Trojaner durch Telekom-Rechnung-Fake eingefangen?

schrauber · 25.06.2014, 18:09

malware entfernt. mehr wirste öffentlich nit erfahren, malware schreiber lesen mit

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

edle_stau · 25.06.2014, 20:06

hi schrauber

Zitat:

Zitat von schrauber

malware entfernt. mehr wirste öffentlich nit erfahren, malware schreiber lesen mit

sooo genau wollte ich das ja auch nicht wissen

maleware entfernt reicht mir doch fast - vielleicht darfst du ja noch verraten welche??

egal, hier die gewünschten logs:
mbam.txt: das gefundene objekt ist die von mir auf dem desktop hinterlegte zip gewesen...
neustart wurde nicht gefordert, habe ich aber trotzdem mal gemacht, hoffe das war ok....

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 25.06.2014
Suchlauf-Zeit: 20:22:27
Logdatei: mbam.txt
Administrator: Ja

Version: 2.00.2.1012
Malware Datenbank: v2014.06.25.16
Rootkit Datenbank: v2014.06.23.02
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows Vista Service Pack 2
CPU: x86
Dateisystem: NTFS
Benutzer: Eddy

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 351622
Verstrichene Zeit: 7 Min, 32 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristics: Aktiviert
PUP: Warnen
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 0
(No malicious items detected)

Registrierungswerte: 0
(No malicious items detected)

Registrierungsdaten: 0
(No malicious items detected)

Ordner: 0
(No malicious items detected)

Dateien: 1
Trojan.Dropper, C:\Users\Eddy\Desktop\VORSICHT TROJANER 2014_06rechnung_74714968142546_sign.zip, In Quarantäne, [60544f2d4c2fe94d897698b1867afc04], 

Physische Sektoren: 0
(No malicious items detected)


(end)

AdwCleaner[S1].txt:

Code:

ATTFilter

# AdwCleaner v3.213 - Bericht erstellt am 25/06/2014 um 20:40:37
# Aktualisiert 23/06/2014 von Xplode
# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Benutzername : Eddy - XXXXXXXPC
# Gestartet von : C:\Users\Eddy\Desktop\adwcleaner_3.213.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6DDA37BA-0553-499A-AE0D-BEBA67204548}
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3152E1F19977892449DC968802CE8964

***** [ Browser ] *****

-\\ Internet Explorer v9.0.8112.16555


-\\ Mozilla Firefox v30.0 (de)

[ Datei : C:\Users\Eddy\AppData\Roaming\Mozilla\Firefox\Profiles\zz0b23mb.default-1366641502146\prefs.js ]


[ Datei : C:\Users\XXXXXXX\AppData\Roaming\Mozilla\Firefox\Profiles\4g06qgc9.default\prefs.js ]


*************************

AdwCleaner[R0].txt - [5669 octets] - [23/02/2014 10:38:19]
AdwCleaner[R1].txt - [1054 octets] - [23/02/2014 10:56:03]
AdwCleaner[R2].txt - [1144 octets] - [26/02/2014 23:25:35]
AdwCleaner[R3].txt - [1442 octets] - [23/06/2014 19:54:37]
AdwCleaner[R4].txt - [1502 octets] - [23/06/2014 20:07:44]
AdwCleaner[R5].txt - [1522 octets] - [25/06/2014 20:38:34]
AdwCleaner[S0].txt - [5736 octets] - [23/02/2014 10:49:09]
AdwCleaner[S1].txt - [1443 octets] - [25/06/2014 20:40:37]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1503 octets] ##########

JRT.txt:

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows Vista (TM) Home Premium x86
Ran by Eddy on 25.06.2014 at 20:46:31,42
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-1170903483-2863482033-2135167284-1006\Software\sweetim
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{AC513376-5AD6-4855-B58E-FB6D844E1974}



~~~ Files



