|
Plagegeister aller Art und deren Bekämpfung: WIN7x64: "Gesellschaft zur Verfügung von Urheberrechtsverletzungen e.V." - Abgesicherter Modus nicht möglich - bereits einiges versuchtWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
22.12.2013, 13:55 | #1 |
| WIN7x64: "Gesellschaft zur Verfügung von Urheberrechtsverletzungen e.V." - Abgesicherter Modus nicht möglich - bereits einiges versucht Hallo Habe mir einen Trojaner eingefangen, den ich leider mit allen Versuchen bisher nicht entfernen konnte. Windows 7 64 bit - abgesicherter Modus nicht möglich, da er beim Versuch automatisch heruntergefahren wird. Bitte dringend um Hilfe! Problem: Beim normalen Start kommt eine Meldung von "Gesellschaft zur Verfügung von Urheberrechtsverletzungen e.V.", die 100 Euro von mir wollen. Wenn noch andere Informationen benötigt werden, werde ich diese umgehend hinzufügen! Vielen Dank! |
22.12.2013, 14:24 | #2 |
/// the machine /// TB-Ausbilder | WIN7x64: "Gesellschaft zur Verfügung von Urheberrechtsverletzungen e.V." - Abgesicherter Modus nicht möglich - bereits einiges versucht hi,
__________________Scan mit Farbar's Recovery Scan Tool (Recovery Mode - Windows Vista, 7, 8) Hinweise für Windows 8-Nutzer: Anleitung 1 (FRST-Variante) und Anleitung 2 (zweiter Teil)
__________________ |
22.12.2013, 15:19 | #3 |
| WIN7x64: "Gesellschaft zur Verfügung von Urheberrechtsverletzungen e.V." - Abgesicherter Modus nicht möglich - bereits einiges versucht Vielen Dank für die schnelle Rückmeldung. Anbei finden Sie meinen Log.
__________________FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 20-12-2013 02 Ran by SYSTEM on MININT-R12U8FI on 22-12-2013 15:13:16 Running from G:\ Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Recovery The current controlset is ControlSet002 ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log. ==================== Registry (Whitelisted) ================== Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-18] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [ControlCenter4] - C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [139264 2011-04-20] (Brother Industries, Ltd.) HKLM-x32\...\Run: [BrStsMon00] - C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [2629632 2011-10-07] (Brother Industries, Ltd.) HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [162856 2013-06-10] (Geek Software GmbH) HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [154144 2009-11-25] () HKU\Default User\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [154144 2009-11-25] () HKU\Wolfgang\...\Run: [RoboForm] - C:\Program Files (x86)\Siber Systems\AI RoboForm\robotaskbaricon.exe [109784 2013-06-30] (Siber Systems) HKU\Wolfgang\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2009-10-20] (Google Inc.) Startup: C:\Users\Wolfgang\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0zj2q3fr.lnk ShortcutTarget: 0zj2q3fr.lnk -> C:\PROGRA~3\\rf3q2jz0.jss (hxxp://tortoisesvn.net) Startup: C:\Users\Wolfgang\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> (No File) ==================== Services (Whitelisted) ================= S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-18] (Avira Operations GmbH & Co. KG) S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG) S2 DevoloNetworkService; C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe [3128856 2012-02-28] (devolo AG) S2 KMService; C:\Windows\SysWow64\srvany.exe [8192 2003-04-18] () S2 MSSQL$MSSMLBIZ; c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation) S4 PDFProFiltSrvPP; C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [144672 2010-03-09] (Nuance Communications, Inc.) S4 RS_Service; C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe [253952 2009-07-10] (Acer Incorporated) S2 StarMoney 9.0 OnlineUpdate; C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe [663184 2013-10-11] (Star Finanz-Software Entwicklung und Vertriebs GmbH) S2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe [2365792 2012-09-19] (TuneUp Software) S2 Winmgmt; C:\PROGRA~3\\0zj2q3fr.zvv [61540 2013-12-22] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG) S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG) S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG) S3 avmaudio; C:\Windows\System32\DRIVERS\avmaudio.sys [116096 2010-11-28] (AVM Berlin) S3 avmaura; C:\Windows\System32\DRIVERS\avmaura.sys [116480 2012-12-16] (AVM Berlin) S3 CH341SER; C:\Windows\System32\Drivers\CH341S64.SYS [58368 2009-06-02] (www.winchiphead.com) S3 CH341SER_A64; C:\Windows\System32\Drivers\CH341S64.SYS [58368 2009-06-02] (www.winchiphead.com) S0 FSProFilter; C:\Windows\System32\Drivers\FSPFltd.sys [54848 2010-07-22] (FSPro Labs) S3 hwusbdev; C:\Windows\System32\DRIVERS\ewusbdev.sys [113792 2009-06-22] (Huawei Technologies Co., Ltd.) S3 int15.sys; C:\Windows\System32\OEM\Factory\int15.sys [17952 2008-03-28] (Acer, Inc.) S2 NPF_devolo; C:\Windows\sysWOW64\drivers\npf_devolo.sys [34048 2012-01-31] (CACE Technologies) S3 StkCMini; C:\Windows\System32\Drivers\StkCMini.sys [1816968 2010-04-16] (Syntek) S3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesDriver64.sys [11880 2012-09-19] (TuneUp Software) S3 cpuz133; \??