x32 Version: 11.0.10700.12.100) Nero Burning ROM 11 Help (CHM) (x32 Version: 11.0.10000) Nero ControlCenter 11 (x32 Version: 11.0.11900.0.17) Nero ControlCenter 11 Help (CHM) (x32 Version: 11.0.10000) Nero Core Components 11 (x32 Version: 11.0.13500.1.0) Nero CoverDesigner 11 (x32 Version: 6.0.10500.8.100) Nero CoverDesigner 11 Help (CHM) (x32 Version: 11.0.10000) Nero Express 11 (x32 Version: 11.0.10700.12.100) Nero Express 11 Help (CHM) (x32 Version: 11.0.10000) Nero Kwik Media (x32 Version: 1.10.14100.42.100) Nero Kwik Media Help (CHM) (x32 Version: 11.0.10000) Nero Recode 11 (x32 Version: 5.0.11300.15.100) Nero Recode 11 Help (CHM) (x32 Version: 11.0.10000) Nero RescueAgent 11 (x32 Version: 4.0.10300.7.100) Nero RescueAgent 11 Help (CHM) (x32 Version: 11.0.10000) Nero SoundTrax 11 (x32 Version: 5.0.10300.3.100) Nero SoundTrax 11 Help (CHM) (x32 Version: 11.0.10000) Nero Update (x32 Version: 11.0.10022.15.0) Nero Video 11 (x32 Version: 8.0.12900.10.100) Nero Video 11 Help (CHM) (x32 Version: 11.0.10000) Nero WaveEditor 11 (x32 Version: 6.0.10500.3.100) Nero WaveEditor 11 Help (CHM) (x32 Version: 11.0.10000) nero.prerequisites.msi (x32 Version: 11.0.20001) newsXpresso (x32 Version: 1.0.0.40) Norton Online Backup (x32 Version: 2.1.17869) NTI Media Maker 9 (x32 Version: 9.0.2.8942) Nur Entfernen der CopyTrans Suite möglich (HKCU Version: 2.37) NVIDIA HD-Audiotreiber 1.2.24.0 (Version: 1.2.24.0) NVIDIA Install Application (Version: 2.1002.85.551) NVIDIA PhysX (x32 Version: 9.10.0514) OpenOffice.org 3.4.1 (x32 Version: 3.41.9593) Poczta usługi Windows Live (x32 Version: 15.4.3502.0922) Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922) Pošta Windows Live (x32 Version: 15.4.3502.0922) ProShield (Version: 1.0.48.3) ProShield (x32 Version: 1.0.48.3) Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922) Realtek PCIE Card Reader (x32 Version: 6.1.7600.74) Shared C Run-time for x64 (Version: 10.0.0) Skype™ 5.10 (x32 Version: 5.10.116) Synaptics Pointing Device Driver (Version: 15.2.14.0) Überwachungstool für die Intel® Turbo-Boost-Technik 2.0 (Version: 2.0.82.0) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3) Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1) Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1) Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1) Update for Microsoft .NET Framework 4 Extended (KB2836939v3) (x32 Version: 3) welcome (x32 Version: 11.0.20000.0.0) Welcome Center (x32 Version: 1.02.3504) Windows Live Communications Platform (x32 Version: 15.4.3502.0922) Windows Live Essentials (x32 Version: 15.4.3502.0922) Windows Live Essentials (x32 Version: 15.4.3538.0513) Windows Live Fotogaléria (x32 Version: 15.4.3502.0922) Windows Live Fotogalerie (x32 Version: 15.4.3502.0922) Windows Live Fotogalleri (x32 Version: 15.4.3502.0922) Windows Live Fotoğraf Galerisi (x32 Version: 15.4.3502.0922) Windows Live Fotótár (x32 Version: 15.4.3502.0922) Windows Live Galeria de Fotos (x32 Version: 15.4.3502.0922) Windows Live Galerija fotografija (x32 Version: 15.4.3502.0922) Windows Live ID Sign-in Assistant (Version: 7.250.4232.0) Windows Live Installer (x32 Version: 15.4.3502.0922) Windows Live Language Selector (Version: 15.4.3538.0513) Windows Live Mail (x32 Version: 15.4.3502.0922) Windows Live Mesh (x32 Version: 15.4.3502.0922) Windows Live Messenger (x32 Version: 15.4.3538.0513) Windows Live MIME IFilter (Version: 15.4.3502.0922) Windows Live Movie Maker (x32 Version: 15.4.3502.0922) Windows Live Photo Common (x32 Version: 15.4.3502.0922) Windows Live Photo Gallery (x32 Version: 15.4.3502.0922) Windows Live PIMT Platform (x32 Version: 15.4.3508.1109) Windows Live Remote Client (Version: 15.4.5722.2) Windows Live Remote Client Resources (Version: 15.4.5722.2) Windows Live Remote Service (Version: 15.4.5722.2) Windows Live Remote Service Resources (Version: 15.4.5722.2) Windows Live SOXE (x32 Version: 15.4.3502.0922) Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922) Windows Live Temel Parçalar (x32 Version: 15.4.3502.0922) Windows Live UX Platform (x32 Version: 15.4.3502.0922) Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109) Windows Live Writer (x32 Version: 15.4.3502.0922) Windows Live Writer Resources (x32 Version: 15.4.3502.0922) Windows Live 影像中心 (x32 Version: 15.4.3502.0922) Windows Live 程式集 (x32 Version: 15.4.3502.0922) Windows Liven asennustyökalu (x32 Version: 15.4.3502.0922) Windows Liven sähköposti (x32 Version: 15.4.3502.0922) Windows Liven valokuvavalikoima (x32 Version: 15.4.3502.0922) Wsys Control 10.2.1.2652 (x32 Version: 10.2.1.2652) ZoneAlarm LTD Toolbar Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922) Основные компоненты Windows Live (x32 Version: 15.4.3502.0922) Почта Windows Live (x32 Version: 15.4.3502.0922) Фотоальбом Windows Live (x32 Version: 15.4.3502.0922) Фотогалерия на Windows Live (x32 Version: 15.4.3502.0922) גלריית התמונות של Windows Live (x32 Version: 15.4.3502.0922) بريد Windows Live (x32 Version: 15.4.3502.0922) معرض صور Windows Live (x32 Version: 15.4.3502.0922) ==================== Restore Points ========================= Could not list Restore Points. Check WMI. ==================== Hosts content: ========================== 2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: C:\Windows\Tasks\a2zLyrics-16-codedownloader.job => ? Task: C:\Windows\Tasks\a2zLyrics-16-enabler.job => ? Task: C:\Windows\Tasks\a2zLyrics-16-firefoxinstaller.job => ? Task: C:\Windows\Tasks\a2zLyrics-16-updater.job => ? Task: C:\Windows\Tasks\Acer Registration - Reminder Recall task.job => ? Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => ? ==================== Loaded Modules (whitelisted) ============= 2011-06-04 13:15 - 2011-06-04 13:15 - 01407536 _____ () C:\Program Files\Acer ProShield\LIBEAY32.dll 2011-11-08 12:39 - 2011-03-26 08:29 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll 2012-08-10 16:51 - 2012-08-10 16:51 - 00985088 _____ () C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll 2011-04-24 03:29 - 2011-04-24 03:29 - 00465640 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\sqlite3.dll 2013-01-28 13:08 - 2013-01-28 13:08 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll 2013-01-28 13:08 - 2013-01-28 13:08 - 01242512 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll 2013-11-15 20:48 - 2013-11-15 20:48 - 03363952 _____ () C:\****\Freeware\Firefox\mozjs.dll 2013-11-16 12:31 - 2013-11-16 12:31 - 16237448 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_152.dll ==================== Alternate Data Streams (whitelisted) ========= ==================== Safe Mode (whitelisted) =================== ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (11/22/2013 06:33:55 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (11/16/2013 01:14:45 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (11/16/2013 00:25:04 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (11/15/2013 08:08:04 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 10062 Error: (11/15/2013 08:08:04 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 10062 Error: (11/15/2013 08:08:04 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (11/08/2013 08:02:47 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "SMC,processorArchitecture="x86",type="win32",version="8.1.0.0"1". Fehler in Manifest- oder Richtliniendatei "SMC,processorArchitecture="x86",type="win32",version="8.1.0.0"2" in Zeile SMC,processorArchitecture="x86",type="win32",version="8.1.0.0"3. Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein. Verweis: SMC,processorArchitecture="x86",type="win32",version="8.1.0.0". Definition: SMC,processorArchitecture="x86",type="win32",version="8.0.0.0". Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose. Error: (11/08/2013 08:02:25 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "ACME,processorArchitecture="x86",type="win32",version="11.0.0.0"1". Die abhängige Assemblierung "ACME,processorArchitecture="x86",type="win32",version="11.0.0.0"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". Error: (11/08/2013 07:05:03 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (11/07/2013 08:10:42 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 System errors: ============= Error: (11/08/2013 08:16:26 PM) (Source: Service Control Manager) (User: ) Description: Dienst "Wsys Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Error: (11/08/2013 07:05:01 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Wsys Service" wurde nicht richtig gestartet. Error: (11/07/2013 08:10:41 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Wsys Service" wurde nicht richtig gestartet. Error: (11/02/2013 00:25:48 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Wsys Service" wurde nicht richtig gestartet. Error: (10/28/2013 06:52:47 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Wsys Service" wurde nicht richtig gestartet. Error: (10/27/2013 09:36:39 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Apple Mobile Device" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts. Error: (06/01/2013 09:43:01 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "WinHTTP-Web Proxy Auto-Discovery-Dienst" wurde aufgrund folgenden Fehlers nicht gestartet: %%1069 Error: (06/01/2013 09:43:01 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "WinHttpAutoProxySvc" konnte sich nicht als "NT AUTHORITY\LocalService" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: %%50 Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC). Error: (05/11/2013 11:42:53 AM) (Source: Disk) (User: ) Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR6 gefunden. Error: (04/21/2013 07:08:31 PM) (Source: Service Control Manager) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Nero Update erreicht. Microsoft Office Sessions: ========================= Error: (11/22/2013 06:33:55 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (11/16/2013 01:14:45 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (11/16/2013 00:25:04 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (11/15/2013 08:08:04 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 10062 Error: (11/15/2013 08:08:04 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: m->NextScheduledEvent 10062 Error: (11/15/2013 08:08:04 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (11/08/2013 08:02:47 PM) (Source: SideBySide)(User: ) Description: SMC,processorArchitecture="x86",type="win32",version="8.1.0.0"SMC,processorArchitecture="x86",type="win32",version="8.0.0.0"c:\program files (x86)\Nero\Nero 11\nero waveeditor\NMDllHost.exe.Manifestc:\program files (x86)\Nero\Nero 11\nero waveeditor\SMC\SMC.MANIFEST3 Error: (11/08/2013 08:02:25 PM) (Source: SideBySide)(User: ) Description: ACME,processorArchitecture="x86",type="win32",version="11.0.0.0"c:\program files (x86)\Nero\Nero 11\nero recode\NeroBRServer.exe.Manifest Error: (11/08/2013 07:05:03 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (11/07/2013 08:10:42 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 CodeIntegrity Errors: =================================== Date: 2012-12-21 23:10:48.495 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2012-12-21 22:19:44.681 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2012-12-21 22:04:24.375 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2012-12-21 21:40:26.931 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2012-12-21 21:24:00.792 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2012-12-21 21:18:34.559 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2012-12-21 21:12:14.208 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. ==================== Memory info =========================== Percentage of memory in use: 25% Total physical RAM: 8043.86 MB Available physical RAM: 5957.36 MB Total Pagefile: 16085.9 MB Available Pagefile: 13837.83 MB Total Virtual: 8192 MB Available Virtual: 8191.8 MB ==================== Drives ================================ Drive c: (Acer) (Fixed) (Total:452.66 GB) (Free:366.55 GB) NTFS ==================== MBR & Partition Table ================== ==================== End Of Log ============================ GMER GMER 2.1.19163 - hxxp://www.gmer.net Rootkit scan 2013-11-22 19:02:41 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Hitachi_ rev.PB4O 465,76GB Running: gmer_2.1.19163.exe; Driver: C:\Users\****\AppData\Local\Temp\awloypoc.sys ---- User code sections - GMER 2.1 ---- .text C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe[1268] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076fc1465 2 bytes [FC, 76] .text C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe[1268] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076fc14bb 2 bytes [FC, 76] .text ... * 2 .text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3300] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076fc1465 2 bytes [FC, 76] .text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3300] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076fc14bb 2 bytes [FC, 76] .text ... * 2 .text C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe[3424] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076fc1465 2 bytes [FC, 76] .text C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe[3424] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076fc14bb 2 bytes [FC, 76] .text ... * 2 .text C:\Program Files (x86)\Launch Manager\LManager.exe[3504] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076fc1465 2 bytes [FC, 76] .text C:\Program Files (x86)\Launch Manager\LManager.exe[3504] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076fc14bb 2 bytes [FC, 76] .text ... * 2 .text C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3588] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076fc1465 2 bytes [FC, 76] .text C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3588] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076fc14bb 2 bytes [FC, 76] .text ... * 2 ---- EOF - GMER 2.1 ---- |