~~~ Folders



~~~ FireFox

Emptied folder: C:\Users\Eddy\AppData\Roaming\mozilla\firefox\profiles\zz0b23mb.default-1366641502146\minidumps [407 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 25.06.2014 at 20:48:34,21
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

und das neue FRST.txt (ein Additional gab's diesmal net...

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:22-06-2014
Ran by Eddy (administrator) on XXXXXXXPC on 25-06-2014 20:53:47
Running from C:\Users\Eddy\Desktop
Platform: Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Microsoft Corporation.) C:\Program Files\Microsoft\BingBar\BBSvc.EXE
(Microsoft Corporation) C:\Program Files\Microsoft\BingBar\SeaPort.EXE
(B.H.A Corporation) C:\Windows\System32\bgsvcgen.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\VS7DEBUG\mdm.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
() C:\Program Files\CyberLink\Shared Files\RichVideo.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe
(Team MediaPortal) C:\Program Files\Team MediaPortal\MediaPortal TV Server\TvService.exe
() C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe
(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
(Panasonic Corporation) C:\Program Files\Common Files\Panasonic\PHOTOfunSTUDIO AutoStart\AutoStartupService.exe
() C:\Program Files\Plustek\OpticFilm 7600i\QuickScan.exe
(Dropbox, Inc.) C:\Users\Eddy\AppData\Roaming\Dropbox\bin\Dropbox.exe
() C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPNetworkCommunicator.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [WrtMon.exe] => C:\Windows\system32\spool\drivers\w32x86\3\WrtMon.exe [20480 2006-09-20] ()
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-06] (Apple Inc.)
HKLM\...\Run: [PinnacleDriverCheck] => C:\Windows\system32\PSDrvCheck.exe [406016 2004-03-10] ()
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [HP Software Update] => C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [49208 2011-05-10] (Hewlett-Packard)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [737872 2014-06-04] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [951576 2014-03-11] (Microsoft Corporation)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-05-26] (Apple Inc.)
HKU\S-1-5-21-1170903483-2863482033-2135167284-1006\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
HKU\S-1-5-21-1170903483-2863482033-2135167284-1006\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-19] (Microsoft Corporation)
HKU\S-1-5-21-1170903483-2863482033-2135167284-1006\...\Run: [HP Officejet Pro 8600 (NET)] => C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe [1837672 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-1170903483-2863482033-2135167284-1006\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [21445248 2014-05-08] (Skype Technologies S.A.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\PHOTOfunSTUDIO 5.1 HD Edition.lnk
ShortcutTarget: PHOTOfunSTUDIO 5.1 HD Edition.lnk -> C:\Program Files\Common Files\Panasonic\PHOTOfunSTUDIO AutoStart\AutoStartupService.exe (Panasonic Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\QuickScan (OpticFilm 7600i).lnk
ShortcutTarget: QuickScan (OpticFilm 7600i).lnk -> C:\Program Files\Plustek\OpticFilm 7600i\QuickScan.exe ()
Startup: C:\Users\Eddy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Eddy\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.geocaching.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x2E66C546A1AECC01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {4844B672-6BC3-40E3-BC81-DD0EE941A5F8} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=937811&p={searchTerms}
BHO: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll No File
BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 05 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Eddy\AppData\Roaming\Mozilla\Firefox\Profiles\zz0b23mb.default-1366641502146
FF NewTab: www.google.de
FF Homepage: hxxp://www.google.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_14_0_0_125.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @garmin.com/GpsControl - C:\Program Files\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @nvidia.com/3DVision - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin: @nvidia.com/3DVisionStreaming - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @citrixonline.com/appdetectorplugin - C:\Users\Eddy\AppData\Local\Citrix\Plugins\104\npappdetector.dll (Citrix Online)