\C:\Users\Wolfgang\AppData\Local\Temp\cpuz133\cpuz133_x64.sys [x] S3 dgderdrv; System32\drivers\dgderdrv.sys [x] S2 regi; \??\C:\Windows\system32\drivers\regi.sys [x] S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [x] S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-12-22 17:46 - 2013-12-22 18:48 - 00139040 _____ C:\OTL.Txt 2013-12-22 15:12 - 2013-12-22 15:12 - 00000000 ____D C:\FRST 2013-12-22 12:07 - 2013-12-22 12:07 - 00276480 _____ C:\Windows\Minidump\122213-22807-01.dmp 2013-12-22 12:05 - 2013-12-22 12:05 - 00276480 _____ C:\Windows\Minidump\122213-66862-01.dmp 2013-12-22 09:36 - 2013-12-22 09:36 - 00006576 ____N C:\bootsqm.dat 2013-12-22 09:29 - 2013-12-22 09:29 - 00276536 _____ C:\Windows\Minidump\122213-19484-01.dmp 2013-12-22 09:28 - 2013-12-22 09:28 - 00276480 _____ C:\Windows\Minidump\122213-65317-01.dmp 2013-12-22 09:26 - 2013-12-22 09:26 - 00000000 ____D C:\ProgramData\HitmanPro 2013-12-22 09:26 - 2013-12-22 09:26 - 00000000 _____ C:\Windows\Minidump\122213-63866-01.dmp 2013-12-22 09:25 - 2013-12-22 12:06 - 397490613 _____ C:\Windows\MEMORY.DMP 2013-12-22 08:32 - 2013-12-22 08:32 - 00000298 ____H C:\Windows\Tasks\User_Feed_Synchronization-{C04CE4A3-31BF-4700-ACCF-DE1A1FA1635C}.job 2013-12-22 07:51 - 2013-12-22 07:51 - 00000291 _____ C:\ProgramData\0zj2q3fr.reg 2013-12-22 07:50 - 2013-12-22 13:20 - 95025368 ____T C:\ProgramData\0zj2q3fr.fee 2013-12-22 07:50 - 2013-12-22 13:20 - 00000000 _____ C:\ProgramData\0zj2q3fr.odd 2013-12-22 07:50 - 2013-12-22 07:50 - 00230912 _____ (hxxp://tortoisesvn.net) C:\ProgramData\rf3q2jz0.jss 2013-12-22 07:50 - 2013-12-22 07:50 - 00061540 ____T (Microsoft Corporation) C:\ProgramData\0zj2q3fr.zvv 2013-12-20 19:37 - 2013-12-20 19:38 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-12-18 20:49 - 2013-12-18 20:49 - 00019018 _____ C:\Windows\PFRO.log 2013-12-15 18:24 - 2013-12-21 09:40 - 00011126 _____ C:\Users\Wolfgang\Desktop\ip adressen.xlsx 2013-12-15 18:15 - 2013-12-22 13:19 - 00003440 _____ C:\Windows\setupact.log 2013-12-15 18:15 - 2013-12-15 18:15 - 00000000 _____ C:\Windows\setuperr.log 2013-12-15 07:36 - 2013-12-15 07:36 - 16383031 _____ C:\Users\Wolfgang\Desktop\XS_TB-2.5_7270_v2_05.53-freetz-devel-11286M.de.zip 2013-12-14 09:24 - 2013-05-10 06:56 - 14631424 _____ (Microsoft Corporation) C:\Windows\System32\wmp.dll 2013-12-14 09:24 - 2013-05-10 06:56 - 12625920 _____ (Microsoft Corporation) C:\Windows\System32\wmploc.DLL 2013-12-14 09:24 - 2013-05-10 05:56 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL 2013-12-14 09:24 - 2013-05-10 05:56 - 11410432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll 2013-12-14 09:22 - 2013-11-26 12:54 - 23183360 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll 2013-12-14 09:22 - 2013-11-26 11:19 - 02724864 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb 2013-12-14 09:22 - 2013-11-26 11:18 - 00004096 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollectorres.dll 2013-12-14 09:22 - 2013-11-26 11:11 - 17112576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2013-12-14 09:22 - 2013-11-26 10:48 - 00066048 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll 2013-12-14 09:22 - 2013-11-26 10:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\System32\ieetwproxystub.dll 2013-12-14 09:22 - 2013-11-26 10:41 - 02764288 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll 2013-12-14 09:22 - 2013-11-26 10:29 - 00053760 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll 2013-12-14 09:22 - 2013-11-26 10:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll 2013-12-14 09:22 - 2013-11-26 10:23 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2013-12-14 09:22 - 2013-11-26 10:21 - 00574976 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll 2013-12-14 09:22 - 2013-11-26 10:18 - 00139264 _____ (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe 2013-12-14 09:22 - 2013-11-26 10:18 - 00111616 