|
23.11.2013, 07:05
| #2 | |
| /// the machine /// TB-Ausbilder    | eGdpSvc.exe/ Maleware, Adware in C:\ProgramData\eSafe gefunden hi,
__________________ So funktioniert es:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!Downloade dir bitte Combofix vom folgenden Downloadspiegel Link 1 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
__________________ |
|
23.11.2013, 10:15
| #3 |
| | eGdpSvc.exe/ Maleware, Adware in C:\ProgramData\eSafe gefunden Hallo Schrauber,
__________________vielen Dank für deine Antwort. Ich hab ComboFix runtergeladen und gestartet, das Programm hat ca 50 Schritte abgearbeitet, Dateien gelöscht, dann wollte es den Neustart machen - hat es gemacht und nach dem Neustart hat es sich wohl mit Antivir nicht vertragen, ich konnte das nicht schnell genug deaktivieren, jetzt hab ich ein springendes, blaues Fenster auf dem Desktop. Ich hab Antivir so schnell wie möglich deaktiviert, aber das war wohl zu langsam. Was jetzt ? Vielen Dank, Janoschi Sorry, Nachtrag - ich habe quer gelesen und habe jetzt den Rechner runtergefahren und mich als Admin neu angemeldet - das schien das Problem gewesen zu sein. ComboFix schreibt gerade die Log Datei. So als sie fertig ist, stelle ich sie hier rein. Code:
ATTFilter ComboFix 13-11-22.01 - jessi 23.11.2013 9:54.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.8044.5965 [GMT 1:00]
ausgeführt von:: c:\users\Jessi_\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\a2zLyrics-16
c:\program files (x86)\a2zLyrics-16\44168.xpi
c:\program files (x86)\a2zLyrics-16\a2zLyrics-16-bg.exe
c:\program files (x86)\a2zLyrics-16\a2ZLyrics-16-bho.dll
c:\program files (x86)\a2zLyrics-16\a2zLyrics-16-bho64.dll
c:\program files (x86)\a2zLyrics-16\a2zLyrics-16-buttonutil.dll
c:\program files (x86)\a2zLyrics-16\a2zLyrics-16-buttonutil.exe
c:\program files (x86)\a2zLyrics-16\a2zLyrics-16-buttonutil64.dll
c:\program files (x86)\a2zLyrics-16\a2zLyrics-16-buttonutil64.exe
c:\program files (x86)\a2zLyrics-16\a2zLyrics-16-codedownloader.exe
c:\program files (x86)\a2zLyrics-16\a2zLyrics-16-enabler.exe
c:\program files (x86)\a2zLyrics-16\a2zLyrics-16-firefoxinstaller.exe
c:\program files (x86)\a2zLyrics-16\a2zLyrics-16-helper.exe
c:\program files (x86)\a2zLyrics-16\a2zLyrics-16-updater.exe
c:\program files (x86)\a2zLyrics-16\a2zLyrics-16.ico
c:\program files (x86)\a2zLyrics-16\background.html
c:\program files (x86)\a2zLyrics-16\Installer.log
c:\program files (x86)\a2zLyrics-16\Uninstall.exe
c:\program files (x86)\a2zLyrics-16\utils.exe
c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\chrome.manifest
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\chrome\content\api.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\chrome\content\api\asyncDB.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\chrome\content\api\background.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\chrome\content\api\browserAction.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\chrome\content\api\contextMenu.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\chrome\content\api\dbManager.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\chrome\content\api\dom_bg.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\chrome\content\api\fileManager.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\chrome\content\api\firefox.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\chrome\content\api\firefoxNotifications.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\chrome\content\api\firefoxOmnibox.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\chrome\content\api\message.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\chrome\content\api\pageAction.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\chrome\content\api\request.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\chrome\content\api\tabs.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\chrome\content\api\webRequest.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\chrome\content\background.html
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\chrome\content\baseObject.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\chrome\content\browser.xul
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\chrome\content\core\console.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\chrome\content\core\consts.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\chrome\content\core\delegate.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\chrome\content\core\extensionDataStore.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\chrome\content\core\folderIOWrapper.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\chrome\content\core\httpObserver.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\chrome\content\core\IDBWrapper.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\chrome\content\core\installer.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\chrome\content\core\logFile.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\chrome\content\core\prefs.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\chrome\content\core\progressListenerObserver.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\chrome\content\core\registry.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\chrome\content\core\reloadObserver.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\chrome\content\core\reports.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\chrome\content\core\requestObject.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\chrome\content\core\searchSettings.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\chrome\content\core\uninstallObserver.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\chrome\content\core\updateManager.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\chrome\content\core\utils.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\chrome\content\core\xhr.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\chrome\content\dialog.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\chrome\content\main.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\chrome\content\options.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\chrome\content\options.xul
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\chrome\content\search_dialog.xul
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\defaults\preferences\prefs.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\manifest.xml
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\plugins.json
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\plugins\1_base.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\plugins\101_cortica_m.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\plugins\102_dealply_m.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\plugins\103_intext_5_m.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\plugins\104_jollywallet_m.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\plugins\105_corticas_m.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\plugins\108_icm_m.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\plugins\116_ads_only_5_m.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\plugins\117_coupons_intext_ads_5_m.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\plugins\119_similar_web_m.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\plugins\120_luck_m.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\plugins\123_intext_adv_m.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\plugins\124_superfish_no_search_no_coupons_m.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\plugins\125_arcadi2_m.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\plugins\126_revizer_ws_m.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\plugins\127_revizer_p_m.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\plugins\128_superfish_pricora_m.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\plugins\129_widdit_m.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\plugins\13_CrossriderAppUtils.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\plugins\135_arcadi3_m.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\plugins\138_getdeal_m.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\plugins\14_CrossriderUtils.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\plugins\141_corticas_ru_m.js.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\plugins\142_intext_fa_m.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\plugins\155_ibario_pops_m.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\plugins\158_50onred_ads_only_no_fb_m.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\plugins\159_cortica_rollover_m.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\plugins\16_FFAppAPIWrapper.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\plugins\17_jQuery.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\plugins\170_icm1_5_m.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\plugins\171_arcadi2_sourceID_m.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\plugins\174_arcadi_serp_dynamic_id_m.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\plugins\175_coolmirage_m.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\plugins\178_revizer_ws_dynamic_m.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\plugins\179_revizer_p_dynamic_m.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\plugins\21_debug.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\plugins\22_resources.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\plugins\28_initializer.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\plugins\4_jquery_1_7_1.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\plugins\47_resources_background.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\plugins\64_appApiMessage.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\plugins\7_hooks.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\plugins\72_appApiValidation.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\plugins\78_CrossriderInfo.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\plugins\87_ginyas_wrapper.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\plugins\9_search_engine_hook.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\plugins\91_monetizationLoader.js.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\plugins\92_superfish_m.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\plugins\93_superfish_no_coupons_m.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\plugins\98_omniCommands.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\userCode\background.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\extensionData\userCode\extension.js
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\install.rdf
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\locale\en-US\translations.dtd
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\skin\button1.png
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\skin\button2.png
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\skin\button3.png
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\skin\button4.png
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\skin\button5.png
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\skin\crossrider_statusbar.png
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\skin\icon128.png
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\skin\icon16.png
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\skin\icon24.png
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\skin\icon48.png
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\skin\panelarrow-up.png
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\skin\popup.html
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\skin\skin.css
c:\users\Jessi_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\extensions\2f86d471-1122-4c15-901a-d7fd67316cd9@ca42b8d2-0eb6-47be-84a2-6d95abe186e8.com\skin\update.css
c:\windows\SysWow64\FlashPlayerApp.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-10-23 bis 2013-11-23 ))))))))))))))))))))))))))))))
.
.
