| |
| |||||||
Log-Analyse und Auswertung: Windows 7: Trojaner Rechnung.exeWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
23.04.2014, 19:32
| #1 |
| |  Windows 7: Trojaner Rechnung.exe Hallo liebe Forummitglieder, am 22.04.2014 um ca. 12.00 Uhr, habe ich in meinem E-Mail Konto folgende Nachricht vorgefunden: "Guten Tag. Im Anhang senden wir Ihnen Ihre aktuelle Rechnung. Der offene Betrag ist innerhalb von 10 Tagen zu begleichen. BpayAG" Im Anhang befand sich die Datei "Rechnung.exe" auf die ich dummerweise drauf klickte. Sofort meldete AntiVir, dass ein unerwünschtes Programm gefunden wurde. Daraufhin habe ich den Antivir Suchlauf gestartet, die Datei Rechnung.exe aus dem Downloadorder gelöscht, sowie Spybot und Adware durchlaufen lassen. Es wurden einige unerwünschte Programme gefunden, allerdings kann ich nicht mit Sicherheit sagen, dass der Trojaner dadurch komplett entfernt wurde. defogger-disable Log: Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 19:24 on 23/04/2014 (Nati)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-04-2014
Ran by Nati (administrator) on NATIS-COMPUTER on 23-04-2014 19:27:23
Running from C:\Users\Nati\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE
() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe
() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTray.exe
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_IATIILE.EXE
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_IATIILE.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Logitech Inc.) C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\Logishrd\LVMVFM\LVPrS64H.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe
(Seiko Epson Corporation) C:\Windows\system32\EscSvc64.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Google Inc.) C:\Users\Nati\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Nati\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Nati\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Nati\AppData\Local\Google\Chrome\Application\chrome.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Google Inc.) C:\Users\Nati\AppData\Local\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\system32\wbem\WMIADAP.EXE
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-04] (Intel Corporation)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [AdAwareTray] => C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTray.exe [4114264 2014-01-23] ()
HKLM-x32\...\Run: [JMB36X IDE Setup] => C:\Windows\RaidTool\xInsIDE.exe [36864 2007-03-20] ()
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [1058400 2011-10-31] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-3307610919-556288989-4226615614-1001\...\Run: [EPLTarget\P0000000000000000] => C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIILE.EXE [283232 2012-02-29] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-3307610919-556288989-4226615614-1001\...\Run: [EPLTarget\P0000000000000001] => C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIILE.EXE [283232 2012-02-29] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-3307610919-556288989-4226615614-1001\...\MountPoints2: {1d904b8b-84db-11e2-a10c-90fba64a5443} - F:\Autorun.exe
HKU\S-1-5-21-3307610919-556288989-4226615614-1001\...\MountPoints2: {23c0297d-97bb-11e1-9b8d-90fba64a5443} - L:\autorun.exe
HKU\S-1-5-21-3307610919-556288989-4226615614-1001\...\MountPoints2: {8673ec96-fc40-11e1-b030-90fba64a5443} - F:\Setup.exe
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=DE&userid=164dd9c1-2303-4165-840a-8a30c04e3fe5&searchtype=ds&q={searchTerms}
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com/?ctid=CT3319434&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SP3D838B47-016E-47AD-AA0C-4C8B68E7EEA6&SSPV=
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xCD6245081482CD01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=DE&userid=164dd9c1-2303-4165-840a-8a30c04e3fe5&searchtype=ds&q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=DE&userid=164dd9c1-2303-4165-840a-8a30c04e3fe5&searchtype=ds&q={searchTerms}
SearchScopes: HKLM-x32 - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=DE&userid=164dd9c1-2303-4165-840a-8a30c04e3fe5&searchtype=ds&q={searchTerms}
SearchScopes: HKCU - DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?ctid=CT3319434&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SP3D838B47-016E-47AD-AA0C-4C8B68E7EEA6&q={searchTerms}&SSPV=
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=DE&userid=164dd9c1-2303-4165-840a-8a30c04e3fe5&searchtype=ds&q={searchTerms}
SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?ctid=CT3319434&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SP3D838B47-016E-47AD-AA0C-4C8B68E7EEA6&q={searchTerms}&SSPV=
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.)
BHO-x32: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)
Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
Toolbar: HKLM-x32 - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @java.com/DTPlugin,version=10.11.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.11.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.3 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Nati\AppData\Local\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Nati\AppData\Local\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF HKLM-x32\...\Firefox\Extensions: [{ACAA314B-EEBA-48e4-AD47-84E31C44796C}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\ []
Chrome:
=======
CHR Extension: (Adblock Plus) - C:\Users\Nati\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-04-22]
CHR Extension: (AdBlock) - C:\Users\Nati\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-04-22]
CHR Extension: (DVDVideoSoft Browser Extension) - C:\Users\Nati\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp [2013-02-22]
CHR Extension: (Google Wallet) - C:\Users\Nati\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-02]
CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\DVDVideoSoftBrowserExtension.crx [2013-02-22]
==================== Services (Whitelisted) =================
R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 EpsonScanSvc; C:\Windows\system32\EscSvc64.exe [135824 2011-12-12] (Seiko Epson Corporation)
R2 LavasoftAdAwareService11; C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe [702744 2014-01-23] ()
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe [2138936 2014-03-20] (TuneUp Software)
==================== Drivers (Whitelisted) ====================
S3 Asushwio; C:\Windows\SysWOW64\drivers\Asushwio.sys [5824 2000-03-29] ()
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [88480 2013-05-10] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-12] (Avira Operations GmbH & Co. KG)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [46400 2013-05-10] ()
R3 LVPr2M64; C:\Windows\System32\DRIVERS\LVPr2M64.sys [30304 2010-05-07] ()
S3 LVPr2Mon; C:\Windows\System32\DRIVERS\LVPr2M64.sys [30304 2010-05-07] ()
R3 Trufos; C:\Windows\System32\DRIVERS\Trufos.sys [329800 2013-07-17] (BitDefender S.R.L.)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [14112 2014-02-10] (TuneUp Software)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-04-23 19:27 - 2014-04-23 19:28 - 00013198 _____ () C:\Users\Nati\Desktop\FRST.txt
2014-04-23 19:27 - 2014-04-23 19:27 - 00000000 ____D () C:\FRST
2014-04-23 19:25 - 2014-04-23 19:25 - 02061312 _____ (Farbar) C:\Users\Nati\Desktop\FRST64.exe
2014-04-23 19:23 - 2014-04-23 19:24 - 00000470 _____ () C:\Users\Nati\Desktop\defogger_disable.log
2014-04-23 19:23 - 2014-04-23 19:23 - 00000000 _____ () C:\Users\Nati\defogger_reenable
2014-04-23 19:04 - 2014-04-23 19:04 - 00021008 _____ () C:\Users\Nati\Desktop\Ereignisse.txt
2014-04-23 00:45 - 2014-04-23 00:45 - 00002770 _____ () C:\Windows\System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013
2014-04-22 23:41 - 2014-04-22 23:41 - 00001379 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-04-22 23:41 - 2014-04-22 23:41 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-04-22 23:41 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2014-04-22 23:37 - 2014-04-22 23:37 - 00000085 _____ () C:\Windows\wininit.ini
2014-04-22 23:36 - 2014-04-22 23:36 - 00000000 ____D () C:\Users\Nati\AppData\Roaming\LavasoftStatistics
2014-04-22 23:23 - 2014-04-23 19:22 - 00002305 _____ () C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
2014-04-22 23:23 - 2014-04-22 23:23 - 00000000 ____D () C:\Program Files\Lavasoft
2014-04-22 23:21 - 2014-04-22 23:22 - 40658208 _____ (Safer-Networking Ltd. ) C:\Users\Nati\Downloads\spybot-2.2.25.exe
2014-04-22 23:21 - 2014-04-22 23:21 - 00000000 ____D () C:\Users\Nati\AppData\Roaming\Lavasoft
2014-04-22 23:21 - 2014-04-22 23:21 - 00000000 ____D () C:\Program Files\Common Files\Lavasoft
2014-04-22 23:20 - 2014-04-22 23:20 - 01727624 _____ () C:\Users\Nati\Downloads\Adaware_Installer.exe
2014-04-22 23:20 - 2014-04-22 23:20 - 00000000 ____D () C:\ProgramData\Lavasoft
2014-04-22 21:23 - 2014-04-23 19:21 - 00004468 _____ () C:\Windows\PFRO.log
2014-04-22 12:52 - 2014-04-23 19:21 - 00000448 _____ () C:\Windows\setupact.log
2014-04-22 12:52 - 2014-04-22 12:52 - 00002209 _____ () C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk
2014-04-22 12:52 - 2014-04-22 12:52 - 00000000 _____ () C:\Windows\setuperr.log
2014-04-22 12:52 - 2014-03-20 14:44 - 00040760 _____ (TuneUp Software) C:\Windows\system32\TURegOpt.exe
2014-04-22 12:52 - 2014-03-20 14:44 - 00029496 _____ (TuneUp Software) C:\Windows\system32\authuitu.dll
2014-04-22 12:52 - 2014-03-20 14:44 - 00025400 _____ (TuneUp Software) C:\Windows\SysWOW64\authuitu.dll
2014-04-22 12:51 - 2014-04-22 12:52 - 00000000 ____D () C:\Program Files (x86)\TuneUp Utilities 2014
2014-04-22 12:51 - 2014-04-22 12:51 - 00000000 ____D () C:\Users\Nati\AppData\Local\TuneUp Software
2014-04-22 12:49 - 2014-04-22 12:58 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-04-22 12:48 - 2014-04-22 12:48 - 06685392 _____ (Glarysoft Ltd ) C:\Users\Nati\Downloads\gusetup_slim_2.56.exe
2014-04-22 12:47 - 2014-04-22 12:48 - 27878824 _____ (TuneUp Software) C:\Users\Nati\Downloads\TuneUpUtilities2014_de2745-DE.exe
2014-04-21 19:32 - 2014-04-21 19:32 - 00000661 _____ () C:\Users\Nati\Desktop\lol.launcher.admin - Verknüpfung.lnk
2014-04-19 18:23 - 2014-04-19 18:23 - 00001210 _____ () C:\Users\Nati\Desktop\TeamSpeak 3 Client.lnk
2014-04-19 18:23 - 2014-04-19 18:23 - 00000000 ____D () C:\Users\Nati\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
2014-04-19 18:21 - 2014-04-19 18:22 - 27601296 _____ (TeamSpeak Systems GmbH) C:\Users\Nati\Downloads\TeamSpeak3-Client-win32-3.0.14 (1).exe
2014-04-16 11:39 - 2011-04-18 18:03 - 00120320 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\E_ILMILE.DLL
2014-04-16 11:39 - 2011-03-13 18:03 - 00083968 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\E_IBCBILE.DLL
2014-04-10 07:07 - 2014-03-31 03:16 - 23134208 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-10 07:07 - 2014-03-31 03:13 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-10 07:07 - 2014-03-31 02:13 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-10 07:07 - 2014-03-31 01:57 - 17073152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-10 07:07 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-10 07:07 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-10 07:07 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-10 07:07 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-10 07:07 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-10 07:07 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-10 07:07 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-10 07:07 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-10 07:07 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-10 07:07 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-10 07:07 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-04-10 07:07 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-10 07:07 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-10 07:07 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-10 07:07 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-10 07:07 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-04-10 07:07 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-04-08 16:22 - 2014-04-08 16:22 - 05260387 _____ () C:\Users\Nati\Downloads\Kinderhaus Wiesenborn.zip
2014-04-06 22:59 - 2014-04-06 22:59 - 00001060 _____ () C:\Users\Public\Desktop\MF Shutdown Manager.lnk
2014-04-06 22:59 - 2014-04-06 22:59 - 00000000 ____D () C:\Program Files (x86)\MF Shutdown Manager
2014-03-30 15:56 - 2014-03-30 15:56 - 00376288 _____ () C:\Users\Nati\Downloads\MediaPlayerClassic.exe
==================== One Month Modified Files and Folders =======
2014-04-23 19:28 - 2014-04-23 19:27 - 00013198 _____ () C:\Users\Nati\Desktop\FRST.txt
2014-04-23 19:27 - 2014-04-23 19:27 - 00000000 ____D () C:\FRST
2014-04-23 19:27 - 2012-07-12 17:56 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-23 19:27 - 2009-07-14 19:58 - 00699432 _____ () C:\Windows\system32\perfh007.dat
2014-04-23 19:27 - 2009-07-14 19:58 - 00149572 _____ () C:\Windows\system32\perfc007.dat
2014-04-23 19:27 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-23 19:25 - 2014-04-23 19:25 - 02061312 _____ (Farbar) C:\Users\Nati\Desktop\FRST64.exe
2014-04-23 19:25 - 2014-02-11 14:49 - 01813743 _____ () C:\Windows\WindowsUpdate.log
2014-04-23 19:24 - 2014-04-23 19:23 - 00000470 _____ () C:\Users\Nati\Desktop\defogger_disable.log
2014-04-23 19:23 - 2014-04-23 19:23 - 00000000 _____ () C:\Users\Nati\defogger_reenable
2014-04-23 19:23 - 2012-02-10 17:51 - 00000000 ____D () C:\Users\Nati
2014-04-23 19:22 - 2014-04-22 23:23 - 00002305 _____ () C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
2014-04-23 19:21 - 2014-04-22 21:23 - 00004468 _____ () C:\Windows\PFRO.log
2014-04-23 19:21 - 2014-04-22 12:52 - 00000448 _____ () C:\Windows\setupact.log
2014-04-23 19:21 - 2012-02-11 22:15 - 00000000 ____D () C:\Windows\SysWOW64\logishrd
