| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Virus Zeus? - will alles neu installieren - aber wie?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
12.01.2014, 14:06
| #1 |
| |  Virus Zeus? - will alles neu installieren - aber wie? Hallo, ich benötige dringend Hilfe. Hatte von ebay eine Nachricht erhalten, dass jemand auf mein Konto zugreift und ich die Passwörter ändern soll. Das habe ich getan. 2 Tage später kam das gleiche. Dann wurde auch noch mein Facebook Konto gesperrt wegen Verdachts eines Virus auf meinen pc. Anscheinend ist das ein schlimmer Virus. Habe sämtlichte Virenprogramme durchlaufen lassen. Die haben nix gefunden. Nun ist doch das beste, dass ich den Laptop komplett neu installiere oder? Dafür bräuchte ich eine Schritt für Schritt Anleitung. Kann ich meine Sachen vom Laptop vorher noch irgendwie speichern ohne Mitnahme des Virus? Hoffe auf eine schnell Antwort. Vielen Dank! |
|
12.01.2014, 14:12
| #2 |
| /// TB-Ausbilder   | Virus Zeus? - will alles neu installieren - aber wie? Hi,
__________________schauen wir doch zuerst mal, was da genau los ist: Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ |
|
12.01.2014, 14:14
| #3 |
| | Virus Zeus? - will alles neu installieren - aber wie? hi,
__________________vielen dank für ihre schnelle Antwort. das werde ich jetzt machen. kleinen Moment bitte |
|
12.01.2014, 14:27
| #4 |
| /// TB-Ausbilder | Virus Zeus? - will alles neu installieren - aber wie? ok.
__________________ cheers, Leo |
|
12.01.2014, 14:58
| #5 |
| | Virus Zeus? - will alles neu installieren - aber wie? FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-01-2014
Ran by Fabi (administrator) on FABI-HP on 12-01-2014 14:26:44
Running from C:\Users\Fabi\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(HP) C:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(AMD) C:\Windows\System32\atieclxx.exe
(HP) C:\Program Files (x86)\HP SimplePass 2011\TouchControl.exe
(HP) C:\Program Files (x86)\HP SimplePass 2011\BioMonitor.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(ICQ, LLC.) C:\Program Files (x86)\ICQ7M\ICQ.exe
(Samsung) C:\Program Files (x86)\Samsung\Kies\Kies.exe
(Samsung Electronics) C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe
(Samsung) C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
(Nero AG) C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(Easybits) C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MpCmdRun.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [1128448 2011-03-11] (IDT, Inc.)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2480936 2010-12-17] (Synaptics Incorporated)
HKLM\...\Run: [MSC] - c:\Program Files\Microsoft Security Client\msseces.exe [1266912 2013-10-23] (Microsoft Corporation)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-05-20] (Intel Corporation)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-03-15] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2013-06-10] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [HPConnectionManager] - C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe [94264 2011-02-15] (Hewlett-Packard Development Company L.P.)
HKLM-x32\...\Run: [HP Quick Launch] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [586296 2010-11-09] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [Easybits Recovery] - C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [61112 2011-03-16] (EasyBits Software AS)
HKLM-x32\...\Run: [KiesTrayAgent] - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311152 2013-07-15] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [NBAgent] - C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe [1406248 2011-04-08] (Nero AG)
HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [162856 2013-03-20] (Geek Software GmbH)
HKLM-x32\...\Run: [HPOSD] - C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960 2011-08-19] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-18] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Magic Desktop for HP notification] - C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe [1258504 2013-12-30] (Easybits)
HKLM-x32\...\Run: [SDTray] - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKCU\...\Run: [ICQ] - C:\Program Files (x86)\ICQ7M\ICQ.exe [127040 2012-08-13] (ICQ, LLC.)
HKCU\...\Run: [KiesPreload] - C:\Program Files (x86)\Samsung\Kies\Kies.exe [1564016 2013-07-15] (Samsung)
HKCU\...\Run: [KiesAirMessage] - C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe [578560 2013-06-14] (Samsung Electronics)
HKCU\...\Run: [] - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844656 2013-07-15] (Samsung)
MountPoints2: H - H:\setup_vmc_lite.exe /checkApplicationPresence
MountPoints2: {0d349099-925b-11e2-a7bb-ac81129a3f40} - H:\setup_vmc_lite.exe /checkApplicationPresence
MountPoints2: {e9bcd007-01e5-11e2-8a29-101f7416856d} - F:\SETUP.EXE
MountPoints2: {f6394ad8-9257-11e2-81ef-ac81129a3f40} - H:\setup_vmc_lite.exe /checkApplicationPresence
MountPoints2: {f6394ae5-9257-11e2-81ef-ac81129a3f40} - H:\setup_vmc_lite.exe /checkApplicationPresence
MountPoints2: {f6394b15-9257-11e2-81ef-ac81129a3f40} - H:\setup_vmc_lite.exe /checkApplicationPresence
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
SearchScopes: HKLM - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKLM - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKLM - {E3CAB253-91D2-4E19-8299-9D00624396ED} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKLM-x32 - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM-x32 - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKLM-x32 - {E3CAB253-91D2-4E19-8299-9D00624396ED} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKCU - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKCU - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKCU - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKCU - {E3CAB253-91D2-4E19-8299-9D00624396ED} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
BHO: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\x64\IEBHO.dll (HP)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll No File
BHO-x32: SwissAcademic.Citavi.Picker.IEPicker - {609D670F-B735-4da7-AC6D-F3BD358E325E} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\IEBHO.dll (HP)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Nero Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask.com)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll No File
Toolbar: HKLM-x32 - Nero Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask.com)
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52920 2011-06-21] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
FireFox:
========
FF ProfilePath: C:\Users\Fabi\AppData\Roaming\Mozilla\Firefox\Profiles\ngenhx4f.default
FF Homepage: www.google.de
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1168638.dll (Adobe Systems, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.10.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Nero Toolbar - C:\Users\Fabi\AppData\Roaming\Mozilla\Firefox\Profiles\ngenhx4f.default\Extensions\toolbar@ask.com [2012-12-24]
FF Extension: DealBulldog Toolbar Toolbar - C:\Users\Fabi\AppData\Roaming\Mozilla\Firefox\Profiles\ngenhx4f.default\Extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC} [2012-09-18]
FF Extension: Bitdefender QuickScan - C:\Users\Fabi\AppData\Roaming\Mozilla\Firefox\Profiles\ngenhx4f.default\Extensions\{e001c731-5e37-4538-a5cb-8168736a2360} [2014-01-12]
FF Extension: TrueSuite Website Logon - C:\Program Files (x86)\Mozilla Firefox\extensions\websitelogon@truesuite.com [2013-07-02]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2013-07-02]
FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2012-10-17]
FF HKLM-x32\...\Firefox\Extensions: [{ACAA314B-EEBA-48e4-AD47-84E31C44796C}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\ []
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-30] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1011768 2013-12-18] (Avira Operations GmbH & Co. KG)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2013-10-23] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [348376 2013-10-23] (Microsoft Corporation)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-30] (Avira Operations GmbH & Co. KG)
S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [132608 2009-06-29] (Huawei Technologies Co., Ltd.)