2013-11-23 09:00 . 2013-11-23 09:54 -------- d-----w- c:\users\jessi\AppData\Local\temp
2013-11-23 09:00 . 2013-11-23 09:00 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2013-11-23 09:00 . 2013-11-23 09:00 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-11-22 17:47 . 2013-11-22 17:47 -------- d-----w- C:\FRST
2013-11-15 22:21 . 2013-10-12 08:43 15404544 ----a-w- c:\windows\system32\ieframe.dll
2013-11-15 22:21 . 2013-10-12 08:43 19269632 ----a-w- c:\windows\system32\mshtml.dll
2013-10-27 10:03 . 2013-10-27 10:03 -------- d-----w- c:\users\Jessi_\Neuer Ordner
2013-10-27 10:00 . 2013-11-08 19:16 -------- d-----w- c:\programdata\eSafe
2013-10-27 10:00 . 2013-10-27 09:59 652020 ----a-w- c:\users\jessi\AppData\Roaming\dosearches.exe
2013-10-27 09:59 . 2013-10-27 09:59 -------- d-----w- c:\program files (x86)\Free M4a to MP3 Converter
2013-10-27 09:57 . 2013-10-27 09:57 -------- d-----w- c:\users\jessi\AppData\Local\Programs
2013-10-27 09:51 . 2013-10-27 09:52 -------- d-----w- C:\Output
2013-10-27 09:48 . 2013-10-27 09:48 -------- d-----w- c:\users\Jessi_\AppData\Roaming\Mp3tag
2013-10-27 08:38 . 2013-10-27 08:39 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-10-27 08:38 . 2013-10-27 08:39 -------- d-----w- c:\program files\iTunes
2013-10-27 08:38 . 2013-10-27 08:38 -------- d-----w- c:\program files\iPod
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-11-16 11:31 . 2011-11-08 12:22 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-11-15 22:19 . 2012-12-30 12:43 82896128 ----a-w- c:\windows\system32\MRT.exe
2013-09-08 02:30 . 2013-10-19 11:03 1903552 ----a-w- c:\windows\system32\drivers\tcpip.sys
2013-09-08 02:27 . 2013-10-19 11:03 327168 ----a-w- c:\windows\system32\mswsock.dll
2013-09-08 02:03 . 2013-10-19 11:03 231424 ----a-w- c:\windows\SysWow64\mswsock.dll
2013-09-05 16:08 . 2013-05-10 16:24 81112 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2013-09-05 16:08 . 2013-03-29 12:36 132088 ----a-w- c:\windows\system32\drivers\avipbb.sys
2013-09-05 16:08 . 2013-03-29 12:36 105344 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2013-08-29 02:17 . 2013-10-19 11:03 5549504 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-08-29 02:16 . 2013-10-19 11:03 1732032 ----a-w- c:\windows\system32\ntdll.dll
2013-08-29 02:16 . 2013-10-19 11:03 243712 ----a-w- c:\windows\system32\wow64.dll
2013-08-29 02:16 . 2013-10-19 11:03 859648 ----a-w- c:\windows\system32\tdh.dll
2013-08-29 02:13 . 2013-10-19 11:03 878080 ----a-w- c:\windows\system32\advapi32.dll
2013-08-29 01:51 . 2013-10-19 11:03 3969472 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2013-08-29 01:51 . 2013-10-19 11:03 3914176 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2013-08-29 01:50 . 2013-10-19 11:03 5120 ----a-w- c:\windows\SysWow64\wow32.dll
2013-08-29 01:50 . 2013-10-19 11:03 1292192 ----a-w- c:\windows\SysWow64\ntdll.dll
2013-08-29 01:50 . 2013-10-19 11:03 619520 ----a-w- c:\windows\SysWow64\tdh.dll
2013-08-29 01:48 . 2013-10-19 11:03 640512 ----a-w- c:\windows\SysWow64\advapi32.dll
2013-08-29 01:48 . 2013-10-19 11:03 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2013-08-29 00:49 . 2013-10-19 11:03 25600 ----a-w- c:\windows\SysWow64\setup16.exe
2013-08-29 00:49 . 2013-10-19 11:03 7680 ----a-w- c:\windows\SysWow64\instnm.exe
2013-08-29 00:49 . 2013-10-19 11:03 14336 ----a-w- c:\windows\SysWow64\ntvdm64.dll
2013-08-29 00:49 . 2013-10-19 11:03 2048 ----a-w- c:\windows\SysWow64\user.exe
2013-08-28 01:21 . 2013-10-19 11:03 3155968 ----a-w- c:\windows\system32\win32k.sys
2013-08-28 01:12 . 2013-10-19 11:03 461312 ----a-w- c:\windows\system32\scavengeui.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2013-02-08 1521800]
.
[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2013-02-08 14:10 1521800 ----a-w- c:\program files (x86)\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2013-02-08 1521800]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Norton Online Backup"="c:\program files (x86)\Symantec\Norton Online Backup\NOBuClient.exe" [2010-06-01 1155928]
"BackupManagerTray"="c:\program files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe" [2011-04-24 297280]
"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2011-07-01 1110096]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"NBAgent"="c:\program files (x86)\Nero\Nero 11\Nero BackItUp\NBAgent.exe" [2011-07-15 1485096]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
"ApnUpdater"="c:\program files (x86)\Ask.com\Updater\Updater.exe" [2013-02-08 1644680]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-09-05 347192]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-10-23 152392]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Acer VCM.lnk - c:\program files (x86)\Acer\Acer VCM\AcerVCM.exe [2011-11-8 723560]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [x]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys;c:\windows\SYSNATIVE\DRIVERS\netaapl64.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 TurboBoost;Intel(R) Turbo Boost Technology Monitor 2.0;c:\program files\Intel\TurboBoost\TurboBoost.exe;c:\program files\Intel\TurboBoost\TurboBoost.exe [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R4 nvkflt;nvkflt;c:\windows\system32\DRIVERS\nvkflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvkflt.sys [x]
R4 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvpciflt.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 NBVol;Nero Backup Volume Filter Driver;c:\windows\system32\DRIVERS\NBVol.sys;c:\windows\SYSNATIVE\DRIVERS\NBVol.sys [x]
S0 NBVolUp;Nero Backup Volume Upper Filter Driver;c:\windows\system32\DRIVERS\NBVolUp.sys;c:\windows\SYSNATIVE\DRIVERS\NBVolUp.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDFilter.sys [x]
S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDNServ.sys [x]
S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDVDisk.sys [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [x]
S2 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE;c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE [x]
S2 CxAudMsg;Conexant Audio Message Service;c:\windows\system32\CxAudMsg64.exe;c:\windows\SYSNATIVE\CxAudMsg64.exe [x]
S2 DsiWMIService;Dritek WMI Service;c:\program files (x86)\Launch Manager\dsiwmis.exe;c:\program files (x86)\Launch Manager\dsiwmis.exe [x]
S2 EgisTec Ticket Service;EgisTec Ticket Service;c:\program files\Common Files\EgisTec\Services\EgisTicketService.exe;c:\program files\Common Files\EgisTec\Services\EgisTicketService.exe [x]
S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [x]
S2 GREGService;GREGService;c:\program files (x86)\Acer\Registration\GREGsvc.exe;c:\program files (x86)\Acer\Registration\GREGsvc.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 IconMan_R;IconMan_R;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [x]
S2 Live Updater Service;Live Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe;c:\program files\Acer\Acer Updater\UpdaterService.exe [x]
S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe;c:\program files (x86)\Nero\Update\NASvc.exe [x]
S2 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE [x]
S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe;c:\program files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [x]
S2 RS_Service;Raw Socket Service;c:\program files (x86)\Acer\Acer VCM\RS_Service.exe;c:\program files (x86)\Acer\Acer VCM\RS_Service.exe [x]
S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys;c:\windows\SYSNATIVE\DRIVERS\TurboB.sys [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C62x64.sys [x]
S3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys;c:\windows\SYSNATIVE\DRIVERS\RtsPStor.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2013-11-23 c:\windows\Tasks\Acer Registration - Reminder Recall task.job
- c:\program files (x86)\Acer\Registration\GREG.exe [2011-05-11 11:30]
.
2013-11-23 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-12-24 11:31]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-03-31 167960]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-03-31 392216]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-03-31 415768]
"IntelTBRunOnce"="wscript.exe" [2009-07-14 168960]
"ProShieldTSR"="c:\program files\Acer ProShield\EgisTSR.exe" [2011-06-04 165936]
"Power Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2011-05-10 1831528]
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.dosearches.com/?utm_source=b&utm_medium=smt&utm_campaign=eXQ&utm_content=hp&from=smt&uid=HitachiXHTS545050B9A300_120326PBN406P7KK5R1EX&ts=1382867998
uLocal Page = c:\windows\system32\blank.htm
mDefault_Page_URL = hxxp://www.dosearches.com/?utm_source=b&utm_medium=smt&utm_campaign=eXQ&utm_content=hp&from=smt&uid=HitachiXHTS545050B9A300_120326PBN406P7KK5R1EX&ts=1382867998
mStart Page = hxxp://www.dosearches.com/?utm_source=b&utm_medium=smt&utm_campaign=eXQ&utm_content=hp&from=smt&uid=HitachiXHTS545050B9A300_120326PBN406P7KK5R1EX&ts=1382867998
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
LSP: c:\program files (x86)\Avira\AntiVir Desktop\avsda.dll
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\jessi\AppData\Roaming\Mozilla\Firefox\Profiles\ij6ozv7g.default\
FF - prefs.js: browser.search.selectedEngine - dosearches
FF - prefs.js: browser.startup.homepage - hxxp://www.dosearches.com/?utm_source=b&utm_medium=smt&utm_campaign=eXQ&utm_content=hp&from=smt&uid=HitachiXHTS545050B9A300_120326PBN406P7KK5R1EX&ts=1382867998
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{11111111-1111-1111-1111-110411411168} - c:\program files (x86)\a2zLyrics-16\a2zLyrics-16-bho.dll
Toolbar-Locked - (no file)
Wow6432Node-HKLM-Run-ZoneAlarm Installer - c:\program files (x86)\CheckPoint\Install\Launcher.exe
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
c:\users\jessi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe
c:\users\Jessi_\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-a2zLyrics-16 - c:\program files (x86)\a2zLyrics-16\Uninstall.exe
AddRemove-WsysControl - c:\programdata\eSafe\eGdpSvc.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_117_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_117_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_117_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_117_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_117.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_117.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_117.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_117.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Launch Manager\LMutilps32.exe
c:\program files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
c:\program files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2013-11-23 10:58:50 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2013-11-23 09:58
.
Vor Suchlauf: 10 Verzeichnis(se), 397.956.005.888 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 399.433.342.976 Bytes frei
.