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollector.exe 2013-12-14 09:22 - 2013-11-26 10:16 - 00708608 _____ (Microsoft Corporation) C:\Windows\System32\jscript9diag.dll 2013-12-14 09:22 - 2013-11-26 09:57 - 00218624 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe 2013-12-14 09:22 - 2013-11-26 09:38 - 02166784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2013-12-14 09:22 - 2013-11-26 09:38 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2013-12-14 09:22 - 2013-11-26 09:35 - 05769216 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll 2013-12-14 09:22 - 2013-11-26 09:32 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2013-12-14 09:22 - 2013-11-26 09:28 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2013-12-14 09:22 - 2013-11-26 09:16 - 04243968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2013-12-14 09:22 - 2013-11-26 09:02 - 01995264 _____ (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl 2013-12-14 09:22 - 2013-11-26 08:48 - 12996608 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll 2013-12-14 09:22 - 2013-11-26 08:32 - 01928192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2013-12-14 09:22 - 2013-11-26 08:26 - 11221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2013-12-14 09:22 - 2013-11-26 08:07 - 02334208 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll 2013-12-14 09:22 - 2013-11-26 07:40 - 01395200 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll 2013-12-14 09:22 - 2013-11-26 07:34 - 00817664 _____ (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll 2013-12-14 09:22 - 2013-11-26 07:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2013-12-14 09:22 - 2013-11-26 07:33 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2013-12-14 09:22 - 2013-11-26 07:27 - 01157632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2013-12-14 08:25 - 2013-12-15 07:51 - 00000000 ____D C:\Program Files (x86)\V-CamShow 2013-12-12 19:28 - 2013-11-23 19:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll 2013-12-12 19:28 - 2013-11-23 18:47 - 00465920 _____ (Microsoft Corporation) C:\Windows\System32\WMPhoto.dll 2013-12-12 19:28 - 2013-11-12 03:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\System32\tzres.dll 2013-12-12 19:28 - 2013-11-12 03:07 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll 2013-12-12 19:28 - 2013-10-30 03:32 - 00335360 _____ (Microsoft Corporation) C:\Windows\System32\msieftp.dll 2013-12-12 19:28 - 2013-10-30 03:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll 2013-12-12 19:28 - 2013-10-30 02:24 - 03155968 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys 2013-12-12 19:28 - 2013-10-19 03:18 - 00081408 _____ (Microsoft Corporation) C:\Windows\System32\imagehlp.dll 2013-12-12 19:28 - 2013-10-19 02:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll 2013-12-12 19:28 - 2013-10-12 03:32 - 00150016 _____ (Microsoft Corporation) C:\Windows\System32\wshom.ocx 2013-12-12 19:28 - 2013-10-12 03:31 - 00202752 _____ (Microsoft Corporation) C:\Windows\System32\scrrun.dll 2013-12-12 19:28 - 2013-10-12 03:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshom.ocx 2013-12-12 19:28 - 2013-10-12 03:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll 2013-12-12 19:28 - 2013-10-12 02:33 - 00168960 _____ (Microsoft Corporation) C:\Windows\System32\wscript.exe 2013-12-12 19:28 - 2013-10-12 02:33 - 00156160 _____ (Microsoft Corporation) C:\Windows\System32\cscript.exe 2013-12-12 19:28 - 2013-10-12 02:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscript.exe 2013-12-12 19:28 - 2013-10-12 02:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe 2013-12-12 19:28 - 2013-10-04 03:16 - 00116736 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\drmk.sys 2013-12-12 19:28 - 2013-10-04 02:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\portcls.sys 2013-11-25 19:52 - 2013-10-14 18:00 - 00028368 _____ (Microsoft Corporation) C:\Windows\System32\IEUDINIT.EXE 2013-11-25 19:47 - 2013-11-25 19:47 - 01228800 _____ (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00942592 _____ (Microsoft Corporation) C:\Windows\System32\jsIntl.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00940032 _____ (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe 2013-11-25 19:47 - 2013-11-25 19:47 - 00774144 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00626176 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat 2013-11-25 19:47 - 2013-11-25 19:47 - 00616104 _____ (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat 2013-11-25 19:47 - 2013-11-25 19:47 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00548352 _____ (Microsoft Corporation) C:\Windows\System32\vbscript.