Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung
GVU und Bundeskriminalamt Trojaner,PC fährt im abgesicherten modus sofort wieder runter

GVU und Bundeskriminalamt Trojaner,PC fährt im abgesicherten modus sofort wieder runter


Log-Analyse und Auswertung: GVU und Bundeskriminalamt Trojaner,PC fährt im abgesicherten modus sofort wieder runter

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML.

 
Vorheriger Beitrag Vorheriger Beitrag   Nächster Beitrag Nächster Beitrag
Alt 03.12.2013, 18:49   #1
zwiefeth
 
GVU und Bundeskriminalamt Trojaner,PC fährt im abgesicherten modus sofort wieder runter - Standard

GVU und Bundeskriminalamt Trojaner,PC fährt im abgesicherten modus sofort wieder runter


Hallo,
ich habe folgendes Problem: Mein Laptop lässt sich nicht mehr starten,wenn er hochfährt öffnen sich sofort 4-5 Fenster mit GVU UND Bundeskriminalamt, die abwechselnd in den vordergrund rücken. Ich habe keine Chance die Registry oder irgendein Programm auszuführen,ich kann gerade so über Strg+Alt+Entf runterfahren lassen..
Mein System: MS Windows 7 HP1 64-Bit
Benutzer: Admin
4GB Ram,Intel Core i3-370

Hab mal ein Scan-Durchlauf mit FRST64 gemacht,hier das ergebnis:

Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03-12-2013 01
Ran by SYSTEM on MININT-RMHETKF on 03-12-2013 18:32:05
Running from G:\
Windows 7 Home Premium (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10920552 2010-06-22] (Realtek Semiconductor)
HKLM\...\Run: [PLFSetI] - C:\Windows\PLFSetI.exe [206208 2010-06-09] ()
HKLM\...\Run: [Acer ePower Management] - C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe [861216 2010-06-11] (Acer Incorporated)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2967352 2012-11-06] (Synaptics Incorporated)
HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [1266912 2013-10-23] (Microsoft Corporation)
HKLM\...\Policies\Explorer\Run: [36930] - C:\ProgramData\msvzgjup.exe [341740 2009-10-08] ( ())
HKLM\...\Policies\Explorer: [TaskbarNoNotification] 1
HKLM\...\Policies\Explorer: [HideSCAHealth] 1
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-04-13] (Intel Corporation)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642728 2012-09-28] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Camera Assistant Software] - C:\Program Files (x86)\Video Web Camera\traybar.exe [600688 2010-07-06] (Chicony)
HKLM-x32\...\Run: [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe [968272 2010-06-21] (Dritek System Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-08-20] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-01] (Oracle Corporation)
HKU\Admin\...\Run: [Facebook Update] - C:\Users\Admin\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2013-09-24] (Facebook Inc.)
HKU\Admin\...\Run: [Google Update*] - [x] <===== ATTENTION (ZeroAccess rootkit hidden path)
HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Packard Bell\Screensaver\run_Packard Bell.exe [154144 2010-07-29] ()
HKU\Default User\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Packard Bell\Screensaver\run_Packard Bell.exe [154144 2010-07-29] ()
IFEO\bejeweled 2 deluxe-wt.exe: [Debugger] "E:\Zeugs\Sonstiges\TuneUpPortable\App\TuneUp\TUAutoReactivator64.exe"
IFEO\build-a-lot 2-wt.exe: [Debugger] "E:\Zeugs\Sonstiges\TuneUpPortable\App\TuneUp\TUAutoReactivator64.exe"
IFEO\chuzzle deluxe-wt.exe: [Debugger] "E:\Zeugs\Sonstiges\TuneUpPortable\App\TuneUp\TUAutoReactivator64.exe"
IFEO\deathonthenile-wt.exe: [Debugger] "E:\Zeugs\Sonstiges\TuneUpPortable\App\TuneUp\TUAutoReactivator64.exe"
IFEO\diner dash 2 restaurant rescue-wt.exe: [Debugger] "E:\Zeugs\Sonstiges\TuneUpPortable\App\TuneUp\TUAutoReactivator64.exe"
IFEO\drivegreen1-wt.exe: [Debugger] "E:\Zeugs\Sonstiges\TuneUpPortable\App\TuneUp\TUAutoReactivator64.exe"
IFEO\farm-wt.exe: [Debugger] "E:\Zeugs\Sonstiges\TuneUpPortable\App\TuneUp\TUAutoReactivator64.exe"
IFEO\fate-wt.exe: [Debugger] "E:\Zeugs\Sonstiges\TuneUpPortable\App\TuneUp\TUAutoReactivator64.exe"
IFEO\gameconsole-wt.exe: [Debugger] "E:\Zeugs\Sonstiges\TuneUpPortable\App\TuneUp\TUAutoReactivator64.exe"
IFEO\golf-wt.exe: [Debugger] "E:\Zeugs\Sonstiges\TuneUpPortable\App\TuneUp\TUAutoReactivator64.exe"
IFEO\insaniquarium-wt.exe: [Debugger] "E:\Zeugs\Sonstiges\TuneUpPortable\App\TuneUp\TUAutoReactivator64.exe"
IFEO\jqsolitaire2-wt.exe: [Debugger] "E:\Zeugs\Sonstiges\TuneUpPortable\App\TuneUp\TUAutoReactivator64.exe"
IFEO\nobuclient.exe: [Debugger] "E:\Zeugs\Sonstiges\TuneUpPortable\App\TuneUp\TUAutoReactivator64.exe"
IFEO\penguins-wt.exe: [Debugger] "E:\Zeugs\Sonstiges\TuneUpPortable\App\TuneUp\TUAutoReactivator64.exe"
IFEO\plants vs. zombies-wt.exe: [Debugger] "E:\Zeugs\Sonstiges\TuneUpPortable\App\TuneUp\TUAutoReactivator64.exe"
IFEO\polar-wt.exe: [Debugger] "E:\Zeugs\Sonstiges\TuneUpPortable\App\TuneUp\TUAutoReactivator64.exe"
IFEO\provider.exe: [Debugger] "E:\Zeugs\Sonstiges\TuneUpPortable\App\TuneUp\TUAutoReactivator64.exe"
IFEO\racing-wt.exe: [Debugger] "E:\Zeugs\Sonstiges\TuneUpPortable\App\TuneUp\TUAutoReactivator64.exe"
IFEO\virtual villagers - the tree of life-wt.exe: [Debugger] "E:\Zeugs\Sonstiges\TuneUpPortable\App\TuneUp\TUAutoReactivator64.exe"
IFEO\zuma deluxe-wt.exe: [Debugger] "E:\Zeugs\Sonstiges\TuneUpPortable\App\TuneUp\TUAutoReactivator64.exe"
IFEO\zumasrevenge-wt.exe: [Debugger] "E:\Zeugs\Sonstiges\TuneUpPortable\App\TuneUp\TUAutoReactivator64.exe"
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8z4bbah.lnk
ShortcutTarget: 8z4bbah.lnk -> C:\ProgramData\habb4z8.dss (Microsoft Corporation)
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a2rqdd.lnk
ShortcutTarget: a2rqdd.lnk -> C:\ProgramData\ddqr2a.dss (Microsoft Corporation)
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk ->  (No File)
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fwjwodh1.lnk
ShortcutTarget: fwjwodh1.lnk -> C:\ProgramData\1hdowjwf.dss (Microsoft Corporation)
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\h8rjfj3.lnk
ShortcutTarget: h8rjfj3.lnk -> C:\ProgramData\3jfjr8h.dss (Microsoft Corporation)
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iel3j64.lnk
ShortcutTarget: iel3j64.lnk -> C:\ProgramData\46j3lei.dss (Microsoft Corporation)
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jbeir2.lnk
ShortcutTarget: jbeir2.lnk -> C:\ProgramData\2riebj.dss (Microsoft Corporation)
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jwbnzj8rr.lnk
ShortcutTarget: jwbnzj8rr.lnk -> C:\ProgramData\rr8jznbwj.dss (Microsoft Corporation)
BootExecute: autocheck autochk * OODBS