- - End Of File - - 6530DCFFE98020169124C3D2E6723C1C
Geändert von Janoschi (23.11.2013 um 11:03 Uhr) |
|
24.11.2013, 08:13
| #4 |
| /// the machine /// TB-Ausbilder | eGdpSvc.exe/ Maleware, Adware in C:\ProgramData\eSafe gefunden Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
24.11.2013, 13:58
| #5 |
| | eGdpSvc.exe/ Maleware, Adware in C:\ProgramData\eSafe gefunden Hallo Schrauber, hier die nächsten Infos: Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.11.24.04 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16736 **** :: ****-PC [Administrator] Schutz: Aktiviert 24.11.2013 13:05:45 mbam-log-2013-11-24 (13-05-45).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 255677 Laufzeit: 4 Minute(n), 54 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 11 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\dosearches Browser Protecter (PUP.Optional.Wilsys.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\CrossriderApp0044168.BHO (PUP.Optional.CrossRider.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\CrossriderApp0044168.Sandbox (PUP.Optional.CrossRider.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\CrossriderApp0044168.Sandbox.1 (PUP.Optional.CrossRider.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} (PUP.Optional.Qone8) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\dosearchesSoftware (PUP.Optional.DoSearches.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} (PUP.Optional.Qone8) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\Software\a2zLyrics-16 (PUP.Optional.A2ZLyrics.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110411411168} (PUP.Optional.CrossRider.M) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\CLSID\{11111111-1111-1111-1111-110411411168} (PUP.Optional.CrossRider.M) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110411411168} (PUP.Optional.CrossRider.M) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 4 HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|Start Page (PUP.Optional.DoSearches) -> Bösartig: (hxxp://www.dosearches.com/?utm_source=b&utm_medium=smt&utm_campaign=eXQ&utm_content=hp&from=smt&uid=HitachiXHTS545050B9A300_120326PBN406P7KK5R1EX&ts=1382867998) Gut: (hxxp://www.google.com) -> Erfolgreich ersetzt und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Internet Explorer\Main|Default_Page_URL (PUP.Optional.DoSearches) -> Bösartig: (hxxp://www.dosearches.com/?utm_source=b&utm_medium=smt&utm_campaign=eXQ&utm_content=hp&from=smt&uid=HitachiXHTS545050B9A300_120326PBN406P7KK5R1EX&ts=1382867998) Gut: (hxxp://www.google.com) -> Erfolgreich ersetzt und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Internet Explorer\Main|Start Page (PUP.Optional.DoSearches) -> Bösartig: (hxxp://www.dosearches.com/?utm_source=b&utm_medium=smt&utm_campaign=eXQ&utm_content=hp&from=smt&uid=HitachiXHTS545050B9A300_120326PBN406P7KK5R1EX&ts=1382867998) Gut: (hxxp://www.google.com) -> Erfolgreich ersetzt und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes|DefaultScope (PUP.Optional.Qone8) -> Bösartig: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}) Gut: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}) -> Erfolgreich ersetzt und in Quarantäne gestellt. Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 1 C:\Users\****\AppData\Roaming\dosearches.exe (PUP.Optional.Wilsys.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) Code:
ATTFilter # AdwCleaner v3.013 - Bericht erstellt am 24/11/2013 um 13:27:27
# Updated 24/11/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : **** - ****-PC
# Gestartet von : C:\Users\****\Desktop\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\eSafe
Ordner Gelöscht : C:\Program Files (x86)\Ask.com
Ordner Gelöscht : C:\Windows\installer\{86d4b82a-abed-442a-be86-96357b70f4fe}
Ordner Gelöscht : C:\Users\****\AppData\LocalLow\AskToolbar
Ordner Gelöscht : C:\Users\****\AppData\Roaming\CheckPoint\ZoneAlarm LTD Toolbar
Ordner Gelöscht : C:\Users\****_\AppData\LocalLow\AskToolbar
Ordner Gelöscht : C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ij6ozv7g.default\Extensions\toolbar@ask.com
Datei Gelöscht : C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ij6ozv7g.default\searchplugins\Askcom.xml
Datei Gelöscht : C:\Windows\System32\Tasks\Scheduled Update for Ask Toolbar
***** [ Verknüpfungen ] *****
Verknüpfung Desinfiziert : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
Verknüpfung Desinfiziert : C:\Users\****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
Verknüpfung Desinfiziert : C:\Users\****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
Verknüpfung Desinfiziert : C:\Users\****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk
Verknüpfung Desinfiziert : C:\Users\****\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
Verknüpfung Desinfiziert : C:\Users\****\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer (64-bit).lnk
Verknüpfung Desinfiziert : C:\Users\****\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHost.Tool
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHost.Tool.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnUpdater]
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@checkpoint.com/FFApi
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WsysSvc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C17DC5CF-54FF-4E63-8AC7-94335D6DA231}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{D14D0EE2-2DD1-4230-BE70-3F3AD6172C40}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{05366194-3126-4601-AC1A-DDE573E093DC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{061F450C-37B9-4330-9235-0F25D9F75B33}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{19D2F415-D58B-46BC-9390-C03DCBC21EB2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{22FEB0F5-0BA0-4D4B-8A66-55A21667BC31}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{26249267-15F4-4DA3-8247-C5A78E4FA918}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{39B217B4-8C69-4E45-A8DC-8CC4DAD3CF0A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3CB4CE45-8849-4638-9226-D6B615A15827}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{43AB7B5D-4C40-4103-A549-7002A116A7D5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6E45F3E8-2683-4824-A6BE-08108022FB36}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{996ED20F-A740-47A2-A7EF-9620D422BB4E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{9F0F16DD-4E76-4049-A9B1-7A91E48F0323}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D2B79F7D-2D7D-4420-B2A9-ECE52C7C83A0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F4288797-CB12-49CE-9DF8-7CDFA1143BEA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220422412268}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{061F450C-37B9-4330-9235-0F25D9F75B33}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{22FEB0F5-0BA0-4D4B-8A66-55A21667BC31}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D2B79F7D-2D7D-4420-B2A9-ECE52C7C83A0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550455415568}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660466416668}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{1D55DAA5-04AC-4036-B0BE-DA81EE9676CD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{212C2C4F-C845-4FBC-9561-C833A13D8DCE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{3C5D1D57-16C8-473C-A552-37B8D88596FE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{4A115D8A-6A7B-4C72-92B1-2E2D01F36979}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{58CBF821-A0C7-4AE8-9430-77DD1AF38E99}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{72BCBFF7-2837-4CA0-B3B5-3DAED7F54601}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{824125FD-7732-4DA2-9277-3A7D0A0A0813}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{99DF8440-814E-497F-BDDD-FB93E9E9DF96}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{83CAD530-387D-40FD-82EA-B9E863D92A9B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C17DC5CF-54FF-4E63-8AC7-94335D6DA231}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D14D0EE2-2DD1-4230-BE70-3F3AD6172C40}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F994E0D9-8335-48F1-99C2-A712C21F8D5F}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220422412268}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550455415568}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660466416668}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Daten Wiederhergestellt : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command
Schlüssel Gelöscht : HKCU\Software\Ask.com
Schlüssel Gelöscht : HKCU\Software\BI
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\AskToolbar
Schlüssel Gelöscht : HKLM\Software\AskToolbar
Schlüssel Gelöscht : HKLM\Software\eSafeSecControl
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\bi_uninstaller
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WsysControl
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\InstalledThirdPartyPrograms
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZoneAlarm LTD Toolbar
Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
***** [ Browser ] *****
-\\ Internet Explorer v10.0.9200.16736
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
-\\ Mozilla Firefox v17.0.1 (de)
[ Datei : C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ij6ozv7g.default\prefs.js ]
Zeile gelöscht : user_pref("browser.newtab.url", "hxxp://www.dosearches.com/newtab/?utm_source=b&utm_medium=smt&utm_campaign=eXQ&utm_content=nt&from=smt&uid=HitachiXHTS545050B9A300_120326PBN406P7KK5R1EX&ts=1382867998"[...]
Zeile gelöscht : user_pref("browser.startup.homepage", "hxxp://www.dosearches.com/?utm_source=b&utm_medium=smt&utm_campaign=eXQ&utm_content=hp&from=smt&uid=HitachiXHTS545050B9A300_120326PBN406P7KK5R1EX&ts=1382867998")[...]
Zeile gelöscht : user_pref("extensions.asktb.ff-original-keyword-url", "");
[ Datei : C:\Users\****_\AppData\Roaming\Mozilla\Firefox\Profiles\zm6d1dwm.default\prefs.js ]
Zeile gelöscht : user_pref("extensions.asktb.ff-original-keyword-url", "");
Zeile gelöscht : user_pref("extensions.crossrider.bic", "141f95c3c0ae44851d45fa06e3b7456f");
*************************
AdwCleaner[R0].txt - [12079 octets] - [24/11/2013 13:24:57]
AdwCleaner[S0].txt - [10400 octets] - [24/11/2013 13:27:27]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [10461 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.8 (11.05.2013:1)
OS: Windows 7 Home Premium x64
Ran by **** on 24.11.2013 at 13:33:27,00
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\installer\upgradecodes\f928123a039649549966d4c29d35b1c9
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{9A9CEFC4-301C-41FB-80AD-26A160CB7900}
~~~ Files
~~~ Folders
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 24.11.2013 at 13:38:04,96
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Und ein frisches FRST: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-11-2013 03
Ran by **** (administrator) on ****-PC on 24-11-2013 13:42:07
Running from C:\Users\****\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Egis Technology Inc. ) C:\Program Files\Common Files\EgisTec\Services\EgisTicketService.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer VCM\AcerVCM.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Egis Technology Inc. ) C:\Program Files\Acer ProShield\EgisTSR.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Absolute Software) C:\Program Files (x86)\Absolute Software\Absolute Reminder\AbsoluteReminder.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(InterVideo) C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [IntelTBRunOnce] - C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs [4526 2010-10-08] ()
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2697512 2011-02-17] (Synaptics Incorporated)
HKLM\...\Run: [ProShieldTSR] - C:\Program Files\Acer ProShield\EgisTSR.exe [165936 2011-06-04] (Egis Technology Inc. )
HKLM\...\Run: [Power Management] - C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [1831528 2011-05-10] (Acer Incorporated)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM-x32\...\Run: [Norton Online Backup] - C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-02] (Symantec Corporation)