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00453120 _____ (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00413696 _____ (Microsoft Corporation) C:\Windows\System32\html.iec 2013-11-25 19:47 - 2013-11-25 19:47 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec 2013-11-25 19:47 - 2013-11-25 19:47 - 00296960 _____ (Microsoft Corporation) C:\Windows\System32\dxtrans.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00263376 _____ (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00247808 _____ (Microsoft Corporation) C:\Windows\System32\msls31.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00243200 _____ (Microsoft Corporation) C:\Windows\System32\webcheck.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00235520 _____ (Microsoft Corporation) C:\Windows\System32\url.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00235008 _____ (Microsoft Corporation) C:\Windows\System32\elshyph.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00195584 _____ (Microsoft Corporation) C:\Windows\System32\msrating.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00167424 _____ (Microsoft Corporation) C:\Windows\System32\iexpress.exe 2013-11-25 19:47 - 2013-11-25 19:47 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe 2013-11-25 19:47 - 2013-11-25 19:47 - 00147968 _____ (Microsoft Corporation) C:\Windows\System32\occache.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00143872 _____ (Microsoft Corporation) C:\Windows\System32\wextract.exe 2013-11-25 19:47 - 2013-11-25 19:47 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe 2013-11-25 19:47 - 2013-11-25 19:47 - 00135680 _____ (Microsoft Corporation) C:\Windows\System32\iepeers.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00131072 _____ (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2013-11-25 19:47 - 2013-11-25 19:47 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00105984 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00101376 _____ (Microsoft Corporation) C:\Windows\System32\inseng.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00090112 _____ (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe 2013-11-25 19:47 - 2013-11-25 19:47 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00086016 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe 2013-11-25 19:47 - 2013-11-25 19:47 - 00084992 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00083968 _____ (Microsoft Corporation) C:\Windows\System32\MshtmlDac.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00081408 _____ (Microsoft Corporation) C:\Windows\System32\icardie.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00077312 _____ (Microsoft Corporation) C:\Windows\System32\tdc.ocx 2013-11-25 19:47 - 2013-11-25 19:47 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe 2013-11-25 19:47 - 2013-11-25 19:47 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe 2013-11-25 19:47 - 2013-11-25 19:47 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx 2013-11-25 19:47 - 2013-11-25 19:47 - 00062464 _____ (Microsoft Corporation) C:\Windows\System32\pngfilt.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00052224 _____ (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00048640 _____ (Microsoft Corporation) C:\Windows\System32\mshtmler.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00048128 _____ (Microsoft Corporation) C:\Windows\System32\imgutil.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00040448 _____ (Microsoft Corporation) C:\Windows\System32\JavaScriptCollectionAgent.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00030208 _____ (Microsoft Corporation) C:\Windows\System32\licmgr10.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00013824 _____ (Microsoft Corporation) C:\Windows\System32\mshta.exe 2013-11-25 19:47 - 2013-11-25 19:47 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe 2013-11-25 19:47 - 2013-11-25 19:47 - 00013312 _____ (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe 2013-11-25 19:47 - 2013-11-25 19:47 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe ==================== One Month Modified Files and Folders ======= 2013-12-22 18:48 - 2013-12-22 17:46 - 00139040 _____ C:\OTL.Txt 2013-12-22 17:42 - 2010-04-11 12:28 - 00000000 ____D C:\users\Wolfgang 2013-12-22 15:12 - 2013-12-22 15:12 - 00000000 ____D C:\FRST 2013-12-22 13:20 - 2013-12-22 07:50 - 95025368 ____T