2014-04-23 19:21 - 2012-02-11 22:15 - 00000000 ____D () C:\Windows\system32\logishrd
2014-04-23 19:21 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-23 19:20 - 2013-01-29 19:29 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3307610919-556288989-4226615614-1001UA.job
2014-04-23 19:04 - 2014-04-23 19:04 - 00021008 _____ () C:\Users\Nati\Desktop\Ereignisse.txt
2014-04-23 19:03 - 2009-07-14 06:45 - 00018960 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-23 19:03 - 2009-07-14 06:45 - 00018960 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-23 16:48 - 2014-03-04 20:18 - 00000000 ____D () C:\Users\Nati\AppData\Local\Battle.net
2014-04-23 16:25 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\system32\FxsTmp
2014-04-23 00:45 - 2014-04-23 00:45 - 00002770 _____ () C:\Windows\System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013
2014-04-22 23:41 - 2014-04-22 23:41 - 00001379 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-04-22 23:41 - 2014-04-22 23:41 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-04-22 23:41 - 2012-02-16 20:26 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-04-22 23:37 - 2014-04-22 23:37 - 00000085 _____ () C:\Windows\wininit.ini
2014-04-22 23:36 - 2014-04-22 23:36 - 00000000 ____D () C:\Users\Nati\AppData\Roaming\LavasoftStatistics
2014-04-22 23:23 - 2014-04-22 23:23 - 00000000 ____D () C:\Program Files\Lavasoft
2014-04-22 23:22 - 2014-04-22 23:21 - 40658208 _____ (Safer-Networking Ltd. ) C:\Users\Nati\Downloads\spybot-2.2.25.exe
2014-04-22 23:21 - 2014-04-22 23:21 - 00000000 ____D () C:\Users\Nati\AppData\Roaming\Lavasoft
2014-04-22 23:21 - 2014-04-22 23:21 - 00000000 ____D () C:\Program Files\Common Files\Lavasoft
2014-04-22 23:20 - 2014-04-22 23:20 - 01727624 _____ () C:\Users\Nati\Downloads\Adaware_Installer.exe
2014-04-22 23:20 - 2014-04-22 23:20 - 00000000 ____D () C:\ProgramData\Lavasoft
2014-04-22 21:45 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-04-22 15:20 - 2013-01-29 19:29 - 00001064 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3307610919-556288989-4226615614-1001Core.job
2014-04-22 12:58 - 2014-04-22 12:49 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-04-22 12:58 - 2012-06-08 23:27 - 00003694 _____ () C:\Windows\System32\Tasks\Adobe-Online-Aktualisierungsprogramm
2014-04-22 12:58 - 2012-05-05 19:03 - 00000000 ____D () C:\Users\Nati\AppData\Local\Microsoft Help
2014-04-22 12:58 - 2012-02-24 20:42 - 00000000 ____D () C:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}
2014-04-22 12:58 - 2012-02-10 20:54 - 00000000 __SHD () C:\ProgramData\{32364CEA-7855-4A3C-B674-53D8E9B97936}
2014-04-22 12:52 - 2014-04-22 12:52 - 00002209 _____ () C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk
2014-04-22 12:52 - 2014-04-22 12:52 - 00000000 _____ () C:\Windows\setuperr.log
2014-04-22 12:52 - 2014-04-22 12:51 - 00000000 ____D () C:\Program Files (x86)\TuneUp Utilities 2014
2014-04-22 12:52 - 2012-02-10 20:54 - 00000000 ____D () C:\ProgramData\TuneUp Software
2014-04-22 12:51 - 2014-04-22 12:51 - 00000000 ____D () C:\Users\Nati\AppData\Local\TuneUp Software
2014-04-22 12:51 - 2012-02-10 20:54 - 00000000 ____D () C:\Users\Nati\AppData\Roaming\TuneUp Software
2014-04-22 12:48 - 2014-04-22 12:48 - 06685392 _____ (Glarysoft Ltd ) C:\Users\Nati\Downloads\gusetup_slim_2.56.exe
2014-04-22 12:48 - 2014-04-22 12:47 - 27878824 _____ (TuneUp Software) C:\Users\Nati\Downloads\TuneUpUtilities2014_de2745-DE.exe
2014-04-22 12:34 - 2012-03-16 21:27 - 00000000 ____D () C:\Users\Nati\AppData\Roaming\TS3Client
2014-04-21 19:32 - 2014-04-21 19:32 - 00000661 _____ () C:\Users\Nati\Desktop\lol.launcher.admin - Verknüpfung.lnk
2014-04-21 12:16 - 2014-03-12 17:52 - 00000000 ____D () C:\Users\Nati\Desktop\PRAKTIKUM
2014-04-19 18:23 - 2014-04-19 18:23 - 00001210 _____ () C:\Users\Nati\Desktop\TeamSpeak 3 Client.lnk
2014-04-19 18:23 - 2014-04-19 18:23 - 00000000 ____D () C:\Users\Nati\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
2014-04-19 18:23 - 2012-06-24 00:58 - 00000000 ____D () C:\Users\Nati\AppData\Local\TeamSpeak 3 Client
2014-04-19 18:22 - 2014-04-19 18:21 - 27601296 _____ (TeamSpeak Systems GmbH) C:\Users\Nati\Downloads\TeamSpeak3-Client-win32-3.0.14 (1).exe
2014-04-19 18:14 - 2012-02-11 01:27 - 00000000 ____D () C:\Users\Nati\AppData\Roaming\Skype
2014-04-19 17:28 - 2012-03-16 21:27 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client
2014-04-12 15:06 - 2014-03-04 20:20 - 00000000 ____D () C:\Program Files (x86)\Hearthstone
2014-04-12 14:10 - 2014-03-04 20:18 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2014-04-11 13:03 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-04-11 11:04 - 2009-07-14 07:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-04-10 07:56 - 2013-07-17 16:42 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-10 07:56 - 2012-05-05 19:03 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-04-10 07:55 - 2012-02-11 00:38 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-04-08 16:22 - 2014-04-08 16:22 - 05260387 _____ () C:\Users\Nati\Downloads\Kinderhaus Wiesenborn.zip
2014-04-06 22:59 - 2014-04-06 22:59 - 00001060 _____ () C:\Users\Public\Desktop\MF Shutdown Manager.lnk
2014-04-06 22:59 - 2014-04-06 22:59 - 00000000 ____D () C:\Program Files (x86)\MF Shutdown Manager
2014-03-31 09:35 - 2012-02-10 18:12 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-03-31 03:16 - 2014-04-10 07:07 - 23134208 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-31 03:13 - 2014-04-10 07:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-31 02:13 - 2014-04-10 07:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-03-31 01:57 - 2014-04-10 07:07 - 17073152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-03-30 15:56 - 2014-03-30 15:56 - 00376288 _____ () C:\Users\Nati\Downloads\MediaPlayerClassic.exe
2014-03-29 16:15 - 2013-01-29 19:29 - 00004084 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3307610919-556288989-4226615614-1001UA
2014-03-29 16:15 - 2013-01-29 19:29 - 00003688 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3307610919-556288989-4226615614-1001Core
Some content of TEMP:
====================
C:\Users\Nati\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-04-19 14:12
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 22-04-2014
Ran by Nati at 2014-04-23 19:28:31
Running from C:\Users\Nati\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Ad-Aware Antivirus (Disabled - Out of date) {D87B6541-12A1-DAEA-0033-9B8057AAB996}
AS: Ad-Aware Antivirus (Disabled - Out of date) {631A84A5-349B-D564-3A83-A0F22C2DF32B}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Out of date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
FW: Ad-Aware Firewall (Disabled) {E040E464-58CE-DBB2-2B6C-32B5A979FEED}
==================== Installed Programs ======================
Update for Microsoft Office 2007 (KB2508958) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version: - Microsoft)
ABBYY FineReader 9.0 Sprint (HKLM-x32\...\ABBYY FineReader 9.0 Sprint) (Version: 9.00.631.5823 - ABBYY)
ABBYY FineReader 9.0 Sprint (x32 Version: 9.00.631.5823 - ABBYY) Hidden
Ad-Aware Antivirus (HKLM\...\{6A16ADA5-0B30-4893-84AB-961B1340D14A}_AdAwareUpdater) (Version: 11.1.5354.0 - Lavasoft)
AdAwareInstaller (Version: 11.1.5354.0 - Lavasoft) Hidden
AdAwareUpdater (Version: 11.1.5354.0 - Lavasoft) Hidden
Adobe Flash Player 12 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 12.0.0.77 - Adobe Systems Incorporated)
Adobe Reader X (10.1.9) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.9 - Adobe Systems Incorporated)
AMD Accelerated Video Transcoding (Version: 12.5.100.21219 - Advanced Micro Devices, Inc.) Hidden
AMD APP SDK Runtime (Version: 10.0.1084.4 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Install Manager (HKLM\...\{1701BD02-09B9-B25B-8290-C7D6A33C5A75}) (Version: 8.0.903.0 - Advanced Micro Devices, Inc.)
AMD Drag and Drop Transcoding (Version: 2.00.0000 - Advanced Micro Devices, Inc.) Hidden
AMD Media Foundation Decoders (Version: 1.0.71219.1540 - Advanced Micro Devices, Inc.) Hidden
Anno 1701 (HKLM-x32\...\{A2433A63-5F5D-40E5-B529-9123C2B3E734}) (Version: 1.04 - Sunflowers)
AntimalwareEngine (Version: 2.6.0.0 - Lavasoft) Hidden
Application Profiles (HKLM-x32\...\{21F3F7EC-CD32-D678-63AD-305F556D7BC9}) (Version: 2.0.4399.36214 - Advanced Micro Devices, Inc.)
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.3.350 - Avira)
Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment)
Benutzerhandbuch EPSON XP-205 207 Series (HKLM-x32\...\EPSON XP-205 207 Series Useg) (Version: - )
CameraHelperMsi (x32 Version: 13.10.1217.0 - Logitech) Hidden
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center (x32 Version: 2012.1219.1521.27485 - Ihr Firmenname) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.05 - Piriform)
Download Navigator (HKLM-x32\...\{E728441A-7820-4B1C-87C9-DE7BE37B2953}) (Version: 1.1.0 - SEIKO EPSON CORPORATION)
Epson Connect Printer Setup (HKLM-x32\...\{D9B1D51B-EB56-410D-AEB5-1CCFAC4B6C8C}) (Version: 1.1.1 - SEIKO EPSON CORPORATION)
Epson Easy Photo Print 2 (HKLM-x32\...\{02A312B5-1542-47B6-BFE9-F51358C39E86}) (Version: 2.4.0.0 - SEIKO EPSON CORPORATION)
Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser) (HKLM-x32\...\{B2D55EB8-32C5-4B43-9006-9E97DECBA178}) (Version: 1.00.0000 - SEIKO EPSON CORPORATION2)
Epson Event Manager (HKLM-x32\...\{BECE9CCD-83F6-4BAA-9B26-227DF7D2E932}) (Version: 3.01.0000 - Seiko Epson Corporation)
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version: - Seiko Epson Corporation)
EPSON XP-205 207 Series Printer Uninstall (HKLM\...\EPSON XP-205 207 Series) (Version: - SEIKO EPSON Corporation)
EpsonNet Print (HKLM-x32\...\{3E31400D-274E-4647-916C-2CACC3741799}) (Version: 2.6.0 - SEIKO EPSON CORPORATION)
erLT (x32 Version: 1.20.138.34 - Logitech, Inc.) Hidden
Free YouTube to MP3 Converter version 3.12.12.827 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.12.827 - DVDVideoSoft Ltd.)
Google Chrome (HKCU\...\Google Chrome) (Version: 34.0.1847.116 - Google Inc.)
Hearthstone (HKLM-x32\...\Hearthstone) (Version: - Blizzard Entertainment)
Intel(R) Network Connections 14.7.31.0 (HKLM\...\PROSetDX) (Version: 14.7.31.0 - Intel)
Intel(R) Network Connections 14.7.31.0 (Version: 14.7.31.0 - Intel) Hidden
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version: - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.36 - Irfan Skiljan)
Java 7 Update 11 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417011FF}) (Version: 7.0.110 - Oracle)
JMicron JMB36X Driver (HKLM-x32\...\{3A1B5D40-41E9-43FA-8C7B-A8667F5586EF}) (Version: 1.00.0000 - JMICRON Technology Corp.)
League of Legends (HKLM-x32\...\{918A9082-6287-4D25-9002-5E5D5E4971CB}) (Version: 1.02.0000 - Riot Games)
Logitech Webcam Software (HKLM-x32\...\{D40EB009-0499-459c-A8AF-C9C110766215}) (Version: 2.0 - Logitech Inc.)
LWS Facebook (x32 Version: 13.10.1216.0 - Logitech) Hidden
LWS Gallery (x32 Version: 13.10.1216.0 - Logitech) Hidden
LWS Help_main (x32 Version: 13.10.1224.0 - Logitech) Hidden
LWS Launcher (x32 Version: 13.10.1224.0 - Logitech) Hidden
LWS Pictures And Video (x32 Version: 13.10.1218.0 - Logitech) Hidden
LWS Twitter (x32 Version: 13.00.1216.0 - Logitech) Hidden
LWS Video Mask Maker (x32 Version: 13.10.1216.0 - Logitech) Hidden
LWS VideoEffects (Version: 13.00.1774.0 - Logitech) Hidden
LWS Webcam Software (x32 Version: 13.00.1774.0 - Logitech) Hidden
LWS WLM Plugin (x32 Version: 1.10.1222.0 - Logitech) Hidden
LWS YouTube Plugin (x32 Version: 13.10.1216.0 - Logitech) Hidden
MF Shutdown Manager 2.1.0 (HKLM-x32\...\{4F2F5589-0217-43A6-91E9-B0F172D32CC9}_is1) (Version: 2.1.0 - Alan Alshozi)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM-x32\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Netzwerkhandbuch EPSON XP-205 207 Series (HKLM-x32\...\EPSON XP-205 207 Series Netg) (Version: - )
NVIDIA PhysX (HKLM-x32\...\{1C4551A6-4743-4093-91E4-1477CD655043}) (Version: 9.09.0203 - NVIDIA Corporation)
Origin (HKLM-x32\...\Origin) (Version: 9.1.15.109 - Electronic Arts, Inc.)
Project64 1.6 (HKLM-x32\...\{9559F7CA-5E34-4237-A2D9-D856464AD727}) (Version: 1.6 - Project64)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5898 - Realtek Semiconductor Corp.)
SimCity™ (HKLM-x32\...\{F70FDE4B-8F86-4eb6-8C8E-636EC89F6419}) (Version: 1.0.0.0 - Electronic Arts)
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.2.25 - Safer-Networking Ltd.)
TeamSpeak 3 Client (HKCU\...\TeamSpeak 3 Client) (Version: 3.0.14 - TeamSpeak Systems GmbH)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: - TeamSpeak Systems GmbH)
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.24482 - TeamViewer)
Tomb Raider (HKLM-x32\...\Tomb Raider_is1) (Version: - )
Torchlight II (HKLM-x32\...\{55F7D521-17CA-454D-9D4D-975EF2E10708}_is1) (Version: - White Rabbit Interactive)
TuneUp Utilities 2014 (de-DE) (x32 Version: 14.0.1000.275 - TuneUp Software) Hidden
TuneUp Utilities 2014 (HKLM-x32\...\TuneUp Utilities) (Version: 14.0.1000.275 - TuneUp Software)
TuneUp Utilities 2014 (x32 Version: 14.0.1000.275 - TuneUp Software) Hidden
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6FAA03BD-2B51-4029-9AD9-64A3B8E3C84C}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
VLC media player 2.0.3 (HKLM-x32\...\VLC media player) (Version: 2.0.3 - VideoLAN)
Warcraft III (HKLM-x32\...\Warcraft III) (Version: - Blizzard Entertainment)
WinRAR 4.10 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.10.0 - win.rar GmbH)
Zoo Tycoon 2 - Marine Mania (HKLM-x32\...\InstallShield_{B406605B-45FE-4D8F-8250-1E77479583AE}) (Version: 1.00.0000 - Microsoft Game Studios)
Zoo Tycoon 2 - Marine Mania (x32 Version: 1.00.0000 - Microsoft Game Studios) Hidden
==================== Restore Points =========================
15-04-2014 07:17:32 Windows Update
16-04-2014 09:39:09 Windows Update
22-04-2014 09:00:10 Windows Update
22-04-2014 10:50:44 TuneUp Utilities 2014 wird installiert
22-04-2014 21:21:01 AA11
22-04-2014 21:28:27 Removed Shutdown Timer.