S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-06-14] ()
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [248240 2013-09-27] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [134944 2013-09-27] (Microsoft Corporation)
S3 OXSDIDRV_x64; C:\Windows\System32\DRIVERS\OXSDIDRV_x64.sys [51760 2009-09-28] ()
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-01-12 14:26 - 2014-01-12 14:27 - 00018899 _____ C:\Users\Fabi\Desktop\FRST.txt
2014-01-12 14:26 - 2014-01-12 14:26 - 02075136 _____ (Farbar) C:\Users\Fabi\Desktop\FRST64.exe
2014-01-12 14:26 - 2014-01-12 14:26 - 00000000 ____D C:\FRST
2014-01-12 14:24 - 2014-01-12 14:24 - 00000000 ____D C:\Users\Fabi\Documents\My Received Files
2014-01-12 14:24 - 2014-01-12 14:24 - 00000000 ____D C:\Users\Fabi\AppData\Roaming\MusicNet
2014-01-12 14:22 - 2014-01-12 14:22 - 01431792 _____ (iMesh Inc) C:\Users\Fabi\Downloads\iMeshSetup-r1487-w-bf.exe
2014-01-12 14:17 - 2014-01-12 14:17 - 00001421 _____ C:\Users\Fabi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-01-12 12:34 - 2014-01-12 12:37 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2014-01-12 12:34 - 2014-01-12 12:34 - 00001379 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-01-12 12:34 - 2014-01-12 12:34 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking
2014-01-12 12:34 - 2014-01-12 12:34 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-01-12 12:34 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2014-01-12 12:33 - 2014-01-12 12:33 - 40658208 _____ (Safer-Networking Ltd. ) C:\Users\Fabi\Downloads\spybot-2.2.exe
2014-01-12 12:29 - 2014-01-12 12:29 - 00000000 ____D C:\Users\Fabi\AppData\Roaming\QuickScan
2014-01-12 12:06 - 2014-01-12 12:22 - 00000000 ____D C:\ProgramData\HitmanPro
2014-01-12 12:05 - 2014-01-12 12:06 - 10264904 _____ (SurfRight B.V.) C:\Users\Fabi\Downloads\hitmanpro_x64.exe
2014-01-12 11:49 - 2013-10-14 18:00 - 00028368 _____ (Microsoft Corporation) C:\Windows\system32\IEUDINIT.EXE
2014-01-12 11:31 - 2014-01-12 11:31 - 23212032 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 17142784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 12995584 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 11220992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 05765120 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 04240384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-01-12 11:31 - 2014-01-12 11:31 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-01-12 11:31 - 2014-01-12 11:31 - 02332160 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 02166272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 01993728 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-01-12 11:31 - 2014-01-12 11:31 - 01926656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-01-12 11:31 - 2014-01-12 11:31 - 01818112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 01394176 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 01228800 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 01156608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-01-12 11:31 - 2014-01-12 11:31 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2014-01-12 11:31 - 2014-01-12 11:31 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2014-01-12 11:31 - 2014-01-12 11:31 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2014-01-12 11:31 - 2014-01-12 11:31 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2014-01-12 11:31 - 2014-01-12 11:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00263376 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-01-12 11:31 - 2014-01-12 11:31 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2014-01-12 11:31 - 2014-01-12 11:31 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2014-01-12 11:31 - 2014-01-12 11:31 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2014-01-12 11:31 - 2014-01-12 11:31 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2014-01-12 11:31 - 2014-01-12 11:31 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-01-12 11:31 - 2014-01-12 11:31 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-01-12 11:31 - 2014-01-12 11:31 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-01-12 11:31 - 2014-01-12 11:31 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2014-01-12 11:31 - 2014-01-12 11:31 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2014-01-12 11:31 - 2014-01-12 11:31 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2014-01-12 11:31 - 2014-01-12 11:31 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2014-01-12 11:31 - 2014-01-12 11:31 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2014-01-12 11:31 - 2014-01-12 11:31 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2014-01-12 11:31 - 2014-01-12 11:31 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-01-12 11:31 - 2014-01-12 11:31 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2014-01-12 11:31 - 2014-01-12 11:31 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-01-12 11:31 - 2014-01-12 11:31 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2014-01-12 11:31 - 2014-01-12 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-01-12 11:26 - 2014-01-12 11:38 - 00000000 ____D C:\Users\Fabi\Desktop\Neuer Ordner (3)
2014-01-12 11:24 - 2014-01-12 11:49 - 00010974 _____ C:\Windows\IE11_main.log
2014-01-12 11:24 - 2014-01-12 11:24 - 02077392 _____ (Microsoft Corporation) C:\Users\Fabi\Downloads\IE11-Windows6.1.exe
2014-01-12 11:23 - 2014-01-12 11:23 - 00000000 ____D C:\Users\Fabi\Desktop\Bilder
2014-01-12 00:27 - 2014-01-12 00:27 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2014-01-12 00:23 - 2014-01-12 00:23 - 23867560 _____ (Mozilla) C:\Users\Fabi\Downloads\Firefox Setup 26.0.exe
2014-01-12 00:13 - 2014-01-12 00:13 - 03270504 _____ (McAfee, Inc.) C:\Users\Fabi\Downloads\McAfeeScanAndRepair1_Release.exe
2014-01-11 16:23 - 2014-01-11 16:23 - 00000000 ____D C:\Users\Fabi\AppData\Roaming\Malwarebytes
2014-01-11 16:22 - 2014-01-11 16:22 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-11 16:22 - 2014-01-11 16:22 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-11 16:22 - 2014-01-11 16:22 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-11 16:22 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-01-11 16:19 - 2014-01-11 16:19 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Fabi\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-11 14:56 - 2014-01-11 14:56 - 00001912 _____ C:\Windows\epplauncher.mif
2014-01-11 14:56 - 2014-01-11 14:56 - 00000000 ____D C:\Program Files\Microsoft Security Client
2014-01-11 14:56 - 2014-01-11 14:56 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2014-01-11 14:55 - 2014-01-11 14:55 - 13697720 _____ (Microsoft Corporation) C:\Users\Fabi\Downloads\mseinstall.exe
2013-12-30 17:11 - 2013-12-30 17:16 - 00000000 ____D C:\ProgramData\Easybits Magic Desktop for HP
==================== One Month Modified Files and Folders =======
2014-01-12 14:27 - 2014-01-12 14:26 - 00018899 _____ C:\Users\Fabi\Desktop\FRST.txt
2014-01-12 14:26 - 2014-01-12 14:26 - 02075136 _____ (Farbar) C:\Users\Fabi\Desktop\FRST64.exe
2014-01-12 14:26 - 2014-01-12 14:26 - 00000000 ____D C:\FRST
2014-01-12 14:26 - 2009-07-14 05:45 - 00031856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-12 14:26 - 2009-07-14 05:45 - 00031856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-12 14:24 - 2014-01-12 14:24 - 00000000 ____D C:\Users\Fabi\Documents\My Received Files
2014-01-12 14:24 - 2014-01-12 14:24 - 00000000 ____D C:\Users\Fabi\AppData\Roaming\MusicNet
2014-01-12 14:23 - 2011-06-21 20:41 - 00654400 _____ C:\Windows\system32\perfh007.dat
2014-01-12 14:23 - 2011-06-21 20:41 - 00130240 _____ C:\Windows\system32\perfc007.dat
2014-01-12 14:23 - 2009-07-14 06:13 - 01498742 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-12 14:22 - 2014-01-12 14:22 - 01431792 _____ (iMesh Inc) C:\Users\Fabi\Downloads\iMeshSetup-r1487-w-bf.exe
2014-01-12 14:22 - 2011-09-02 01:32 - 01486260 _____ C:\Windows\WindowsUpdate.log
2014-01-12 14:20 - 2012-08-13 21:40 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-12 14:18 - 2012-08-13 20:20 - 00000000 ____D C:\Users\Fabi\AppData\Roaming\ICQ
2014-01-12 14:17 - 2014-01-12 14:17 - 00001421 _____ C:\Users\Fabi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-01-12 14:15 - 2010-11-21 04:47 - 00463954 _____ C:\Windows\PFRO.log
2014-01-12 14:15 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-12 14:15 - 2009-07-14 05:51 - 00119860 _____ C:\Windows\setupact.log