HKLM-x32\...\Run: [BackupManagerTray] - C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe [297280 2011-04-24] (NTI Corporation)
HKLM-x32\...\Run: [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe [1110096 2011-07-01] (Dritek System Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [NBAgent] - C:\Program Files (x86)\Nero\Nero 11\Nero BackItUp\NBAgent.exe [1485096 2011-07-15] (Nero AG)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-05] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-10-23] (Apple Inc.)
HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [162408 2011-09-13] ()
HKU\Default User\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [162408 2011-09-13] ()
HKU\UpdatusUser\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [162408 2011-09-13] ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
URLSearchHook: HKCU - UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll No File
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
SearchScopes: HKCU - {A1380F1F-C6B6-43F7-8F42-3BFCF1C1E9DE} URL = hxxp://search.zonealarm.com/search?Source=Browser&oemCode=ZLN116033868135274-1001&toolbarId=base&affiliateId=1001 tlbrid=ZoneAlarmSecurity&Lan=de&utid=62267e3900000000000008edb9137aa2&q={searchTerms}&r=466
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: EgisPBIE Sign-in Helper - {7B51CCBE-4AF9-44A6-BDAB-D7F7E4C4E6F9} - C:\Program Files\Acer ProShield\x86\EgisPBIE.dll (Egis Technology Inc.)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ij6ozv7g.default
FF SearchEngineOrder.1: Ask.com
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_152.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_152.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @Nero.com/KM - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [{41ecbc0b-34d5-4cd4-935f-253a30e2cb7e}] - C:\Program Files\Acer ProShield\FFExt
FF Extension: Online Accounts Extension - C:\Program Files\Acer ProShield\FFExt
FF HKLM-x32\...\Firefox\Extensions: [{d4da7309-b89a-45ec-8ebb-cfb2ae13618b}] - C:\Program Files\Acer ProShield\FFExt20
FF Extension: Online Accounts Extension - C:\Program Files\Acer ProShield\FFExt20
FF HKLM-x32\...\Firefox\Extensions: [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}] - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 EgisTec Ticket Service; C:\Program Files\Common Files\EgisTec\Services\EgisTicketService.exe [212016 2011-06-04] (Egis Technology Inc. )
S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-02] (Symantec Corporation)
R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [256832 2011-04-24] (NTI Corporation)
R2 RS_Service; C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe [260640 2010-01-30] (Acer Incorporated)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-05] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-09-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-03-29] (Avira Operations GmbH & Co. KG)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 s217bus; C:\Windows\System32\DRIVERS\s217bus.sys [108072 2007-11-02] (MCCI Corporation)
S3 s217mdfl; C:\Windows\System32\DRIVERS\s217mdfl.sys [19496 2007-11-02] (MCCI Corporation)
S3 s217mdm; C:\Windows\System32\DRIVERS\s217mdm.sys [145448 2007-11-02] (MCCI Corporation)
S3 s217nd5; C:\Windows\System32\DRIVERS\s217nd5.sys [33832 2007-11-02] (MCCI Corporation)
S3 s217obex; C:\Windows\System32\DRIVERS\s217obex.sys [124968 2007-11-02] (MCCI Corporation)
S3 s217unic; C:\Windows\System32\DRIVERS\s217unic.sys [138792 2007-11-02] (MCCI)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S4 nvkflt; system32\DRIVERS\nvkflt.sys [x]
S4 nvlddmkm; system32\DRIVERS\nvlddmkm.sys [x]
S4 nvpciflt; \SystemRoot\system32\DRIVERS\nvpciflt.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-11-24 13:42 - 2013-11-24 13:42 - 00012301 _____ C:\Users\****\Desktop\FRST.txt
2013-11-24 13:41 - 2013-11-24 13:41 - 01958396 _____ (Farbar) C:\Users\****\Desktop\FRST64.exe
2013-11-24 13:38 - 2013-11-24 13:38 - 00000902 _____ C:\Users\****\Desktop\JRT.txt
2013-11-24 13:33 - 2013-11-24 13:33 - 00000000 ____D C:\Windows\ERUNT
2013-11-24 13:32 - 2013-11-24 13:32 - 01034531 _____ (Thisisu) C:\Users\****\Desktop\JRT.exe
2013-11-24 13:29 - 2013-11-24 13:29 - 00010582 _____ C:\Users\****\Desktop\AdwCleaner[S0].txt
2013-11-24 13:24 - 2013-11-24 13:27 - 00000000 ____D C:\AdwCleaner
2013-11-24 13:02 - 2013-11-24 13:02 - 00001117 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-11-24 13:02 - 2013-11-24 13:02 - 00000000 ____D C:\Users\****\AppData\Roaming\Malwarebytes
2013-11-24 13:02 - 2013-11-24 13:02 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-24 13:02 - 2013-11-24 13:02 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-11-24 13:02 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-11-24 12:59 - 2013-11-24 12:59 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\****\Desktop\mbam-setup-1.75.0.1300.exe
2013-11-24 12:59 - 2013-11-24 12:59 - 01091882 _____ C:\Users\****\Desktop\adwcleaner.exe
2013-11-23 11:05 - 2013-11-23 11:05 - 00000000 ____D C:\Users\****\AppData\Local\Macromedia
2013-11-23 10:59 - 2013-11-23 10:59 - 00046940 _____ C:\Users\****\Desktop\ComboFix.txt
2013-11-23 10:58 - 2013-11-23 10:58 - 00046940 _____ C:\ComboFix.txt
2013-11-23 09:51 - 2013-11-23 10:58 - 00000000 ____D C:\Qoobox
2013-11-23 09:51 - 2013-11-23 10:57 - 00000000 ____D C:\Windows\erdnt
2013-11-23 09:51 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2013-11-23 09:51 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2013-11-23 09:51 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-11-23 09:51 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-11-23 09:51 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-11-23 09:51 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2013-11-23 09:51 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2013-11-23 09:51 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2013-11-23 09:49 - 2013-11-23 09:49 - 05147802 ____R (Swearware) C:\Users\****_\Desktop\ComboFix.exe
2013-11-22 19:07 - 2013-11-22 19:07 - 00004700 _____ C:\Users\****_\Desktop\Ereignisse_Avira.txt
2013-11-22 19:04 - 2013-11-22 19:04 - 00262144 _____ C:\Windows\Minidump\112213-20342-01.dmp
2013-11-22 19:02 - 2013-11-22 19:02 - 00002827 _____ C:\Users\****_\Desktop\GMER.txt
2013-11-22 18:49 - 2013-11-22 18:50 - 00022616 _____ C:\Users\****_\Desktop\Addition.txt
2013-11-22 18:48 - 2013-11-22 18:50 - 00031577 _____ C:\Users\****_\Desktop\FRST.txt
2013-11-22 18:47 - 2013-11-22 18:47 - 00000000 ____D C:\FRST
2013-11-22 18:44 - 2013-11-22 18:44 - 00000472 _____ C:\Users\****_\Desktop\defogger_disable.log
2013-11-22 18:44 - 2013-11-22 18:44 - 00000000 _____ C:\Users\****\defogger_reenable
2013-11-22 18:40 - 2013-11-22 18:40 - 00000000 ____D C:\Users\****_\Desktop\Neuer Ordner
2013-11-22 18:33 - 2013-11-22 18:33 - 105757824 _____ C:\Windows\SysWOW64\脫쫪b
2013-11-16 13:35 - 2013-11-16 13:35 - 00377856 _____ C:\Users\****_\Desktop\gmer_2.1.19163.exe
2013-11-16 13:34 - 2013-11-16 13:34 - 00050477 _____ C:\Users\****_\Desktop\Defogger.exe
2013-11-15 23:22 - 2013-10-12 09:45 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-15 23:22 - 2013-10-12 09:45 - 01364992 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-15 23:22 - 2013-10-12 09:45 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-15 23:22 - 2013-10-12 09:43 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-15 23:22 - 2013-10-12 09:43 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-15 23:22 - 2013-10-12 09:43 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-15 23:22 - 2013-10-12 09:43 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-15 23:22 - 2013-10-12 09:43 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-15 23:22 - 2013-10-12 09:43 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-15 23:22 - 2013-10-12 09:43 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-15 23:22 - 2013-10-12 09:43 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-15 23:22 - 2013-10-12 09:43 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-15 23:22 - 2013-10-12 08:03 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-15 23:22 - 2013-10-12 08:03 - 01138176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-11-15 23:22 - 2013-10-12 08:02 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-15 23:22 - 2013-10-12 08:02 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-15 23:22 - 2013-10-12 08:02 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-15 23:22 - 2013-10-12 08:02 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-11-15 23:22 - 2013-10-12 08:02 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-11-15 23:22 - 2013-10-12 08:02 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-11-15 23:22 - 2013-10-12 08:02 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-11-15 23:22 - 2013-10-12 08:02 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-11-15 23:22 - 2013-10-12 08:02 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-11-15 23:22 - 2013-10-12 08:02 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-11-15 23:22 - 2013-10-12 07:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-15 23:22 - 2013-10-12 07:08 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-11-15 23:22 - 2013-10-12 06:44 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-15 23:22 - 2013-10-12 06:15 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-11-15 23:21 - 2013-10-12 09:43 - 19269632 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-15 23:21 - 2013-10-12 09:43 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-15 23:21 - 2013-10-12 08:02 - 14355968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-15 20:21 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2013-11-15 20:21 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2013-11-15 20:21 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2013-11-15 20:21 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2013-11-15 20:21 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2013-11-15 20:21 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-11-15 20:21 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-11-15 20:21 - 2013-10-04 03:28 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll
2013-11-15 20:21 - 2013-10-04 03:25 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll
2013-11-15 20:21 - 2013-10-04 03:24 - 01930752 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2013-11-15 20:21 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SmartcardCredentialProvider.dll
2013-11-15 20:21 - 2013-10-04 02:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2013-11-15 20:21 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credui.dll
2013-11-15 20:21 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2013-11-15 20:21 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2013-11-15 20:21 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-11-15 20:21 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-11-15 20:21 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2013-11-15 20:21 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2013-11-15 20:21 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2013-11-15 20:21 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2013-11-15 20:21 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-11-15 20:21 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-11-15 20:21 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2013-11-15 20:21 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2013-11-15 20:21 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-11-15 20:21 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2013-11-15 20:21 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2013-11-15 20:21 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2013-11-15 20:21 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-10-27 11:03 - 2013-10-27 11:03 - 00000000 ____D C:\Users\****_\Neuer Ordner
2013-10-27 11:00 - 2013-10-27 11:00 - 00001177 _____ C:\Users\****_\Desktop\Free M4a to MP3 Converter.lnk