FF Plugin HKCU: @Google.com/GoogleEarthPlugin - C:\Users\Eddy\AppData\Local\Google\Google Earth\plugin\npgeplugin.dll No File
FF Plugin HKCU: LWAPlugin15.8 - C:\Users\Eddy\AppData\Roaming\Mozilla\Plugins\npLWAPlugin15.8.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Users\Eddy\AppData\Roaming\mozilla\plugins\npLWAPlugin15.8.dll (Microsoft Corporation)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Garmin Communicator - C:\Users\Eddy\AppData\Roaming\Mozilla\Firefox\Profiles\zz0b23mb.default-1366641502146\Extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} [2014-05-01]
FF Extension: Tab Mix Plus - C:\Users\Eddy\AppData\Roaming\Mozilla\Firefox\Profiles\zz0b23mb.default-1366641502146\Extensions\{dc572301-7619-498c-a57d-39143191b318}.xpi [2013-04-22]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2014-06-12]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2014-06-12]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} [2014-06-12]
FF Extension: ELO Archiv-Transfer - C:\Program Files\Mozilla Firefox\extensions\EloFirefoxAddon.xpi [2014-06-12]
FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2 [2011-11-05]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2011-11-05]

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-06-04] (Avira Operations GmbH & Co. KG)
S3 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-06-04] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1039440 2014-06-04] (Avira Operations GmbH & Co. KG)
R2 bgsvcgen; C:\Windows\System32\bgsvcgen.exe [145504 2007-06-15] (B.H.A Corporation)
R3 hpqcxs08; C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll [217088 2008-10-16] (Hewlett-Packard Co.) [File not signed]
R2 hpqddsvc; C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll [135168 2008-10-16] (Hewlett-Packard Co.) [File not signed]
R2 HPSLPSVC; C:\Program Files\HP\Digital Imaging\bin\HPSLPSVC32.DLL [634880 2008-10-16] (Hewlett-Packard Co.) [File not signed]
R2 MDM; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [335872 2006-10-26] (Microsoft Corporation) [File not signed]
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [22216 2014-03-11] (Microsoft Corporation)
S4 MSSQLServerADHelper; C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [44384 2010-12-10] (Microsoft Corporation)
S4 msvsmon80; C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [2808664 2007-02-14] (Microsoft Corporation)
S3 NasPmService; C:\Program Files\BUFFALO\NASNAVI\nassvc.exe [251760 2011-12-25] (BUFFALO INC.)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [44032 2010-08-06] (Hewlett-Packard) [File not signed]
S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [279776 2014-03-11] (Microsoft Corporation)
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53760 2010-08-06] (Hewlett-Packard) [File not signed]
R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [272024 2007-01-09] ()
R2 TVService; C:\Program Files\Team MediaPortal\MediaPortal TV Server\TVService.exe [212992 2011-09-24] (Team MediaPortal) [File not signed]

==================== Drivers (Whitelisted) ====================

R3 3xHybrid; C:\Windows\System32\DRIVERS\3xHybrid.sys [1006816 2009-09-24] (NXP Semiconductors Germany GmbH)
R3 ASAPIW2k; C:\Windows\System32\drivers\ASAPIW2k.sys [11264 2004-03-10] (Pinnacle Systems GmbH) [File not signed]
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [93528 2014-06-04] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-06-04] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-14] (Avira Operations GmbH & Co. KG)
S3 FETNDIS; C:\Windows\System32\DRIVERS\fetnd5.sys [45568 2006-11-02] (VIA Technologies, Inc.              )
S3 grmnusb; C:\Windows\System32\drivers\grmnusb.sys [15720 2012-04-18] (GARMIN Corp.)
R3 MarvinBus; C:\Windows\System32\DRIVERS\MarvinBus.sys [90464 2004-03-29] (Pinnacle Systems GmbH) [File not signed]
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [231960 2014-01-25] (Microsoft Corporation)
R3 netr28u; C:\Windows\System32\DRIVERS\netr28u.sys [554496 2007-09-21] (Ralink Technology Corp.)