2014-01-12 14:13 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2014-01-12 12:37 - 2014-01-12 12:34 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2014-01-12 12:34 - 2014-01-12 12:34 - 00001379 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-01-12 12:34 - 2014-01-12 12:34 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking
2014-01-12 12:34 - 2014-01-12 12:34 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-01-12 12:33 - 2014-01-12 12:33 - 40658208 _____ (Safer-Networking Ltd. ) C:\Users\Fabi\Downloads\spybot-2.2.exe
2014-01-12 12:29 - 2014-01-12 12:29 - 00000000 ____D C:\Users\Fabi\AppData\Roaming\QuickScan
2014-01-12 12:22 - 2014-01-12 12:06 - 00000000 ____D C:\ProgramData\HitmanPro
2014-01-12 12:06 - 2014-01-12 12:05 - 10264904 _____ (SurfRight B.V.) C:\Users\Fabi\Downloads\hitmanpro_x64.exe
2014-01-12 11:49 - 2014-01-12 11:24 - 00010974 _____ C:\Windows\IE11_main.log
2014-01-12 11:38 - 2014-01-12 11:26 - 00000000 ____D C:\Users\Fabi\Desktop\Neuer Ordner (3)
2014-01-12 11:31 - 2014-01-12 11:31 - 23212032 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 17142784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 12995584 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 11220992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 05765120 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 04240384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-01-12 11:31 - 2014-01-12 11:31 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-01-12 11:31 - 2014-01-12 11:31 - 02332160 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 02166272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 01993728 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-01-12 11:31 - 2014-01-12 11:31 - 01926656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-01-12 11:31 - 2014-01-12 11:31 - 01818112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 01394176 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 01228800 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 01156608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-01-12 11:31 - 2014-01-12 11:31 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2014-01-12 11:31 - 2014-01-12 11:31 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2014-01-12 11:31 - 2014-01-12 11:31 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2014-01-12 11:31 - 2014-01-12 11:31 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2014-01-12 11:31 - 2014-01-12 11:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00263376 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-01-12 11:31 - 2014-01-12 11:31 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2014-01-12 11:31 - 2014-01-12 11:31 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2014-01-12 11:31 - 2014-01-12 11:31 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2014-01-12 11:31 - 2014-01-12 11:31 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2014-01-12 11:31 - 2014-01-12 11:31 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-01-12 11:31 - 2014-01-12 11:31 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-01-12 11:31 - 2014-01-12 11:31 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-01-12 11:31 - 2014-01-12 11:31 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2014-01-12 11:31 - 2014-01-12 11:31 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2014-01-12 11:31 - 2014-01-12 11:31 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2014-01-12 11:31 - 2014-01-12 11:31 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2014-01-12 11:31 - 2014-01-12 11:31 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2014-01-12 11:31 - 2014-01-12 11:31 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2014-01-12 11:31 - 2014-01-12 11:31 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2014-01-12 11:31 - 2014-01-12 11:31 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-01-12 11:31 - 2014-01-12 11:31 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2014-01-12 11:31 - 2014-01-12 11:31 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-01-12 11:31 - 2014-01-12 11:31 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2014-01-12 11:31 - 2014-01-12 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-01-12 11:28 - 2013-10-20 14:08 - 00000000 ____D C:\Users\Fabi\AppData\Local\Google
2014-01-12 11:26 - 2013-11-10 21:41 - 00000000 ____D C:\Users\Fabi\Desktop\Neuer Ordner (2)
2014-01-12 11:24 - 2014-01-12 11:24 - 02077392 _____ (Microsoft Corporation) C:\Users\Fabi\Downloads\IE11-Windows6.1.exe
2014-01-12 11:23 - 2014-01-12 11:23 - 00000000 ____D C:\Users\Fabi\Desktop\Bilder
2014-01-12 00:27 - 2014-01-12 00:27 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2014-01-12 00:27 - 2013-07-02 22:41 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2014-01-12 00:27 - 2012-08-13 19:43 - 00001147 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-01-12 00:23 - 2014-01-12 00:23 - 23867560 _____ (Mozilla) C:\Users\Fabi\Downloads\Firefox Setup 26.0.exe
2014-01-12 00:22 - 2012-08-13 19:34 - 00003922 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{F7753B04-9AE5-44FB-84ED-0230241BF5B4}
2014-01-12 00:13 - 2014-01-12 00:13 - 03270504 _____ (McAfee, Inc.) C:\Users\Fabi\Downloads\McAfeeScanAndRepair1_Release.exe
2014-01-11 16:23 - 2014-01-11 16:23 - 00000000 ____D C:\Users\Fabi\AppData\Roaming\Malwarebytes
2014-01-11 16:22 - 2014-01-11 16:22 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-11 16:22 - 2014-01-11 16:22 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-11 16:22 - 2014-01-11 16:22 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-11 16:19 - 2014-01-11 16:19 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Fabi\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-11 14:56 - 2014-01-11 14:56 - 00001912 _____ C:\Windows\epplauncher.mif
2014-01-11 14:56 - 2014-01-11 14:56 - 00000000 ____D C:\Program Files\Microsoft Security Client
2014-01-11 14:56 - 2014-01-11 14:56 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2014-01-11 14:55 - 2014-01-11 14:55 - 13697720 _____ (Microsoft Corporation) C:\Users\Fabi\Downloads\mseinstall.exe
2014-01-11 14:51 - 2012-08-13 21:29 - 00235196 _____ C:\Windows\AutoKMS.log
2014-01-11 14:50 - 2012-08-13 19:28 - 00000000 ____D C:\Users\Fabi
2014-01-11 14:49 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\registration
2014-01-11 14:49 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\AppCompat
2013-12-30 19:28 - 2013-06-24 06:45 - 00003180 _____ C:\Windows\System32\Tasks\HPCeeScheduleForFabi
2013-12-30 19:28 - 2013-06-24 06:45 - 00000328 _____ C:\Windows\Tasks\HPCeeScheduleForFabi.job
2013-12-30 17:16 - 2013-12-30 17:11 - 00000000 ____D C:\ProgramData\Easybits Magic Desktop for HP
2013-12-30 17:11 - 2009-07-14 06:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2013-12-19 21:36 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-12-18 08:04 - 2013-07-29 10:34 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-12-18 08:04 - 2013-07-29 10:33 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-12-18 08:04 - 2013-07-29 10:33 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-12-15 23:40 - 2013-08-14 22:57 - 00000000 ____D C:\Windows\system32\MRT
2013-12-15 23:39 - 2012-08-19 13:44 - 90708896 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-12-13 08:20 - 2009-07-14 05:45 - 00433528 _____ C:\Windows\system32\FNTCACHE.DAT
Some content of TEMP:
====================
C:\Users\Fabi\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-01-11 18:21
==================== End Of Log ============================
--- --- --- Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 12-01-2014
Ran by Fabi at 2014-01-12 14:28:07
Running from C:\Users\Fabi\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Microsoft Security Essentials (Enabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F}
AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Out of date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
AS: Microsoft Security Essentials (Enabled - Up to date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
==================== Installed Programs ======================
Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.05) - Deutsch (x32 Version: 11.0.05 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.6 (x32 Version: 11.6.8.638 - Adobe Systems, Inc.)
Agatha Christie - Peril at End House (x32 Version: 2.2.0.95 - WildTangent) Hidden
ANSTOSS 3 (x32 Version: - )
Ask Toolbar (x32 Version: 1.6.9.0 - Ask.com) <==== ATTENTION
ATI Catalyst Install Manager (Version: 3.0.816.0 - ATI Technologies, Inc.)