==================== Services (Whitelisted) =================

S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-08-20] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-08-20] (Avira Operations GmbH & Co. KG)
S2 ePowerSvc; C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe [868896 2010-06-11] (Acer Incorporated)
S4 GameConsoleService; C:\Program Files (x86)\Packard Bell Games\Packard Bell Game Console\GameConsoleService.exe [246520 2010-04-03] (WildTangent, Inc.)
S4 GREGService; C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe [23584 2010-01-08] (Acer Incorporated)
S2 McAfee SiteAdvisor Service; C:\Program Files (x86)\McAfee\SiteAdvisor\mcsacore.exe [121616 2013-10-02] (McAfee, Inc.)
S2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2013-10-23] (Microsoft Corporation)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [348376 2013-10-23] (Microsoft Corporation)
S4 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-01] (Symantec Corporation)
S2 NTI IScheduleSvc; C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\IScheduleSvc.exe [255744 2010-06-28] (NewTech Infosystems, Inc.)
S2 OODefragAgent; C:\Program Files\OO Software\Defrag\oodag.exe [3060040 2010-08-30] (O&O Software GmbH)
S2 Updater Service; C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe [243232 2010-01-28] (Acer Group)
S2 Winmgmt; C:\ProgramData\a2rqdd.pss [61048 2013-12-02] (Microsoft Corporation)
S2 *etadpug; "C:\Program Files (x86)\Google\Desktop\Install\{6437db8a-3823-6502-deca-ff92c65659e7}\   \...\???\{6437db8a-3823-6502-deca-ff92c65659e7}\GoogleUpdate.exe" < <==== ATTENTION (ZeroAccess)