==================== Hosts content: ==========================
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {0C3EB01A-D17A-4F08-9465-282D1A833AD8} - System32\Tasks\{E63FB020-55F5-4E08-A3B1-7A104A36EFD6} => Iexplore.exe hxxp://ui.skype.com/ui/0/5.10.0.116/de/go/help.faq.installer?LastError=1603
Task: {0EE95B81-BD48-46E7-B59E-9E7CE1345640} - System32\Tasks\{6834D4E4-08CE-4D7D-842C-906AA648F8EC} => Iexplore.exe hxxp://ui.skype.com/ui/0/5.10.0.116/de/go/help.faq.installer?LastError=1603
Task: {0FA11578-843C-432D-B3D4-C92F5CF728CF} - System32\Tasks\{A70D08EF-7A13-4699-80D8-9D798C9EB645} => Iexplore.exe hxxp://ui.skype.com/ui/0/5.10.0.116/de/go/help.faq.installer?LastError=1603
Task: {148E3BB1-9A3A-4B21-B04B-881EE65089CE} - System32\Tasks\{E39751D9-ADDE-46DA-AE07-4D79057E02F5} => Iexplore.exe hxxp://ui.skype.com/ui/0/5.10.0.116/de/go/help.faq.installer?LastError=1603
Task: {18F206BA-51F6-4769-AE8D-FB870A80E386} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-03-11] (Adobe Systems Incorporated)
Task: {19017702-4CEE-4449-98B3-F4D31ACB1BF6} - System32\Tasks\{3CBDF91A-83BD-45FE-BE87-4ED839AF85FF} => Iexplore.exe hxxp://ui.skype.com/ui/0/5.10.0.116/de/go/help.faq.installer?LastError=1603
Task: {3B472BB3-E64D-4A72-B0B3-B7956987969A} - System32\Tasks\{0F0F3C91-70C1-4A61-A1AC-97EBF8448DBA} => C:\Users\Nati\AppData\Roaming\Spotify\spotify.exe
Task: {44B8FF76-F697-43DA-A249-FA2CD129ECE1} - System32\Tasks\{D7F44A86-D448-43BB-8D0B-5EF1933C86CD} => Firefox.exe
Task: {528B3951-5AB1-4AB7-A65C-8EA01A1501C5} - System32\Tasks\{0319BF13-6550-40AF-86A0-FCA87146FD9C} => Iexplore.exe hxxp://ui.skype.com/ui/0/5.10.0.116/de/go/help.faq.installer?LastError=1603
Task: {535EE4FE-92B1-4BCE-8BE3-5FB08210B1FC} - System32\Tasks\{A78A78EC-3112-420E-93BA-F20B63C54939} => Iexplore.exe hxxp://ui.skype.com/ui/0/5.10.0.116/de/go/help.faq.installer?LastError=1603
Task: {5E55C891-0697-4E91-9517-B9B528BC7169} - System32\Tasks\{56C626E4-6434-4541-B986-84D41886CDF0} => Iexplore.exe hxxp://ui.skype.com/ui/0/5.10.0.116/de/go/help.faq.installer?LastError=1603
Task: {67B5CEAE-DF05-416D-A82B-E119B6A07355} - System32\Tasks\{F2DA21EB-A58B-4287-93A4-17A3F067B4F8} => Iexplore.exe hxxp://ui.skype.com/ui/0/5.10.0.116/de/go/help.faq.installer?LastError=1603
Task: {6D65501B-695B-4A60-ABBD-C7A42CDD7692} - System32\Tasks\{35963DA2-8993-4D62-920F-B72ED668CFFE} => Iexplore.exe hxxp://ui.skype.com/ui/0/5.10.0.116/de/go/help.faq.installer?LastError=1603
Task: {6DDEF1D9-CB24-4AAC-B423-4B0E3300AC5C} - System32\Tasks\{F6CBC135-0477-44C2-8A0F-1C0A03198CB3} => Iexplore.exe hxxp://ui.skype.com/ui/0/5.10.0.116/de/go/help.faq.installer?LastError=1603
Task: {73D244B6-22F0-4917-9B19-4C082B638B52} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 => C:\Program Files (x86)\TuneUp Utilities 2014\OneClick.exe [2014-03-20] (TuneUp Software)
Task: {774F9088-9FC3-47DC-954D-1F1AF2D74018} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-08-21] (Piriform Ltd)
Task: {78E6933D-C3E0-4BAB-8932-14756CFE5C1A} - System32\Tasks\{5673AE96-8F42-4CDF-B9DB-2236ACC22FC7} => Iexplore.exe hxxp://ui.skype.com/ui/0/5.10.0.116/de/go/help.faq.installer?LastError=1603
Task: {7A0CC15B-0A68-4BCA-9D21-2B180E376539} - System32\Tasks\{7865C135-5B5E-495B-865E-C6C4FBE5C9AE} => Iexplore.exe hxxp://ui.skype.com/ui/0/5.10.0.116/de/go/help.faq.installer?LastError=1603
Task: {7A2A9ABB-AB33-4C97-AAB1-CC9AD31AB997} - System32\Tasks\{FE7FF34C-2C04-4DCB-A76E-17D6A90668C5} => Iexplore.exe hxxp://ui.skype.com/ui/0/5.10.0.116/de/go/help.faq.installer?LastError=1603
Task: {7A6A1698-271A-4EE4-9535-E404CAB4AB4D} - System32\Tasks\{0FC61F4C-DC39-45FB-B0C7-2FD1A0034A9F} => Iexplore.exe hxxp://ui.skype.com/ui/0/5.10.0.116/de/go/help.faq.installer?LastError=1603
Task: {80166777-7BA7-42E5-B7E0-BCCF0187D0CD} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3307610919-556288989-4226615614-1001Core => C:\Users\Nati\AppData\Local\Google\Update\GoogleUpdate.exe [2013-01-29] (Google Inc.)
Task: {8630396B-D7A1-44FF-9242-AE30EA0ED98A} - System32\Tasks\{1351B12F-3BA1-49C8-AAD7-130769F1ADDA} => D:\LoL\League of Legends\lol.launcher.admin.exe [2011-04-26] ()
Task: {8A4688C1-B8B8-40C7-9B87-3D7DFAB1F688} - System32\Tasks\{2F22495C-9B58-49DB-928A-0DEC831D3A1E} => C:\Users\Nati\AppData\Roaming\Spotify\spotify.exe
Task: {8A4FD3C1-CAB8-4CF9-993F-BE0F022E3016} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe
Task: {8CC75E42-1853-4A59-ABAF-6ABD38070914} - System32\Tasks\{B97DE49C-ABD7-4A87-AD0B-21010F193848} => C:\Program Files (x86)\Microsoft Games\Zoo Tycoon 2\zt.exe
Task: {8F1BCD9A-8467-409F-853C-6BE766E0502A} - System32\Tasks\{6ED82589-1BE2-480E-ACED-2F3F4F042828} => Firefox.exe hxxp://ui.skype.com/ui/0/5.8.0.158/de/go/help.faq.installer?LastError=1603
Task: {902CE8B3-F84A-43DD-AEA1-FCC6C82BF395} - System32\Tasks\{63E93347-10B2-4E62-A9D8-ED4D1BB6F688} => Iexplore.exe hxxp://ui.skype.com/ui/0/5.10.0.116/de/go/help.faq.installer?LastError=1603
Task: {9098F716-4260-47C3-A775-7C29485AE171} - System32\Tasks\{0B84934A-3CD3-4A90-B3C0-5F7EE67C2A9D} => Iexplore.exe hxxp://ui.skype.com/ui/0/5.10.0.116/de/go/help.faq.installer?LastError=1603
Task: {92189C30-20EB-4C6B-B02E-B5C8583AF29F} - System32\Tasks\{169E37EF-263A-4124-B09F-237F34B53E79} => Iexplore.exe hxxp://ui.skype.com/ui/0/5.10.0.116/de/go/help.faq.installer?LastError=1603
Task: {9A2759D9-E82C-4134-8B73-32A096F5B65F} - System32\Tasks\{6778366B-F273-4025-AAAA-4D0FBC4E9AE2} => D:\SimCity 4 Deluxe\SimCity 4.exe
Task: {9D3AB9FA-D0C5-441C-ABE0-0407E589C148} - System32\Tasks\{F60A2857-7DE8-4C53-9D61-4C9535599453} => Iexplore.exe hxxp://ui.skype.com/ui/0/5.10.0.116/de/go/help.faq.installer?LastError=1603
Task: {9DE9D6B5-D16D-49F2-AF39-14687EE9A773} - System32\Tasks\{2EA228BC-9423-4AAF-8823-90AE59BEEB3B} => C:\Users\Nati\AppData\Roaming\Spotify\spotify.exe
Task: {A14B0B0B-E977-43F7-92F0-D17ABC6C643F} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3307610919-556288989-4226615614-1001UA => C:\Users\Nati\AppData\Local\Google\Update\GoogleUpdate.exe [2013-01-29] (Google Inc.)
Task: {A208E0C4-1C54-47CE-B651-46B14A005EAD} - System32\Tasks\{0C7CD2A8-608E-4FA5-926E-164744B70DF2} => Iexplore.exe hxxp://ui.skype.com/ui/0/5.10.0.116/de/go/help.faq.installer?LastError=1603
Task: {A429C04B-B143-4B5C-B2C1-2EA612DBF0BC} - System32\Tasks\{F96AB1A8-7DBD-4055-9E13-F5F94CE04763} => D:\LoL\League of Legends\lol.launcher.admin.exe [2011-04-26] ()
Task: {AF0347B0-00FA-413D-A897-C90DEF87BB96} - System32\Tasks\{D698D68A-F39E-4227-A2B7-DF6B99F9D325} => Firefox.exe hxxp://ui.skype.com/ui/0/5.10.0.116/de/go/help.faq.installer?LastError=1603
Task: {B471F9FD-2A38-42C0-9FBC-B00034CF3B47} - System32\Tasks\{B3923A96-8848-4855-A8B0-723453910F49} => Iexplore.exe hxxp://ui.skype.com/ui/0/5.10.0.116/de/go/help.faq.installer?LastError=1603
Task: {B5AB36A5-89CE-4E02-83FD-4B7DBC269397} - System32\Tasks\{187C9630-C071-441B-AF42-F78D043122BF} => Iexplore.exe hxxp://ui.skype.com/ui/0/5.10.0.116/de/go/help.faq.installer?LastError=1603
Task: {B6321296-2AEA-449A-BED7-9F6D9BC978B4} - System32\Tasks\{74776D96-DD6F-4DD4-ACAA-F66B4860F23F} => C:\Users\Nati\AppData\Roaming\Spotify\spotify.exe
Task: {BC8AD30B-8F68-4907-AB57-07819B1A0F35} - System32\Tasks\{6ECC07CF-EB45-4E35-AA41-B0A53BF67D9D} => Iexplore.exe hxxp://ui.skype.com/ui/0/5.10.0.116/de/go/help.faq.installer?LastError=1603
Task: {C48016C3-91A0-4F3B-A380-F2107E429379} - System32\Tasks\{7F485D69-7070-4662-B3DA-93D32C4782C2} => Iexplore.exe hxxp://ui.skype.com/ui/0/5.10.0.116/de/go/help.faq.installer?LastError=1603
Task: {C86CE982-AF2C-491F-8889-6456C46A96A6} - System32\Tasks\{3DB5ED30-FA3D-446B-B7F0-7B1F660F00AE} => Iexplore.exe hxxp://ui.skype.com/ui/0/5.10.0.116/de/go/help.faq.installer?LastError=1603
Task: {D6BF362E-F590-4621-B3A4-B803FBC9D130} - System32\Tasks\{3F63DFE8-E156-451C-BEC0-902EC8575E2C} => Iexplore.exe hxxp://ui.skype.com/ui/0/5.10.0.116/de/go/help.faq.installer?LastError=1603
Task: {DBCB0F2E-147D-4F5C-8CC0-617765212C70} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe
Task: {DCB0EE29-4EBD-40BC-93FD-7E7A09352440} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe
Task: {E0ABC376-DAF9-4DEC-9BEB-194F0DC53088} - System32\Tasks\{D555DCDB-3701-4F51-A02E-F532D8506B1A} => Iexplore.exe hxxp://ui.skype.com/ui/0/5.10.0.116/de/go/help.faq.installer?LastError=1603
Task: {E2D44B87-E183-4E62-92ED-DBEF1B54FDBC} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-11-21] (Adobe Systems Incorporated)
Task: {EBEEDCC2-D16E-4398-B063-F59FCBFB20E6} - System32\Tasks\{9948C988-C9CD-4607-AF92-4CCB9CED2A93} => Iexplore.exe hxxp://ui.skype.com/ui/0/5.10.0.116/de/go/help.faq.installer?LastError=1603
Task: {ECFF6F1D-7A20-42E4-B74D-043DBB68C814} - System32\Tasks\{2D40296F-FB4C-46E4-BDCF-DDD8BC7E2FB0} => Iexplore.exe hxxp://ui.skype.com/ui/0/5.10.0.116/de/go/help.faq.installer?LastError=1603
Task: {F4872359-79AD-425F-944B-2E462EA8AC3F} - System32\Tasks\Google Updater and Installer => C:\Users\Nati\AppData\Local\Google\Update\GoogleUpdate.exe [2013-01-29] (Google Inc.)
Task: {F71257D9-2ED7-4C0B-AAD5-61D889FDA333} - System32\Tasks\{4E85F415-F723-4CFE-9A20-956A0B9EF560} => Iexplore.exe hxxp://ui.skype.com/ui/0/5.10.0.116/de/go/help.faq.installer?LastError=1603
Task: {FF80FE7A-25CE-48A0-875B-337B511A7C2B} - System32\Tasks\{CD085222-D3FA-4856-BE82-747DC71B9F93} => D:\LoL\League of Legends\lol.launcher.admin.exe [2011-04-26] ()
Task: {FFA7D87F-1C71-4D79-A710-619D0B4872B5} - System32\Tasks\{2EFD16EE-5343-460D-A150-38966A664664} => Iexplore.exe hxxp://ui.skype.com/ui/0/5.10.0.116/de/go/help.faq.installer?LastError=1603
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3307610919-556288989-4226615614-1001Core.job => C:\Users\Nati\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3307610919-556288989-4226615614-1001UA.job => C:\Users\Nati\AppData\Local\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2014-01-23 16:29 - 2014-01-23 16:29 - 02141040 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareShellExtension.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00685904 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\SQLite.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 02595144 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\RCF.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00123776 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_filesystem-vc100-mt-1_55.dll
2014-01-23 16:30 - 2014-01-23 16:30 - 00024440 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_system-vc100-mt-1_55.dll
2012-02-19 14:26 - 2012-01-09 20:44 - 00193536 _____ () C:\Program Files\WinRAR\rarext.dll
2014-01-23 16:09 - 2014-01-23 16:09 - 00702744 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe
2014-01-23 16:30 - 2014-01-23 16:30 - 00103800 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_thread-vc100-mt-1_55.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00033656 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_chrono-vc100-mt-1_55.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00055680 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_date_time-vc100-mt-1_55.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 03720040 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareServiceKernel.dll
2014-01-23 16:30 - 2014-01-23 16:30 - 00158032 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\pugixml.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00788856 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_regex-vc100-mt-1_55.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00602984 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareActivation.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00291192 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareApplicationUpdater.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00142696 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareGamingMode.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00098648 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareReset.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00120152 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTime.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00268152 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareDefinitionsUpdater.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00198024 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareDefinitionsUpdaterScheduler.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00417128 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareIgnoreList.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00253800 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareQuarantine.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00293744 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareAntiMalwareEngine.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00212336 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareAntiRootkitEngine.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00509808 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareScannerHistory.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00607584 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareScanner.dll
2014-01-23 16:30 - 2014-01-23 16:30 - 00035192 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_timer-vc100-mt-1_55.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00325488 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareScannerScheduler.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00333688 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareRealTimeProtection.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00227688 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareIncompatibles.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00219488 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareAntiSpam.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00129896 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareAntiPhishing.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00599920 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareParentalControl.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 01926504 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareWebProtection.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00263536 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareEmailProtection.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00650608 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareNetworkProtection.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00490848 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareInstaller.dll
2014-01-23 16:30 - 2014-01-23 16:30 - 00106824 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\zlib.dll
2014-01-23 16:30 - 2014-01-23 16:30 - 00149840 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\libssh2.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00358744 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwarePromo.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00291680 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareFeedback.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00154464 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\SecurityCenter.dll
2013-07-17 17:10 - 2013-07-17 17:10 - 00777296 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Antimalware Engine\2.6.0.0\BDSmartDB.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 04114264 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTray.exe
2014-01-23 16:29 - 2014-01-23 16:29 - 00500088 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_locale-vc100-mt-1_55.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00361824 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\HtmlFramework.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00066904 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\DllStorage.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00788848 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTrayDefaultSkin.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00139608 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\Localization.dll
2014-03-20 14:44 - 2014-03-20 14:44 - 00675640 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\avgrepliba.dll
2013-04-07 14:48 - 2013-04-07 14:43 - 00397704 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2014-04-22 23:41 - 2013-05-16 10:55 - 00113496 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2014-04-22 23:41 - 2013-05-16 10:55 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2014-04-22 23:41 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2014-04-22 23:41 - 2013-05-16 10:55 - 00161112 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2014-04-22 23:41 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2014-04-11 11:24 - 2014-04-02 03:57 - 00065352 _____ () C:\Users\Nati\AppData\Local\Google\Chrome\Application\34.0.1847.116\chrome_elf.dll
2014-04-11 11:25 - 2014-04-02 03:57 - 00674632 _____ () C:\Users\Nati\AppData\Local\Google\Chrome\Application\34.0.1847.116\libglesv2.dll
2014-04-11 11:25 - 2014-04-02 03:57 - 00093000 _____ () C:\Users\Nati\AppData\Local\Google\Chrome\Application\34.0.1847.116\libegl.dll
2014-04-11 11:25 - 2014-04-02 03:57 - 04081480 _____ () C:\Users\Nati\AppData\Local\Google\Chrome\Application\34.0.1847.116\pdf.dll
2014-04-11 11:25 - 2014-04-02 03:58 - 00390472 _____ () C:\Users\Nati\AppData\Local\Google\Chrome\Application\34.0.1847.116\ppGoogleNaClPluginChrome.dll
2014-04-11 11:25 - 2014-04-02 03:57 - 01647432 _____ () C:\Users\Nati\AppData\Local\Google\Chrome\Application\34.0.1847.116\ffmpegsumo.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\ProgramData:gs5sys
AlternateDataStreams: C:\Users\All Users:gs5sys
AlternateDataStreams: C:\Users\Nati:gs5sys
AlternateDataStreams: C:\ProgramData\Anwendungsdaten:gs5sys
AlternateDataStreams: C:\ProgramData\Application Data:gs5sys
AlternateDataStreams: C:\ProgramData\Templates:gs5sys
AlternateDataStreams: C:\ProgramData\Vorlagen:gs5sys
AlternateDataStreams: C:\Users\Nati\Anwendungsdaten:gs5sys
AlternateDataStreams: C:\Users\Nati\Cookies:gs5sys
AlternateDataStreams: C:\Users\Nati\Lokale Einstellungen:gs5sys
AlternateDataStreams: C:\Users\Nati\Vorlagen:gs5sys
AlternateDataStreams: C:\Users\Nati\Desktop\desktop.ini:gs5sys
AlternateDataStreams: C:\Users\Nati\AppData\Local:gs5sys
AlternateDataStreams: C:\Users\Nati\AppData\Roaming:gs5sys