R1 PCLEPCI; C:\Windows\system32\drivers\pclepci.sys [14165 2002-03-19] (Pinnacle Systems GmbH) [File not signed]
S3 Ph3xIB32; C:\Windows\System32\DRIVERS\Ph3xIB32.sys [1131136 2007-04-03] (Philips Semiconductors GmbH) [File not signed]
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-08-05] (Avira GmbH)
R3 XUIF; C:\Windows\System32\Drivers\x10ufx2.sys [27416 2006-11-30] (X10 Wireless Technology, Inc.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-19] (Microsoft Corporation)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 catchme; \??\C:\Users\Eddy\AppData\Local\Temp\catchme.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-25 20:48 - 2014-06-25 20:48 - 00001114 _____ () C:\Users\Eddy\Desktop\JRT.txt
2014-06-25 20:46 - 2014-06-25 20:46 - 00000000 ____D () C:\Windows\ERUNT
2014-06-25 20:44 - 2014-06-25 20:40 - 00001583 _____ () C:\Users\Eddy\Desktop\AdwCleaner[S1].txt
2014-06-25 20:32 - 2014-06-25 20:32 - 00001277 _____ () C:\Users\Eddy\Desktop\mbam.txt
2014-06-25 20:20 - 2014-06-25 20:21 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-25 20:20 - 2014-06-25 20:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-25 20:20 - 2014-06-25 20:20 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-06-25 20:20 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-06-25 20:20 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-06-25 20:19 - 2014-06-23 21:23 - 01073152 _____ (Farbar) C:\Users\Eddy\Desktop\FRST.exe
2014-06-25 20:18 - 2014-06-25 20:18 - 01342659 _____ () C:\Users\Eddy\Desktop\adwcleaner_3.213.exe
2014-06-25 20:18 - 2014-06-25 20:18 - 01016261 _____ (Thisisu) C:\Users\Eddy\Desktop\JRT.exe
2014-06-25 20:17 - 2014-06-25 20:18 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Eddy\Desktop\mbam-setup-2.0.2.1012.exe
2014-06-24 20:54 - 2014-06-24 21:03 - 00016516 _____ () C:\Users\Eddy\Desktop\ComboFix.txt
2014-06-24 20:42 - 2014-06-24 20:42 - 00016516 _____ () C:\ComboFix.txt
2014-06-24 20:26 - 2014-06-24 20:42 - 00000000 ____D () C:\Qoobox
2014-06-24 20:26 - 2014-06-24 20:42 - 00000000 ____D () C:\ComboFix
2014-06-24 20:26 - 2014-06-24 20:41 - 00000000 ____D () C:\Windows\erdnt
2014-06-24 20:26 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-06-24 20:26 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-06-24 20:26 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-06-24 20:26 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-06-24 20:26 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-06-24 20:26 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-06-24 20:26 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-06-24 20:26 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-06-24 20:20 - 2014-06-24 20:20 - 01073152 _____ (Farbar) C:\Users\Eddy\Downloads\FRST.exe
2014-06-23 21:23 - 2014-06-25 20:53 - 00017513 _____ () C:\Users\Eddy\Desktop\FRST.txt
2014-06-23 21:23 - 2014-06-25 20:53 - 00000000 ____D () C:\FRST
2014-06-23 20:17 - 2014-06-23 20:17 - 00305936 _____ () C:\Users\Eddy\Desktop\WinRAR-ZIP-Archiv (neu).zip
2014-06-23 20:09 - 2014-06-23 20:12 - 00001502 _____ () C:\Users\Eddy\Desktop\AdwCleaner[R4].txt
2014-06-23 19:47 - 2014-06-23 19:51 - 00010176 _____ () C:\Users\Eddy\Desktop\hijackthis.log
2014-06-23 17:39 - 2014-06-23 17:41 - 00000000 ____D () C:\Program Files\Citrix
2014-06-23 17:39 - 2014-06-23 17:39 - 00000000 ____D () C:\Users\Eddy\AppData\Local\Citrix
2014-06-23 17:33 - 2014-06-23 17:34 - 04968448 _____ () C:\Users\Eddy\Downloads\LWAXpPlugin32BitInstaller(1).msi
2014-06-23 17:28 - 2014-06-23 17:29 - 04968448 _____ () C:\Users\Eddy\Downloads\LWAXpPlugin32BitInstaller.msi
2014-06-18 10:37 - 2014-06-18 10:53 - 00008533 _____ () C:\Users\Eddy\Desktop\NRW24.txt
2014-06-15 21:06 - 2014-06-15 21:06 - 00155458 _____ () C:\Users\Eddy\Desktop\13517436.zip
2014-06-15 12:33 - 2014-06-15 12:33 - 00000000 ____D () C:\Users\Eddy\AppData\Local\Adobe