AuthenTec TrueAPI (Version: 1.2.1.33 - AuthenTec, Inc.) Hidden
Avira Free Antivirus (x32 Version: 14.0.2.286 - Avira)
Bejeweled 2 Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Big Rig Europe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Blasterball 3 (x32 Version: 2.2.0.95 - WildTangent) Hidden
Bounce Symphony (x32 Version: 2.2.0.95 - WildTangent) Hidden
Broadcom 802.11 Wireless LAN Adapter (Version: 5.60.48.61 - Broadcom Corporation)
Cake Mania (x32 Version: 2.2.0.95 - WildTangent) Hidden
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - ATI) Hidden
Catalyst Control Center (x32 Version: 2011.0315.958.16016 - Ihr Firmenname) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2011.0315.958.16016 - ATI) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2011.0315.958.16016 - ATI Technologies, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2011.0315.958.16016 - ATI) Hidden
Catalyst Control Center Profiles Mobile (x32 Version: 2011.0315.958.16016 - ATI) Hidden
CCC Help Chinese Standard (x32 Version: 2011.0315.0957.16016 - ATI) Hidden
CCC Help Chinese Traditional (x32 Version: 2011.0315.0957.16016 - ATI) Hidden
CCC Help Czech (x32 Version: 2011.0315.0957.16016 - ATI) Hidden
CCC Help Danish (x32 Version: 2011.0315.0957.16016 - ATI) Hidden
CCC Help Dutch (x32 Version: 2011.0315.0957.16016 - ATI) Hidden
CCC Help English (x32 Version: 2011.0315.0957.16016 - ATI) Hidden
CCC Help Finnish (x32 Version: 2011.0315.0957.16016 - ATI) Hidden
CCC Help French (x32 Version: 2011.0315.0957.16016 - ATI) Hidden
CCC Help German (x32 Version: 2011.0315.0957.16016 - ATI) Hidden
CCC Help Greek (x32 Version: 2011.0315.0957.16016 - ATI) Hidden
CCC Help Hungarian (x32 Version: 2011.0315.0957.16016 - ATI) Hidden
CCC Help Italian (x32 Version: 2011.0315.0957.16016 - ATI) Hidden
CCC Help Japanese (x32 Version: 2011.0315.0957.16016 - ATI) Hidden
CCC Help Korean (x32 Version: 2011.0315.0957.16016 - ATI) Hidden
CCC Help Norwegian (x32 Version: 2011.0315.0957.16016 - ATI) Hidden
CCC Help Polish (x32 Version: 2011.0315.0957.16016 - ATI) Hidden
CCC Help Portuguese (x32 Version: 2011.0315.0957.16016 - ATI) Hidden
CCC Help Russian (x32 Version: 2011.0315.0957.16016 - ATI) Hidden
CCC Help Spanish (x32 Version: 2011.0315.0957.16016 - ATI) Hidden
CCC Help Swedish (x32 Version: 2011.0315.0957.16016 - ATI) Hidden
CCC Help Thai (x32 Version: 2011.0315.0957.16016 - ATI) Hidden
CCC Help Turkish (x32 Version: 2011.0315.0957.16016 - ATI) Hidden
ccc-utility64 (Version: 2011.0315.958.16016 - ATI) Hidden
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Cisco AnyConnect VPN Client (x32 Version: 2.5.1025 - Cisco Systems, Inc.)
Citavi (x32 Version: 3.3.0.0 - Swiss Academic Software)
Crazy Chicken Kart 2 (x32 Version: 2.2.0.95 - WildTangent) Hidden
CyberLink YouCam (x32 Version: 3.5.1.3908 - CyberLink Corp.)
CyberLink YouCam (x32 Version: 3.5.1.3908 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32 Version: - Microsoft)
Diner Dash 2 Restaurant Rescue (x32 Version: 2.2.0.95 - WildTangent) Hidden
ESU for Microsoft Windows 7 (x32 Version: 1.0.0 - Hewlett-Packard)
Farm Frenzy (x32 Version: 2.2.0.95 - WildTangent) Hidden
FATE (x32 Version: 2.2.0.95 - WildTangent) Hidden
Fishdom (x32 Version: 2.2.0.95 - WildTangent) Hidden
Free YouTube to MP3 Converter version 3.11.37.1212 (x32 Version: 3.11.37.1212 - DVDVideoSoft Ltd.)
Full Tilt Poker.Eu (x32 Version: 4.65.0.WIN.FullTilt.EU - )
FUSSBALL MANAGER 12 (x32 Version: 1.0.0.3 - Electronic Arts)
High-Definition Video Playback (x32 Version: 7.3.10800.5.0 - Nero AG) Hidden
HP 3D DriveGuard (Version: 4.1.9.1 - Hewlett-Packard Company)
HP Auto (Version: 1.0.12935.3667 - Hewlett-Packard Company) Hidden
HP Client Services (Version: 1.1.12938.3539 - Hewlett-Packard) Hidden
HP Connection Manager (x32 Version: 4.0.45.1 - Hewlett-Packard Company)
HP Customer Experience Enhancements (x32 Version: 6.0.1.7 - Hewlett-Packard) Hidden
HP Documentation (x32 Version: 1.1.0.0 - Hewlett-Packard)
HP Games (x32 Version: 1.0.2.4 - WildTangent)
HP On Screen Display (x32 Version: 1.3.5 - Hewlett-Packard Company)
HP Power Manager (x32 Version: 1.4.4 - Hewlett-Packard Company)
HP Quick Launch (x32 Version: 2.3.6 - Hewlett-Packard Company)
HP Setup (x32 Version: 8.6.4530.3651 - Hewlett-Packard Company)
HP Setup Manager (x32 Version: 1.1.13231.3673 - Hewlett-Packard Company)
HP SimplePass 2011 (x32 Version: 5.1.0.495 - Hewlett-Packard)
HP Software Framework (x32 Version: 4.1.13.1 - Hewlett-Packard Company)
ICQ7M (x32 Version: 7.8 - ICQ)
IDT Audio (x32 Version: 1.0.6329.0 - IDT)
iMesh (x32 Version: 12.5.0.134600 - iMesh Inc)
Intel(R) Control Center (x32 Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Display Audio Driver (x32 Version: 6.14.00.3074 - Intel Corporation)
Intel(R) Management Engine Components (x32 Version: 7.0.0.1144 - Intel Corporation)
Intel(R) Rapid Storage Technology (x32 Version: 10.6.0.1002 - Intel Corporation)
Iomega Encryption (Version: 1.00.0003 - Iomega an EMC Company)
Jewel Quest Solitaire (x32 Version: 2.2.0.95 - WildTangent) Hidden
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Magic Desktop (x32 Version: 3.0 - EasyBits Software AS)
Mah Jong Medley (x32 Version: 2.2.0.95 - WildTangent) Hidden
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300 - Malwarebytes Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30320 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30320 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30320 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30320 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office 2010 Service Pack 1 (SP1) (x32 Version: - Microsoft) Hidden
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint 2003 Template Pack 1 (x32 Version: 11.0.5614.0 - Microsoft Corporation)
Microsoft Office PowerPoint 2003 Template Pack 3 (x32 Version: 11.0.5614.0 - Microsoft Corporation)
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Professional 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation)