AlternateDataStreams: C:\Users\Nati\AppData\Local\Anwendungsdaten:gs5sys
AlternateDataStreams: C:\Users\Nati\AppData\Local\Verlauf:gs5sys
AlternateDataStreams: C:\Users\Nati\Documents\desktop.ini:gs5sys
AlternateDataStreams: C:\Users\Public\Documents\desktop.ini:gs5sys
==================== Safe Mode (whitelisted) ===================
==================== Disabled items from MSCONFIG ==============
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: Google Update => "C:\Users\Nati\AppData\Local\Google\Update\GoogleUpdate.exe" /c
==================== Faulty Device Manager Devices =============
Name: Standardtastatur (PS/2)
Description: Standardtastatur (PS/2)
Class Guid: {4d36e96b-e325-11ce-bfc1-08002be10318}
Manufacturer: (Standardtastaturen)
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
Name: Microsoft PS/2-Maus
Description: Microsoft PS/2-Maus
Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
==================== Event log errors: =========================
Application errors:
==================
Error: (04/19/2014 05:33:33 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: update.exe_TeamSpeak 3 Client Updater, Version: 3.0.8.0, Zeitstempel: 0x5149b927
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000100000000
ID des fehlerhaften Prozesses: 0x418
Startzeit der fehlerhaften Anwendung: 0xupdate.exe_TeamSpeak 3 Client Updater0
Pfad der fehlerhaften Anwendung: update.exe_TeamSpeak 3 Client Updater1
Pfad des fehlerhaften Moduls: update.exe_TeamSpeak 3 Client Updater2
Berichtskennung: update.exe_TeamSpeak 3 Client Updater3
Error: (04/13/2014 07:01:07 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: insAED5.tmp, Version: 3.0.0.0, Zeitstempel: 0x40daa4fa
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc00000fd
Fehleroffset: 0x7448e4e4
ID des fehlerhaften Prozesses: 0x11b8
Startzeit der fehlerhaften Anwendung: 0xinsAED5.tmp0
Pfad der fehlerhaften Anwendung: insAED5.tmp1
Pfad des fehlerhaften Moduls: insAED5.tmp2
Berichtskennung: insAED5.tmp3
Error: (04/05/2014 11:27:11 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: E_IATIILE.EXE, Version: 7.0.3.0, Zeitstempel: 0x4f4dd337
Name des fehlerhaften Moduls: E_IERSILE.DLL, Version: 1.2.2.7, Zeitstempel: 0x4ff3f697
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000b8abc
ID des fehlerhaften Prozesses: 0x604
Startzeit der fehlerhaften Anwendung: 0xE_IATIILE.EXE0
Pfad der fehlerhaften Anwendung: E_IATIILE.EXE1
Pfad des fehlerhaften Moduls: E_IATIILE.EXE2
Berichtskennung: E_IATIILE.EXE3
Error: (03/25/2014 03:02:53 PM) (Source: Application Hang) (User: )
Description: Programm Battle.net.exe, Version 1.0.10.4336 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 6c0
Startzeit: 01cf482a6b54347b
Endzeit: 5
Anwendungspfad: C:\Program Files (x86)\Battle.net\Battle.net.4336\Battle.net.exe
Berichts-ID: bceb0fcc-b41d-11e3-91a5-90fba64a5443
Error: (03/15/2014 07:11:59 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: insFA57.tmp, Version: 3.0.0.0, Zeitstempel: 0x40daa4fa
Name des fehlerhaften Moduls: insFA57.tmp, Version: 3.0.0.0, Zeitstempel: 0x40daa4fa
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00058b99
ID des fehlerhaften Prozesses: 0xfec
Startzeit der fehlerhaften Anwendung: 0xinsFA57.tmp0
Pfad der fehlerhaften Anwendung: insFA57.tmp1
Pfad des fehlerhaften Moduls: insFA57.tmp2
Berichtskennung: insFA57.tmp3
Error: (03/13/2014 05:47:04 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: insFE3D.tmp, Version: 3.0.0.0, Zeitstempel: 0x40daa4fa
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc00000fd
Fehleroffset: 0x740fe384
ID des fehlerhaften Prozesses: 0x1018
Startzeit der fehlerhaften Anwendung: 0xinsFE3D.tmp0
Pfad der fehlerhaften Anwendung: insFE3D.tmp1
Pfad des fehlerhaften Moduls: insFE3D.tmp2
Berichtskennung: insFE3D.tmp3
Error: (03/08/2014 10:28:07 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: ins37E.tmp, Version: 3.0.0.0, Zeitstempel: 0x40daa4fa
Name des fehlerhaften Moduls: ins37E.tmp, Version: 3.0.0.0, Zeitstempel: 0x40daa4fa
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00058b94
ID des fehlerhaften Prozesses: 0x1030
Startzeit der fehlerhaften Anwendung: 0xins37E.tmp0
Pfad der fehlerhaften Anwendung: ins37E.tmp1
Pfad des fehlerhaften Moduls: ins37E.tmp2
Berichtskennung: ins37E.tmp3
Error: (03/08/2014 10:13:13 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: ins63C6.tmp, Version: 3.0.0.0, Zeitstempel: 0x40daa4fa
Name des fehlerhaften Moduls: ins63C6.tmp, Version: 3.0.0.0, Zeitstempel: 0x40daa4fa
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00058b94
ID des fehlerhaften Prozesses: 0x728
Startzeit der fehlerhaften Anwendung: 0xins63C6.tmp0
Pfad der fehlerhaften Anwendung: ins63C6.tmp1
Pfad des fehlerhaften Moduls: ins63C6.tmp2
Berichtskennung: ins63C6.tmp3
Error: (03/03/2014 07:50:41 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: ins87D4.tmp, Version: 3.0.0.0, Zeitstempel: 0x40daa4fa
Name des fehlerhaften Moduls: ins87D4.tmp, Version: 3.0.0.0, Zeitstempel: 0x40daa4fa
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00058b94
ID des fehlerhaften Prozesses: 0xaa4
Startzeit der fehlerhaften Anwendung: 0xins87D4.tmp0
Pfad der fehlerhaften Anwendung: ins87D4.tmp1
Pfad des fehlerhaften Moduls: ins87D4.tmp2
Berichtskennung: ins87D4.tmp3
Error: (03/03/2014 04:16:24 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: insBC7B.tmp, Version: 3.0.0.0, Zeitstempel: 0x40daa4fa
Name des fehlerhaften Moduls: insBC7B.tmp, Version: 3.0.0.0, Zeitstempel: 0x40daa4fa
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00058b96
ID des fehlerhaften Prozesses: 0x10f0
Startzeit der fehlerhaften Anwendung: 0xinsBC7B.tmp0
Pfad der fehlerhaften Anwendung: insBC7B.tmp1
Pfad des fehlerhaften Moduls: insBC7B.tmp2
Berichtskennung: insBC7B.tmp3
System errors:
=============
Error: (04/23/2014 07:22:36 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
Error: (04/23/2014 06:56:09 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
Error: (04/23/2014 05:30:21 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
Error: (04/23/2014 05:29:56 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Spybot-S&D 2 Scanner Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (04/23/2014 05:29:56 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Spybot-S&D 2 Scanner Service erreicht.
Error: (04/23/2014 04:25:00 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
Error: (04/23/2014 01:25:30 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
Error: (04/23/2014 01:25:24 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "TeamViewer 9" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (04/23/2014 01:25:24 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst TeamViewer 9 erreicht.
Error: (04/22/2014 11:40:11 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
Microsoft Office Sessions:
=========================
Error: (05/19/2012 01:47:19 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6612.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 17 seconds with 0 seconds of active time. This session ended with a crash.
CodeIntegrity Errors:
===================================
Date: 2013-05-10 09:21:49.045
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-05-10 09:21:48.958
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-05-10 09:21:48.750
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-05-10 09:21:48.663
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Percentage of memory in use: 36%
Total physical RAM: 6071.06 MB
Available physical RAM: 3845.32 MB
Total Pagefile: 12140.3 MB
Available Pagefile: 9573.22 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:453.45 GB) (Free:376.05 GB) NTFS
Drive d: () (Fixed) (Total:453.96 GB) (Free:338.83 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: A7FE8E29)
Partition 1: (Not Active) - (Size=24 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=453 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=454 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-04-23 20:00:38
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD10 rev.01.0 931,51GB
Running: Gmer-19357.exe; Driver: C:\Users\Nati\AppData\Local\Temp\kwldakob.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2248] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 00000000766c1465 2 bytes [6C, 76]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2248] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000766c14bb 2 bytes [6C, 76]
.text ... * 2
---- EOF - GMER 2.1 ----
Code:
ATTFilter Exportierte Ereignisse:
23.04.2014 00:05 [Echtzeit-Scanner] Malware gefunden
In der Datei
'C:\Windows\Temp\6e1f8933-acce-4d49-855e-e92366646400\tmp00003eaf\tmp0005479c'
wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.XPACK.Gen2' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
23.04.2014 00:05 [Echtzeit-Scanner] Malware gefunden
In der Datei
'C:\Windows\Temp\6e1f8933-acce-4d49-855e-e92366646400\tmp00003eaf\tmp000546cd'
wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.XPACK.Gen2' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
23.04.2014 00:05 [Echtzeit-Scanner] Malware gefunden
In der Datei
'C:\Windows\Temp\6e1f8933-acce-4d49-855e-e92366646400\tmp00003eaf\tmp0005435f'
wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.XPACK.Gen2' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
23.04.2014 00:04 [Echtzeit-Scanner] Malware gefunden
In der Datei
'C:\Windows\Temp\6e1f8933-acce-4d49-855e-e92366646400\tmp00003eaf\tmp00053071'
wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.XPACK.Gen2' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
23.04.2014 00:04 [Echtzeit-Scanner] Malware gefunden
In der Datei
'C:\Windows\Temp\6e1f8933-acce-4d49-855e-e92366646400\tmp00003eaf\tmp00052eee'
wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.XPACK.Gen2' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
23.04.2014 00:04 [Echtzeit-Scanner] Malware gefunden
In der Datei
'C:\Windows\Temp\6e1f8933-acce-4d49-855e-e92366646400\tmp00003eaf\tmp0004f992'
wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.XPACK.Gen2' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
22.04.2014 12:27 [Echtzeit-Scanner] Malware gefunden
In der Datei
'C:\$Recycle.Bin\S-1-5-21-3307610919-556288989-4226615614-1001\$R0Z3UBF.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.A.16384' [trojan]
gefunden.
Ausgeführte Aktion: Übergeben an Scanner
22.04.2014 12:27 [Echtzeit-Scanner] Malware gefunden
In der Datei
'C:\$Recycle.Bin\S-1-5-21-3307610919-556288989-4226615614-1001\$R0Z3UBF.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.A.16384' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
22.04.2014 12:27 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\Nati\Downloads\Rechnung.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.A.16384' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
22.04.2014 12:27 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\Nati\Downloads\Rechnung.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.A.16384' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
22.04.2014 12:27 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\Nati\Downloads\Rechnung.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.A.16384' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
22.04.2014 12:27 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\Nati\Downloads\Rechnung.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.A.16384' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
22.04.2014 12:27 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\Nati\Downloads\Rechnung.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.A.16384' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
22.04.2014 12:27 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\Nati\Downloads\Rechnung.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.A.16384' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
22.04.2014 12:27 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\Nati\Downloads\Rechnung.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.A.16384' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
22.04.2014 12:27 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\Nati\Downloads\Rechnung.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.A.16384' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
22.04.2014 12:27 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\Nati\Downloads\Rechnung.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.A.16384' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
22.04.2014 12:27 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\Nati\Downloads\Rechnung.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.A.16384' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
22.04.2014 12:27 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\Nati\Downloads\Rechnung.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.A.16384' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
22.04.2014 12:27 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\Nati\Downloads\Rechnung.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.A.16384' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
22.04.2014 12:27 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\Nati\Downloads\Rechnung.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.A.16384' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
22.04.2014 12:27 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\Nati\Downloads\Rechnung.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.A.16384' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
22.04.2014 12:27 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\Nati\Downloads\Rechnung.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.A.16384' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
22.04.2014 12:27 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\Nati\Downloads\Rechnung.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.A.16384' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
22.04.2014 12:27 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\Nati\Downloads\Rechnung.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.A.16384' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
22.04.2014 12:27 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\Nati\Downloads\Rechnung.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.A.16384' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
22.04.2014 12:27 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\Nati\Downloads\Rechnung.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.A.16384' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
22.04.2014 12:27 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\Nati\Downloads\Rechnung.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.A.16384' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
22.04.2014 12:27 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\Nati\Downloads\Rechnung.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.A.16384' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
22.04.2014 12:26 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\Nati\Downloads\Rechnung.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.A.16384' [trojan]
gefunden.
Ausgeführte Aktion: Übergeben an Scanner
22.04.2014 12:26 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\Nati\Downloads\Rechnung.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.A.16384' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
22.04.2014 12:26 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\Nati\Downloads\Rechnung.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.A.16384' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
22.04.2014 12:26 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\Nati\Downloads\Rechnung.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.A.16384' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
22.04.2014 12:26 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\Nati\Downloads\Rechnung.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.A.16384' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
22.04.2014 12:26 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\Nati\Downloads\Rechnung.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.A.16384' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
22.04.2014 12:26 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\Nati\Downloads\Rechnung.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.A.16384' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
22.04.2014 12:26 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\Nati\Downloads\Rechnung.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.A.16384' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
22.04.2014 12:26 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\Nati\Downloads\Rechnung.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.A.16384' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
22.04.2014 12:26 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\Nati\Downloads\Rechnung.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.A.16384' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
 |
|
23.04.2014, 19:45
| #2 |
| /// the machine /// TB-Ausbilder    | Windows 7: Trojaner Rechnung.exe hi,
__________________Scan mit Combofix
__________________ |
|
23.04.2014, 20:10
| #3 |
| | Windows 7: Trojaner Rechnung.exe Ok, das Programm hat angezeigt, dass SpyBot noch aktiv wäre, obwohl ich den Prozess beendet hatte, daraufhin habe ich SpyBot deinstalliert, und das Programm lief durch.
__________________Hier die Log Datei: Code:
ATTFilter ComboFix 14-04-20.01 - Nati 23.04.2014 20:57:02.1.4 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1252.49.1031.18.6071.4620 [GMT 2:00]
ausgeführt von:: c:\users\Nati\Desktop\ComboFix.exe
AV: Ad-Aware Antivirus *Disabled/Outdated* {D87B6541-12A1-DAEA-0033-9B8057AAB996}
AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
FW: Ad-Aware Firewall *Disabled* {E040E464-58CE-DBB2-2B6C-32B5A979FEED}
SP: Ad-Aware Antivirus *Disabled/Outdated* {631A84A5-349B-D564-3A83-A0F22C2DF32B}
SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Spybot - Search and Destroy *Enabled/Outdated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\END
c:\windows\IsUn0407.exe
c:\windows\wininit.ini
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-03-23 bis 2014-04-23 ))))))))))))))))))))))))))))))
.
.