2014-06-12 15:25 - 2014-06-12 15:25 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-06-10 19:55 - 2014-05-28 18:48 - 12356608 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-06-10 19:55 - 2014-05-28 18:39 - 01810432 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-06-10 19:55 - 2014-05-28 18:38 - 09711104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-06-10 19:55 - 2014-05-28 18:33 - 01106432 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-06-10 19:55 - 2014-05-28 18:32 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-06-10 19:55 - 2014-05-28 18:32 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-06-10 19:55 - 2014-05-28 18:31 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-06-10 19:55 - 2014-05-28 18:31 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-06-10 19:55 - 2014-05-28 18:30 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-06-10 19:55 - 2014-05-28 18:30 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-06-10 19:55 - 2014-05-28 18:30 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-06-10 19:55 - 2014-05-28 18:30 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-06-10 19:55 - 2014-05-28 18:30 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-06-10 19:55 - 2014-05-28 18:30 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-06-10 19:55 - 2014-05-28 18:30 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-06-10 19:55 - 2014-05-28 18:29 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-06-10 19:55 - 2014-05-28 18:29 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-06-10 19:55 - 2014-05-28 18:29 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-06-10 19:55 - 2014-05-28 18:29 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-06-10 19:55 - 2014-05-28 18:29 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-06-10 19:55 - 2014-05-28 18:28 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-06-10 19:55 - 2014-04-26 18:01 - 00502784 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2014-06-10 19:55 - 2014-04-05 05:23 - 00915392 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-06-10 19:55 - 2014-04-05 03:49 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpipreg.sys
2014-06-10 19:55 - 2014-03-10 03:22 - 01401344 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-06-10 19:55 - 2014-03-10 03:22 - 01248768 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-06-09 17:21 - 2014-04-19 21:36 - 00001114 _____ () C:\Users\Eddy\Desktop\2009.kmz
2014-06-08 11:33 - 2014-06-08 11:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PIONEER CORPORATION
2014-06-08 11:33 - 2014-06-08 11:33 - 00000000 ____D () C:\Program Files\PIONEER CORPORATION
2014-06-04 15:14 - 2014-06-04 15:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-06-04 15:13 - 2014-06-04 15:14 - 00000000 ____D () C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2014-06-04 15:13 - 2014-06-04 15:14 - 00000000 ____D () C:\Program Files\iTunes
2014-06-04 15:13 - 2014-06-04 15:13 - 00000000 ____D () C:\Program Files\iPod
2014-06-02 16:34 - 2014-06-02 16:34 - 00000000 ____D () C:\Program Files\Common Files\Skype

==================== One Month Modified Files and Folders =======

2014-06-25 20:54 - 2014-06-23 21:23 - 00017513 _____ () C:\Users\Eddy\Desktop\FRST.txt
2014-06-25 20:53 - 2014-06-23 21:23 - 00000000 ____D () C:\FRST
2014-06-25 20:48 - 2014-06-25 20:48 - 00001114 _____ () C:\Users\Eddy\Desktop\JRT.txt
2014-06-25 20:47 - 2011-11-05 14:50 - 01484555 _____ () C:\Windows\WindowsUpdate.log
2014-06-25 20:46 - 2014-06-25 20:46 - 00000000 ____D () C:\Windows\ERUNT
2014-06-25 20:44 - 2014-04-09 16:46 - 00000000 ____D () C:\Users\Eddy\AppData\Roaming\DropboxMaster
2014-06-25 20:44 - 2012-11-10 16:47 - 00000000 ____D () C:\Users\Eddy\AppData\Roaming\Skype
2014-06-25 20:44 - 2011-12-06 21:22 - 00000000 ____D () C:\Users\Eddy\AppData\Roaming\Dropbox
2014-06-25 20:43 - 2011-11-09 22:34 - 00001090 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-25 20:42 - 2011-11-05 18:08 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-06-25 20:42 - 2011-11-05 18:07 - 00472942 _____ () C:\Windows\PFRO.log
2014-06-25 20:42 - 2006-11-02 15:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-25 20:42 - 2006-11-02 14:47 - 00003264 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-25 20:42 - 2006-11-02 14:47 - 00003264 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-25 20:41 - 2006-11-02 15:01 - 00032530 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-06-25 20:40 - 2014-06-25 20:44 - 00001583 _____ () C:\Users\Eddy\Desktop\AdwCleaner[S1].txt