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Single Image 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Security Client (Version: 4.4.0304.0 - Microsoft Corporation) Hidden
Microsoft Security Essentials (Version: 4.4.304.0 - Microsoft Corporation)
Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable - KB2467175 (x32 Version: 8.0.51011 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0 - Mozilla)
Mozilla Maintenance Service (x32 Version: 26.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0 - Microsoft Corporation)
MyFreeCodec (HKCU Version: - )
Mystery P.I. - The London Caper (x32 Version: 2.2.0.95 - WildTangent) Hidden
Namco All-Stars PAC-MAN (x32 Version: 2.2.0.95 - WildTangent) Hidden
Nero 10 ClipartPack (x32 Version: 10.6.10000.11.0 - Nero AG)
Nero 10 Kwik Themes 1 (x32 Version: 10.6.10000.1.0 - Nero AG)
Nero 10 Kwik Themes 2 (x32 Version: 10.6.10000.2.0 - Nero AG)
Nero 10 Kwik Themes 3 (x32 Version: 10.6.10000.1.0 - Nero AG)
Nero 10 Kwik Themes 4 (x32 Version: 10.6.10000.1.0 - Nero AG)
Nero 10 Menu TemplatePack 1 (x32 Version: 10.6.10000.0.0 - Nero AG)
Nero 10 Menu TemplatePack 2 (x32 Version: 10.6.10000.0.0 - Nero AG)
Nero 10 Menu TemplatePack 3 (x32 Version: 10.6.10000.1.0 - Nero AG)
Nero 10 Menu TemplatePack Basic (x32 Version: 10.6.10000.0.0 - Nero AG) Hidden
Nero 10 Movie ThemePack Basic (x32 Version: 10.6.10000.1.0 - Nero AG) Hidden
Nero 10 PiP EffectPack 1 (x32 Version: 10.6.10000.0.0 - Nero AG)
Nero 10 Sample ImagePack (x32 Version: 10.6.10000.11.0 - Nero AG)
Nero 10 Sample Videos (x32 Version: 10.6.10000.11.0 - Nero AG)
Nero 10 Video TransitionPack 1 (x32 Version: 10.6.10000.0.0 - Nero AG)
Nero BackItUp 10 (x32 Version: 5.8.10400.4.100 - Nero AG)
Nero BackItUp 10 Help (CHM) (x32 Version: 10.6.10600 - Nero AG) Hidden
Nero Burning ROM 10 (x32 Version: 10.6.10600.4.100 - Nero AG)
Nero BurningROM 10 Help (CHM) (x32 Version: 10.6.10600 - Nero AG) Hidden
Nero BurnLite 10 (x32 Version: 10.0.10500.5.100 - Nero AG)
Nero BurnLite 10 (x32 Version: 10.0.10600 - Nero AG)
Nero BurnRights 10 (x32 Version: 4.4.10300.1.100 - Nero AG)
Nero BurnRights 10 Help (CHM) (x32 Version: 10.6.10600 - Nero AG) Hidden
Nero Control Center 10 (x32 Version: 10.6.12600.0.5 - Nero AG) Hidden
Nero ControlCenter 10 Help (CHM) (x32 Version: 1.0.10700 - Nero AG) Hidden
Nero Core Components 10 (x32 Version: 2.0.19800.9.10 - Nero AG) Hidden
Nero CoverDesigner 10 (x32 Version: 5.6.10500.3.100 - Nero AG)
Nero CoverDesigner 10 Help (CHM) (x32 Version: 10.6.10600 - Nero AG) Hidden
Nero DiscSpeed 10 (x32 Version: 6.4.10400.0.100 - Nero AG)
Nero DiscSpeed 10 Help (CHM) (x32 Version: 10.6.10600 - Nero AG) Hidden
Nero Dolby Files 10 (x32 Version: 2.0.13000.0.10 - Nero AG) Hidden
Nero Express 10 (x32 Version: 10.6.10600.4.100 - Nero AG)
Nero Express 10 Help (CHM) (x32 Version: 10.6.10600 - Nero AG) Hidden
Nero InfoTool 10 (x32 Version: 7.4.10200.0.100 - Nero AG)
Nero InfoTool 10 Help (CHM) (x32 Version: 10.6.10600 - Nero AG) Hidden
Nero Kwik Media (x32 Version: 1.6.14000.46.100 - Nero AG)
Nero Multimedia Suite 10 Platinum HD (x32 Version: 10.6.11800 - Nero AG)
Nero Recode 10 (x32 Version: 4.10.10600.4.100 - Nero AG)
Nero Recode 10 Help (CHM) (x32 Version: 10.6.10600 - Nero AG) Hidden
Nero RescueAgent 10 (x32 Version: 3.6.10500.3.100 - Nero AG)
Nero RescueAgent 10 Help (CHM) (x32 Version: 10.6.10700 - Nero AG) Hidden
Nero SoundTrax 10 (x32 Version: 4.10.10300.2.100 - Nero AG)
Nero SoundTrax 10 Help (CHM) (x32 Version: 10.6.10600 - Nero AG) Hidden
Nero StartSmart 10 (x32 Version: 10.6.10400.2.100 - Nero AG)
Nero StartSmart 10 Help (CHM) (x32 Version: 10.6.10600 - Nero AG) Hidden
Nero Update (x32 Version: 1.0.10900.31.0 - Nero AG) Hidden
Nero Vision 10 (x32 Version: 7.4.10800.7.100 - Nero AG)
Nero Vision 10 Help (CHM) (x32 Version: 10.6.10600 - Nero AG) Hidden
Nero WaveEditor 10 (x32 Version: 5.10.10400.3.100 - Nero AG)
Nero WaveEditor 10 Help (CHM) (x32 Version: 10.6.10600 - Nero AG) Hidden
NeroKwikMedia Help (CHM) (x32 Version: 10.6.10700 - Nero AG) Hidden
PDF24 Creator 5.4.0 (x32 Version: - PDF24.org)
Penguins! (x32 Version: 2.2.0.95 - WildTangent) Hidden
PixelNet Software 4.12.2 (x32 Version: 4.12.2 - ORWO Net)
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.95 - WildTangent) Hidden
Polar Bowler (x32 Version: 2.2.0.95 - WildTangent) Hidden
PX Profile Update (x32 Version: 1.00.1. - AMD) Hidden
Realtek Ethernet Controller Driver (x32 Version: 7.41.216.2011 - Realtek)
Realtek PCIE Card Reader (x32 Version: 6.1.7601.83 - Realtek Semiconductor Corp.)
Recovery Manager (x32 Version: 2.0.0 - Hewlett-Packard) Hidden
RemoteComms External Disk Access (x32 Version: 1.25.0003 - PLX Technology)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.1.19.0 - Renesas Electronics Corporation)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.1.19.0 - Renesas Electronics Corporation) Hidden
Samsung Kies (x32 Version: 2.5.0.12094_27 - Samsung Electronics Co., Ltd.)
Samsung Kies (x32 Version: 2.5.0.12094_27 - Samsung Electronics Co., Ltd.) Hidden
Samsung Story Album Viewer (x32 Version: 1.0.0.13054_1 - Samsung Electronics Co., Ltd.)
Samsung Story Album Viewer (x32 Version: 1.0.0.13054_1 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (Version: 1.5.27.0 - SAMSUNG Electronics Co., Ltd.)
Skype™ 5.10 (x32 Version: 5.10.116 - Skype Technologies S.A.)
Slingo Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Spybot - Search & Destroy (x32 Version: 2.2.25 - Safer-Networking Ltd.)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics Pointing Device Driver (Version: 15.2.4.4 - Synaptics Incorporated)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3 - Microsoft Corporation)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2553065) (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2566458) (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2687503) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Word 2010 (KB2837593) 32-Bit Edition (x32 Version: - Microsoft)
Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden
Validity WBF DDK (Version: 4.3.205.0 - Validity Sensors, Inc.)