2014-04-23 19:01 . 2014-04-23 19:01 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-04-23 17:27 . 2014-04-23 17:29 -------- d-----w- C:\FRST
2014-04-22 21:41 . 2014-04-23 19:02 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy 2
2014-04-22 21:23 . 2014-04-22 21:23 -------- d-----w- c:\program files\Lavasoft
2014-04-22 21:21 . 2014-04-22 21:21 -------- d-----w- c:\users\Nati\AppData\Roaming\Lavasoft
2014-04-22 21:21 . 2014-04-22 21:21 -------- d-----w- c:\program files\Common Files\Lavasoft
2014-04-22 21:20 . 2014-04-22 21:20 -------- d-----w- c:\programdata\Lavasoft
2014-04-22 10:51 . 2014-04-22 10:51 -------- d-----w- c:\users\Nati\AppData\Local\TuneUp Software
2014-04-22 10:49 . 2014-04-22 10:58 -------- d-sh--w- c:\programdata\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-04-22 10:49 . 2014-04-22 10:49 -------- d--h--w- c:\programdata\Common Files
2014-04-22 09:01 . 2014-04-17 03:31 10651704 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{32D4E24A-43FD-4F4A-BF20-404E7B5D539E}\mpengine.dll
2014-04-16 09:39 . 2011-04-18 16:03 120320 ----a-w- c:\windows\system32\E_ILMILE.DLL
2014-04-16 09:39 . 2011-03-13 16:03 83968 ----a-w- c:\windows\system32\E_IBCBILE.DLL
2014-04-06 20:59 . 2014-04-06 20:59 -------- d-----w- c:\users\Nati\AppData\Roaming\MFSM-Tasks
2014-04-06 20:59 . 2014-04-06 20:59 -------- d-----w- c:\program files (x86)\MF Shutdown Manager
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-04-10 05:55 . 2012-02-10 22:38 90655440 ----a-w- c:\windows\system32\MRT.exe
2014-03-31 07:35 . 2012-02-10 16:12 270496 ------w- c:\windows\system32\MpSigStub.exe
2014-03-11 19:27 . 2012-07-03 17:12 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-03-11 19:27 . 2012-02-11 16:53 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-03-04 09:17 . 2014-04-10 05:07 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2014-03-01 05:16 . 2014-03-12 08:22 4096 ----a-w- c:\windows\system32\ieetwcollectorres.dll
2014-03-01 04:58 . 2014-03-12 08:22 2765824 ----a-w- c:\windows\system32\iertutil.dll
2014-03-01 04:52 . 2014-03-12 08:22 66048 ----a-w- c:\windows\system32\iesetup.dll
2014-03-01 04:51 . 2014-03-12 08:22 48640 ----a-w- c:\windows\system32\ieetwproxystub.dll
2014-03-01 04:42 . 2014-03-12 08:22 53760 ----a-w- c:\windows\system32\jsproxy.dll
2014-03-01 04:40 . 2014-03-12 08:22 33792 ----a-w- c:\windows\system32\iernonce.dll
2014-03-01 04:37 . 2014-03-12 08:22 574976 ----a-w- c:\windows\system32\ieui.dll
2014-03-01 04:33 . 2014-03-12 08:22 139264 ----a-w- c:\windows\system32\ieUnatt.exe
2014-03-01 04:33 . 2014-03-12 08:22 111616 ----a-w- c:\windows\system32\ieetwcollector.exe
2014-03-01 04:32 . 2014-03-12 08:22 708608 ----a-w- c:\windows\system32\jscript9diag.dll
2014-03-01 04:23 . 2014-03-12 08:22 940032 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2014-03-01 04:17 . 2014-03-12 08:22 218624 ----a-w- c:\windows\system32\ie4uinit.exe
2014-03-01 04:02 . 2014-03-12 08:22 195584 ----a-w- c:\windows\system32\msrating.dll
2014-03-01 03:54 . 2014-03-12 08:22 5768704 ----a-w- c:\windows\system32\jscript9.dll
2014-03-01 03:52 . 2014-03-12 08:22 61952 ----a-w- c:\windows\SysWow64\iesetup.dll
2014-03-01 03:51 . 2014-03-12 08:22 51200 ----a-w- c:\windows\SysWow64\ieetwproxystub.dll
2014-03-01 03:42 . 2014-03-12 08:22 627200 ----a-w- c:\windows\system32\msfeeds.dll
2014-03-01 03:38 . 2014-03-12 08:22 112128 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2014-03-01 03:37 . 2014-03-12 08:22 553472 ----a-w- c:\windows\SysWow64\jscript9diag.dll
2014-03-01 03:35 . 2014-03-12 08:22 2041856 ----a-w- c:\windows\system32\inetcpl.cpl
2014-03-01 03:18 . 2014-03-12 08:22 13051904 ----a-w- c:\windows\system32\ieframe.dll
2014-03-01 03:14 . 2014-03-12 08:22 4244480 ----a-w- c:\windows\SysWow64\jscript9.dll
2014-03-01 03:10 . 2014-03-12 08:22 2334208 ----a-w- c:\windows\system32\wininet.dll
2014-03-01 03:00 . 2014-03-12 08:22 1964032 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2014-03-01 02:38 . 2014-03-12 08:22 1393664 ----a-w- c:\windows\system32\urlmon.dll
2014-03-01 02:32 . 2014-03-12 08:22 1820160 ----a-w- c:\windows\SysWow64\wininet.dll
2014-03-01 02:25 . 2014-03-12 08:22 817664 ----a-w- c:\windows\system32\ieapfltr.dll
2014-02-07 01:23 . 2014-03-12 08:22 3156480 ----a-w- c:\windows\system32\win32k.sys
2014-02-04 02:32 . 2014-03-12 08:20 1424384 ----a-w- c:\windows\system32\WindowsCodecs.dll
2014-02-04 02:32 . 2014-03-12 08:20 624128 ----a-w- c:\windows\system32\qedit.dll
2014-02-04 02:04 . 2014-03-12 08:20 1230336 ----a-w- c:\windows\SysWow64\WindowsCodecs.dll
2014-02-04 02:04 . 2014-03-12 08:20 509440 ----a-w- c:\windows\SysWow64\qedit.dll
2014-01-29 02:32 . 2014-03-12 08:22 484864 ----a-w- c:\windows\system32\wer.dll
2014-01-29 02:06 . 2014-03-12 08:22 381440 ----a-w- c:\windows\SysWow64\wer.dll
2014-01-28 02:32 . 2014-03-12 08:22 228864 ----a-w- c:\windows\system32\wwansvc.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}]
2013-01-28 14:49 281760 ----a-w- c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EPLTarget\P0000000000000000"="c:\windows\system32\spool\DRIVERS\x64\3\E_IATIILE.EXE" [2012-02-28 283232]
"EPLTarget\P0000000000000001"="c:\windows\system32\spool\DRIVERS\x64\3\E_IATIILE.EXE" [2012-02-28 283232]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2007-03-20 36864]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2014-02-20 689744]
"EEventManager"="c:\program files (x86)\Epson Software\Event Manager\EEventManager.exe" [2011-10-31 1058400]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0sdnclean64.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
"LWS"=c:\program files (x86)\Logitech\LWS\Webcam Software\LWS.exe -hide
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 Asushwio;Asushwio;c:\windows\system32\drivers\Asushwio.sys;c:\windows\SYSNATIVE\drivers\Asushwio.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\DRIVERS\ss_bbus.sys;c:\windows\SYSNATIVE\DRIVERS\ss_bbus.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WSDScan;WSD-Scanunterstützung durch UMB;c:\windows\system32\drivers\WSDScan.sys;c:\windows\SYSNATIVE\drivers\WSDScan.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S2 ABBYY.Licensing.FineReader.Sprint.9.0;ABBYY FineReader 9.0 Sprint Licensing Service;c:\program files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe;c:\program files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 EPSON_PM_RPCV4_04;EPSON V3 Service4(04);c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE;c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE [x]
S2 EpsonScanSvc;Epson Scanner Service;c:\windows\system32\EscSvc64.exe;c:\windows\SYSNATIVE\EscSvc64.exe [x]
S2 LavasoftAdAwareService11;Ad-Aware Service 11;c:\program files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe;c:\program files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe [x]
S2 LVPrcS64;Process Monitor;c:\program files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe;c:\program files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe [x]
S2 TeamViewer9;TeamViewer 9;c:\program files (x86)\TeamViewer\Version9\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version9\TeamViewer_Service.exe [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
S3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\DRIVERS\e1k62x64.sys;c:\windows\SYSNATIVE\DRIVERS\e1k62x64.sys [x]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys;c:\windows\SYSNATIVE\DRIVERS\HECIx64.sys [x]
S3 LVPr2M64;Logitech LVPr2M64 Driver;c:\windows\system32\DRIVERS\LVPr2M64.sys;c:\windows\SYSNATIVE\DRIVERS\LVPr2M64.sys [x]
S3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys;c:\windows\SYSNATIVE\DRIVERS\lvrs64.sys [x]
S3 LVUVC64;Logitech Webcam C210(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys;c:\windows\SYSNATIVE\DRIVERS\lvuvc64.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
Inhalt des "geplante Tasks" Ordners
.
2014-04-23 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-03 19:27]
.
2014-04-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3307610919-556288989-4226615614-1001Core.job
- c:\users\Nati\AppData\Local\Google\Update\GoogleUpdate.exe [2013-01-29 17:29]
.
2014-04-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3307610919-556288989-4226615614-1001UA.job
- c:\users\Nati\AppData\Local\Google\Update\GoogleUpdate.exe [2013-01-29 17:29]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}]
2013-01-28 14:49 342176 ----a-w- c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-04 186904]
"AdAwareTray"="c:\program files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTray.exe" [2014-01-23 4114264]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://search.conduit.com/?ctid=CT3319434&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SP3D838B47-016E-47AD-AA0C-4C8B68E7EEA6&SSPV=
mLocal Page = c:\windows\SysWOW64\blank.htm
uSearchAssistant = hxxp://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=DE&userid=164dd9c1-2303-4165-840a-8a30c04e3fe5&searchtype=ds&q={searchTerms}
IE: Free YouTube Download - c:\program files (x86)\Common Files\DVDVideoSoft\plugins\freeytvdownloader.htm
IE: Free YouTube to MP3 Converter - c:\program files (x86)\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: {{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll
TCP: DhcpNameServer = 192.168.178.1
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*]
@="?????????????????? v1"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*]
@="?????????????????? v2"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Common Files\Logishrd\LVMVFM\LVPrS64H.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2014-04-23 21:06:44 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2014-04-23 19:06
.
Vor Suchlauf: 9 Verzeichnis(se), 403.644.067.840 Bytes frei
Nach Suchlauf: 13 Verzeichnis(se), 403.555.807.232 Bytes frei
.
- - End Of File - - E34259C04DA651E7307E8695E4B190E8
A36C5E4F47E84449FF07ED3517B43A31
|
|
24.04.2014, 12:29
| #4 |
| /// the machine /// TB-Ausbilder | Windows 7: Trojaner Rechnung.exe Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
24.04.2014, 16:39
| #5 |
| | Windows 7: Trojaner Rechnung.exe Die Suchläufe haben folgendes ergeben: Log Datei mbam.txt: Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 24.04.2014 Suchlauf-Zeit: 17:09:08 Logdatei: mbam.txt Administrator: Ja Version: 2.00.1.1004 Malware Datenbank: v2014.04.24.07 Rootkit Datenbank: v2014.03.27.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Chameleon: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: Nati Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 260291 Verstrichene Zeit: 16 Min, 41 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Aktiviert Shuriken: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 0 (No malicious items detected) Registrierungswerte: 0 (No malicious items detected) Registrierungsdaten: 3 PUP.Optional.Conduit.A, HKU\S-1-5-21-3307610919-556288989-4226615614-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://search.conduit.com/?ctid=CT3319434&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SP3D838B47-016E-47AD-AA0C-4C8B68E7EEA6&SSPV=, Gut: (hxxp://www.google.com), Schlecht: (hxxp://search.conduit.com/?ctid=CT3319434&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SP3D838B47-016E-47AD-AA0C-4C8B68E7EEA6&SSPV=),Löschen bei Neustart,[03fdf8084eb204fc58a0a67ee71d33cd] PUP.Optional.Snapdo, HKU\S-1-5-21-3307610919-556288989-4226615614-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|Default_Search_URL, hxxp://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=DE&userid=164dd9c1-2303-4165-840a-8a30c04e3fe5&searchtype=ds&q={searchTerms}, Gut: (hxxp://www.google.com), Schlecht: (hxxp://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=DE&userid=164dd9c1-2303-4165-840a-8a30c04e3fe5&searchtype=ds&q={searchTerms}),Löschen bei Neustart,[7b85709034cc966a21e981ad13f1c937] PUP.Optional.Snapdo, HKU\S-1-5-21-3307610919-556288989-4226615614-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|SearchAssistant, hxxp://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=DE&userid=164dd9c1-2303-4165-840a-8a30c04e3fe5&searchtype=ds&q={searchTerms}, Gut: (hxxp://www.google.com), Schlecht: (hxxp://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=DE&userid=164dd9c1-2303-4165-840a-8a30c04e3fe5&searchtype=ds&q={searchTerms}),Löschen bei Neustart,[9a660ff1c33d4eb27b901d11b54f42be] Ordner: 6 PUP.Optional.OpenCandy, C:\Users\Nati\AppData\Roaming\OpenCandy, In Quarantäne, [31cf857b7e828878caf808591ae8a858], PUP.Optional.OpenCandy, C:\Users\Nati\AppData\Roaming\OpenCandy\456D5A472B5149D1B84CCFC829DABD4E, In Quarantäne, [31cf857b7e828878caf808591ae8a858], PUP.Optional.OpenCandy, C:\Users\Nati\AppData\Roaming\OpenCandy\63C5FC044CD04919B4DABF808D4E1D20, In Quarantäne, [31cf857b7e828878caf808591ae8a858], PUP.Optional.OpenCandy, C:\Users\Nati\AppData\Roaming\OpenCandy\6977B202071645FEBDC97E7ABC15A84D, In Quarantäne, [31cf857b7e828878caf808591ae8a858], PUP.Optional.OpenCandy, C:\Users\Nati\AppData\Roaming\OpenCandy\D1E32863FDD44E94A169D79AEB05FAE2, In Quarantäne, [31cf857b7e828878caf808591ae8a858], PUP.Optional.OpenCandy, C:\Users\Nati\AppData\Roaming\OpenCandy\OpenCandy_D1E32863FDD44E94A169D79AEB05FAE2, In Quarantäne, [31cf857b7e828878caf808591ae8a858], Dateien: 13 PUP.Optional.Conduit.A, C:\Users\Nati\AppData\Roaming\OpenCandy\6977B202071645FEBDC97E7ABC15A84D\SSStub_SearchProtect_p1v0.exe, In Quarantäne, [cf31f40cf50be8188a9928f0ae53db25], PUP.Optional.OpenCandy, C:\Users\Nati\Downloads\DTLite4454-0314.exe, In Quarantäne, [b64ad12fa55b8e72c737c78a6f9523dd], PUP.Optional.OpenCandy, C:\Users\Nati\Downloads\DTLite4461-0327.exe, In Quarantäne, [8a7614ec52ae4db3f90576db8381ca36], PUP.Optional.OpenCandy, C:\Users\Nati\Downloads\DTLite4481-0347.exe, In Quarantäne, [77891ce4629ee11f619d76db4aba2bd5], PUP.Optional.OpenCandy, C:\Users\Nati\AppData\Roaming\OpenCandy\456D5A472B5149D1B84CCFC829DABD4E\driverscannerDE.exe, In Quarantäne, [31cf857b7e828878caf808591ae8a858], PUP.Optional.OpenCandy, C:\Users\Nati\AppData\Roaming\OpenCandy\63C5FC044CD04919B4DABF808D4E1D20\3708.ico, In Quarantäne, [31cf857b7e828878caf808591ae8a858], PUP.Optional.OpenCandy, C:\Users\Nati\AppData\Roaming\OpenCandy\63C5FC044CD04919B4DABF808D4E1D20\EBB77268-338F-4C6A-8590-AD88FED26F4A, In Quarantäne, [31cf857b7e828878caf808591ae8a858], PUP.Optional.OpenCandy, C:\Users\Nati\AppData\Roaming\OpenCandy\63C5FC044CD04919B4DABF808D4E1D20\OCBrowserHelper_1.0.5.112.dll, In Quarantäne, [31cf857b7e828878caf808591ae8a858], PUP.Optional.OpenCandy, C:\Users\Nati\AppData\Roaming\OpenCandy\D1E32863FDD44E94A169D79AEB05FAE2\3707.ico, In Quarantäne, [31cf857b7e828878caf808591ae8a858], PUP.Optional.OpenCandy, C:\Users\Nati\AppData\Roaming\OpenCandy\D1E32863FDD44E94A169D79AEB05FAE2\EBB77268-338F-4C6A-8590-AD88FED26F4A, In Quarantäne, [31cf857b7e828878caf808591ae8a858], PUP.Optional.OpenCandy, C:\Users\Nati\AppData\Roaming\OpenCandy\D1E32863FDD44E94A169D79AEB05FAE2\OCBrowserHelper_1.0.3.85.dll, In Quarantäne, [31cf857b7e828878caf808591ae8a858], PUP.Optional.OpenCandy, C:\Users\Nati\AppData\Roaming\OpenCandy\D1E32863FDD44E94A169D79AEB05FAE2\SnapDo.exe, In Quarantäne, [31cf857b7e828878caf808591ae8a858], PUP.Optional.OpenCandy, C:\Users\Nati\AppData\Roaming\OpenCandy\D1E32863FDD44E94A169D79AEB05FAE2\SnapDo_ALL_p1v4.exe, In Quarantäne, [31cf857b7e828878caf808591ae8a858], Physische Sektoren: 0 (No malicious items detected) (end) Code:
ATTFilter # AdwCleaner v3.202 - Bericht erstellt am 24/04/2014 um 17:23:03
# Aktualisiert 23/04/2014 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : Nati - NATIS-COMPUTER
# Gestartet von : C:\Users\Nati\Desktop\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\ClickIT
Ordner Gelöscht : C:\Users\Nati\AppData\Roaming\dvdvideosoftiehelpers
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{ACAA314B-EEBA-48E4-AD47-84E31C44796C}]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\driverscanner
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\driverscanner_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\driverscanner_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SaveByClick_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SaveByClick_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Wert Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\adawarebp
Schlüssel Gelöscht : HKLM\Software\SProtector
Schlüssel Gelöscht : HKLM\Software\Uniblue
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.16521
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\SearchUrl [Default]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchUrl [Default]
-\\ Google Chrome v
[ Datei : C:\Users\Nati\AppData\Local\Google\Chrome\User Data\Default\preferences ]
Gelöscht [Search Provider] : hxxp://search.conduit.com/Results.aspx?ctid=CT3319434&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SP3D838B47-016E-47AD-AA0C-4C8B68E7EEA6&q=%s&SSPV=
*************************
AdwCleaner[R0].txt - [4586 octets] - [24/04/2014 17:13:55]
AdwCleaner[S0].txt - [3911 octets] - [24/04/2014 17:23:03]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [3971 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Professional x64
Ran by Nati on 24.04.2014 at 17:27:01,50
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\adawarebp
~~~ Files
~~~ Folders
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 24.04.2014 at 17:30:55,18
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-04-2014
Ran by Nati (administrator) on NATIS-COMPUTER on 24-04-2014 17:32:45
Running from C:\Users\Nati\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_IATIILE.EXE
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_IATIILE.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE
() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\Logishrd\LVMVFM\LVPrS64H.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe
(Seiko Epson Corporation) C:\Windows\system32\EscSvc64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-04] (Intel Corporation)
HKLM\...\Run: [AdAwareTray] => C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTray.exe [4114264 2014-01-23] ()
HKLM-x32\...\Run: [JMB36X IDE Setup] => C:\Windows\RaidTool\xInsIDE.exe [36864 2007-03-20] ()
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [1058400 2011-10-31] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-3307610919-556288989-4226615614-1001\...\Run: [EPLTarget\P0000000000000000] => C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIILE.EXE [283232 2012-02-29] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-3307610919-556288989-4226615614-1001\...\Run: [EPLTarget\P0000000000000001] => C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIILE.EXE [283232 2012-02-29] (SEIKO EPSON CORPORATION)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xCD6245081482CD01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @java.com/DTPlugin,version=10.11.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.11.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.3 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Nati\AppData\Local\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Nati\AppData\Local\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
Chrome:
=======
CHR HomePage:
CHR Extension: (Last updated at $time$ on $date$) - C:\Users\Nati\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-04-22]
CHR Extension: (AdBlock) - C:\Users\Nati\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-04-22]
CHR Extension: (DVDVideoSoft Browser Extension) - C:\Users\Nati\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp [2013-02-22]
CHR Extension: (Google Wallet) - C:\Users\Nati\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-02]
CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\DVDVideoSoftBrowserExtension.crx [2013-02-22]
==================== Services (Whitelisted) =================
R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 EpsonScanSvc; C:\Windows\system32\EscSvc64.exe [135824 2011-12-12] (Seiko Epson Corporation)
R2 LavasoftAdAwareService11; C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe [702744 2014-01-23] ()
==================== Drivers (Whitelisted) ====================
S3 Asushwio; C:\Windows\SysWOW64\drivers\Asushwio.sys [5824 2000-03-29] ()
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [88480 2013-05-10] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-12] (Avira Operations GmbH & Co. KG)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [46400 2013-05-10] ()
R3 LVPr2M64; C:\Windows\System32\DRIVERS\LVPr2M64.sys [30304 2010-05-07] ()
S3 LVPr2Mon; C:\Windows\System32\DRIVERS\LVPr2M64.sys [30304 2010-05-07] ()
R3 Trufos; C:\Windows\System32\DRIVERS\Trufos.sys [329800 2013-07-17] (BitDefender S.R.L.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-04-24 17:30 - 2014-04-24 17:30 - 00000721 _____ () C:\Users\Nati\Desktop\JRT.txt
2014-04-24 17:27 - 2014-04-24 17:27 - 00000000 ____D () C:\Windows\ERUNT
2014-04-24 17:25 - 2014-04-24 17:25 - 00004067 _____ () C:\Users\Nati\Desktop\AdwCleaner[S0].txt
2014-04-24 17:14 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-04-24 17:13 - 2014-04-24 17:23 - 00000000 ____D () C:\AdwCleaner
2014-04-24 17:12 - 2014-04-24 17:12 - 00005735 _____ () C:\Users\Nati\Desktop\mbam.txt
2014-04-24 16:50 - 2014-04-24 17:11 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-24 16:49 - 2014-04-24 16:49 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-04-24 16:49 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-24 16:49 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-24 16:49 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-24 16:46 - 2014-04-24 16:46 - 00000085 _____ () C:\Windows\wininit.ini
2014-04-24 16:43 - 2014-04-24 16:43 - 02061824 _____ (Farbar) C:\Users\Nati\Desktop\FRST64.exe
2014-04-24 16:43 - 2014-04-24 16:43 - 01016261 _____ (Thisisu) C:\Users\Nati\Desktop\JRT.exe
2014-04-23 21:12 - 2014-04-23 21:12 - 00014932 _____ () C:\Users\Nati\Desktop\ComboFix.txt
2014-04-23 21:06 - 2014-04-23 21:06 - 00014932 _____ () C:\ComboFix.txt
2014-04-23 20:56 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-04-23 20:56 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-04-23 20:56 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-04-23 20:56 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-04-23 20:56 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-04-23 20:56 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-04-23 20:56 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-04-23 20:56 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-04-23 20:54 - 2014-04-23 21:06 - 00000000 ____D () C:\Qoobox
2014-04-23 20:54 - 2014-04-23 21:05 - 00000000 ____D () C:\Windows\erdnt
2014-04-23 20:00 - 2014-04-23 20:00 - 00000824 _____ () C:\Users\Nati\Desktop\Gmer.txt
2014-04-23 19:42 - 2014-04-23 19:42 - 00275488 _____ () C:\Windows\Minidump\042314-27861-01.dmp
2014-04-23 19:41 - 2014-04-23 19:41 - 496828449 _____ () C:\Windows\MEMORY.DMP
2014-04-23 19:28 - 2014-04-23 19:29 - 00050648 _____ () C:\Users\Nati\Desktop\Addition.txt
2014-04-23 19:27 - 2014-04-24 17:32 - 00008408 _____ () C:\Users\Nati\Desktop\FRST.txt
2014-04-23 19:27 - 2014-04-24 17:32 - 00000000 ____D () C:\FRST
2014-04-23 19:23 - 2014-04-23 19:24 - 00000470 _____ () C:\Users\Nati\Desktop\defogger_disable.log
2014-04-23 19:23 - 2014-04-23 19:23 - 00000000 _____ () C:\Users\Nati\defogger_reenable
2014-04-23 19:04 - 2014-04-23 19:04 - 00021008 _____ () C:\Users\Nati\Desktop\Antivir_Ereignisse.txt
2014-04-22 23:41 - 2014-04-24 16:47 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-04-22 23:36 - 2014-04-22 23:36 - 00000000 ____D () C:\Users\Nati\AppData\Roaming\LavasoftStatistics
2014-04-22 23:23 - 2014-04-24 17:24 - 00002305 _____ () C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
2014-04-22 23:23 - 2014-04-22 23:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ad-Aware Antivirus
2014-04-22 23:23 - 2014-04-22 23:23 - 00000000 ____D () C:\Program Files\Lavasoft
2014-04-22 23:21 - 2014-04-22 23:22 - 40658208 _____ (Safer-Networking Ltd. ) C:\Users\Nati\Downloads\spybot-2.2.25.exe
2014-04-22 23:21 - 2014-04-22 23:21 - 00000000 ____D () C:\Users\Nati\AppData\Roaming\Lavasoft
2014-04-22 23:21 - 2014-04-22 23:21 - 00000000 ____D () C:\Program Files\Common Files\Lavasoft
2014-04-22 23:20 - 2014-04-22 23:20 - 01727624 _____ () C:\Users\Nati\Downloads\Adaware_Installer.exe
2014-04-22 23:20 - 2014-04-22 23:20 - 00000000 ____D () C:\ProgramData\Lavasoft
2014-04-22 21:23 - 2014-04-24 17:10 - 00016960 _____ () C:\Windows\PFRO.log
2014-04-22 12:52 - 2014-04-24 17:24 - 00001167 _____ () C:\Windows\setupact.log
2014-04-22 12:52 - 2014-04-22 12:52 - 00000000 _____ () C:\Windows\setuperr.log
2014-04-22 12:51 - 2014-04-22 12:51 - 00000000 ____D () C:\Users\Nati\AppData\Local\TuneUp Software
2014-04-22 12:49 - 2014-04-22 12:58 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-04-22 12:48 - 2014-04-22 12:48 - 06685392 _____ (Glarysoft Ltd ) C:\Users\Nati\Downloads\gusetup_slim_2.56.exe
2014-04-22 12:47 - 2014-04-22 12:48 - 27878824 _____ (TuneUp Software) C:\Users\Nati\Downloads\TuneUpUtilities2014_de2745-DE.exe
2014-04-21 19:32 - 2014-04-21 19:32 - 00000661 _____ () C:\Users\Nati\Desktop\lol.launcher.admin - Verknüpfung.lnk
2014-04-19 18:23 - 2014-04-19 18:23 - 00001210 _____ () C:\Users\Nati\Desktop\TeamSpeak 3 Client.lnk
2014-04-19 18:23 - 2014-04-19 18:23 - 00000000 ____D () C:\Users\Nati\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
2014-04-19 18:21 - 2014-04-19 18:22 - 27601296 _____ (TeamSpeak Systems GmbH) C:\Users\Nati\Downloads\TeamSpeak3-Client-win32-3.0.14 (1).exe
2014-04-16 11:39 - 2011-04-18 18:03 - 00120320 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\E_ILMILE.DLL
2014-04-16 11:39 - 2011-03-13 18:03 - 00083968 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\E_IBCBILE.DLL
2014-04-10 07:07 - 2014-03-31 03:16 - 23134208 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-10 07:07 - 2014-03-31 03:13 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-10 07:07 - 2014-03-31 02:13 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-10 07:07 - 2014-03-31 01:57 - 17073152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-10 07:07 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-10 07:07 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-10 07:07 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-10 07:07 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-10 07:07 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-10 07:07 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-10 07:07 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-10 07:07 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-10 07:07 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-10 07:07 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-10 07:07 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-04-10 07:07 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-10 07:07 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-10 07:07 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-10 07:07 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-10 07:07 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-04-10 07:07 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-04-08 16:22 - 2014-04-08 16:22 - 05260387 _____ () C:\Users\Nati\Downloads\Kinderhaus Wiesenborn.zip
2014-04-06 22:59 - 2014-04-06 22:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MF Shutdown Manager
2014-04-06 22:59 - 2014-04-06 22:59 - 00000000 ____D () C:\Program Files (x86)\MF Shutdown Manager
2014-03-30 15:56 - 2014-03-30 15:56 - 00376288 _____ () C:\Users\Nati\Downloads\MediaPlayerClassic.exe
==================== One Month Modified Files and Folders =======
2014-04-24 17:33 - 2014-04-23 19:27 - 00008408 _____ () C:\Users\Nati\Desktop\FRST.txt
2014-04-24 17:32 - 2014-04-23 19:27 - 00000000 ____D () C:\FRST
2014-04-24 17:32 - 2009-07-14 06:45 - 00018960 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-24 17:32 - 2009-07-14 06:45 - 00018960 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-24 17:31 - 2009-07-14 19:58 - 00699432 _____ () C:\Windows\system32\perfh007.dat
2014-04-24 17:31 - 2009-07-14 19:58 - 00149572 _____ () C:\Windows\system32\perfc007.dat
2014-04-24 17:31 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-24 17:30 - 2014-04-24 17:30 - 00000721 _____ () C:\Users\Nati\Desktop\JRT.txt
2014-04-24 17:28 - 2014-02-11 14:49 - 01937917 _____ () C:\Windows\WindowsUpdate.log
2014-04-24 17:27 - 2014-04-24 17:27 - 00000000 ____D () C:\Windows\ERUNT
2014-04-24 17:27 - 2012-07-12 17:56 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-24 17:25 - 2014-04-24 17:25 - 00004067 _____ () C:\Users\Nati\Desktop\AdwCleaner[S0].txt
2014-04-24 17:24 - 2014-04-22 23:23 - 00002305 _____ () C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
2014-04-24 17:24 - 2014-04-22 12:52 - 00001167 _____ () C:\Windows\setupact.log
2014-04-24 17:24 - 2012-02-11 22:15 - 00000000 ____D () C:\Windows\SysWOW64\logishrd
2014-04-24 17:24 - 2012-02-11 22:15 - 00000000 ____D () C:\Windows\system32\logishrd
2014-04-24 17:24 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-24 17:23 - 2014-04-24 17:13 - 00000000 ____D () C:\AdwCleaner
2014-04-24 17:20 - 2013-01-29 19:29 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3307610919-556288989-4226615614-1001UA.job
2014-04-24 17:12 - 2014-04-24 17:12 - 00005735 _____ () C:\Users\Nati\Desktop\mbam.txt
2014-04-24 17:11 - 2014-04-24 16:50 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-24 17:10 - 2014-04-22 21:23 - 00016960 _____ () C:\Windows\PFRO.log
2014-04-24 17:09 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Resources
2014-04-24 16:49 - 2014-04-24 16:49 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-04-24 16:49 - 2012-10-23 21:27 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-24 16:47 - 2014-04-22 23:41 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-04-24 16:46 - 2014-04-24 16:46 - 00000085 _____ () C:\Windows\wininit.ini
2014-04-24 16:46 - 2012-02-16 20:26 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-04-24 16:43 - 2014-04-24 16:43 - 02061824 _____ (Farbar) C:\Users\Nati\Desktop\FRST64.exe
2014-04-24 16:43 - 2014-04-24 16:43 - 01016261 _____ (Thisisu) C:\Users\Nati\Desktop\JRT.exe
2014-04-24 16:39 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\system32\FxsTmp
2014-04-24 03:48 - 2012-03-16 21:27 - 00000000 ____D () C:\Users\Nati\AppData\Roaming\TS3Client
2014-04-23 23:44 - 2012-02-11 22:15 - 00010049 _____ () C:\Windows\system32\lvcoinst.log