2014-06-25 20:40 - 2014-02-23 10:38 - 00000000 ____D () C:\AdwCleaner
2014-06-25 20:32 - 2014-06-25 20:32 - 00001277 _____ () C:\Users\Eddy\Desktop\mbam.txt
2014-06-25 20:26 - 2012-06-27 15:04 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-06-25 20:24 - 2011-11-09 22:34 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-25 20:21 - 2014-06-25 20:20 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-25 20:20 - 2014-06-25 20:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-25 20:20 - 2014-06-25 20:20 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-06-25 20:20 - 2011-11-28 21:26 - 00000000 ____D () C:\Users\Eddy\AppData\Roaming\Malwarebytes
2014-06-25 20:20 - 2011-11-05 18:50 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-25 20:18 - 2014-06-25 20:18 - 01342659 _____ () C:\Users\Eddy\Desktop\adwcleaner_3.213.exe
2014-06-25 20:18 - 2014-06-25 20:18 - 01016261 _____ (Thisisu) C:\Users\Eddy\Desktop\JRT.exe
2014-06-25 20:18 - 2014-06-25 20:17 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Eddy\Desktop\mbam-setup-2.0.2.1012.exe
2014-06-24 21:03 - 2014-06-24 20:54 - 00016516 _____ () C:\Users\Eddy\Desktop\ComboFix.txt
2014-06-24 20:54 - 2011-12-08 22:41 - 00000000 ____D () C:\Users\Eddy\AppData\Local\Apps\2.0
2014-06-24 20:42 - 2014-06-24 20:42 - 00016516 _____ () C:\ComboFix.txt
2014-06-24 20:42 - 2014-06-24 20:26 - 00000000 ____D () C:\Qoobox
2014-06-24 20:42 - 2014-06-24 20:26 - 00000000 ____D () C:\ComboFix
2014-06-24 20:42 - 2006-11-02 13:18 - 00000000 __RHD () C:\Users\Default
2014-06-24 20:42 - 2006-11-02 13:18 - 00000000 ___RD () C:\Users\Public
2014-06-24 20:41 - 2014-06-24 20:26 - 00000000 ____D () C:\Windows\erdnt
2014-06-24 20:40 - 2006-11-02 12:23 - 00000215 _____ () C:\Windows\system.ini
2014-06-24 20:25 - 2011-11-28 21:21 - 00000000 ____D () C:\Users\Eddy\Desktop\Sicherheit
2014-06-24 20:20 - 2014-06-24 20:20 - 01073152 _____ (Farbar) C:\Users\Eddy\Downloads\FRST.exe
2014-06-23 21:23 - 2014-06-25 20:19 - 01073152 _____ (Farbar) C:\Users\Eddy\Desktop\FRST.exe
2014-06-23 20:17 - 2014-06-23 20:17 - 00305936 _____ () C:\Users\Eddy\Desktop\WinRAR-ZIP-Archiv (neu).zip
2014-06-23 20:12 - 2014-06-23 20:09 - 00001502 _____ () C:\Users\Eddy\Desktop\AdwCleaner[R4].txt
2014-06-23 19:51 - 2014-06-23 19:47 - 00010176 _____ () C:\Users\Eddy\Desktop\hijackthis.log
2014-06-23 17:41 - 2014-06-23 17:39 - 00000000 ____D () C:\Program Files\Citrix
2014-06-23 17:39 - 2014-06-23 17:39 - 00000000 ____D () C:\Users\Eddy\AppData\Local\Citrix
2014-06-23 17:34 - 2014-06-23 17:33 - 04968448 _____ () C:\Users\Eddy\Downloads\LWAXpPlugin32BitInstaller(1).msi
2014-06-23 17:31 - 2011-11-28 19:39 - 00000000 ____D () C:\Users\Eddy\AppData\Roaming\Mozilla
2014-06-23 17:29 - 2014-06-23 17:28 - 04968448 _____ () C:\Users\Eddy\Downloads\LWAXpPlugin32BitInstaller.msi
2014-06-22 20:24 - 2011-11-28 20:53 - 00000000 ____D () C:\Users\Eddy\AppData\Local\Elo
2014-06-22 18:05 - 2012-03-30 23:33 - 00000000 ____D () C:\Users\Eddy\AppData\Local\GARMIN_Corp
2014-06-22 18:03 - 2012-03-30 23:22 - 00000000 ____D () C:\WebUpdater
2014-06-22 18:03 - 2012-03-30 23:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Garmin
2014-06-22 17:40 - 2011-11-29 18:05 - 00023552 _____ () C:\Users\Eddy\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-06-19 20:31 - 2011-11-28 21:21 - 00000000 ____D () C:\Users\Eddy\Desktop\Tools
2014-06-18 10:53 - 2014-06-18 10:37 - 00008533 _____ () C:\Users\Eddy\Desktop\NRW24.txt
2014-06-17 16:54 - 2011-11-28 19:38 - 00000000 ____D () C:\Users\Eddy
2014-06-15 21:06 - 2014-06-15 21:06 - 00155458 _____ () C:\Users\Eddy\Desktop\13517436.zip
2014-06-15 12:33 - 2014-06-15 12:33 - 00000000 ____D () C:\Users\Eddy\AppData\Local\Adobe
2014-06-13 17:49 - 2012-04-14 12:31 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-06-13 17:49 - 2011-11-06 15:30 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-06-12 21:21 - 2012-05-05 17:28 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-06-12 15:25 - 2014-06-12 15:25 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-06-12 15:17 - 2011-11-28 20:26 - 00000000 ____D () C:\Users\Eddy\Desktop\Büro