==================== Drivers (Whitelisted) ====================

S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-08] (Avira Operations GmbH & Co. KG)
S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-08-20] (Avira Operations GmbH & Co. KG)
S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-05-06] (Avira Operations GmbH & Co. KG)
S0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [248240 2013-09-27] (Microsoft Corporation)
S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [134944 2013-09-27] (Microsoft Corporation)
S0 sptd; C:\Windows\System32\Drivers\sptd.sys [564824 2012-11-21] (Duplex Secure Ltd.)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-12-03 17:28 - 2013-12-03 17:28 - 00000000 ____D C:\FRST
2013-12-03 17:03 - 2013-12-03 17:03 - 00000000 __SHD C:\$$PendingFiles
2013-12-02 07:16 - 2013-12-03 07:36 - 95025368 ____T C:\ProgramData\3rtfrrjb.bxx
2013-12-02 07:16 - 2013-12-02 07:16 - 00205312 _____ (Microsoft Corporation) C:\ProgramData\bjrrftr3.dss
2013-12-02 07:16 - 2013-12-02 07:16 - 00061048 ____T (Microsoft Corporation) C:\ProgramData\3rtfrrjb.pss
2013-12-02 07:16 - 2013-12-02 07:16 - 00000857 _____ C:\Windows\SysWOW64\3rtfrrjb.lnk
2013-12-02 07:16 - 2013-12-02 07:16 - 00000000 _____ C:\ProgramData\3rtfrrjb.fvv
2013-12-02 03:30 - 2013-12-03 09:13 - 95025368 ____T C:\ProgramData\iel3j64.bxx
2013-12-02 03:30 - 2013-12-03 09:13 - 00000000 _____ C:\ProgramData\iel3j64.fvv
2013-12-02 03:30 - 2013-12-02 03:30 - 00206336 _____ (Microsoft Corporation) C:\ProgramData\46j3lei.dss
2013-12-02 03:30 - 2013-12-02 03:30 - 00061048 ____T (Microsoft Corporation) C:\ProgramData\iel3j64.pss
2013-12-02 03:25 - 2013-12-03 09:13 - 95025368 ____T C:\ProgramData\h8rjfj3.bxx
2013-12-02 03:25 - 2013-12-03 09:13 - 00000000 _____ C:\ProgramData\h8rjfj3.fvv
2013-12-02 03:25 - 2013-12-02 03:25 - 00206336 _____ (Microsoft Corporation) C:\ProgramData\3jfjr8h.dss
2013-12-02 03:25 - 2013-12-02 03:25 - 00061048 ____T (Microsoft Corporation) C:\ProgramData\h8rjfj3.pss
2013-12-02 03:11 - 2013-12-03 09:13 - 00000000 _____ C:\ProgramData\fwjwodh1.fvv
2013-12-02 03:11 - 2013-12-02 03:11 - 00061048 ____T (Microsoft Corporation) C:\ProgramData\fwjwodh1.pss
2013-12-02 03:10 - 2013-12-03 09:14 - 95025368 ____T C:\ProgramData\fwjwodh1.bxx
2013-12-02 03:10 - 2013-12-02 03:10 - 00206848 _____ (Microsoft Corporation) C:\ProgramData\1hdowjwf.dss
2013-12-02 03:02 - 2013-12-02 03:09 - 00000859 _____ C:\Windows\SysWOW64\9j67trj6v.lnk
2013-12-02 03:02 - 2013-12-02 03:08 - 95025368 ____T C:\ProgramData\9j67trj6v.bxx
2013-12-02 03:02 - 2013-12-02 03:02 - 00206336 _____ (Microsoft Corporation) C:\ProgramData\v6jrt76j9.dss
2013-12-02 03:02 - 2013-12-02 03:02 - 00061048 ____T (Microsoft Corporation) C:\ProgramData\9j67trj6v.pss
2013-12-02 03:02 - 2013-12-02 03:02 - 00000000 _____ C:\ProgramData\9j67trj6v.fvv
2013-12-02 02:59 - 2013-12-03 09:14 - 95025368 ____T C:\ProgramData\jwbnzj8rr.bxx
2013-12-02 02:59 - 2013-12-03 09:13 - 00000000 _____ C:\ProgramData\jwbnzj8rr.fvv
2013-12-02 02:59 - 2013-12-02 02:59 - 00206336 _____ (Microsoft Corporation) C:\ProgramData\rr8jznbwj.dss
2013-12-02 02:59 - 2013-12-02 02:59 - 00061048 ____T (Microsoft Corporation) C:\ProgramData\jwbnzj8rr.pss
2013-12-02 02:47 - 2013-12-03 09:13 - 95025368 ____T C:\ProgramData\jbeir2.bxx
2013-12-02 02:47 - 2013-12-03 09:13 - 00000000 _____ C:\ProgramData\jbeir2.fvv
2013-12-02 02:47 - 2013-12-02 02:47 - 00207360 _____ (Microsoft Corporation) C:\ProgramData\2riebj.dss
2013-12-02 02:47 - 2013-12-02 02:47 - 00061048 ____T (Microsoft Corporation) C:\ProgramData\jbeir2.pss
2013-12-02 02:41 - 2013-12-02 02:41 - 00207360 _____ (Microsoft Corporation) C:\ProgramData\1agjreb.dss
2013-12-02 02:38 - 2013-12-03 09:13 - 95025368 ____T C:\ProgramData\8z4bbah.bxx
2013-12-02 02:38 - 2013-12-03 09:13 - 00000000 _____ C:\ProgramData\8z4bbah.fvv
2013-12-02 02:38 - 2013-12-02 02:38 - 00207360 _____ (Microsoft Corporation) C:\ProgramData\habb4z8.dss
2013-12-02 02:38 - 2013-12-02 02:38 - 00061048 ____T (Microsoft Corporation) C:\ProgramData\8z4bbah.pss
2013-12-02 02:32 - 2013-12-02 02:32 - 00000273 _____ C:\ProgramData\a2rqdd.reg
2013-12-02 02:31 - 2013-12-03 09:14 - 95025368 ____T C:\ProgramData\a2rqdd.bxx
2013-12-02 02:31 - 2013-12-03 09:13 - 00000000 _____ C:\ProgramData\a2rqdd.fvv
2013-12-02 02:31 - 2013-12-02 02:31 - 00207360 _____ (Microsoft Corporation) C:\ProgramData\ddqr2a.dss
2013-12-02 02:31 - 2013-12-02 02:31 - 00061048 ____T (Microsoft Corporation) C:\ProgramData\a2rqdd.pss
2013-11-28 11:35 - 2013-10-14 09:00 - 00028368 _____ (Microsoft Corporation) C:\Windows\System32\IEUDINIT.EXE
2013-11-28 11:22 - 2013-11-28 11:22 - 00940032 _____ (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2013-11-28 11:22 - 2013-11-28 11:22 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 23212032 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 17142784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 12995584 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 11220992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 05765120 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 04240384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 02764288 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-11-28 11:21 - 2013-11-28 11:21 - 02724864 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-11-28 11:21 - 2013-11-28 11:21 - 02332160 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 02166272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 01993728 _____ (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-11-28 11:21 - 2013-11-28 11:21 - 01926656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-11-28 11:21 - 2013-11-28 11:21 - 01818112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 01394176 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 01228800 _____ (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 01156608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00942592 _____ (Microsoft Corporation) C:\Windows\System32\jsIntl.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00817664 _____ (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00774144 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00708608 _____ (Microsoft Corporation) C:\Windows\System32\jscript9diag.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00626176 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-11-28 11:21 - 2013-11-28 11:21 - 00616104 _____ (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat
2013-11-28 11:21 - 2013-11-28 11:21 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00574976 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00548352 _____ (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00453120 _____ (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00413696 _____ (Microsoft Corporation) C:\Windows\System32\html.iec
2013-11-28 11:21 - 2013-11-28 11:21 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-11-28 11:21 - 2013-11-28 11:21 - 00296960 _____ (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00263376 _____ (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00247808 _____ (Microsoft Corporation) C:\Windows\System32\msls31.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00243200 _____ (Microsoft Corporation) C:\Windows\System32\webcheck.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00235520 _____ (Microsoft Corporation) C:\Windows\System32\url.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00235008 _____ (Microsoft Corporation) C:\Windows\System32\elshyph.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00218624 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-11-28 11:21 - 2013-11-28 11:21 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00195584 _____ (Microsoft Corporation) C:\Windows\System32\msrating.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00167424 _____ (Microsoft Corporation) C:\Windows\System32\iexpress.exe