2014-04-23 23:43 - 2012-02-11 22:15 - 00000000 ____D () C:\Program Files\Common Files\Logishrd
2014-04-23 23:22 - 2014-03-04 20:18 - 00000000 ____D () C:\Users\Nati\AppData\Local\Battle.net
2014-04-23 21:12 - 2014-04-23 21:12 - 00014932 _____ () C:\Users\Nati\Desktop\ComboFix.txt
2014-04-23 21:06 - 2014-04-23 21:06 - 00014932 _____ () C:\ComboFix.txt
2014-04-23 21:06 - 2014-04-23 20:54 - 00000000 ____D () C:\Qoobox
2014-04-23 21:06 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2014-04-23 21:05 - 2014-04-23 20:54 - 00000000 ____D () C:\Windows\erdnt
2014-04-23 21:03 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-04-23 20:00 - 2014-04-23 20:00 - 00000824 _____ () C:\Users\Nati\Desktop\Gmer.txt
2014-04-23 19:42 - 2014-04-23 19:42 - 00275488 _____ () C:\Windows\Minidump\042314-27861-01.dmp
2014-04-23 19:42 - 2012-04-15 01:05 - 00000000 ____D () C:\Windows\Minidump
2014-04-23 19:41 - 2014-04-23 19:41 - 496828449 _____ () C:\Windows\MEMORY.DMP
2014-04-23 19:29 - 2014-04-23 19:28 - 00050648 _____ () C:\Users\Nati\Desktop\Addition.txt
2014-04-23 19:24 - 2014-04-23 19:23 - 00000470 _____ () C:\Users\Nati\Desktop\defogger_disable.log
2014-04-23 19:23 - 2014-04-23 19:23 - 00000000 _____ () C:\Users\Nati\defogger_reenable
2014-04-23 19:23 - 2012-02-10 17:51 - 00000000 ____D () C:\Users\Nati
2014-04-23 19:04 - 2014-04-23 19:04 - 00021008 _____ () C:\Users\Nati\Desktop\Antivir_Ereignisse.txt
2014-04-22 23:36 - 2014-04-22 23:36 - 00000000 ____D () C:\Users\Nati\AppData\Roaming\LavasoftStatistics
2014-04-22 23:23 - 2014-04-22 23:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ad-Aware Antivirus
2014-04-22 23:23 - 2014-04-22 23:23 - 00000000 ____D () C:\Program Files\Lavasoft
2014-04-22 23:22 - 2014-04-22 23:21 - 40658208 _____ (Safer-Networking Ltd. ) C:\Users\Nati\Downloads\spybot-2.2.25.exe
2014-04-22 23:21 - 2014-04-22 23:21 - 00000000 ____D () C:\Users\Nati\AppData\Roaming\Lavasoft
2014-04-22 23:21 - 2014-04-22 23:21 - 00000000 ____D () C:\Program Files\Common Files\Lavasoft
2014-04-22 23:20 - 2014-04-22 23:20 - 01727624 _____ () C:\Users\Nati\Downloads\Adaware_Installer.exe
2014-04-22 23:20 - 2014-04-22 23:20 - 00000000 ____D () C:\ProgramData\Lavasoft
2014-04-22 21:45 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-04-22 15:20 - 2013-01-29 19:29 - 00001064 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3307610919-556288989-4226615614-1001Core.job
2014-04-22 12:58 - 2014-04-22 12:49 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-04-22 12:58 - 2012-06-08 23:27 - 00003694 _____ () C:\Windows\System32\Tasks\Adobe-Online-Aktualisierungsprogramm
2014-04-22 12:58 - 2012-05-05 19:03 - 00000000 ____D () C:\Users\Nati\AppData\Local\Microsoft Help
2014-04-22 12:58 - 2012-02-24 20:42 - 00000000 ____D () C:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}
2014-04-22 12:58 - 2012-02-10 20:54 - 00000000 __SHD () C:\ProgramData\{32364CEA-7855-4A3C-B674-53D8E9B97936}
2014-04-22 12:52 - 2014-04-22 12:52 - 00000000 _____ () C:\Windows\setuperr.log
2014-04-22 12:52 - 2012-02-10 20:54 - 00000000 ____D () C:\ProgramData\TuneUp Software
2014-04-22 12:51 - 2014-04-22 12:51 - 00000000 ____D () C:\Users\Nati\AppData\Local\TuneUp Software
2014-04-22 12:51 - 2012-02-10 20:54 - 00000000 ____D () C:\Users\Nati\AppData\Roaming\TuneUp Software
2014-04-22 12:48 - 2014-04-22 12:48 - 06685392 _____ (Glarysoft Ltd ) C:\Users\Nati\Downloads\gusetup_slim_2.56.exe
2014-04-22 12:48 - 2014-04-22 12:47 - 27878824 _____ (TuneUp Software) C:\Users\Nati\Downloads\TuneUpUtilities2014_de2745-DE.exe
2014-04-21 19:32 - 2014-04-21 19:32 - 00000661 _____ () C:\Users\Nati\Desktop\lol.launcher.admin - Verknüpfung.lnk
2014-04-21 12:16 - 2014-03-12 17:52 - 00000000 ____D () C:\Users\Nati\Desktop\PRAKTIKUM
2014-04-19 18:23 - 2014-04-19 18:23 - 00001210 _____ () C:\Users\Nati\Desktop\TeamSpeak 3 Client.lnk
2014-04-19 18:23 - 2014-04-19 18:23 - 00000000 ____D () C:\Users\Nati\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
2014-04-19 18:23 - 2012-06-24 00:58 - 00000000 ____D () C:\Users\Nati\AppData\Local\TeamSpeak 3 Client
2014-04-19 18:22 - 2014-04-19 18:21 - 27601296 _____ (TeamSpeak Systems GmbH) C:\Users\Nati\Downloads\TeamSpeak3-Client-win32-3.0.14 (1).exe
2014-04-19 18:14 - 2012-02-11 01:27 - 00000000 ____D () C:\Users\Nati\AppData\Roaming\Skype
2014-04-19 17:28 - 2012-03-16 21:27 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client
2014-04-12 15:06 - 2014-03-04 20:20 - 00000000 ____D () C:\Program Files (x86)\Hearthstone
2014-04-12 14:10 - 2014-03-04 20:18 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2014-04-11 13:03 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-04-11 11:04 - 2009-07-14 07:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-04-10 07:56 - 2013-07-17 16:42 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-10 07:56 - 2012-05-05 19:03 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-04-10 07:55 - 2012-02-11 00:38 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-04-08 16:22 - 2014-04-08 16:22 - 05260387 _____ () C:\Users\Nati\Downloads\Kinderhaus Wiesenborn.zip
2014-04-06 22:59 - 2014-04-06 22:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MF Shutdown Manager
2014-04-06 22:59 - 2014-04-06 22:59 - 00000000 ____D () C:\Program Files (x86)\MF Shutdown Manager
2014-04-03 09:51 - 2014-04-24 16:49 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-03 09:51 - 2014-04-24 16:49 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-03 09:50 - 2014-04-24 16:49 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-03-31 09:35 - 2012-02-10 18:12 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-03-31 03:16 - 2014-04-10 07:07 - 23134208 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-31 03:13 - 2014-04-10 07:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-31 02:13 - 2014-04-10 07:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-03-31 01:57 - 2014-04-10 07:07 - 17073152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-03-30 15:56 - 2014-03-30 15:56 - 00376288 _____ () C:\Users\Nati\Downloads\MediaPlayerClassic.exe
2014-03-29 16:15 - 2013-01-29 19:29 - 00004084 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3307610919-556288989-4226615614-1001UA
2014-03-29 16:15 - 2013-01-29 19:29 - 00003688 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3307610919-556288989-4226615614-1001Core
Some content of TEMP:
====================
C:\Users\Nati\AppData\Local\Temp\avgnt.exe
C:\Users\Nati\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-04-19 14:12
==================== End Of Log ============================
--- --- ---  DANKE! |
|
25.04.2014, 09:35
| #6 |
| /// the machine /// TB-Ausbilder | Windows 7: Trojaner Rechnung.exeESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ --> Windows 7: Trojaner Rechnung.exe |
|
27.04.2014, 19:14
| #7 |
| | Windows 7: Trojaner Rechnung.exe Hallo nochmal Zu deiner Frage, ob es noch Probleme gibt: Mein PC lief vor wie nach der Infizierung gleichbleibend. Ich habe keine Veränderungen bemerkt, also er hat keinerlei "Macken" gezeigt. Meine einzige Hoffnung ist, dass ich durch die Scans jetzt wieder ohne Angst meine Online Konten benutzen kann. Hier die geforderten Logs: Eset: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=29908129100ae844baeec206b4cbc62e
# engine=18048
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-04-27 04:10:08
# local_time=2014-04-27 06:10:08 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 96 17343 169286313 10117 0
# compatibility_mode=5893 16776573 100 94 9306 150244858 0 0
# scanned=198352
# found=1
# cleaned=0
# scan_time=5358
sh=40A5B8D7BC66B74A354D306A0DCE7582205ACBA6 ft=1 fh=b13b4b9de16a3f8c vn="Win32/AdWare.1ClickDownload.AR Anwendung" ac=I fn="C:\Users\Nati\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\00\00000000"
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=29908129100ae844baeec206b4cbc62e
# engine=18048
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-04-27 05:59:00
# local_time=2014-04-27 07:59:00 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 96 23875 169292845 16649 0
# compatibility_mode=5893 16776573 100 94 15838 150251390 0 0
# scanned=199308
# found=1
# cleaned=0
# scan_time=6412
sh=40A5B8D7BC66B74A354D306A0DCE7582205ACBA6 ft=1 fh=b13b4b9de16a3f8c vn="Win32/AdWare.1ClickDownload.AR Anwendung" ac=I fn="C:\Users\Nati\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\00\00000000"
Code:
ATTFilter Results of screen317's Security Check version 0.99.82
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Avira Desktop
Ad-Aware Antivirus
Antivirus up to date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
Adobe Flash Player 12.0.0.77 Flash Player out of Date!
Adobe Reader 10.1.9 Adobe Reader out of Date!
Google Chrome 34.0.1847.116
Google Chrome 34.0.1847.131
````````Process Check: objlist.exe by Laurent````````
Avira Antivir avgnt.exe
Avira Antivir avguard.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-04-2014
Ran by Nati (administrator) on NATIS-COMPUTER on 27-04-2014 20:07:26
Running from C:\Users\Nati\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_IATIILE.EXE
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_IATIILE.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE
() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe
(Logitech Inc.) C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\Logishrd\LVMVFM\LVPrS64H.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(Seiko Epson Corporation) C:\Windows\system32\EscSvc64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Google Inc.) C:\Users\Nati\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Nati\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Nati\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Nati\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Nati\AppData\Local\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-04] (Intel Corporation)
HKLM\...\Run: [AdAwareTray] => C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTray.exe [4114264 2014-01-23] ()
HKLM-x32\...\Run: [JMB36X IDE Setup] => C:\Windows\RaidTool\xInsIDE.exe [36864 2007-03-20] ()
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [1058400 2011-10-31] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-3307610919-556288989-4226615614-1001\...\Run: [EPLTarget\P0000000000000000] => C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIILE.EXE [283232 2012-02-29] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-3307610919-556288989-4226615614-1001\...\Run: [EPLTarget\P0000000000000001] => C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIILE.EXE [283232 2012-02-29] (SEIKO EPSON CORPORATION)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xCD6245081482CD01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @java.com/DTPlugin,version=10.11.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.11.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.3 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Nati\AppData\Local\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Nati\AppData\Local\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
Chrome:
=======
CHR HomePage:
CHR Extension: (Adblock Plus) - C:\Users\Nati\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-04-22]
CHR Extension: (AdBlock) - C:\Users\Nati\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-04-22]
CHR Extension: (DVDVideoSoft Browser Extension) - C:\Users\Nati\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp [2013-02-22]
CHR Extension: (Google Wallet) - C:\Users\Nati\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-02]
CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\DVDVideoSoftBrowserExtension.crx [2013-02-22]
==================== Services (Whitelisted) =================
R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 EpsonScanSvc; C:\Windows\system32\EscSvc64.exe [135824 2011-12-12] (Seiko Epson Corporation)
R2 LavasoftAdAwareService11; C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe [702744 2014-01-23] ()
==================== Drivers (Whitelisted) ====================
S3 Asushwio; C:\Windows\SysWOW64\drivers\Asushwio.sys [5824 2000-03-29] ()
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [88480 2013-05-10] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-12] (Avira Operations GmbH & Co. KG)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [46400 2013-05-10] ()
R3 LVPr2M64; C:\Windows\System32\DRIVERS\LVPr2M64.sys [30304 2010-05-07] ()
S3 LVPr2Mon; C:\Windows\System32\DRIVERS\LVPr2M64.sys [30304 2010-05-07] ()
R3 Trufos; C:\Windows\System32\DRIVERS\Trufos.sys [329800 2013-07-17] (BitDefender S.R.L.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-04-27 20:06 - 2014-04-27 20:06 - 00000911 _____ () C:\Users\Nati\Desktop\checkup.txt
2014-04-27 20:04 - 2014-04-27 20:05 - 02061824 _____ (Farbar) C:\Users\Nati\Desktop\FRST64.exe
2014-04-24 17:30 - 2014-04-24 17:30 - 00000721 _____ () C:\Users\Nati\Desktop\JRT.txt
2014-04-24 17:27 - 2014-04-24 17:27 - 00000000 ____D () C:\Windows\ERUNT
2014-04-24 17:25 - 2014-04-24 17:25 - 00004067 _____ () C:\Users\Nati\Desktop\AdwCleaner[S0].txt
2014-04-24 17:14 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-04-24 17:13 - 2014-04-24 17:23 - 00000000 ____D () C:\AdwCleaner
2014-04-24 17:12 - 2014-04-24 17:12 - 00005735 _____ () C:\Users\Nati\Desktop\mbam.txt
2014-04-24 16:50 - 2014-04-24 17:11 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-24 16:49 - 2014-04-24 16:49 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-04-24 16:49 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-24 16:49 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-24 16:49 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-24 16:46 - 2014-04-24 16:46 - 00000085 _____ () C:\Windows\wininit.ini
2014-04-23 21:12 - 2014-04-23 21:12 - 00014932 _____ () C:\Users\Nati\Desktop\ComboFix.txt
2014-04-23 21:06 - 2014-04-23 21:06 - 00014932 _____ () C:\ComboFix.txt
2014-04-23 20:56 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-04-23 20:56 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-04-23 20:56 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-04-23 20:56 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-04-23 20:56 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-04-23 20:56 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-04-23 20:56 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-04-23 20:56 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-04-23 20:54 - 2014-04-23 21:06 - 00000000 ____D () C:\Qoobox
2014-04-23 20:54 - 2014-04-23 21:05 - 00000000 ____D () C:\Windows\erdnt
2014-04-23 20:00 - 2014-04-23 20:00 - 00000824 _____ () C:\Users\Nati\Desktop\Gmer.txt
2014-04-23 19:42 - 2014-04-23 19:42 - 00275488 _____ () C:\Windows\Minidump\042314-27861-01.dmp
2014-04-23 19:41 - 2014-04-23 19:41 - 496828449 _____ () C:\Windows\MEMORY.DMP
2014-04-23 19:28 - 2014-04-23 19:29 - 00050648 _____ () C:\Users\Nati\Desktop\Addition.txt
2014-04-23 19:27 - 2014-04-27 20:07 - 00008864 _____ () C:\Users\Nati\Desktop\FRST.txt
2014-04-23 19:27 - 2014-04-27 20:07 - 00000000 ____D () C:\FRST
2014-04-23 19:23 - 2014-04-23 19:24 - 00000470 _____ () C:\Users\Nati\Desktop\defogger_disable.log
2014-04-23 19:23 - 2014-04-23 19:23 - 00000000 _____ () C:\Users\Nati\defogger_reenable