Virtual Villagers - The Secret City (x32 Version: 2.2.0.95 - WildTangent) Hidden
Wedding Dash (x32 Version: 2.2.0.95 - WildTangent) Hidden
WildTangent Games App (HP Games) (x32 Version: 4.0.5.2 - WildTangent) Hidden
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX control for remote connections (x32 Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (x32 Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Media Player Firefox Plugin (x32 Version: 1.0.0.8 - Microsoft Corp)
WinRAR 4.20 (64-Bit) (Version: 4.20.0 - win.rar GmbH)
Zuma Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
==================== Restore Points =========================
03-01-2014 18:11:42 Windows Update
05-01-2014 18:00:21 Windows-Sicherung
07-01-2014 07:26:29 Windows Update
10-01-2014 22:18:16 Windows Update
11-01-2014 13:47:14 Wiederherstellungsvorgang
11-01-2014 13:55:20 Windows Update
12-01-2014 10:27:38 Windows Modules Installer
==================== Hosts content: ==========================
2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {12BC440A-DFCE-4137-BDB4-400CA52FE358} - System32\Tasks\ServicePlan => C:\Program Files (x86)\Hewlett-Packard\HP Setup\RemEngine.exe [2011-01-31] ()
Task: {24A9AF74-2F00-45C3-A4D3-B3B58D885140} - System32\Tasks\HPCeeScheduleForFabi => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13] (Hewlett-Packard)
Task: {2B93C8A0-668A-45FF-A04B-64B2390F8141} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2011-03-08] (CyberLink)
Task: {3A34EF4F-0C6E-4F41-A422-18E4DD9CA6CE} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe
Task: {3A7F0C74-5758-4DCC-A566-1647155C89FF} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files (x86)\Ask.com\UpdateTask.exe [2010-05-21] ()
Task: {91826CBD-B589-4446-A8D1-E0FBEA4AE77E} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe
Task: {A075B77A-BFAC-4C65-BE2B-C7BBC560A6A3} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe
Task: {A7D196DA-AD72-4201-8DB5-40A16751BC36} - System32\Tasks\Registration => C:\Program Files (x86)\Hewlett-Packard\HP Setup\RemEngine.exe [2011-01-31] ()
Task: {B3713749-5BEB-4369-A54F-D9AEDD7BE98C} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HPSAObjUtilTask => C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\UtilTask.exe
Task: {BEDE0FA3-078B-4B94-A5CE-48989D025EA6} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-11] (Adobe Systems Incorporated)
Task: {FD973B52-A9F3-434C-996B-5AA970635EA6} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\HPCeeScheduleForFabi.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
==================== Loaded Modules (whitelisted) =============
2011-09-02 01:29 - 2011-01-27 17:11 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2011-03-14 13:21 - 2011-03-14 13:21 - 00016384 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2011-03-15 08:57 - 2011-03-15 08:57 - 00243712 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2013-07-29 10:33 - 2013-07-29 10:04 - 00394824 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2014-01-12 12:34 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2014-01-12 12:34 - 2013-05-16 10:55 - 00113496 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2014-01-12 12:34 - 2013-05-16 10:55 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2014-01-12 12:34 - 2013-05-16 10:55 - 00161112 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2014-01-12 12:34 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2013-08-15 17:13 - 2013-08-15 17:13 - 00172544 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\1beb84c27c2edeb38839916524b9df4d\IsdiInterop.ni.dll
2011-09-02 01:29 - 2011-05-20 09:05 - 00059904 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2013-07-02 22:41 - 2013-12-05 20:36 - 03559024 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2012-10-17 20:23 - 2012-10-17 20:23 - 00122880 _____ () C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox\components\CitaviPickerCommunication.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
==================== Faulty Device Manager Devices =============
Name: Cisco AnyConnect VPN Virtual Miniport Adapter for Windows x64
Description: Cisco AnyConnect VPN Virtual Miniport Adapter for Windows x64
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: vpnva
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (01/12/2014 02:16:29 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (01/12/2014 02:13:25 PM) (Source: ATIeRecord) (User: )
Description: ATI EEU failed to post message to CCC
Error: (01/12/2014 02:13:25 PM) (Source: ATIeRecord) (User: )
Description: ATI EEU failed to post message to CCC
Error: (01/12/2014 02:13:25 PM) (Source: ATIeRecord) (User: )
Description: ATI EEU failed to post message to CCC
Error: (01/12/2014 02:13:25 PM) (Source: ATIeRecord) (User: )
Description: ATI EEU failed to post message to CCC
Error: (01/12/2014 02:13:25 PM) (Source: ATIeRecord) (User: )
Description: ATI EEU failed to post message to CCC
Error: (01/12/2014 11:16:10 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (01/12/2014 00:28:05 AM) (Source: ATIeRecord) (User: )
Description: ATI EEU failed to post message to CCC
Error: (01/11/2014 07:07:50 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (01/11/2014 07:05:51 PM) (Source: ATIeRecord) (User: )
Description: ATI EEU failed to post message to CCC
System errors:
=============
Error: (01/12/2014 02:13:48 PM) (Source: DCOM) (User: )
Description: {078AEF33-C48A-49F7-AFF3-A0EE810BFE7C}
Error: (01/12/2014 11:21:55 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Update" wurde nicht richtig gestartet.
Error: (01/01/2014 05:45:37 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Time" wurde nicht richtig gestartet.
Error: (12/13/2013 08:22:39 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Time" wurde nicht richtig gestartet.
Error: (12/13/2013 08:22:30 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Time" wurde nicht richtig gestartet.
Error: (12/13/2013 08:19:15 AM) (Source: Microsoft-Windows-LanguagePackSetup) (User: NT-AUTORITÄT)
Description: Fehler bei der CBS-Clientinitialisierung. Letzter Fehler: 0x8007045b
Error: (12/13/2013 08:18:37 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Time" wurde nicht richtig gestartet.
Error: (12/06/2013 08:20:04 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Time" wurde nicht richtig gestartet.
Error: (11/23/2013 11:04:00 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Time" wurde nicht richtig gestartet.
Error: (11/23/2013 02:08:13 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst HPWMISVC erreicht.
Microsoft Office Sessions:
=========================
Error: (01/12/2014 02:16:29 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (01/12/2014 02:13:25 PM) (Source: ATIeRecord)(User: )
Description:
Error: (01/12/2014 02:13:25 PM) (Source: ATIeRecord)(User: )
Description:
Error: (01/12/2014 02:13:25 PM) (Source: ATIeRecord)(User: )
Description:
Error: (01/12/2014 02:13:25 PM) (Source: ATIeRecord)(User: )
Description:
Error: (01/12/2014 02:13:25 PM) (Source: ATIeRecord)(User: )
Description:
Error: (01/12/2014 11:16:10 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (01/12/2014 00:28:05 AM) (Source: ATIeRecord)(User: )
Description:
Error: (01/11/2014 07:07:50 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (01/11/2014 07:05:51 PM) (Source: ATIeRecord)(User: )
Description:
CodeIntegrity Errors:
===================================
Date: 2013-07-24 15:44:18.691
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-07-24 15:44:18.647
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-07-24 15:44:16.559
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-07-24 15:44:16.514
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-07-24 15:44:14.418
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-07-24 15:44:14.372
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-07-24 15:44:12.267
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-07-24 15:44:12.222
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-07-24 15:44:10.121
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-07-24 15:44:10.077
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Percentage of memory in use: 47%
Total physical RAM: 4043.86 MB
Available physical RAM: 2141.39 MB
Total Pagefile: 8085.9 MB
Available Pagefile: 5320.11 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:450.4 GB) (Free:365.79 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (RECOVERY) (Fixed) (Total:15.06 GB) (Free:1.61 GB) NTFS ==>[System with boot components (obtained from reading drive)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 21053EDB)
Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=450 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=15 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=103 MB) - (Type=0C)
==================== End Of Log ============================
|
|
12.01.2014, 15:57
| #6 |
| /// TB-Ausbilder | Virus Zeus? - will alles neu installieren - aber wie? Ich seh da keine Anzeichen für Malware.. Benutzt du noch andere Rechner?