2013-11-28 11:21 - 2013-11-28 11:21 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-11-28 11:21 - 2013-11-28 11:21 - 00147968 _____ (Microsoft Corporation) C:\Windows\System32\occache.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00143872 _____ (Microsoft Corporation) C:\Windows\System32\wextract.exe
2013-11-28 11:21 - 2013-11-28 11:21 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-11-28 11:21 - 2013-11-28 11:21 - 00139264 _____ (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-11-28 11:21 - 2013-11-28 11:21 - 00135680 _____ (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00131072 _____ (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-11-28 11:21 - 2013-11-28 11:21 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00111616 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollector.exe
2013-11-28 11:21 - 2013-11-28 11:21 - 00105984 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00101376 _____ (Microsoft Corporation) C:\Windows\System32\inseng.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00090112 _____ (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe
2013-11-28 11:21 - 2013-11-28 11:21 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00086016 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-11-28 11:21 - 2013-11-28 11:21 - 00084992 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00083968 _____ (Microsoft Corporation) C:\Windows\System32\MshtmlDac.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00081408 _____ (Microsoft Corporation) C:\Windows\System32\icardie.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00077312 _____ (Microsoft Corporation) C:\Windows\System32\tdc.ocx
2013-11-28 11:21 - 2013-11-28 11:21 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-11-28 11:21 - 2013-11-28 11:21 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-11-28 11:21 - 2013-11-28 11:21 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00066048 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-11-28 11:21 - 2013-11-28 11:21 - 00062464 _____ (Microsoft Corporation) C:\Windows\System32\pngfilt.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00053760 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00052224 _____ (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00048640 _____ (Microsoft Corporation) C:\Windows\System32\mshtmler.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00048640 _____ (Microsoft Corporation) C:\Windows\System32\ieetwproxystub.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00048128 _____ (Microsoft Corporation) C:\Windows\System32\imgutil.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00040448 _____ (Microsoft Corporation) C:\Windows\System32\JavaScriptCollectionAgent.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00033792 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00030208 _____ (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00013824 _____ (Microsoft Corporation) C:\Windows\System32\mshta.exe
2013-11-28 11:21 - 2013-11-28 11:21 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-11-28 11:21 - 2013-11-28 11:21 - 00013312 _____ (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2013-11-28 11:21 - 2013-11-28 11:21 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-11-28 11:21 - 2013-11-28 11:21 - 00004096 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollectorres.dll
2013-11-28 11:15 - 2013-11-28 11:35 - 00014535 _____ C:\Windows\IE11_main.log
2013-11-27 12:32 - 2013-11-27 12:33 - 00119610 _____ C:\Users\Admin\Desktop\Köln   Schiffstouren auf dem Rhein   Ausflugsfahrten   Panoramfahrt Kreuzfahrt   Tourismusinfos   Abfahrtszeiten  Ticketpreis   Fahrten   Routen   Übersicht   Adressen   Informationen.htm
2013-11-27 12:32 - 2013-11-27 12:33 - 00000000 ____D C:\Users\Admin\Desktop\Köln   Schiffstouren auf dem Rhein   Ausflugsfahrten   Panoramfahrt Kreuzfahrt   Tourismusinfos   Abfahrtszeiten  Ticketpreis   Fahrten   Routen   Übersicht   Adressen   Informationen-Dateien
2013-11-19 09:01 - 2013-11-19 09:02 - 00000000 ____D C:\Users\Admin\Desktop\Bild
2013-11-18 12:33 - 2013-11-18 12:33 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-14 11:00 - 2013-10-11 18:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\System32\nshwfp.dll
2013-11-14 11:00 - 2013-10-11 18:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\System32\IKEEXT.DLL
2013-11-14 11:00 - 2013-10-11 18:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\System32\FWPUCLNT.DLL
2013-11-14 11:00 - 2013-10-11 18:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2013-11-14 11:00 - 2013-10-11 18:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2013-11-14 11:00 - 2013-10-05 12:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-11-14 11:00 - 2013-10-05 11:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-11-14 11:00 - 2013-10-03 18:28 - 00190464 _____ (Microsoft Corporation) C:\Windows\System32\SmartcardCredentialProvider.dll
2013-11-14 11:00 - 2013-10-03 18:25 - 00197120 _____ (Microsoft Corporation) C:\Windows\System32\credui.dll
2013-11-14 11:00 - 2013-10-03 18:24 - 01930752 _____ (Microsoft Corporation) C:\Windows\System32\authui.dll
2013-11-14 11:00 - 2013-10-03 17:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SmartcardCredentialProvider.dll
2013-11-14 11:00 - 2013-10-03 17:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2013-11-14 11:00 - 2013-10-03 17:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credui.dll
2013-11-14 11:00 - 2013-10-02 18:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\System32\gdi32.dll
2013-11-14 11:00 - 2013-10-02 18:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2013-11-14 11:00 - 2013-09-27 17:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\afd.sys
2013-11-14 11:00 - 2013-09-24 18:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys
2013-11-14 11:00 - 2013-09-24 18:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys
2013-11-14 11:00 - 2013-09-24 18:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\System32\sspicli.dll
2013-11-14 11:00 - 2013-09-24 18:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\System32\sspisrv.dll
2013-11-14 11:00 - 2013-09-24 18:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\System32\secur32.dll
2013-11-14 11:00 - 2013-09-24 18:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\System32\schannel.dll
2013-11-14 11:00 - 2013-09-24 18:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\System32\lsasrv.dll
2013-11-14 11:00 - 2013-09-24 18:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\System32\ncrypt.dll
2013-11-14 11:00 - 2013-09-24 17:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2013-11-14 11:00 - 2013-09-24 17:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-11-14 11:00 - 2013-09-24 17:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2013-11-14 11:00 - 2013-09-24 17:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2013-11-14 11:00 - 2013-09-24 17:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\System32\lsass.exe
2013-11-14 11:00 - 2013-07-04 04:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\cng.sys