C:\ProgramData\0zj2q3fr.fee 2013-12-22 13:20 - 2013-12-22 07:50 - 00000000 _____ C:\ProgramData\0zj2q3fr.odd 2013-12-22 13:19 - 2013-12-15 18:15 - 00003440 _____ C:\Windows\setupact.log 2013-12-22 13:19 - 2009-07-14 06:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT 2013-12-22 13:19 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2013-12-22 12:25 - 2009-07-14 05:45 - 00018736 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-12-22 12:25 - 2009-07-14 05:45 - 00018736 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-12-22 12:20 - 2012-08-07 18:02 - 00000000 ___RD C:\Users\Wolfgang\Dropbox 2013-12-22 12:20 - 2012-08-07 17:34 - 00000000 ____D C:\Users\Wolfgang\AppData\Roaming\Dropbox 2013-12-22 12:11 - 2013-05-01 16:40 - 00001037 _____ C:\Users\Wolfgang\Desktop\Dropbox.lnk 2013-12-22 12:07 - 2013-12-22 12:07 - 00276480 _____ C:\Windows\Minidump\122213-22807-01.dmp 2013-12-22 12:07 - 2010-08-15 13:59 - 00000000 ____D C:\Windows\Minidump 2013-12-22 12:06 - 2013-12-22 09:25 - 397490613 _____ C:\Windows\MEMORY.DMP 2013-12-22 12:05 - 2013-12-22 12:05 - 00276480 _____ C:\Windows\Minidump\122213-66862-01.dmp 2013-12-22 11:54 - 2010-11-07 09:05 - 01174429 _____ C:\Windows\WindowsUpdate.log 2013-12-22 10:58 - 2012-04-05 10:11 - 00000000 ____D C:\FTP 2013-12-22 09:41 - 2013-04-17 06:42 - 00000000 ____D C:\Program Files (x86)\StarMoney 9.0 2013-12-22 09:36 - 2013-12-22 09:36 - 00006576 ____N C:\bootsqm.dat 2013-12-22 09:29 - 2013-12-22 09:29 - 00276536 _____ C:\Windows\Minidump\122213-19484-01.dmp 2013-12-22 09:28 - 2013-12-22 09:28 - 00276480 _____ C:\Windows\Minidump\122213-65317-01.dmp 2013-12-22 09:26 - 2013-12-22 09:26 - 00000000 ____D C:\ProgramData\HitmanPro 2013-12-22 09:26 - 2013-12-22 09:26 - 00000000 _____ C:\Windows\Minidump\122213-63866-01.dmp 2013-12-22 08:32 - 2013-12-22 08:32 - 00000298 ____H C:\Windows\Tasks\User_Feed_Synchronization-{C04CE4A3-31BF-4700-ACCF-DE1A1FA1635C}.job 2013-12-22 07:51 - 2013-12-22 07:51 - 00000291 _____ C:\ProgramData\0zj2q3fr.reg 2013-12-22 07:50 - 2013-12-22 07:50 - 00230912 _____ (hxxp://tortoisesvn.net) C:\ProgramData\rf3q2jz0.jss 2013-12-22 07:50 - 2013-12-22 07:50 - 00061540 ____T (Microsoft Corporation) C:\ProgramData\0zj2q3fr.zvv 2013-12-22 06:23 - 2013-04-28 15:09 - 00000452 _____ C:\Windows\System32\Drivers\etc\hosts.ics 2013-12-21 09:45 - 2012-04-28 06:09 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2013-12-21 09:40 - 2013-12-15 18:24 - 00011126 _____ C:\Users\Wolfgang\Desktop\ip adressen.xlsx 2013-12-21 07:56 - 2009-10-20 00:51 - 00000000 ____D C:\Program Files (x86)\Google 2013-12-20 19:38 - 2013-12-20 19:37 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-12-19 20:05 - 2009-07-14 06:13 - 01769676 _____ C:\Windows\System32\PerfStringBackup.INI 2013-12-19 20:05 - 2009-07-02 17:08 - 00757616 _____ C:\Windows\System32\perfh007.dat 2013-12-19 20:05 - 2009-07-02 17:08 - 00172936 _____ C:\Windows\System32\perfc007.dat 2013-12-18 20:49 - 2013-12-18 20:49 - 00019018 _____ C:\Windows\PFRO.log 2013-12-18 20:49 - 2013-08-18 14:49 - 00000000 ____D C:\ProgramData\seavenshare! 2013-12-18 18:19 - 2013-05-07 16:41 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avnetflt.sys 2013-12-18 18:19 - 2013-03-30 07:02 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avipbb.sys 2013-12-18 18:19 - 2013-03-30 07:02 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avgntflt.sys 2013-12-15 20:24 - 2010-09-12 17:35 - 00000000 ____D C:\Program Files (x86)\Biet-O-Matic 2013-12-15 18:15 - 2013-12-15 18:15 - 00000000 _____ C:\Windows\setuperr.log 2013-12-15 10:35 - 2013-07-08 10:45 - 00000000 ____D C:\Users\Wolfgang\Desktop\Essen_Trinken 2013-12-15 08:20 - 2013-09-27 16:47 - 00000000 ____D C:\Program Files (x86)\JDownloader 2013-12-15 07:51 - 2013-12-14 08:25 - 00000000 ____D C:\Program Files (x86)\V-CamShow 2013-12-15 07:51 - 2010-04-17 08:24 - 00000000 ____D C:\Program Files (x86)\CCleaner 2013-12-15 07:36 - 2013-12-15 07:36 - 16383031 _____ C:\Users\Wolfgang\Desktop\XS_TB-2.5_7270_v2_05.53-freetz-devel-11286M.de.zip 2013-12-15 05:18 - 2012-12-06 20:40 - 00003086 _____ C:\Windows\System32\Tasks\{5FEC34F1-308C-4A14-849B-49DE915BAC42} 2013-12-14 19:45 - 2011-01-07 10:37 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy 2013-12-14 19:44 - 2007-07-12 02:49 - 00000000 ____D C:\Windows\Panther 2013-12-14 19:42 - 2011-11-12 08:00 - 00000000 ____D C:\Users\Wolfgang\AppData\Roaming\1&1 2013-12-14 19:39 - 2010-04-11 13:07 - 00000000 ____D C:\Users\Wolfgang\AppData\Local\Google 2013-12-14 19:35 - 2013-07-08 