__________________ --> Virus Zeus? - will alles neu installieren - aber wie? |
|
12.01.2014, 16:45
| #7 |
| | Virus Zeus? - will alles neu installieren - aber wie? habe noch ein tablet. was hat es dann mit der Facebook sperrung auf sich? egal von wo ich mich einloggen will, kommt folgende Fehlermeldung: Aus Sicherheitsgründen wurde dein Konto vorübergehend gesperrt. Leider ist dein Computer wahrscheinlich mit einem Virus infiziert. Keine Sorge. Wir helfen dir bei der Feststellung und dem Entfernen der infizierten Dateien.* Dann wollen die, dass ich MCAffee runterlade, aber das funktioniert da nicht. Haben Sie noch weitere Ideen? |
|
12.01.2014, 16:50
| #8 |
| /// TB-Ausbilder | Virus Zeus? - will alles neu installieren - aber wie? ok. Scan mit Combofix
__________________ cheers, Leo |
|
12.01.2014, 17:23
| #9 |
| | Virus Zeus? - will alles neu installieren - aber wie?Code:
ATTFilter ComboFix 14-01-08.03 - Fabi 12.01.2014 17:08:12.1.8 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.4044.1924 [GMT 1:00]
ausgeführt von:: c:\users\Fabi\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Spybot - Search and Destroy *Disabled/Outdated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Fabi\AppData\Local\Microsoft\Windows\Temporary Internet Files\{047C022B-C226-4A66-BB12-E3886A80E437}.xps
c:\users\Fabi\AppData\Local\Microsoft\Windows\Temporary Internet Files\{2532A113-C4B8-4B86-AD0A-1F1D7C342092}.xps
c:\users\Fabi\AppData\Local\Microsoft\Windows\Temporary Internet Files\{2ED1225F-A6C1-4115-87C9-983D4A1CD4C8}.xps
c:\users\Fabi\AppData\Local\Microsoft\Windows\Temporary Internet Files\{455E018C-7E74-42C0-99C2-2C567990875F}.xps
c:\users\Fabi\AppData\Local\Microsoft\Windows\Temporary Internet Files\{821ECF58-D45C-42AC-B9ED-9E51D9DB3CB2}.xps
c:\users\Fabi\AppData\Local\Microsoft\Windows\Temporary Internet Files\{B15B66F8-7C1E-4EAF-94D0-26DA904D98F4}.xps
c:\users\Fabi\AppData\Local\Microsoft\Windows\Temporary Internet Files\{E176BFE3-353A-4758-9B60-C254111FDB80}.xps
c:\users\Fabi\AppData\Local\Microsoft\Windows\Temporary Internet Files\{E66EC3FB-01AA-4B60-A0D6-17E7BC428AD3}.xps
c:\users\Fabi\AppData\Local\Microsoft\Windows\Temporary Internet Files\{F52371F6-D10E-4694-ACC3-77E43440A1A3}.xps
c:\users\Fabi\AppData\Local\TempFullTiltPokerEuSetup.exe
c:\windows\wininit.ini
.
.
((((((((((((((((((((((((((((((((((((((( Treiber/Dienste )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_vpnagent
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-12-12 bis 2014-01-12 ))))))))))))))))))))))))))))))
.
.
2014-01-12 14:21 . 2014-01-12 14:24 -------- d-----w- C:\AdwCleaner
2014-01-12 13:26 . 2014-01-12 13:26 -------- d-----w- C:\FRST
2014-01-12 13:24 . 2014-01-12 13:24 -------- d-----w- c:\users\Fabi\AppData\Roaming\MusicNet
2014-01-12 11:34 . 2014-01-12 16:06 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2014-01-12 11:34 . 2014-01-12 16:14 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy 2
2014-01-12 11:29 . 2014-01-12 11:29 -------- d-----w- c:\users\Fabi\AppData\Roaming\QuickScan
2014-01-12 11:06 . 2014-01-12 11:22 -------- d-----w- c:\programdata\HitmanPro
2014-01-12 10:49 . 2013-10-14 17:00 28368 ----a-w- c:\windows\system32\IEUDINIT.EXE
2014-01-11 23:27 . 2014-01-11 23:27 -------- d-----w- c:\program files (x86)\Mozilla Maintenance Service
2014-01-11 15:23 . 2014-01-11 15:23 -------- d-----w- c:\users\Fabi\AppData\Roaming\Malwarebytes
2014-01-11 15:22 . 2014-01-11 15:22 -------- d-----w- c:\programdata\Malwarebytes
2014-01-11 13:56 . 2013-12-04 03:28 10315576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{89F96702-5F93-41D7-9CAE-0AC9FE834335}\mpengine.dll
2013-12-30 16:11 . 2013-12-30 16:16 -------- d-----w- c:\programdata\Easybits Magic Desktop for HP
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-12-18 07:04 . 2013-07-29 09:34 84720 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2013-12-18 07:04 . 2013-07-29 09:33 131576 ----a-w- c:\windows\system32\drivers\avipbb.sys
2013-12-18 07:04 . 2013-07-29 09:33 108440 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2013-12-15 22:39 . 2012-08-19 12:44 90708896 ----a-w- c:\windows\system32\MRT.exe
2013-12-11 20:20 . 2012-08-13 20:40 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-12-11 20:20 . 2012-08-13 20:40 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-11-30 08:49 . 2013-07-29 09:33 28600 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2013-11-23 18:26 . 2013-12-12 19:29 417792 ----a-w- c:\windows\SysWow64\WMPhoto.dll
2013-11-23 17:47 . 2013-12-12 19:29 465920 ----a-w- c:\windows\system32\WMPhoto.dll
2013-11-19 10:21 . 2010-11-21 03:27 267936 ------w- c:\windows\system32\MpSigStub.exe
2013-11-12 02:23 . 2013-12-12 19:29 2048 ----a-w- c:\windows\system32\tzres.dll
2013-11-12 02:07 . 2013-12-12 19:29 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2013-10-30 02:32 . 2013-12-12 19:29 335360 ----a-w- c:\windows\system32\msieftp.dll
2013-10-30 02:19 . 2013-12-12 19:29 301568 ----a-w- c:\windows\SysWow64\msieftp.dll
2013-10-30 01:24 . 2013-12-12 19:29 3155968 ----a-w- c:\windows\system32\win32k.sys
2013-10-28 00:12 . 2013-10-28 00:12 204568 ----a-w- c:\windows\system32\drivers\ssudmdm.sys
2013-10-28 00:12 . 2013-10-28 00:12 107288 ----a-w- c:\windows\system32\drivers\ssudbus.sys
2013-10-19 02:18 . 2013-12-12 19:29 81408 ----a-w- c:\windows\system32\imagehlp.dll
2013-10-19 01:36 . 2013-12-12 19:29 159232 ----a-w- c:\windows\SysWow64\imagehlp.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ICQ"="c:\program files (x86)\ICQ7M\ICQ.exe" [2012-08-13 127040]
"KiesPreload"="c:\program files (x86)\Samsung\Kies\Kies.exe" [2013-07-15 1564016]
"KiesAirMessage"="c:\program files (x86)\Samsung\Kies\KiesAirMessage.exe" [2013-06-14 578560]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-05-20 284440]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-03-15 336384]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2013-06-10 113288]
"HPConnectionManager"="c:\program files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe" [2011-02-15 94264]
"HP Quick Launch"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" [2010-11-09 586296]
"Easybits Recovery"="c:\program files (x86)\EasyBits For Kids\ezRecover.exe" [2011-03-16 61112]
"KiesTrayAgent"="c:\program files (x86)\Samsung\Kies\KiesTrayAgent.exe" [2013-07-15 311152]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"NBAgent"="c:\program files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe" [2011-04-08 1406248]
"PDFPrint"="c:\program files (x86)\PDF24\pdf24.exe" [2013-03-20 162856]
"HPOSD"="c:\program files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe" [2011-08-19 379960]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-12-18 684600]
"Magic Desktop for HP notification"="c:\programdata\Easybits Magic Desktop for HP\mdhpSUN.exe" [2013-12-30 1258504]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"EnableShellExecuteHooks"= 1 (0x1)
.