==================== One Month Modified Files and Folders =======

2013-12-03 17:28 - 2013-12-03 17:28 - 00000000 ____D C:\FRST
2013-12-03 17:03 - 2013-12-03 17:03 - 00000000 __SHD C:\$$PendingFiles
2013-12-03 09:14 - 2013-12-02 03:10 - 95025368 ____T C:\ProgramData\fwjwodh1.bxx
2013-12-03 09:14 - 2013-12-02 02:59 - 95025368 ____T C:\ProgramData\jwbnzj8rr.bxx
2013-12-03 09:14 - 2013-12-02 02:31 - 95025368 ____T C:\ProgramData\a2rqdd.bxx
2013-12-03 09:13 - 2013-12-02 03:30 - 95025368 ____T C:\ProgramData\iel3j64.bxx
2013-12-03 09:13 - 2013-12-02 03:30 - 00000000 _____ C:\ProgramData\iel3j64.fvv
2013-12-03 09:13 - 2013-12-02 03:25 - 95025368 ____T C:\ProgramData\h8rjfj3.bxx
2013-12-03 09:13 - 2013-12-02 03:25 - 00000000 _____ C:\ProgramData\h8rjfj3.fvv
2013-12-03 09:13 - 2013-12-02 03:11 - 00000000 _____ C:\ProgramData\fwjwodh1.fvv
2013-12-03 09:13 - 2013-12-02 02:59 - 00000000 _____ C:\ProgramData\jwbnzj8rr.fvv
2013-12-03 09:13 - 2013-12-02 02:47 - 95025368 ____T C:\ProgramData\jbeir2.bxx
2013-12-03 09:13 - 2013-12-02 02:47 - 00000000 _____ C:\ProgramData\jbeir2.fvv
2013-12-03 09:13 - 2013-12-02 02:38 - 95025368 ____T C:\ProgramData\8z4bbah.bxx
2013-12-03 09:13 - 2013-12-02 02:38 - 00000000 _____ C:\ProgramData\8z4bbah.fvv
2013-12-03 09:13 - 2013-12-02 02:31 - 00000000 _____ C:\ProgramData\a2rqdd.fvv
2013-12-03 09:13 - 2013-05-28 12:21 - 00000000 ___RD C:\Users\Admin\Dropbox
2013-12-03 09:13 - 2013-05-28 12:19 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Dropbox
2013-12-03 09:13 - 2013-05-06 09:08 - 00014589 _____ C:\Windows\setupact.log
2013-12-03 09:13 - 2011-08-14 05:45 - 00770704 _____ C:\Windows\System32\oodbs.lor
2013-12-03 09:13 - 2009-07-13 21:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-12-03 08:36 - 2009-07-13 21:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-12-03 08:22 - 2009-07-13 20:45 - 00009696 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-12-03 08:22 - 2009-07-13 20:45 - 00009696 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-12-03 07:36 - 2013-12-02 07:16 - 95025368 ____T C:\ProgramData\3rtfrrjb.bxx
2013-12-03 07:29 - 2010-10-15 13:49 - 01713457 _____ C:\Windows\WindowsUpdate.log
2013-12-03 07:25 - 2013-09-24 11:02 - 00000928 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1137888572-3402251499-3570389332-1000UA.job
2013-12-03 07:25 - 2012-06-18 09:46 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-12-02 13:28 - 2013-09-24 11:02 - 00000906 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1137888572-3402251499-3570389332-1000Core.job
2013-12-02 07:16 - 2013-12-02 07:16 - 00205312 _____ (Microsoft Corporation) C:\ProgramData\bjrrftr3.dss
2013-12-02 07:16 - 2013-12-02 07:16 - 00061048 ____T (Microsoft Corporation) C:\ProgramData\3rtfrrjb.pss
2013-12-02 07:16 - 2013-12-02 07:16 - 00000857 _____ C:\Windows\SysWOW64\3rtfrrjb.lnk
2013-12-02 07:16 - 2013-12-02 07:16 - 00000000 _____ C:\ProgramData\3rtfrrjb.fvv
2013-12-02 03:30 - 2013-12-02 03:30 - 00206336 _____ (Microsoft Corporation) C:\ProgramData\46j3lei.dss
2013-12-02 03:30 - 2013-12-02 03:30 - 00061048 ____T (Microsoft Corporation) C:\ProgramData\iel3j64.pss
2013-12-02 03:25 - 2013-12-02 03:25 - 00206336 _____ (Microsoft Corporation) C:\ProgramData\3jfjr8h.dss
2013-12-02 03:25 - 2013-12-02 03:25 - 00061048 ____T (Microsoft Corporation) C:\ProgramData\h8rjfj3.pss
2013-12-02 03:11 - 2013-12-02 03:11 - 00061048 ____T (Microsoft Corporation) C:\ProgramData\fwjwodh1.pss
2013-12-02 03:10 - 2013-12-02 03:10 - 00206848 _____ (Microsoft Corporation) C:\ProgramData\1hdowjwf.dss
2013-12-02 03:09 - 2013-12-02 03:02 - 00000859 _____ C:\Windows\SysWOW64\9j67trj6v.lnk
2013-12-02 03:08 - 2013-12-02 03:02 - 95025368 ____T C:\ProgramData\9j67trj6v.bxx
2013-12-02 03:02 - 2013-12-02 03:02 - 00206336 _____ (Microsoft Corporation) C:\ProgramData\v6jrt76j9.dss
2013-12-02 03:02 - 2013-12-02 03:02 - 00061048 ____T (Microsoft Corporation) C:\ProgramData\9j67trj6v.pss
2013-12-02 03:02 - 2013-12-02 03:02 - 00000000 _____ C:\ProgramData\9j67trj6v.fvv
2013-12-02 02:59 - 2013-12-02 02:59 - 00206336 _____ (Microsoft Corporation) C:\ProgramData\rr8jznbwj.dss
2013-12-02 02:59 - 2013-12-02 02:59 - 00061048 ____T (Microsoft Corporation) C:\ProgramData\jwbnzj8rr.pss
2013-12-02 02:51 - 2011-07-02 05:38 - 00000000 ____D C:\Users\Admin\AppData\Local\CrashDumps
2013-12-02 02:47 - 2013-12-02 02:47 - 00207360 _____ (Microsoft Corporation) C:\ProgramData\2riebj.dss
2013-12-02 02:47 - 2013-12-02 02:47 - 00061048 ____T (Microsoft Corporation) C:\ProgramData\jbeir2.pss
2013-12-02 02:41 - 2013-12-02 02:41 - 00207360 _____ (Microsoft Corporation) C:\ProgramData\1agjreb.dss
2013-12-02 02:38 - 2013-12-02 02:38 - 00207360 _____ (Microsoft Corporation) C:\ProgramData\habb4z8.dss
2013-12-02 02:38 - 2013-12-02 02:38 - 00061048 ____T (Microsoft Corporation) C:\ProgramData\8z4bbah.pss
2013-12-02 02:32 - 2013-12-02 02:32 - 00000273 _____ C:\ProgramData\a2rqdd.reg
2013-12-02 02:31 - 2013-12-02 02:31 - 00207360 _____ (Microsoft Corporation) C:\ProgramData\ddqr2a.dss
2013-12-02 02:31 - 2013-12-02 02:31 - 00061048 ____T (Microsoft Corporation) C:\ProgramData\a2rqdd.pss
2013-12-02 02:31 - 2011-07-01 14:16 - 00000000 ____D C:\Users\Admin\AppData\Local\Google
2013-12-02 02:31 - 2010-07-14 01:25 - 00000000 ____D C:\Program Files (x86)\Google
2013-11-28 11:51 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-11-28 11:35 - 2013-11-28 11:15 - 00014535 _____ C:\Windows\IE11_main.log
2013-11-28 11:22 - 2013-11-28 11:22 - 00940032 _____ (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2013-11-28 11:22 - 2013-11-28 11:22 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 23212032 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 17142784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 12995584 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 11220992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 05765120 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 04240384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 02764288 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-11-28 11:21 - 2013-11-28 11:21 - 02724864 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-11-28 11:21 - 2013-11-28 11:21 - 02332160 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 02166272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 01993728 _____ (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-11-28 11:21 - 2013-11-28 11:21 - 01926656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-11-28 11:21 - 2013-11-28 11:21 - 01818112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 01394176 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 01228800 _____ (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 01156608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00942592 _____ (Microsoft Corporation) C:\Windows\System32\jsIntl.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00817664 _____ (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00774144 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00708608 _____ (Microsoft Corporation) C:\Windows\System32\jscript9diag.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00626176 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-11-28 11:21 - 2013-11-28 11:21 - 00616104 _____ (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat
2013-11-28 11:21 - 2013-11-28 11:21 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00574976 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00548352 _____ (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00453120 _____ (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00413696 _____ (Microsoft Corporation) C:\Windows\System32\html.iec
2013-11-28 11:21 - 2013-11-28 11:21 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-11-28 11:21 - 2013-11-28 11:21 - 00296960 _____ (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00263376 _____ (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00247808 _____ (Microsoft Corporation) C:\Windows\System32\msls31.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00243200 _____ (Microsoft Corporation) C:\Windows\System32\webcheck.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00235520 _____ (Microsoft Corporation) C:\Windows\System32\url.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00235008 _____ (Microsoft Corporation) C:\Windows\System32\elshyph.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00218624 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-11-28 11:21 - 2013-11-28 11:21 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00195584 _____ (Microsoft Corporation) C:\Windows\System32\msrating.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00167424 _____ (Microsoft Corporation) C:\Windows\System32\iexpress.exe
2013-11-28 11:21 - 2013-11-28 11:21 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-11-28 11:21 - 2013-11-28 11:21 - 00147968 _____ (Microsoft Corporation) C:\Windows\System32\occache.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00143872 _____ (Microsoft Corporation) C:\Windows\System32\wextract.exe
2013-11-28 11:21 - 2013-11-28 11:21 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-11-28 11:21 - 2013-11-28 11:21 - 00139264 _____ (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-11-28 11:21 - 2013-11-28 11:21 - 00135680 _____ (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00131072 _____ (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-11-28 11:21 - 2013-11-28 11:21 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00111616 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollector.exe
2013-11-28 11:21 - 2013-11-28 11:21 - 00105984 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00101376 _____ (Microsoft Corporation) C:\Windows\System32\inseng.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00090112 _____ (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe
2013-11-28 11:21 - 2013-11-28 11:21 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00086016 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-11-28 11:21 - 2013-11-28 11:21 - 00084992 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00083968 _____ (Microsoft Corporation) C:\Windows\System32\MshtmlDac.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00081408 _____ (Microsoft Corporation) C:\Windows\System32\icardie.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00077312 _____ (Microsoft Corporation) C:\Windows\System32\tdc.ocx
2013-11-28 11:21 - 2013-11-28 11:21 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-11-28 11:21 - 2013-11-28 11:21 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-11-28 11:21 - 2013-11-28 11:21 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00066048 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-11-28 11:21 - 2013-11-28 11:21 - 00062464 _____ (Microsoft Corporation) C:\Windows\System32\pngfilt.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00053760 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00052224 _____ (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00048640 _____ (Microsoft Corporation) C:\Windows\System32\mshtmler.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00048640 _____ (Microsoft Corporation) C:\Windows\System32\ieetwproxystub.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00048128 _____ (Microsoft Corporation) C:\Windows\System32\imgutil.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00040448 _____ (Microsoft Corporation) C:\Windows\System32\JavaScriptCollectionAgent.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00033792 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00030208 _____ (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-11-28 11:21 - 2013-11-28 11:21 - 00013824 _____ (Microsoft Corporation) C:\Windows\System32\mshta.exe
2013-11-28 11:21 - 2013-11-28 11:21 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-11-28 11:21 - 2013-11-28 11:21 - 00013312 _____ (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2013-11-28 11:21 - 2013-11-28 11:21 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-11-28 11:21 - 2013-11-28 11:21 - 00004096 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollectorres.dll
2013-11-27 12:33 - 2013-11-27 12:32 - 00119610 _____ C:\Users\Admin\Desktop\Köln   Schiffstouren auf dem Rhein   Ausflugsfahrten   Panoramfahrt Kreuzfahrt   Tourismusinfos   Abfahrtszeiten  Ticketpreis   Fahrten   Routen   Übersicht   Adressen   Informationen.htm
2013-11-27 12:33 - 2013-11-27 12:32 - 00000000 ____D C:\Users\Admin\Desktop\Köln   Schiffstouren auf dem Rhein   Ausflugsfahrten   Panoramfahrt Kreuzfahrt   Tourismusinfos   Abfahrtszeiten  Ticketpreis   Fahrten   Routen   Übersicht   Adressen   Informationen-Dateien
2013-11-24 02:55 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\rescache
2013-11-19 20:45 - 2012-05-21 07:34 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-11-19 11:26 - 2010-10-15 23:40 - 00697082 _____ C:\Windows\System32\perfh007.dat
2013-11-19 11:26 - 2010-10-15 23:40 - 00148346 _____ C:\Windows\System32\perfc007.dat
2013-11-19 11:26 - 2009-07-13 21:13 - 01613340 _____ C:\Windows\System32\PerfStringBackup.INI
2013-11-19 11:01 - 2011-12-08 13:35 - 00001912 _____ C:\Windows\epplauncher.mif
2013-11-19 11:01 - 2011-12-08 13:35 - 00000000 ____D C:\Program Files\Microsoft Security Client
2013-11-19 11:01 - 2011-12-08 13:35 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2013-11-19 09:02 - 2013-11-19 09:01 - 00000000 ____D C:\Users\Admin\Desktop\Bild
2013-11-19 02:21 - 2011-07-01 08:44 - 00267936 ____N (Microsoft Corporation) C:\Windows\System32\MpSigStub.exe
2013-11-18 12:33 - 2013-11-18 12:33 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-14 11:04 - 2011-07-01 08:41 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-11-14 11:03 - 2013-08-20 04:09 - 00000000 ____D C:\Windows\System32\MRT
2013-11-14 11:01 - 2011-07-01 09:37 - 82896128 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
ZeroAccess:
C:\Users\Admin\AppData\Local\Google\Desktop\Install
ZeroAccess:
C:\Program Files (x86)\Google\Desktop\Install