10:42 - 00000000 ___RD C:\Users\Wolfgang\Desktop\Hardware 2013-12-14 18:00 - 1998-06-24 01:00 - 00203576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RICHTX32.OCX 2013-12-14 10:09 - 2009-07-14 06:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD 2013-12-14 10:06 - 2009-07-14 05:45 - 05020592 _____ C:\Windows\System32\FNTCACHE.DAT 2013-12-14 10:02 - 2012-07-01 11:38 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-12-14 09:24 - 2009-10-20 00:39 - 00000000 ____D C:\ProgramData\Microsoft Help 2013-12-14 09:20 - 2013-08-17 03:59 - 00000000 ____D C:\Windows\System32\MRT 2013-12-14 09:17 - 2010-04-11 12:54 - 90708896 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe 2013-12-14 08:17 - 2012-07-01 11:38 - 00003824 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater 2013-12-14 08:17 - 2012-05-13 06:33 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2013-12-14 08:17 - 2011-05-15 07:05 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2013-12-14 08:13 - 2010-04-11 13:12 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2013-12-14 08:13 - 2010-04-11 13:12 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2013-12-14 08:05 - 2013-10-20 07:25 - 00000000 ____D C:\Users\Wolfgang\Documents\Calibre-Bibliothek 2013-12-14 07:49 - 2012-12-22 11:54 - 00000000 ____D C:\Users\Wolfgang\Documents\Outlook-Dateien 2013-12-13 11:09 - 2010-04-11 13:12 - 00004108 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2013-12-13 11:09 - 2010-04-11 13:12 - 00003856 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2013-12-01 16:16 - 2011-08-07 16:04 - 00000000 ____D C:\Freigabe 2013-11-26 20:33 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache 2013-11-26 12:54 - 2013-12-14 09:22 - 23183360 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll 2013-11-26 11:19 - 2013-12-14 09:22 - 02724864 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb 2013-11-26 11:18 - 2013-12-14 09:22 - 00004096 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollectorres.dll 2013-11-26 11:11 - 2013-12-14 09:22 - 17112576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2013-11-26 10:48 - 2013-12-14 09:22 - 00066048 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll 2013-11-26 10:46 - 2013-12-14 09:22 - 00048640 _____ (Microsoft Corporation) C:\Windows\System32\ieetwproxystub.dll 2013-11-26 10:41 - 2013-12-14 09:22 - 02764288 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll 2013-11-26 10:29 - 2013-12-14 09:22 - 00053760 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll 2013-11-26 10:27 - 2013-12-14 09:22 - 00033792 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll 2013-11-26 10:23 - 2013-12-14 09:22 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2013-11-26 10:21 - 2013-12-14 09:22 - 00574976 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll 2013-11-26 10:18 - 2013-12-14 09:22 - 00139264 _____ (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe 2013-11-26 10:18 - 2013-12-14 09:22 - 00111616 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollector.exe 2013-11-26 10:16 - 2013-12-14 09:22 - 00708608 _____ (Microsoft Corporation) C:\Windows\System32\jscript9diag.dll 2013-11-26 09:57 - 2013-12-14 09:22 - 00218624 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe 2013-11-26 09:38 - 2013-12-14 09:22 - 02166784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2013-11-26 09:38 - 2013-12-14 09:22 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2013-11-26 09:35 - 2013-12-14 09:22 - 05769216 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll 2013-11-26 09:32 - 2013-12-14 09:22 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2013-11-26 09:28 - 2013-12-14 09:22 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2013-11-26 09:16 - 2013-12-14 09:22 - 04243968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2013-11-26 09:02 - 2013-12-14 09:22 - 01995264 _____ (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl 2013-11-26 08:48 - 2013-12-14 09:22 - 12996608 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll 2013-11-26 08:32 - 2013-12-14 09:22 - 01928192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2013-11-26 08:26 - 2013-12-14 09:22 - 11221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2013-11-26 08:07 - 2013-12-14 09:22 - 02334208 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll 2013-11-26 07:40 - 2013-12-14 09:22 - 01395200 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll 2013-11-26 07:34 - 2013-12-14 09:22 - 00817664 _____ (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll 2013-11-26 07:34 - 2013-12-14 09:22 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2013-11-26 07:33 - 2013-12-14 09:22 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2013-11-26 07:27 - 2013-12-14 09:22 - 01157632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2013-11-25 19:55 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\PolicyDefinitions 2013-11-25 19:47 - 2013-11-25 19:47 - 01228800 _____ (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00942592 _____ (Microsoft Corporation) C:\Windows\System32\jsIntl.