2014-06-11 03:17 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-06-11 03:13 - 2011-11-06 13:20 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-06-11 03:05 - 2013-08-25 03:09 - 00000000 ____D () C:\Windows\system32\MRT
2014-06-11 03:02 - 2006-11-02 12:24 - 92708840 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-06-08 13:22 - 2011-11-28 21:03 - 00000000 ___RD () C:\Users\Eddy\Desktop\Media
2014-06-08 11:33 - 2014-06-08 11:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PIONEER CORPORATION
2014-06-08 11:33 - 2014-06-08 11:33 - 00000000 ____D () C:\Program Files\PIONEER CORPORATION
2014-06-05 22:53 - 2006-11-02 12:33 - 01726106 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-04 15:14 - 2014-06-04 15:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-06-04 15:14 - 2014-06-04 15:13 - 00000000 ____D () C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2014-06-04 15:14 - 2014-06-04 15:13 - 00000000 ____D () C:\Program Files\iTunes
2014-06-04 15:13 - 2014-06-04 15:13 - 00000000 ____D () C:\Program Files\iPod
2014-06-04 15:13 - 2011-11-09 23:11 - 00000000 ____D () C:\Program Files\Common Files\Apple
2014-06-04 15:01 - 2013-08-05 21:07 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-06-04 15:01 - 2013-08-05 21:07 - 00093528 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-06-02 16:34 - 2014-06-02 16:34 - 00000000 ____D () C:\Program Files\Common Files\Skype
2014-06-02 16:34 - 2014-03-05 19:20 - 00000000 ___RD () C:\Program Files\Skype
2014-06-02 16:34 - 2012-11-10 16:47 - 00000000 ____D () C:\ProgramData\Skype
2014-06-01 21:16 - 2011-11-10 23:16 - 00000000 ____D () C:\Aktuelle Bilder
2014-05-28 18:48 - 2014-06-10 19:55 - 12356608 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-28 18:39 - 2014-06-10 19:55 - 01810432 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-05-28 18:38 - 2014-06-10 19:55 - 09711104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-05-28 18:33 - 2014-06-10 19:55 - 01106432 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-05-28 18:32 - 2014-06-10 19:55 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-05-28 18:32 - 2014-06-10 19:55 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-05-28 18:31 - 2014-06-10 19:55 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-05-28 18:31 - 2014-06-10 19:55 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-05-28 18:30 - 2014-06-10 19:55 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-05-28 18:30 - 2014-06-10 19:55 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-05-28 18:30 - 2014-06-10 19:55 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-05-28 18:30 - 2014-06-10 19:55 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-05-28 18:30 - 2014-06-10 19:55 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-05-28 18:30 - 2014-06-10 19:55 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-05-28 18:30 - 2014-06-10 19:55 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-05-28 18:29 - 2014-06-10 19:55 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-28 18:29 - 2014-06-10 19:55 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-05-28 18:29 - 2014-06-10 19:55 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-28 18:29 - 2014-06-10 19:55 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-05-28 18:29 - 2014-06-10 19:55 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-05-28 18:28 - 2014-06-10 19:55 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-05-28 07:57 - 2014-05-08 16:48 - 00000000 ____D () C:\Users\Eddy\Desktop\Radtour

Some content of TEMP:
====================
C:\Users\Eddy\AppData\Local\temp\avgnt.exe
C:\Users\Eddy\AppData\Local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpqocgml.dll
C:\Users\Eddy\AppData\Local\temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-06-25 20:48

==================== End Of Log ============================

--- --- ---

--- --- ---

danke und grüße
edle_stau

Trojaner durch Telekom-Rechnung-Fake eingefangen?

Log-Analyse und Auswertung: Trojaner durch Telekom-Rechnung-Fake eingefangen?

Trojaner durch Telekom-Rechnung-Fake eingefangen?

Trojaner durch Telekom-Rechnung-Fake eingefangen?

Ähnliche Themen: Trojaner durch Telekom-Rechnung-Fake eingefangen?