ZeroAccess:
C:\Windows\assembly\GAC_32\Desktop.ini

ZeroAccess:
C:\Windows\assembly\GAC_64\Desktop.ini

Files to move or delete:
====================
C:\ProgramData\1agjreb.dss
C:\ProgramData\1hdowjwf.dss
C:\ProgramData\2riebj.dss
C:\ProgramData\3jfjr8h.dss
C:\ProgramData\3rtfrrjb.bxx
C:\ProgramData\3rtfrrjb.fvv
C:\ProgramData\3rtfrrjb.pss
C:\ProgramData\46j3lei.dss
C:\ProgramData\8z4bbah.bxx
C:\ProgramData\8z4bbah.fvv
C:\ProgramData\8z4bbah.pss
C:\ProgramData\9j67trj6v.bxx
C:\ProgramData\9j67trj6v.fvv
C:\ProgramData\9j67trj6v.pss
C:\ProgramData\a2rqdd.bxx
C:\ProgramData\a2rqdd.fvv
C:\ProgramData\a2rqdd.pss
C:\ProgramData\a2rqdd.reg
C:\ProgramData\bjrrftr3.dss
C:\ProgramData\ddqr2a.dss
C:\ProgramData\fwjwodh1.bxx
C:\ProgramData\fwjwodh1.fvv
C:\ProgramData\fwjwodh1.pss
C:\ProgramData\h8rjfj3.bxx
C:\ProgramData\h8rjfj3.fvv
C:\ProgramData\h8rjfj3.pss
C:\ProgramData\habb4z8.dss
C:\ProgramData\iel3j64.bxx
C:\ProgramData\iel3j64.fvv
C:\ProgramData\iel3j64.pss
C:\ProgramData\jbeir2.bxx
C:\ProgramData\jbeir2.fvv
C:\ProgramData\jbeir2.pss
C:\ProgramData\jwbnzj8rr.bxx
C:\ProgramData\jwbnzj8rr.fvv
C:\ProgramData\jwbnzj8rr.pss
C:\ProgramData\ms504C4FA1.dat
C:\ProgramData\ms504D92B4.dat
C:\ProgramData\ms504DB91B.dat
C:\ProgramData\ms504E8957.dat
C:\ProgramData\ms504E8CA2.dat
C:\ProgramData\ms504EBE91.dat
C:\ProgramData\ms504EBF50.dat
C:\ProgramData\ms504F57B4.dat
C:\ProgramData\ms504F691C.dat
C:\ProgramData\ms508107D3.dat
C:\ProgramData\msvzgjup.exe
C:\ProgramData\rr8jznbwj.dss
C:\ProgramData\v6jrt76j9.dss


Some content of TEMP:
====================
C:\Users\Admin\AppData\Local\Temp\1346529348.exe
C:\Users\Admin\AppData\Local\Temp\1347381042.exe
C:\Users\Admin\AppData\Local\Temp\APNSetup.exe
C:\Users\Admin\AppData\Local\Temp\FotobuchSetup.exe
C:\Users\Admin\AppData\Local\Temp\FotobuchUpdater.exe
C:\Users\Admin\AppData\Local\Temp\mingwm10.dll