2014-04-23 19:04 - 2014-04-23 19:04 - 00021008 _____ () C:\Users\Nati\Desktop\Antivir_Ereignisse.txt
2014-04-22 23:41 - 2014-04-24 16:47 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-04-22 23:36 - 2014-04-22 23:36 - 00000000 ____D () C:\Users\Nati\AppData\Roaming\LavasoftStatistics
2014-04-22 23:23 - 2014-04-27 13:17 - 00002305 _____ () C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
2014-04-22 23:23 - 2014-04-22 23:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ad-Aware Antivirus
2014-04-22 23:23 - 2014-04-22 23:23 - 00000000 ____D () C:\Program Files\Lavasoft
2014-04-22 23:21 - 2014-04-22 23:22 - 40658208 _____ (Safer-Networking Ltd. ) C:\Users\Nati\Downloads\spybot-2.2.25.exe
2014-04-22 23:21 - 2014-04-22 23:21 - 00000000 ____D () C:\Users\Nati\AppData\Roaming\Lavasoft
2014-04-22 23:21 - 2014-04-22 23:21 - 00000000 ____D () C:\Program Files\Common Files\Lavasoft
2014-04-22 23:20 - 2014-04-22 23:20 - 01727624 _____ () C:\Users\Nati\Downloads\Adaware_Installer.exe
2014-04-22 23:20 - 2014-04-22 23:20 - 00000000 ____D () C:\ProgramData\Lavasoft
2014-04-22 21:23 - 2014-04-24 17:10 - 00016960 _____ () C:\Windows\PFRO.log
2014-04-22 12:52 - 2014-04-27 13:15 - 00001615 _____ () C:\Windows\setupact.log
2014-04-22 12:52 - 2014-04-22 12:52 - 00000000 _____ () C:\Windows\setuperr.log
2014-04-22 12:51 - 2014-04-22 12:51 - 00000000 ____D () C:\Users\Nati\AppData\Local\TuneUp Software
2014-04-22 12:49 - 2014-04-22 12:58 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-04-22 12:48 - 2014-04-22 12:48 - 06685392 _____ (Glarysoft Ltd ) C:\Users\Nati\Downloads\gusetup_slim_2.56.exe
2014-04-22 12:47 - 2014-04-22 12:48 - 27878824 _____ (TuneUp Software) C:\Users\Nati\Downloads\TuneUpUtilities2014_de2745-DE.exe
2014-04-21 19:32 - 2014-04-21 19:32 - 00000661 _____ () C:\Users\Nati\Desktop\lol.launcher.admin - Verknüpfung.lnk
2014-04-19 18:23 - 2014-04-19 18:23 - 00001210 _____ () C:\Users\Nati\Desktop\TeamSpeak 3 Client.lnk
2014-04-19 18:23 - 2014-04-19 18:23 - 00000000 ____D () C:\Users\Nati\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
2014-04-19 18:21 - 2014-04-19 18:22 - 27601296 _____ (TeamSpeak Systems GmbH) C:\Users\Nati\Downloads\TeamSpeak3-Client-win32-3.0.14 (1).exe
2014-04-16 11:39 - 2011-04-18 18:03 - 00120320 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\E_ILMILE.DLL
2014-04-16 11:39 - 2011-03-13 18:03 - 00083968 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\E_IBCBILE.DLL
2014-04-10 07:07 - 2014-03-31 03:16 - 23134208 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-10 07:07 - 2014-03-31 03:13 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-10 07:07 - 2014-03-31 02:13 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-10 07:07 - 2014-03-31 01:57 - 17073152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-10 07:07 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-10 07:07 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-10 07:07 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-10 07:07 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-10 07:07 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-10 07:07 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-10 07:07 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-10 07:07 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-10 07:07 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-10 07:07 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-10 07:07 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-04-10 07:07 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-10 07:07 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-10 07:07 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-10 07:07 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-10 07:07 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-04-10 07:07 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-04-08 16:22 - 2014-04-08 16:22 - 05260387 _____ () C:\Users\Nati\Downloads\Kinderhaus Wiesenborn.zip
2014-04-06 22:59 - 2014-04-06 22:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MF Shutdown Manager
2014-04-06 22:59 - 2014-04-06 22:59 - 00000000 ____D () C:\Program Files (x86)\MF Shutdown Manager
2014-03-30 15:56 - 2014-03-30 15:56 - 00376288 _____ () C:\Users\Nati\Downloads\MediaPlayerClassic.exe
==================== One Month Modified Files and Folders =======
2014-04-27 20:07 - 2014-04-23 19:27 - 00008864 _____ () C:\Users\Nati\Desktop\FRST.txt
2014-04-27 20:07 - 2014-04-23 19:27 - 00000000 ____D () C:\FRST
2014-04-27 20:06 - 2014-04-27 20:06 - 00000911 _____ () C:\Users\Nati\Desktop\checkup.txt
2014-04-27 20:05 - 2014-04-27 20:04 - 02061824 _____ (Farbar) C:\Users\Nati\Desktop\FRST64.exe
2014-04-27 19:27 - 2012-07-12 17:56 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-27 19:20 - 2013-01-29 19:29 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3307610919-556288989-4226615614-1001UA.job
2014-04-27 17:50 - 2014-02-11 14:49 - 02095552 _____ () C:\Windows\WindowsUpdate.log
2014-04-27 16:32 - 2009-07-14 19:58 - 00699432 _____ () C:\Windows\system32\perfh007.dat
2014-04-27 16:32 - 2009-07-14 19:58 - 00149572 _____ () C:\Windows\system32\perfc007.dat
2014-04-27 16:32 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-27 15:34 - 2014-03-04 20:18 - 00000000 ____D () C:\Users\Nati\AppData\Local\Battle.net
2014-04-27 15:20 - 2013-01-29 19:29 - 00001064 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3307610919-556288989-4226615614-1001Core.job
2014-04-27 13:24 - 2009-07-14 06:45 - 00018960 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-27 13:24 - 2009-07-14 06:45 - 00018960 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-27 13:17 - 2014-04-22 23:23 - 00002305 _____ () C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
2014-04-27 13:17 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\system32\FxsTmp
2014-04-27 13:16 - 2012-02-11 22:15 - 00000000 ____D () C:\Windows\SysWOW64\logishrd
2014-04-27 13:16 - 2012-02-11 22:15 - 00000000 ____D () C:\Windows\system32\logishrd
2014-04-27 13:15 - 2014-04-22 12:52 - 00001615 _____ () C:\Windows\setupact.log
2014-04-27 13:15 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-27 02:50 - 2012-03-16 21:27 - 00000000 ____D () C:\Users\Nati\AppData\Roaming\TS3Client
2014-04-24 19:56 - 2012-02-11 22:15 - 00010510 _____ () C:\Windows\system32\lvcoinst.log
2014-04-24 18:31 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-04-24 17:30 - 2014-04-24 17:30 - 00000721 _____ () C:\Users\Nati\Desktop\JRT.txt
2014-04-24 17:27 - 2014-04-24 17:27 - 00000000 ____D () C:\Windows\ERUNT
2014-04-24 17:25 - 2014-04-24 17:25 - 00004067 _____ () C:\Users\Nati\Desktop\AdwCleaner[S0].txt
2014-04-24 17:23 - 2014-04-24 17:13 - 00000000 ____D () C:\AdwCleaner
2014-04-24 17:12 - 2014-04-24 17:12 - 00005735 _____ () C:\Users\Nati\Desktop\mbam.txt
2014-04-24 17:11 - 2014-04-24 16:50 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-24 17:10 - 2014-04-22 21:23 - 00016960 _____ () C:\Windows\PFRO.log
2014-04-24 17:09 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Resources
2014-04-24 16:49 - 2014-04-24 16:49 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-04-24 16:49 - 2012-10-23 21:27 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-24 16:47 - 2014-04-22 23:41 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-04-24 16:46 - 2014-04-24 16:46 - 00000085 _____ () C:\Windows\wininit.ini
2014-04-24 16:46 - 2012-02-16 20:26 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-04-23 23:43 - 2012-02-11 22:15 - 00000000 ____D () C:\Program Files\Common Files\Logishrd
2014-04-23 21:12 - 2014-04-23 21:12 - 00014932 _____ () C:\Users\Nati\Desktop\ComboFix.txt
2014-04-23 21:06 - 2014-04-23 21:06 - 00014932 _____ () C:\ComboFix.txt
2014-04-23 21:06 - 2014-04-23 20:54 - 00000000 ____D () C:\Qoobox
2014-04-23 21:06 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2014-04-23 21:05 - 2014-04-23 20:54 - 00000000 ____D () C:\Windows\erdnt
2014-04-23 21:03 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-04-23 20:00 - 2014-04-23 20:00 - 00000824 _____ () C:\Users\Nati\Desktop\Gmer.txt
2014-04-23 19:42 - 2014-04-23 19:42 - 00275488 _____ () C:\Windows\Minidump\042314-27861-01.dmp
2014-04-23 19:42 - 2012-04-15 01:05 - 00000000 ____D () C:\Windows\Minidump
2014-04-23 19:41 - 2014-04-23 19:41 - 496828449 _____ () C:\Windows\MEMORY.DMP
2014-04-23 19:29 - 2014-04-23 19:28 - 00050648 _____ () C:\Users\Nati\Desktop\Addition.txt
2014-04-23 19:24 - 2014-04-23 19:23 - 00000470 _____ () C:\Users\Nati\Desktop\defogger_disable.log
2014-04-23 19:23 - 2014-04-23 19:23 - 00000000 _____ () C:\Users\Nati\defogger_reenable
2014-04-23 19:23 - 2012-02-10 17:51 - 00000000 ____D () C:\Users\Nati
2014-04-23 19:04 - 2014-04-23 19:04 - 00021008 _____ () C:\Users\Nati\Desktop\Antivir_Ereignisse.txt
2014-04-22 23:36 - 2014-04-22 23:36 - 00000000 ____D () C:\Users\Nati\AppData\Roaming\LavasoftStatistics
2014-04-22 23:23 - 2014-04-22 23:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ad-Aware Antivirus
2014-04-22 23:23 - 2014-04-22 23:23 - 00000000 ____D () C:\Program Files\Lavasoft
2014-04-22 23:22 - 2014-04-22 23:21 - 40658208 _____ (Safer-Networking Ltd. ) C:\Users\Nati\Downloads\spybot-2.2.25.exe
2014-04-22 23:21 - 2014-04-22 23:21 - 00000000 ____D () C:\Users\Nati\AppData\Roaming\Lavasoft
2014-04-22 23:21 - 2014-04-22 23:21 - 00000000 ____D () C:\Program Files\Common Files\Lavasoft
2014-04-22 23:20 - 2014-04-22 23:20 - 01727624 _____ () C:\Users\Nati\Downloads\Adaware_Installer.exe
2014-04-22 23:20 - 2014-04-22 23:20 - 00000000 ____D () C:\ProgramData\Lavasoft
2014-04-22 12:58 - 2014-04-22 12:49 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-04-22 12:58 - 2012-06-08 23:27 - 00003694 _____ () C:\Windows\System32\Tasks\Adobe-Online-Aktualisierungsprogramm
2014-04-22 12:58 - 2012-05-05 19:03 - 00000000 ____D () C:\Users\Nati\AppData\Local\Microsoft Help
2014-04-22 12:58 - 2012-02-24 20:42 - 00000000 ____D () C:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}
2014-04-22 12:58 - 2012-02-10 20:54 - 00000000 __SHD () C:\ProgramData\{32364CEA-7855-4A3C-B674-53D8E9B97936}
2014-04-22 12:52 - 2014-04-22 12:52 - 00000000 _____ () C:\Windows\setuperr.log
2014-04-22 12:52 - 2012-02-10 20:54 - 00000000 ____D () C:\ProgramData\TuneUp Software
2014-04-22 12:51 - 2014-04-22 12:51 - 00000000 ____D () C:\Users\Nati\AppData\Local\TuneUp Software
2014-04-22 12:51 - 2012-02-10 20:54 - 00000000 ____D () C:\Users\Nati\AppData\Roaming\TuneUp Software
2014-04-22 12:48 - 2014-04-22 12:48 - 06685392 _____ (Glarysoft Ltd ) C:\Users\Nati\Downloads\gusetup_slim_2.56.exe
2014-04-22 12:48 - 2014-04-22 12:47 - 27878824 _____ (TuneUp Software) C:\Users\Nati\Downloads\TuneUpUtilities2014_de2745-DE.exe
2014-04-21 19:32 - 2014-04-21 19:32 - 00000661 _____ () C:\Users\Nati\Desktop\lol.launcher.admin - Verknüpfung.lnk
2014-04-21 12:16 - 2014-03-12 17:52 - 00000000 ____D () C:\Users\Nati\Desktop\PRAKTIKUM
2014-04-19 18:23 - 2014-04-19 18:23 - 00001210 _____ () C:\Users\Nati\Desktop\TeamSpeak 3 Client.lnk
2014-04-19 18:23 - 2014-04-19 18:23 - 00000000 ____D () C:\Users\Nati\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
2014-04-19 18:23 - 2012-06-24 00:58 - 00000000 ____D () C:\Users\Nati\AppData\Local\TeamSpeak 3 Client
2014-04-19 18:22 - 2014-04-19 18:21 - 27601296 _____ (TeamSpeak Systems GmbH) C:\Users\Nati\Downloads\TeamSpeak3-Client-win32-3.0.14 (1).exe
2014-04-19 18:14 - 2012-02-11 01:27 - 00000000 ____D () C:\Users\Nati\AppData\Roaming\Skype
2014-04-19 17:28 - 2012-03-16 21:27 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client
2014-04-12 15:06 - 2014-03-04 20:20 - 00000000 ____D () C:\Program Files (x86)\Hearthstone
2014-04-12 14:10 - 2014-03-04 20:18 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2014-04-11 13:03 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-04-11 11:04 - 2009-07-14 07:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-04-10 07:56 - 2013-07-17 16:42 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-10 07:56 - 2012-05-05 19:03 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-04-10 07:55 - 2012-02-11 00:38 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-04-08 16:22 - 2014-04-08 16:22 - 05260387 _____ () C:\Users\Nati\Downloads\Kinderhaus Wiesenborn.zip
2014-04-06 22:59 - 2014-04-06 22:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MF Shutdown Manager
2014-04-06 22:59 - 2014-04-06 22:59 - 00000000 ____D () C:\Program Files (x86)\MF Shutdown Manager
2014-04-03 09:51 - 2014-04-24 16:49 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-03 09:51 - 2014-04-24 16:49 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-03 09:50 - 2014-04-24 16:49 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-03-31 09:35 - 2012-02-10 18:12 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-03-31 03:16 - 2014-04-10 07:07 - 23134208 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-31 03:13 - 2014-04-10 07:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-31 02:13 - 2014-04-10 07:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-03-31 01:57 - 2014-04-10 07:07 - 17073152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-03-30 15:56 - 2014-03-30 15:56 - 00376288 _____ () C:\Users\Nati\Downloads\MediaPlayerClassic.exe
2014-03-29 16:15 - 2013-01-29 19:29 - 00004084 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3307610919-556288989-4226615614-1001UA
2014-03-29 16:15 - 2013-01-29 19:29 - 00003688 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3307610919-556288989-4226615614-1001Core
Some content of TEMP:
====================
C:\Users\Nati\AppData\Local\Temp\avgnt.exe
C:\Users\Nati\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-04-19 14:12
==================== End Of Log ============================
Danke für alles Schrauber, du bist Klasse |
|
28.04.2014, 08:51
| #8 |
| /// the machine /// TB-Ausbilder | Windows 7: Trojaner Rechnung.exe Adobe updaten. Revo Uninstaller - Download - Filepony damit Chrome deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren. Dann: https://support.google.com/chrome/answer/3296214?hl=de Fertig Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
30.04.2014, 22:39
| #9 |
| | Windows 7: Trojaner Rechnung.exe Hey, alles erledigt. Habe ehrlich gesagt immer noch bedenken, ob ich nun wieder sicher Online-Banking betreiben kann. Kann ich mir denn sicher sein, dass es wieder in Ordnung ist oder soll ich lieber meinen Rechner formatieren? Alles Liebe und nochmals tausend Dank. |
|
01.05.2014, 16:52
| #10 |
| /// the machine /// TB-Ausbilder | Windows 7: Trojaner Rechnung.exe 100% Garantie kann(darf) man bei sowas nicht Versprechen. Deswegen sind es nur 99,999%  Avira hat das Ding großteils direkt geblockt. Der Rest ist runter. Solange du nit total veraltet mit TAN-Liste unterwegs bist pasiert da eh nix.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Windows 7: Trojaner Rechnung.exe |
| ad-aware, antivirus, avira, branding, converter, dvdvideosoft ltd., e-mail, excel, flash player, helper, iexplore.exe, programm, pup.optional.conduit.a, pup.optional.opencandy, pup.optional.snapdo, refresh, safer networking, scan, security, senden, software, svchost.exe, system, teamspeak, tr/crypt.xpack.gen, tr/crypt.xpack.gen2, tr/dropper.a.16384, trojaner, windows |
WARNUNG an die MITLESER: 