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00940032 _____ (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe 2013-11-25 19:47 - 2013-11-25 19:47 - 00774144 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00626176 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat 2013-11-25 19:47 - 2013-11-25 19:47 - 00616104 _____ (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat 2013-11-25 19:47 - 2013-11-25 19:47 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00548352 _____ (Microsoft Corporation) C:\Windows\System32\vbscript.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00453120 _____ (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00413696 _____ (Microsoft Corporation) C:\Windows\System32\html.iec 2013-11-25 19:47 - 2013-11-25 19:47 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec 2013-11-25 19:47 - 2013-11-25 19:47 - 00296960 _____ (Microsoft Corporation) C:\Windows\System32\dxtrans.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00263376 _____ (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00247808 _____ (Microsoft Corporation) C:\Windows\System32\msls31.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00243200 _____ (Microsoft Corporation) C:\Windows\System32\webcheck.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00235520 _____ (Microsoft Corporation) C:\Windows\System32\url.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00235008 _____ (Microsoft Corporation) C:\Windows\System32\elshyph.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00195584 _____ (Microsoft Corporation) C:\Windows\System32\msrating.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00167424 _____ (Microsoft Corporation) C:\Windows\System32\iexpress.exe 2013-11-25 19:47 - 2013-11-25 19:47 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe 2013-11-25 19:47 - 2013-11-25 19:47 - 00147968 _____ (Microsoft Corporation) C:\Windows\System32\occache.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00143872 _____ (Microsoft Corporation) C:\Windows\System32\wextract.exe 2013-11-25 19:47 - 2013-11-25 19:47 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe 2013-11-25 19:47 - 2013-11-25 19:47 - 00135680 _____ (Microsoft Corporation) C:\Windows\System32\iepeers.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00131072 _____ (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2013-11-25 19:47 - 2013-11-25 19:47 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00105984 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00101376 _____ (Microsoft Corporation) C:\Windows\System32\inseng.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00090112 _____ (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe 2013-11-25 19:47 - 2013-11-25 19:47 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00086016 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe 2013-11-25 19:47 - 2013-11-25 19:47 - 00084992 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00083968 _____ (Microsoft Corporation) C:\Windows\System32\MshtmlDac.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00081408 _____ (Microsoft Corporation) C:\Windows\System32\icardie.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00077312 _____ (Microsoft Corporation) C:\Windows\System32\tdc.ocx 2013-11-25 19:47 - 2013-11-25 19:47 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe 2013-11-25 19:47 - 2013-11-25 19:47 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe 2013-11-25 19:47 - 2013-11-25 19:47 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx 2013-11-25 19:47 - 2013-11-25 19:47 - 00062464 _____ (Microsoft Corporation) C:\Windows\System32\pngfilt.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00052224 _____ (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00048640 _____ (Microsoft Corporation) C:\Windows\System32\mshtmler.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00048128 _____ (Microsoft Corporation) C:\Windows\System32\imgutil.