[hkey_local_machine\software\Wow6432Node\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean64.exe
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]
@=""
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys;c:\windows\SYSNATIVE\DRIVERS\ewusbnet.sys [x]
R3 FsUsbExDisk;FsUsbExDisk;c:\windows\SysWOW64\FsUsbExDisk.SYS;c:\windows\SysWOW64\FsUsbExDisk.SYS [x]
R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [x]
R3 hpCMSrv;HP Connection Manager 4.0 Service;c:\program files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe;c:\program files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe [x]
R3 hwusbfake;Huawei DataCard USB Fake;c:\windows\system32\DRIVERS\ewusbfake.sys;c:\windows\SYSNATIVE\DRIVERS\ewusbfake.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 OXSDIDRV_x64;Oxford Semi eSATA Filter (x64);c:\windows\system32\DRIVERS\OXSDIDRV_x64.sys;c:\windows\SYSNATIVE\DRIVERS\OXSDIDRV_x64.sys [x]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTAZL6.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTDPV6.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTCNXT6.SYS [x]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssadbus.sys [x]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys;c:\windows\SYSNATIVE\DRIVERS\ssadmdfl.sys [x]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssadmdm.sys [x]
R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;%TsUsbGD.DeviceDesc.Generic%;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R4 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe;c:\program files\IDT\WDM\AESTSr64.exe [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 ezSharedSvc;Easybits Services for Windows;c:\windows\System32\ezSharedSvcHost.exe;c:\windows\SYSNATIVE\ezSharedSvcHost.exe [x]
S2 FPLService;TrueSuiteService;c:\program files (x86)\HP SimplePass 2011\TrueSuiteService.exe;c:\program files (x86)\HP SimplePass 2011\TrueSuiteService.exe [x]
S2 HPClientSvc;HP Client Services;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe [x]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe;c:\windows\SYSNATIVE\Hpservice.exe [x]
S2 HPWMISVC;HPWMISVC;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 IconMan_R;IconMan_R;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [x]
S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe;c:\program files (x86)\Nero\Update\NASvc.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys;c:\windows\SYSNATIVE\DRIVERS\clwvd.sys [x]
S3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 intelkmd;intelkmd;c:\windows\system32\DRIVERS\igdpmd64.sys;c:\windows\SYSNATIVE\DRIVERS\igdpmd64.sys [x]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x]
S3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys;c:\windows\SYSNATIVE\DRIVERS\RtsPStor.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
Inhalt des "geplante Tasks" Ordners
.
2014-01-12 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-13 20:20]
.
2013-12-30 c:\windows\Tasks\HPCeeScheduleForFabi.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13 20:15]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-01-27 167960]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-01-27 391704]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-01-27 418328]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2011-03-11 1128448]
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: An OneNote s&enden - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: Free YouTube to MP3 Converter - c:\users\Fabi\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: {{781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - c:\program files (x86)\ICQ7M\ICQ.exe
LSP: c:\program files (x86)\Avira\AntiVir Desktop\avsda.dll
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\Fabi\AppData\Roaming\Mozilla\Firefox\Profiles\ngenhx4f.default\
FF - prefs.js: browser.startup.homepage - www.google.de
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-EasyBits Magic Desktop - c:\windows\system32\ezMDUninstall.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{8DCB7100-DF86-4384-8842-8FA844297B3F}"=hex:51,66,7a,6c,4c,1d,38,12,6e,72,d8,
89,b4,91,ea,06,f7,54,cc,e8,41,77,3f,2b
"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,
1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7
"{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}"=hex:51,66,7a,6c,4c,1d,38,12,d5,94,07,
72,c2,98,42,03,c9,fd,97,9a,f4,87,69,57
"{8590886E-EC8C-43C1-A32C-E4C2B0B6395B}"=hex:51,66,7a,6c,4c,1d,38,12,00,8b,83,
81,be,a2,af,06,dc,3a,a7,82,b5,e8,7d,4f
"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,
94,30,02,d1,0f,f1,da,12,24,73,56,27,d2
"{B4F3A835-0E21-4959-BA22-42B3008E02FF}"=hex:51,66,7a,6c,4c,1d,38,12,5b,ab,e0,
b0,13,40,37,0c,c5,34,01,f3,05,d0,46,eb
"{D2CE3E00-F94A-4740-988E-03DC2F38C34F}"=hex:51,66,7a,6c,4c,1d,38,12,6e,3d,dd,
d6,78,b7,2e,02,e7,98,40,9c,2a,66,87,5b
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,
df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (LocalSystem)
"Timestamp"=hex:e0,29,9f,bb,9c,ac,cd,01
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,5f,d1,9c,8a,d7,e5,ea,41,a3,d2,04,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,5f,d1,9c,8a,d7,e5,ea,41,a3,d2,04,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_170_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_170_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0008\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\windows\SysWOW64\ezSharedSvcHost.exe
c:\program files (x86)\CyberLink\YouCam\YCMMirage.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\program files (x86)\Avira\AntiVir Desktop\update.exe
c:\program files (x86)\Avira\AntiVir Desktop\updrgui.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2014-01-12 17:19:58 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2014-01-12 16:19
.
Vor Suchlauf: 15 Verzeichnis(se), 392.862.904.320 Bytes frei
Nach Suchlauf: 24 Verzeichnis(se), 393.511.010.304 Bytes frei
.
- - End Of File - - 280F401B6EE7B9FD5AB3C63C62233511
|
|
12.01.2014, 17:47
| #10 |
| /// TB-Ausbilder | Virus Zeus? - will alles neu installieren - aber wie? Schritt 1
Schritt 2 ESET Online Scanner
__________________ cheers, Leo |
|
12.01.2014, 19:20
| #11 |
| | Virus Zeus? - will alles neu installieren - aber wie? Schritt 1 Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2014.01.12.05 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 11.0.9600.16428 Fabi :: FABI-HP [Administrator] Schutz: Aktiviert 12.01.2014 17:52:37 mbam-log-2014-01-12 (17-52-37).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 216045 Laufzeit: 4 Minute(n), 59 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 1 C:\Users\Fabi\Downloads\iMeshSetup-r1487-w-bf.exe (PUP.Optional.Bandoo.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=9ea6acd96d57ea4d970b84e3478afcab
# engine=16622
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-01-12 06:15:15
# local_time=2014-01-12 07:15:15 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 94 10514 160221820 3287 0
# compatibility_mode=5893 16776573 100 94 17596 141180365 0 0
# scanned=201078
# found=0
# cleaned=0
# scan_time=4143
|
|
12.01.2014, 19:45
| #12 |
| /// TB-Ausbilder | Virus Zeus? - will alles neu installieren - aber wie? Ich kann im Moment auf diesem Rechner keine Malware sehen. Willst du trotzdem neu installieren? Dann ist das eine Anleitung: http://www.trojaner-board.de/51262-a...sicherung.html
__________________ cheers, Leo |
|
12.01.2014, 19:48
| #13 |
| | Virus Zeus? - will alles neu installieren - aber wie? ich weiß halt nicht wieso mein facebook konto gesperrt wurde und sagt, dass es sich um einen Virus handelt. Meinen Sie ich sollte den Laptop neu installieren oder hätten Sie den Virus sonst erkannt? |
|
12.01.2014, 19:59
| #14 |
| /// TB-Ausbilder | Virus Zeus? - will alles neu installieren - aber wie? Hast du die Meldung von Ebay noch? Was stand dort genau drin? Und wie kommst du darauf, dass Zeus da mit im Spiel ist?
__________________ cheers, Leo |
|
12.01.2014, 22:42
| #15 |
| | Virus Zeus? - will alles neu installieren - aber wie? betreff war: MC010 Nicht autorisierte Nutzung Ihres Kontos dort stand halt auch mein vollständiger Name und alles. das sah alles sehr echt aus. habe die mails leider schon gelöscht. in der Mail stand, dass ich zuerst mein passwort von der mail ändern sollte und dann als nächstes das passwort bei ebay ändern. Das habe ich auch getan. Und ein tag später kam dann halt bei facebook auch die Meldung mit der Sperrung wegen nem Virus. Wie kann ich das wieder beheben? wenn ich mich facebook einloggen möchte, erfolgt folgende fehlermeldung: Aus Sicherheitsgründen wurde dein Konto vorübergehend gesperrt Leider ist dein Computer wahrscheinlich mit einem Virus infiziert. Keine Sorge. Wir helfen dir bei der Feststellung und dem Entfernen der infizierten Dateien. Haben Sie noch eine Lösung? |
|
| Themen zu Virus Zeus? - will alles neu installieren - aber wie? |
| benötige, beste, bräuchte, dringend, ebay, erhalte, erhalten, gesperrt, installieren, komplett, konto, laptop, nachricht, neu, passwörter, programme, sache, sachen, schei, schlimmer, schnell, speicher, speichern, virenprogramme, virus, ändern |
WARNUNG an die MITLESER: 
Linear-Darstellung