2013-10-27 10:59 - 2013-10-27 10:59 - 00001159 _____ C:\Users\****\Desktop\Free M4a to MP3 Converter.lnk
2013-10-27 10:59 - 2013-10-27 10:59 - 00001154 _____ C:\Users\****\Desktop\My Music Tools.lnk
2013-10-27 10:59 - 2013-10-27 10:59 - 00000000 ____D C:\Program Files (x86)\Free M4a to MP3 Converter
2013-10-27 10:55 - 2013-10-27 10:55 - 05834488 _____ (ManiacTools.com ) C:\Users\****_\Downloads\m4a-to80-mp3-converter.exe
2013-10-27 10:51 - 2013-10-27 10:52 - 00000000 ____D C:\Output
2013-10-27 10:49 - 2013-10-27 10:49 - 03624560 _____ (hxxp://www.MP4ToMP3Converter.net ) C:\Users\****_\Downloads\mp4tomp3-304.exe
2013-10-27 10:48 - 2013-10-27 10:48 - 00000000 ____D C:\Users\****_\AppData\Roaming\Mp3tag
2013-10-27 10:20 - 2013-10-27 11:03 - 00000000 ____D C:\Users\****_\Desktop\Musik Backup 2013-10-27
2013-10-27 09:48 - 2013-10-27 09:48 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_netaapl64_01009.Wdf
2013-10-27 09:38 - 2013-10-27 09:39 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-10-27 09:38 - 2013-10-27 09:39 - 00000000 ____D C:\Program Files\iTunes
2013-10-27 09:38 - 2013-10-27 09:38 - 00000000 ____D C:\Program Files\iPod
==================== One Month Modified Files and Folders =======
2013-11-24 13:42 - 2013-11-24 13:42 - 00012301 _____ C:\Users\****\Desktop\FRST.txt
2013-11-24 13:41 - 2013-11-24 13:41 - 01958396 _____ (Farbar) C:\Users\****\Desktop\FRST64.exe
2013-11-24 13:38 - 2013-11-24 13:38 - 00000902 _____ C:\Users\****\Desktop\JRT.txt
2013-11-24 13:36 - 2009-07-14 05:45 - 00016752 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-24 13:36 - 2009-07-14 05:45 - 00016752 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-24 13:33 - 2013-11-24 13:33 - 00000000 ____D C:\Windows\ERUNT
2013-11-24 13:33 - 2012-04-23 23:07 - 00696870 _____ C:\Windows\system32\perfh007.dat
2013-11-24 13:33 - 2012-04-23 23:07 - 00148134 _____ C:\Windows\system32\perfc007.dat
2013-11-24 13:33 - 2012-04-23 13:14 - 01277258 _____ C:\Windows\WindowsUpdate.log
2013-11-24 13:33 - 2009-07-14 06:13 - 01612484 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-24 13:32 - 2013-11-24 13:32 - 01034531 _____ (Thisisu) C:\Users\****\Desktop\JRT.exe
2013-11-24 13:29 - 2013-11-24 13:29 - 00010582 _____ C:\Users\****\Desktop\AdwCleaner[S0].txt
2013-11-24 13:28 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-24 13:28 - 2009-07-14 05:51 - 00066577 _____ C:\Windows\setupact.log
2013-11-24 13:27 - 2013-11-24 13:24 - 00000000 ____D C:\AdwCleaner
2013-11-24 13:27 - 2012-12-19 02:26 - 00001186 _____ C:\Users\****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-11-24 13:27 - 2012-12-19 02:26 - 00000999 _____ C:\Users\****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
2013-11-24 13:14 - 2010-11-21 04:47 - 00033856 _____ C:\Windows\PFRO.log
2013-11-24 13:05 - 2012-12-24 13:14 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-24 13:02 - 2013-11-24 13:02 - 00001117 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-11-24 13:02 - 2013-11-24 13:02 - 00000000 ____D C:\Users\****\AppData\Roaming\Malwarebytes
2013-11-24 13:02 - 2013-11-24 13:02 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-24 13:02 - 2013-11-24 13:02 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-11-24 12:59 - 2013-11-24 12:59 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\****\Desktop\mbam-setup-1.75.0.1300.exe
2013-11-24 12:59 - 2013-11-24 12:59 - 01091882 _____ C:\Users\****\Desktop\adwcleaner.exe
2013-11-23 11:05 - 2013-11-23 11:05 - 00000000 ____D C:\Users\****\AppData\Local\Macromedia
2013-11-23 10:59 - 2013-11-23 10:59 - 00046940 _____ C:\Users\****\Desktop\ComboFix.txt
2013-11-23 10:58 - 2013-11-23 10:58 - 00046940 _____ C:\ComboFix.txt
2013-11-23 10:58 - 2013-11-23 09:51 - 00000000 ____D C:\Qoobox
2013-11-23 10:57 - 2013-11-23 09:51 - 00000000 ____D C:\Windows\erdnt
2013-11-23 10:57 - 2012-12-23 22:49 - 00000000 ___RD C:\Users\****_\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-11-23 10:57 - 2012-12-19 02:26 - 00000000 ___RD C:\Users\****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-11-23 10:54 - 2009-07-14 03:34 - 00000215 _____ C:\Windows\system.ini
2013-11-23 10:01 - 2009-07-14 03:34 - 68681728 _____ C:\Windows\system32\config\SOFTWARE.bak
2013-11-23 10:01 - 2009-07-14 03:34 - 18874368 _____ C:\Windows\system32\config\SYSTEM.bak
2013-11-23 10:01 - 2009-07-14 03:34 - 00786432 _____ C:\Windows\system32\config\DEFAULT.bak
2013-11-23 10:01 - 2009-07-14 03:34 - 00262144 _____ C:\Windows\system32\config\SECURITY.bak
2013-11-23 10:01 - 2009-07-14 03:34 - 00262144 _____ C:\Windows\system32\config\SAM.bak
2013-11-23 09:49 - 2013-11-23 09:49 - 05147802 ____R (Swearware) C:\Users\****_\Desktop\ComboFix.exe
2013-11-22 19:07 - 2013-11-22 19:07 - 00004700 _____ C:\Users\****_\Desktop\Ereignisse_Avira.txt
2013-11-22 19:04 - 2013-11-22 19:04 - 00262144 _____ C:\Windows\Minidump\112213-20342-01.dmp
2013-11-22 19:04 - 2012-12-19 16:46 - 550031169 _____ C:\Windows\MEMORY.DMP
2013-11-22 19:04 - 2012-12-19 16:46 - 00000000 ____D C:\Windows\Minidump
2013-11-22 19:02 - 2013-11-22 19:02 - 00002827 _____ C:\Users\****_\Desktop\GMER.txt
2013-11-22 18:50 - 2013-11-22 18:49 - 00022616 _____ C:\Users\****_\Desktop\Addition.txt
2013-11-22 18:50 - 2013-11-22 18:48 - 00031577 _____ C:\Users\****_\Desktop\FRST.txt
2013-11-22 18:47 - 2013-11-22 18:47 - 00000000 ____D C:\FRST
2013-11-22 18:44 - 2013-11-22 18:44 - 00000472 _____ C:\Users\****_\Desktop\defogger_disable.log
2013-11-22 18:44 - 2013-11-22 18:44 - 00000000 _____ C:\Users\****\defogger_reenable
2013-11-22 18:44 - 2012-12-19 02:21 - 00000000 ____D C:\Users\****
2013-11-22 18:40 - 2013-11-22 18:40 - 00000000 ____D C:\Users\****_\Desktop\Neuer Ordner
2013-11-22 18:33 - 2013-11-22 18:33 - 105757824 _____ C:\Windows\SysWOW64\脫쫪b
2013-11-16 13:35 - 2013-11-16 13:35 - 00377856 _____ C:\Users\****_\Desktop\gmer_2.1.19163.exe
2013-11-16 13:34 - 2013-11-16 13:34 - 00050477 _____ C:\Users\****_\Desktop\Defogger.exe
2013-11-16 12:33 - 2013-07-18 18:35 - 00000000 ____D C:\Users\****\AppData\Local\Adobe
2013-11-16 12:31 - 2012-12-24 13:14 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-11-16 12:31 - 2011-11-08 13:22 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-11-15 23:21 - 2013-08-18 12:06 - 00000000 ____D C:\Windows\system32\MRT
2013-11-15 23:19 - 2012-12-30 13:43 - 82896128 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-11-03 12:12 - 2013-02-25 20:18 - 00000000 ____D C:\Users\****_\Desktop\Kontakte
2013-10-27 11:03 - 2013-10-27 11:03 - 00000000 ____D C:\Users\****_\Neuer Ordner
2013-10-27 11:03 - 2013-10-27 10:20 - 00000000 ____D C:\Users\****_\Desktop\Musik Backup 2013-10-27
2013-10-27 11:03 - 2012-12-23 22:49 - 00000000 ____D C:\Users\****_
2013-10-27 11:00 - 2013-10-27 11:00 - 00001177 _____ C:\Users\****_\Desktop\Free M4a to MP3 Converter.lnk
2013-10-27 10:59 - 2013-10-27 10:59 - 00001159 _____ C:\Users\****\Desktop\Free M4a to MP3 Converter.lnk
2013-10-27 10:59 - 2013-10-27 10:59 - 00001154 _____ C:\Users\****\Desktop\My Music Tools.lnk
2013-10-27 10:59 - 2013-10-27 10:59 - 00000000 ____D C:\Program Files (x86)\Free M4a to MP3 Converter
2013-10-27 10:55 - 2013-10-27 10:55 - 05834488 _____ (ManiacTools.com ) C:\Users\****_\Downloads\m4a-to80-mp3-converter.exe
2013-10-27 10:52 - 2013-10-27 10:51 - 00000000 ____D C:\Output
2013-10-27 10:49 - 2013-10-27 10:49 - 03624560 _____ (hxxp://www.MP4ToMP3Converter.net ) C:\Users\****_\Downloads\mp4tomp3-304.exe
2013-10-27 10:48 - 2013-10-27 10:48 - 00000000 ____D C:\Users\****_\AppData\Roaming\Mp3tag
2013-10-27 10:11 - 2013-02-25 20:42 - 00000000 ____D C:\Users\****_\AppData\Roaming\WindSolutions
2013-10-27 10:11 - 2012-12-30 14:02 - 00000000 ____D C:\ProgramData\WindSolutions
2013-10-27 09:48 - 2013-10-27 09:48 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_netaapl64_01009.Wdf
2013-10-27 09:39 - 2013-10-27 09:38 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-10-27 09:39 - 2013-10-27 09:38 - 00000000 ____D C:\Program Files\iTunes
2013-10-27 09:39 - 2013-02-26 18:35 - 00001787 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-10-27 09:39 - 2013-02-25 21:12 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-10-27 09:38 - 2013-10-27 09:38 - 00000000 ____D C:\Program Files\iPod
2013-10-25 20:38 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
Some content of TEMP:
====================
C:\Users\****\AppData\Local\temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-11-02 13:13
==================== End Of Log ============================
--- --- --- --- --- --- --- --- --- Viele Grüße und einen schönen Sonntag !! die Janoschi |
|
25.11.2013, 08:05
| #6 |
| /// the machine /// TB-Ausbilder | eGdpSvc.exe/ Maleware, Adware in C:\ProgramData\eSafe gefundenESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ --> eGdpSvc.exe/ Maleware, Adware in C:\ProgramData\eSafe gefunden |
|
25.11.2013, 23:09
| #7 |
| | eGdpSvc.exe/ Maleware, Adware in C:\ProgramData\eSafe gefunden Hi Schrauber, das mache ich heute abend - ich bin den Tag über arbeiten. Was ich so schon sagen kann ist, dass die grün unterstrichene Schrift auf den ersten Blick weg ist, keine Werbefenster mehr aufgehen und im Browser "DOSearch" nicht mehr auftaucht.  Also - die nächsten Schritte folgen heute abend. Viele Grüße Janoschi Nachtrag: So, hier die Logfiles: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=be50efd6f6a1844385cf00edffd64278
# engine=16021
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-11-25 09:40:36
# local_time=2013-11-25 10:40:36 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 96 9068 23097978 1836 0
# compatibility_mode=5893 16776574 100 94 11243712 137045486 0 0
# scanned=196114
# found=0
# cleaned=0
# scan_time=5281
Code:
ATTFilter Results of screen317's Security Check version 0.99.76 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 10 ``````````````Antivirus/Firewall Check:`````````````` Avira Desktop Antivirus up to date! (On Access scanning disabled!) `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware Version 1.75.0.1300 Adobe Flash Player 11.9.900.152 Adobe Reader XI Mozilla Firefox 17.0.1 Firefox out of Date! ````````Process Check: objlist.exe by Laurent```````` Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbamgui.exe Avira Antivir avgnt.exe Avira Antivir avguard.exe Malwarebytes' Anti-Malware mbamscheduler.exe Symantec Norton Online Backup NOBuAgent.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-11-2013 01
Ran by **** (administrator) on ****-PC on 25-11-2013 23:08:06
Running from C:\Users\****\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Egis Technology Inc. ) C:\Program Files\Common Files\EgisTec\Services\EgisTicketService.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer VCM\AcerVCM.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe
(Egis Technology Inc. ) C:\Program Files\Acer ProShield\EgisTSR.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
(Mozilla Corporation) C:\****\Freeware\Firefox\firefox.exe
(InterVideo) C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [IntelTBRunOnce] - C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs [4526 2010-10-08] ()
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2697512 2011-02-17] (Synaptics Incorporated)
HKLM\...\Run: [ProShieldTSR] - C:\Program Files\Acer ProShield\EgisTSR.exe [165936 2011-06-04] (Egis Technology Inc. )
HKLM\...\Run: [Power Management] - C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [1831528 2011-05-10] (Acer Incorporated)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM-x32\...\Run: [Norton Online Backup] - C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-02] (Symantec Corporation)
HKLM-x32\...\Run: [BackupManagerTray] - C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe [297280 2011-04-24] (NTI Corporation)
HKLM-x32\...\Run: [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe [1110096 2011-07-01] (Dritek System Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [NBAgent] - C:\Program Files (x86)\Nero\Nero 11\Nero BackItUp\NBAgent.exe [1485096 2011-07-15] (Nero AG)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-05] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-10-23] (Apple Inc.)
HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [162408 2011-09-13] ()
HKU\UpdatusUser\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [162408 2011-09-13] ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
URLSearchHook: HKCU - UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll No File
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
SearchScopes: HKCU - DefaultScope {A1380F1F-C6B6-43F7-8F42-3BFCF1C1E9DE} URL = hxxp://search.zonealarm.com/search?Source=Browser&oemCode=ZLN116033868135274-1001&toolbarId=base&affiliateId=1001 tlbrid=ZoneAlarmSecurity&Lan=de&utid=62267e3900000000000008edb9137aa2&q={searchTerms}&r=466
SearchScopes: HKCU - {A1380F1F-C6B6-43F7-8F42-3BFCF1C1E9DE} URL = hxxp://search.zonealarm.com/search?Source=Browser&oemCode=ZLN116033868135274-1001&toolbarId=base&affiliateId=1001 tlbrid=ZoneAlarmSecurity&Lan=de&utid=62267e3900000000000008edb9137aa2&q={searchTerms}&r=466
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: EgisPBIE Sign-in Helper - {7B51CCBE-4AF9-44A6-BDAB-D7F7E4C4E6F9} - C:\Program Files\Acer ProShield\x86\EgisPBIE.dll (Egis Technology Inc.)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ij6ozv7g.default
FF SearchEngineOrder.1: Ask.com
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_152.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_152.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @Nero.com/KM - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [{41ecbc0b-34d5-4cd4-935f-253a30e2cb7e}] - C:\Program Files\Acer ProShield\FFExt
FF Extension: Online Accounts Extension - C:\Program Files\Acer ProShield\FFExt
FF HKLM-x32\...\Firefox\Extensions: [{d4da7309-b89a-45ec-8ebb-cfb2ae13618b}] - C:\Program Files\Acer ProShield\FFExt20
FF Extension: Online Accounts Extension - C:\Program Files\Acer ProShield\FFExt20
FF HKLM-x32\...\Firefox\Extensions: [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}] - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 EgisTec Ticket Service; C:\Program Files\Common Files\EgisTec\Services\EgisTicketService.exe [212016 2011-06-04] (Egis Technology Inc. )
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-02] (Symantec Corporation)
R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [256832 2011-04-24] (NTI Corporation)
R2 RS_Service; C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe [260640 2010-01-30] (Acer Incorporated)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-05] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-09-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-03-29] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 s217bus; C:\Windows\System32\DRIVERS\s217bus.sys [108072 2007-11-02] (MCCI Corporation)
S3 s217mdfl; C:\Windows\System32\DRIVERS\s217mdfl.sys [19496 2007-11-02] (MCCI Corporation)
S3 s217mdm; C:\Windows\System32\DRIVERS\s217mdm.sys [145448 2007-11-02] (MCCI Corporation)
S3 s217nd5; C:\Windows\System32\DRIVERS\s217nd5.sys [33832 2007-11-02] (MCCI Corporation)
S3 s217obex; C:\Windows\System32\DRIVERS\s217obex.sys [124968 2007-11-02] (MCCI Corporation)
S3 s217unic; C:\Windows\System32\DRIVERS\s217unic.sys [138792 2007-11-02] (MCCI)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S4 nvkflt; system32\DRIVERS\nvkflt.sys [x]
S4 nvlddmkm; system32\DRIVERS\nvlddmkm.sys [x]
S4 nvpciflt; \SystemRoot\system32\DRIVERS\nvpciflt.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-11-25 23:07 - 2013-11-25 23:07 - 01958474 _____ (Farbar) C:\Users\****\Desktop\FRST64.exe
2013-11-25 23:05 - 2013-11-25 23:05 - 00001023 _____ C:\Users\****\Desktop\checkup.txt
2013-11-25 23:01 - 2013-11-25 23:01 - 00891184 _____ C:\Users\****\Desktop\SecurityCheck.exe
2013-11-25 21:09 - 2013-11-25 21:09 - 106156080 _____ C:\Windows\SysWOW64\➷䢳
2013-11-25 21:05 - 2013-11-25 21:06 - 02347384 _____ (ESET) C:\Users\****\Desktop\esetsmartinstaller_enu.exe
2013-11-24 13:42 - 2013-11-25 23:08 - 00012776 _____ C:\Users\****\Desktop\FRST.txt
2013-11-24 13:38 - 2013-11-24 13:38 - 00000902 _____ C:\Users\****\Desktop\JRT.txt
2013-11-24 13:33 - 2013-11-24 13:33 - 00000000 ____D C:\Windows\ERUNT
2013-11-24 13:32 - 2013-11-24 13:32 - 01034531 _____ (Thisisu) C:\Users\****\Desktop\JRT.exe
2013-11-24 13:29 - 2013-11-24 13:29 - 00010582 _____ C:\Users\****\Desktop\AdwCleaner[S0].txt
2013-11-24 13:24 - 2013-11-24 13:27 - 00000000 ____D C:\AdwCleaner
2013-11-24 13:02 - 2013-11-24 13:02 - 00001117 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-11-24 13:02 - 2013-11-24 13:02 - 00000000 ____D C:\Users\****\AppData\Roaming\Malwarebytes
2013-11-24 13:02 - 2013-11-24 13:02 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-24 13:02 - 2013-11-24 13:02 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-11-24 13:02 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-11-24 12:59 - 2013-11-24 12:59 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\****\Desktop\mbam-setup-1.75.0.1300.exe
2013-11-24 12:59 - 2013-11-24 12:59 - 01091882 _____ C:\Users\****\Desktop\adwcleaner.exe
2013-11-23 11:05 - 2013-11-23 11:05 - 00000000 ____D C:\Users\****\AppData\Local\Macromedia
2013-11-23 10:59 - 2013-11-23 10:59 - 00046940 _____ C:\Users\****\Desktop\ComboFix.txt
2013-11-23 10:58 - 2013-11-23 10:58 - 00046940 _____ C:\ComboFix.txt
2013-11-23 09:51 - 2013-11-23 10:58 - 00000000 ____D C:\Qoobox
2013-11-23 09:51 - 2013-11-23 10:57 - 00000000 ____D C:\Windows\erdnt
2013-11-23 09:51 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2013-11-23 09:51 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2013-11-23 09:51 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-11-23 09:51 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-11-23 09:51 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-11-23 09:51 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2013-11-23 09:51 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2013-11-23 09:51 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2013-11-23 09:49 - 2013-11-23 09:49 - 05147802 ____R (Swearware) C:\Users\****_\Desktop\ComboFix.exe
2013-11-22 19:07 - 2013-11-22 19:07 - 00004700 _____ C:\Users\****_\Desktop\Ereignisse_Avira.txt
2013-11-22 19:04 - 2013-11-22 19:04 - 00262144 _____ C:\Windows\Minidump\112213-20342-01.dmp
2013-11-22 19:02 - 2013-11-22 19:02 - 00002827 _____ C:\Users\****_\Desktop\GMER.txt
2013-11-22 18:49 - 2013-11-22 18:50 - 00022616 _____ C:\Users\****_\Desktop\Addition.txt
2013-11-22 18:48 - 2013-11-22 18:50 - 00031577 _____ C:\Users\****_\Desktop\FRST.txt
2013-11-22 18:47 - 2013-11-22 18:47 - 00000000 ____D C:\FRST
2013-11-22 18:44 - 2013-11-22 18:44 - 00000472 _____ C:\Users\****_\Desktop\defogger_disable.log
2013-11-22 18:44 - 2013-11-22 18:44 - 00000000 _____ C:\Users\****\defogger_reenable
2013-11-22 18:40 - 2013-11-22 18:40 - 00000000 ____D C:\Users\****_\Desktop\Neuer Ordner
2013-11-22 18:33 - 2013-11-22 18:33 - 105757824 _____ C:\Windows\SysWOW64\脫쫪b
2013-11-16 13:35 - 2013-11-16 13:35 - 00377856 _____ C:\Users\****_\Desktop\gmer_2.1.19163.exe
2013-11-16 13:34 - 2013-11-16 13:34 - 00050477 _____ C:\Users\****_\Desktop\Defogger.exe
2013-11-15 23:22 - 2013-10-12 09:45 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-15 23:22 - 2013-10-12 09:45 - 01364992 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-15 23:22 - 2013-10-12 09:45 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-15 23:22 - 2013-10-12 09:43 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-15 23:22 - 2013-10-12 09:43 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-15 23:22 - 2013-10-12 09:43 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-15 23:22 - 2013-10-12 09:43 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-15 23:22 - 2013-10-12 09:43 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-15 23:22 - 2013-10-12 09:43 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-15 23:22 - 2013-10-12 09:43 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-15 23:22 - 2013-10-12 09:43 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-15 23:22 - 2013-10-12 09:43 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-15 23:22 - 2013-10-12 08:03 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-15 23:22 - 2013-10-12 08:03 - 01138176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-11-15 23:22 - 2013-10-12 08:02 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-15 23:22 - 2013-10-12 08:02 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-15 23:22 - 2013-10-12 08:02 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-15 23:22 - 2013-10-12 08:02 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-11-15 23:22 - 2013-10-12 08:02 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-11-15 23:22 - 2013-10-12 08:02 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-11-15 23:22 - 2013-10-12 08:02 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-11-15 23:22 - 2013-10-12 08:02 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-11-15 23:22 - 2013-10-12 08:02 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-11-15 23:22 - 2013-10-12 08:02 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-11-15 23:22 - 2013-10-12 07:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-15 23:22 - 2013-10-12 07:08 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-11-15 23:22 - 2013-10-12 06:44 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-15 23:22 - 2013-10-12 06:15 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-11-15 23:21 - 2013-10-12 09:43 - 19269632 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-15 23:21 - 2013-10-12 09:43 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-15 23:21 - 2013-10-12 08:02 - 14355968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-15 20:21 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2013-11-15 20:21 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2013-11-15 20:21 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2013-11-15 20:21 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2013-11-15 20:21 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2013-11-15 20:21 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-11-15 20:21 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-11-15 20:21 - 2013-10-04 03:28 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll
2013-11-15 20:21 - 2013-10-04 03:25 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll
2013-11-15 20:21 - 2013-10-04 03:24 - 01930752 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2013-11-15 20:21 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SmartcardCredentialProvider.dll
2013-11-15 20:21 - 2013-10-04 02:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2013-11-15 20:21 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credui.dll