==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
ATTENTION: ====> ZeroAccess. Use DeleteJunctionsIndirectory: C:\Program Files\Windows Defender

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

8
Restore point made on: 2013-11-14 11:00:48
Restore point made on: 2013-11-14 12:10:16
Restore point made on: 2013-11-18 12:39:16
Restore point made on: 2013-11-19 11:00:35
Restore point made on: 2013-11-24 00:20:21
Restore point made on: 2013-11-27 07:56:37
Restore point made on: 2013-11-28 11:14:51
Restore point made on: 2013-12-02 02:48:48

==================== Memory info =========================== 

Percentage of memory in use: 19%
Total physical RAM: 3958.71 MB
Available physical RAM: 3205.29 MB
Total Pagefile: 3956.86 MB
Available Pagefile: 3201.15 MB
Total Virtual: 8192 MB
Available Virtual: 8191.88 MB

==================== Drives ================================

Drive c: (Packard Bell) (Fixed) (Total:452.66 GB) (Free:360.78 GB) NTFS
Drive e: (PQSERVICE) (Fixed) (Total:13 GB) (Free:0.93 GB) NTFS
Drive g: (32GB) (Removable) (Total:29.67 GB) (Free:29.67 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (SYSTEM RESERVED) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: E89BA888)
Partition 1: (Not Active) - (Size=13 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=453 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 30 GB) (Disk ID: 0217934C)
Partition 1: (Active) - (Size=30 GB) - (Type=0C)


LastRegBack: 2013-11-24 02:47

==================== End Of Log ============================

 

Themen zu GVU und Bundeskriminalamt Trojaner,PC fährt im abgesicherten modus sofort wieder runter
antivir, askbar, association, bundesamt für sicherheit und informationstechnik trojaner, diner dash, flash player, gvu - trojaner - abgesicherter modus geht nicht, launch, packard bell, programm, pup.netcat, pup.optional.opencandy, realtek, rootkit, rootkit.0access, security, services.exe, siteadvisor, software, svchost.exe, symantec, trojan.fakems, trojaner, win32/kryptik.bqau, win32/psw.fareit.a


« Avast zeigt einmalig rootkit, bei jedem weiteren Scan nicht mehr. | Programme lassen sich nicht mehr über Systemsteuerung löschen »


Ähnliche Themen: GVU und Bundeskriminalamt Trojaner,PC fährt im abgesicherten modus sofort wieder runter


  1. Windows 7 fährt im abgesicherten Modus gleich wieder runter. GUV Trojaner vermutet
    Log-Analyse und Auswertung - 27.09.2014 (25)
  2. BKA Trojaner, Windows fährt im abgesicherten Modus wieder runter
    Plagegeister aller Art und deren Bekämpfung - 12.09.2014 (17)
  3. Windows 7: trojaner GVU/Bundespolizei fährt den Pc im abgesicherten Modus runter!
    Log-Analyse und Auswertung - 13.05.2014 (19)
  4. Windows7/64 fährt im abgesicherten Modus sofort wieder runter, Sicherheitscenter bleibt abgehdreht & Netzwerkadapter finden kein Netzwerk
    Log-Analyse und Auswertung - 23.04.2014 (8)
  5. Win7 SP1 64Bit hängt nach Anmeldung / Fährt im abgesicherten Modus sofort runter
    Log-Analyse und Auswertung - 05.12.2013 (3)
  6. Win7 fährt im abgesicherten Modus sofort herunter
    Log-Analyse und Auswertung - 25.10.2013 (5)
  7. GVU Trojaner - Windows 7 fährt im abgesicherten Modus automatisch runter
    Log-Analyse und Auswertung - 13.10.2013 (10)
  8. GVU Trojaner - Windows 7 fährt im abgesicherten Modus automatisch runter
    Log-Analyse und Auswertung - 21.07.2013 (1)
  9. GVU-Trojaner-Windows fährt im abgesicherten Modus automatisch wieder runter
    Log-Analyse und Auswertung - 10.07.2013 (13)
  10. Trojaner, Abgesicherter Modus fährt sofort wieder runter
    Plagegeister aller Art und deren Bekämpfung - 09.07.2013 (40)
  11. Weißer-Bildschirm mit Zahlungsaufforderung, Abgesicherter Modus fährt sofort runter
    Plagegeister aller Art und deren Bekämpfung - 16.05.2013 (20)
  12. W7 fährt im abgesicherten Modus sofort herunter
    Alles rund um Windows - 13.03.2013 (1)
  13. Pc fährt sofort wieder runter Win Xp
    Plagegeister aller Art und deren Bekämpfung - 29.08.2010 (5)
  14. Windows Vista startet nicht, fährt sofort wieder runter und gleich wieder hoch...
    Alles rund um Windows - 03.04.2010 (3)
  15. Computer fährtr sofort runter-auch im abgesicherten Modus
    Plagegeister aller Art und deren Bekämpfung - 06.09.2008 (2)
  16. Windows fährt hoch, meldet sich an und fährt sofort wieder runter
    Alles rund um Windows - 27.11.2007 (1)
  17. Win 98 fährt sofort wieder runter
    Alles rund um Windows - 05.05.2005 (0)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema GVU und Bundeskriminalamt Trojaner,PC fährt im abgesicherten modus sofort wieder runter - Hallo, ich habe folgendes Problem: Mein Laptop lässt sich nicht mehr starten,wenn er hochfährt öffnen sich sofort 4-5 Fenster mit GVU UND Bundeskriminalamt, die abwechselnd in den vordergrund rücken. Ich - GVU und Bundeskriminalamt Trojaner,PC fährt im abgesicherten modus sofort wieder runter...
Archiv
Du betrachtest: GVU und Bundeskriminalamt Trojaner,PC fährt im abgesicherten modus sofort wieder runter auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131