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00040448 _____ (Microsoft Corporation) C:\Windows\System32\JavaScriptCollectionAgent.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00030208 _____ (Microsoft Corporation) C:\Windows\System32\licmgr10.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll 2013-11-25 19:47 - 2013-11-25 19:47 - 00013824 _____ (Microsoft Corporation) C:\Windows\System32\mshta.exe 2013-11-25 19:47 - 2013-11-25 19:47 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe 2013-11-25 19:47 - 2013-11-25 19:47 - 00013312 _____ (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe 2013-11-25 19:47 - 2013-11-25 19:47 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe 2013-11-25 19:12 - 2013-03-30 07:02 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avkmgr.sys 2013-11-24 14:41 - 2010-04-25 07:56 - 00000528 _____ C:\Users\Wolfgang\Desktop\nxfmg9Qh.txt 2013-11-23 19:26 - 2013-12-12 19:28 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll 2013-11-23 18:47 - 2013-12-12 19:28 - 00465920 _____ (Microsoft Corporation) C:\Windows\System32\WMPhoto.dll Files to move or delete: ==================== C:\ProgramData\0zj2q3fr.reg Some content of TEMP: ==================== C:\Users\Wolfgang\AppData\Local\Temp\avgnt.exe C:\Users\Wolfgang\AppData\Local\Temp\~tmf9043366444806648529.dll ==================== Known DLLs (Whitelisted) ================ ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ==================== EXE ASSOCIATION ===================== HKLM\...\.exe: exefile => OK HKLM\...\exefile\DefaultIcon: %1 => OK HKLM\...\exefile\open\command: "%1" %* => OK ==================== Restore Points ========================= Restore point made on: 2013-12-14 09:16:14 ==================== Memory info =========================== Percentage of memory in use: 28% Total physical RAM: 1976.93 MB Available physical RAM: 1414.64 MB Total Pagefile: 1976.93 MB Available Pagefile: 1409.73 MB Total Virtual: 8192 MB Available Virtual: 8191.87 MB ==================== Drives ================================ Drive c: (Acer) (Fixed) (Total:220.79 GB) (Free:89.69 GB) NTFS Drive e: (PQSERVICE) (Fixed) (Total:12 GB) (Free:0.99 GB) NTFS Drive f: (GRMCULXFRER_DE_DVD) (CDROM) (Total:3.04 GB) (Free:0 GB) UDF Drive g: (HITMANPRO) (Removable) (Total:1.86 GB) (Free:1.85 GB) FAT32 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS Drive y: (SYSTEM RESERVED) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)] ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: 2C2FF16E) Partition 1: (Not Active) - (Size=12 GB) - (Type=27) Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=221 GB) - (Type=07 NTFS) ======================================================== Disk: 1 (Size: 2 GB) (Disk ID: 51575880) Partition 1: (Active) - (Size=2 GB) - (Type=0B) LastRegBack: 2013-11-20 11:09 ==================== End Of Log ============================ |
23.12.2013, 08:51 | #4 |
/// the machine /// TB-Ausbilder | WIN7x64: "Gesellschaft zur Verfügung von Urheberrechtsverletzungen e.V." - Abgesicherter Modus nicht möglich - bereits einiges versucht Drücke bitte die + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter Startup: C:\Users\Wolfgang\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0zj2q3fr.lnk ShortcutTarget: 0zj2q3fr.lnk -> C:\PROGRA~3\\rf3q2jz0.jss (hxxp://tortoisesvn.net) S2 Winmgmt; C:\PROGRA~3\\0zj2q3fr.zvv [61540 2013-12-22] (Microsoft Corporation) 2013-12-22 07:51 - 2013-12-22 07:51 - 00000291 _____ C:\ProgramData\0zj2q3fr.reg 2013-12-22 07:50 - 2013-12-22 13:20 - 95025368 ____T C:\ProgramData\0zj2q3fr.fee 2013-12-22 07:50 - 2013-12-22 13:20 - 00000000 _____ C:\ProgramData\0zj2q3fr.odd 2013-12-22 07:50 - 2013-12-22 07:50 - 00230912 _____ (hxxp://tortoisesvn.net) C:\ProgramData\rf3q2jz0.jss 2013-12-22 07:50 - 2013-12-22 07:50 - 00061540 ____T (Microsoft Corporation) C:\ProgramData\0zj2q3fr.zvv
Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier. Rechner normal starten.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
Themen zu WIN7x64: "Gesellschaft zur Verfügung von Urheberrechtsverletzungen e.V." - Abgesicherter Modus nicht möglich - bereits einiges versucht |
100 euro trojaner virus windows7, abgesicherter, abgesicherter modus funktioniert nicht, andere, automatisch, benötigt, bereits, dringend, eingefangen, entferne, entfernen, euro, gefangen, gen, gesellschaft zur verfügung von urheberrechtsverletzung e.v., hinzufügen, informationen, meldung, modus, start, troja, trojaner, versuche, versucht, win, windows, windows 7, windows 7 64 bit, zunge |