2013-11-15 20:21 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2013-11-15 20:21 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2013-11-15 20:21 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-11-15 20:21 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-11-15 20:21 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2013-11-15 20:21 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2013-11-15 20:21 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2013-11-15 20:21 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2013-11-15 20:21 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-11-15 20:21 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-11-15 20:21 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2013-11-15 20:21 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2013-11-15 20:21 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-11-15 20:21 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2013-11-15 20:21 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2013-11-15 20:21 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2013-11-15 20:21 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-10-27 11:03 - 2013-10-27 11:03 - 00000000 ____D C:\Users\****_\Neuer Ordner
2013-10-27 11:00 - 2013-10-27 11:00 - 00001177 _____ C:\Users\****_\Desktop\Free M4a to MP3 Converter.lnk
2013-10-27 10:59 - 2013-10-27 10:59 - 00001159 _____ C:\Users\****\Desktop\Free M4a to MP3 Converter.lnk
2013-10-27 10:59 - 2013-10-27 10:59 - 00001154 _____ C:\Users\****\Desktop\My Music Tools.lnk
2013-10-27 10:59 - 2013-10-27 10:59 - 00000000 ____D C:\Program Files (x86)\Free M4a to MP3 Converter
2013-10-27 10:55 - 2013-10-27 10:55 - 05834488 _____ (ManiacTools.com ) C:\Users\****_\Downloads\m4a-to80-mp3-converter.exe
2013-10-27 10:51 - 2013-10-27 10:52 - 00000000 ____D C:\Output
2013-10-27 10:49 - 2013-10-27 10:49 - 03624560 _____ (hxxp://www.MP4ToMP3Converter.net ) C:\Users\****_\Downloads\mp4tomp3-304.exe
2013-10-27 10:48 - 2013-10-27 10:48 - 00000000 ____D C:\Users\****_\AppData\Roaming\Mp3tag
2013-10-27 10:20 - 2013-10-27 11:03 - 00000000 ____D C:\Users\****_\Desktop\Musik Backup 2013-10-27
2013-10-27 09:48 - 2013-10-27 09:48 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_netaapl64_01009.Wdf
2013-10-27 09:38 - 2013-10-27 09:39 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-10-27 09:38 - 2013-10-27 09:39 - 00000000 ____D C:\Program Files\iTunes
2013-10-27 09:38 - 2013-10-27 09:38 - 00000000 ____D C:\Program Files\iPod
==================== One Month Modified Files and Folders =======
2013-11-25 23:08 - 2013-11-24 13:42 - 00012776 _____ C:\Users\****\Desktop\FRST.txt
2013-11-25 23:07 - 2013-11-25 23:07 - 01958474 _____ (Farbar) C:\Users\****\Desktop\FRST64.exe
2013-11-25 23:05 - 2013-11-25 23:05 - 00001023 _____ C:\Users\****\Desktop\checkup.txt
2013-11-25 23:05 - 2012-12-24 13:14 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-25 23:01 - 2013-11-25 23:01 - 00891184 _____ C:\Users\****\Desktop\SecurityCheck.exe
2013-11-25 22:58 - 2012-12-19 02:24 - 00000598 _____ C:\Users\****\AppData\Roaming\AbsoluteReminder.xml
2013-11-25 22:57 - 2012-04-23 13:14 - 01319104 _____ C:\Windows\WindowsUpdate.log
2013-11-25 21:10 - 2009-07-14 05:45 - 00016752 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-25 21:10 - 2009-07-14 05:45 - 00016752 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-25 21:09 - 2013-11-25 21:09 - 106156080 _____ C:\Windows\SysWOW64\➷䢳
2013-11-25 21:08 - 2012-04-23 23:07 - 00696870 _____ C:\Windows\system32\perfh007.dat
2013-11-25 21:08 - 2012-04-23 23:07 - 00148134 _____ C:\Windows\system32\perfc007.dat
2013-11-25 21:08 - 2009-07-14 06:13 - 01612484 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-25 21:06 - 2013-11-25 21:05 - 02347384 _____ (ESET) C:\Users\****\Desktop\esetsmartinstaller_enu.exe
2013-11-25 21:02 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-25 21:02 - 2009-07-14 05:51 - 00066689 _____ C:\Windows\setupact.log
2013-11-24 13:38 - 2013-11-24 13:38 - 00000902 _____ C:\Users\****\Desktop\JRT.txt
2013-11-24 13:33 - 2013-11-24 13:33 - 00000000 ____D C:\Windows\ERUNT
2013-11-24 13:32 - 2013-11-24 13:32 - 01034531 _____ (Thisisu) C:\Users\****\Desktop\JRT.exe
2013-11-24 13:29 - 2013-11-24 13:29 - 00010582 _____ C:\Users\****\Desktop\AdwCleaner[S0].txt
2013-11-24 13:27 - 2013-11-24 13:24 - 00000000 ____D C:\AdwCleaner
2013-11-24 13:27 - 2012-12-19 16:44 - 00000000 ____D C:\Users\****\AppData\Roaming\CheckPoint
2013-11-24 13:27 - 2012-12-19 02:26 - 00001186 _____ C:\Users\****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-11-24 13:27 - 2012-12-19 02:26 - 00000999 _____ C:\Users\****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
2013-11-24 13:14 - 2010-11-21 04:47 - 00033856 _____ C:\Windows\PFRO.log
2013-11-24 13:02 - 2013-11-24 13:02 - 00001117 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-11-24 13:02 - 2013-11-24 13:02 - 00000000 ____D C:\Users\****\AppData\Roaming\Malwarebytes
2013-11-24 13:02 - 2013-11-24 13:02 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-24 13:02 - 2013-11-24 13:02 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-11-24 12:59 - 2013-11-24 12:59 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\****\Desktop\mbam-setup-1.75.0.1300.exe
2013-11-24 12:59 - 2013-11-24 12:59 - 01091882 _____ C:\Users\****\Desktop\adwcleaner.exe
2013-11-23 11:05 - 2013-11-23 11:05 - 00000000 ____D C:\Users\****\AppData\Local\Macromedia
2013-11-23 10:59 - 2013-11-23 10:59 - 00046940 _____ C:\Users\****\Desktop\ComboFix.txt
2013-11-23 10:58 - 2013-11-23 10:58 - 00046940 _____ C:\ComboFix.txt
2013-11-23 10:58 - 2013-11-23 09:51 - 00000000 ____D C:\Qoobox
2013-11-23 10:57 - 2013-11-23 09:51 - 00000000 ____D C:\Windows\erdnt
2013-11-23 10:57 - 2012-12-23 22:49 - 00000000 ___RD C:\Users\****_\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-11-23 10:57 - 2012-12-19 02:26 - 00000000 ___RD C:\Users\****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-11-23 10:54 - 2009-07-14 03:34 - 00000215 _____ C:\Windows\system.ini
2013-11-23 10:01 - 2009-07-14 03:34 - 68681728 _____ C:\Windows\system32\config\SOFTWARE.bak
2013-11-23 10:01 - 2009-07-14 03:34 - 18874368 _____ C:\Windows\system32\config\SYSTEM.bak
2013-11-23 10:01 - 2009-07-14 03:34 - 00786432 _____ C:\Windows\system32\config\DEFAULT.bak
2013-11-23 10:01 - 2009-07-14 03:34 - 00262144 _____ C:\Windows\system32\config\SECURITY.bak
2013-11-23 10:01 - 2009-07-14 03:34 - 00262144 _____ C:\Windows\system32\config\SAM.bak
2013-11-23 09:49 - 2013-11-23 09:49 - 05147802 ____R (Swearware) C:\Users\****_\Desktop\ComboFix.exe
2013-11-22 19:07 - 2013-11-22 19:07 - 00004700 _____ C:\Users\****_\Desktop\Ereignisse_Avira.txt
2013-11-22 19:04 - 2013-11-22 19:04 - 00262144 _____ C:\Windows\Minidump\112213-20342-01.dmp
2013-11-22 19:04 - 2012-12-19 16:46 - 550031169 _____ C:\Windows\MEMORY.DMP
2013-11-22 19:04 - 2012-12-19 16:46 - 00000000 ____D C:\Windows\Minidump
2013-11-22 19:02 - 2013-11-22 19:02 - 00002827 _____ C:\Users\****_\Desktop\GMER.txt
2013-11-22 18:50 - 2013-11-22 18:49 - 00022616 _____ C:\Users\****_\Desktop\Addition.txt
2013-11-22 18:50 - 2013-11-22 18:48 - 00031577 _____ C:\Users\****_\Desktop\FRST.txt
2013-11-22 18:47 - 2013-11-22 18:47 - 00000000 ____D C:\FRST
2013-11-22 18:44 - 2013-11-22 18:44 - 00000472 _____ C:\Users\****_\Desktop\defogger_disable.log
2013-11-22 18:44 - 2013-11-22 18:44 - 00000000 _____ C:\Users\****\defogger_reenable
2013-11-22 18:44 - 2012-12-19 02:21 - 00000000 ____D C:\Users\****
2013-11-22 18:40 - 2013-11-22 18:40 - 00000000 ____D C:\Users\****_\Desktop\Neuer Ordner
2013-11-22 18:33 - 2013-11-22 18:33 - 105757824 _____ C:\Windows\SysWOW64\脫쫪b
2013-11-16 13:35 - 2013-11-16 13:35 - 00377856 _____ C:\Users\****_\Desktop\gmer_2.1.19163.exe
2013-11-16 13:34 - 2013-11-16 13:34 - 00050477 _____ C:\Users\****_\Desktop\Defogger.exe
2013-11-16 12:33 - 2013-07-18 18:35 - 00000000 ____D C:\Users\****\AppData\Local\Adobe
2013-11-16 12:31 - 2012-12-24 13:14 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-11-16 12:31 - 2011-11-08 13:22 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-11-15 23:21 - 2013-08-18 12:06 - 00000000 ____D C:\Windows\system32\MRT
2013-11-15 23:19 - 2012-12-30 13:43 - 82896128 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-11-03 12:12 - 2013-02-25 20:18 - 00000000 ____D C:\Users\****_\Desktop\Kontakte
2013-10-27 11:03 - 2013-10-27 11:03 - 00000000 ____D C:\Users\****_\Neuer Ordner
2013-10-27 11:03 - 2013-10-27 10:20 - 00000000 ____D C:\Users\****_\Desktop\Musik Backup 2013-10-27
2013-10-27 11:03 - 2012-12-23 22:49 - 00000000 ____D C:\Users\****_
2013-10-27 11:00 - 2013-10-27 11:00 - 00001177 _____ C:\Users\****_\Desktop\Free M4a to MP3 Converter.lnk
2013-10-27 10:59 - 2013-10-27 10:59 - 00001159 _____ C:\Users\****\Desktop\Free M4a to MP3 Converter.lnk
2013-10-27 10:59 - 2013-10-27 10:59 - 00001154 _____ C:\Users\****\Desktop\My Music Tools.lnk
2013-10-27 10:59 - 2013-10-27 10:59 - 00000000 ____D C:\Program Files (x86)\Free M4a to MP3 Converter
2013-10-27 10:55 - 2013-10-27 10:55 - 05834488 _____ (ManiacTools.com ) C:\Users\****_\Downloads\m4a-to80-mp3-converter.exe
2013-10-27 10:52 - 2013-10-27 10:51 - 00000000 ____D C:\Output
2013-10-27 10:49 - 2013-10-27 10:49 - 03624560 _____ (hxxp://www.MP4ToMP3Converter.net ) C:\Users\****_\Downloads\mp4tomp3-304.exe
2013-10-27 10:48 - 2013-10-27 10:48 - 00000000 ____D C:\Users\****_\AppData\Roaming\Mp3tag
2013-10-27 10:11 - 2013-02-25 20:42 - 00000000 ____D C:\Users\****_\AppData\Roaming\WindSolutions
2013-10-27 10:11 - 2012-12-30 14:02 - 00000000 ____D C:\ProgramData\WindSolutions
2013-10-27 09:48 - 2013-10-27 09:48 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_netaapl64_01009.Wdf
2013-10-27 09:39 - 2013-10-27 09:38 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-10-27 09:39 - 2013-10-27 09:38 - 00000000 ____D C:\Program Files\iTunes
2013-10-27 09:39 - 2013-02-26 18:35 - 00001787 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-10-27 09:39 - 2013-02-25 21:12 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-10-27 09:38 - 2013-10-27 09:38 - 00000000 ____D C:\Program Files\iPod
Some content of TEMP:
====================
C:\Users\****\AppData\Local\temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-11-02 13:13
==================== End Of Log ============================
--- --- --- --- --- --- Viele Grüße Janoschi |
|
26.11.2013, 12:46
| #8 |
| /// the machine /// TB-Ausbilder | eGdpSvc.exe/ Maleware, Adware in C:\ProgramData\eSafe gefunden Firefox updaten. Fertig Die Reihenfolge ist hier entscheidend.
Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
28.11.2013, 20:42
| #9 |
| | eGdpSvc.exe/ Maleware, Adware in C:\ProgramData\eSafe gefunden Hallo Schrauber, ich hab alles erledigt, Programme gem. Anweisung entfernt und Firefox und Avira auf den neusten Stand gebracht. Die Updates werden von Windows automatisch gemacht, an der Einstellung hab ich nix ändern müssen  Somit bedanke ich mich recht herzlich für deine Hilfe und die ganzen Tipps !! Ich wünsche dir ein schönes Wochenende !! Vielen lieben Dank und viele Grüße Janoschi (PS: gespendet hab ich auch schon ...) |
|
29.11.2013, 15:39
| #10 |
| /// the machine /// TB-Ausbilder | eGdpSvc.exe/ Maleware, Adware in C:\ProgramData\eSafe gefunden Gern Geschehen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu eGdpSvc.exe/ Maleware, Adware in C:\ProgramData\eSafe gefunden |
| adware/elex.w, antivir, avira searchfree toolbar, bingbar, browser, device driver, entfernen, flash player, homepage, iexplore.exe, install.exe, launch, maleware, malware, nvpciflt.sys, pup.optional.a2zlyrics.a, pup.optional.crossrider.a, pup.optional.crossrider.m, pup.optional.dosearches, pup.optional.dosearches.a, pup.optional.qone8, pup.optional.wilsys.a, quelldatei, richtlinie, svchost.exe, symantec, tr/spy.1126912.2, werbung |
Linear-Darstellung
