Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung
Trojaner soll weg, aber wie?

Trojaner soll weg, aber wie?


Plagegeister aller Art und deren Bekämpfung: Trojaner soll weg, aber wie?

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Seite 2 von 2 1 2
Alt 03.07.2014, 20:13   #16
Kiwini
 
Trojaner soll weg, aber wie? - Standard

Trojaner soll weg, aber wie?


stocken tut es ein wenig, aber das scheint normal zu sein.
ist den das backdoor ding weg?
kaspersky und system sind up to date

vielen dank

Code:
ATTFilter
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 03-07-2014
Ran by Laxman at 2014-07-03 20:51:59 Run:1
Running from C:\Users\Laxman\Downloads
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
HKU\.DEFAULT\...\Winlogon: [Shell] C:\Windows\Explorer.exe [2871808 2011-02-25] (Microsoft Corporation) <==== ATTENTION 
HKU\S-1-5-19\...\Winlogon: [Shell] C:\Windows\Explorer.exe [2871808 2011-02-25] (Microsoft Corporation) <==== ATTENTION 
HKU\S-1-5-20\...\Winlogon: [Shell] C:\Windows\Explorer.exe [2871808 2011-02-25] (Microsoft Corporation) <==== ATTENTION 
HKU\S-1-5-21-3176568229-742132424-851327841-1003\...\Winlogon: [Shell] C:\Windows\Explorer.exe [2871808 2011-02-25] (Microsoft Corporation) <==== ATTENTION
         
*****************

HKU\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => removed successfully.
HKU\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => removed successfully.
HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => removed successfully.
HKU\S-1-5-21-3176568229-742132424-851327841-1003\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => removed successfully.

==== End of Fixlog ====





FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03-07-2014
Ran by Laxman (administrator) on LAXMAN-PC on 03-07-2014 20:54:19
Running from C:\Users\Laxman\Downloads
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\MWLService.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe
(Acer) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Yahoo! Inc.) C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesApp64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe
(OldTimer Tools) C:\Users\Laxman\Downloads\TFC.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-05] (Intel Corporation)
HKLM\...\Run: [mwlDaemon] => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe [349480 2009-08-06] (Egis Technology Inc.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7981088 2009-07-20] (Realtek Semiconductor)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\nvspcap64.dll [1063200 2013-10-18] (NVIDIA Corporation)
HKLM-x32\...\Run: [BackupManagerTray] => C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [261888 2009-08-12] (NewTech Infosystems, Inc.)
HKLM-x32\...\Run: [Hotkey Utility] => C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe [629280 2009-08-18] ()
HKLM-x32\...\Run: [ArcadeDeluxeAgent] => C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe [128296 2009-07-31] (CyberLink Corp.)
HKLM-x32\...\Run: [FreePDF Assistant] => C:\Program Files (x86)\FreePDF_XP\fpassist.exe [371200 2011-02-23] (shbox.de)
HKU\S-1-5-21-3176568229-742132424-851327841-1003\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [162336 2009-07-22] ()
HKU\S-1-5-21-3176568229-742132424-851327841-1003\...\Policies\Explorer: [NoSetActiveDesktop] 0
Startup: C:\Users\Laxman\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip ()
ShellIconOverlayIdentifiers:  SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers:  SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers:  SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
ShellIconOverlayIdentifiers: egisPSDP -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x64\psdprotect.dll (Egis Technology Inc.)
ShellIconOverlayIdentifiers-x32:  SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers-x32:  SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers-x32:  SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
ShellIconOverlayIdentifiers-x32: egisPSDP -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\psdprotect.dll (Egis Technology Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yahoo.de
SearchScopes: HKLM-x32 - DefaultScope value is missing.
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: No Name - {AB4C7833-A6EC-433f-B9FE-6B14B1A2F836} -  No File
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: Zonealarm Helper Object - {2A841F7A-A014-4DA5-B6D9-8B913DFB7A8C} -  No File
BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: No Name - {AB4C7833-A6EC-433f-B9FE-6B14B1A2F836} -  No File
BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc)
Toolbar: HKLM - No Name - {A13C2648-91D4-4bf3-BC6D-0079707C4389} -  No File
Toolbar: HKLM-x32 - ZoneAlarm Security Toolbar - {438FAE3E-BDEF-44D3-AB8B-0C7C8350DF59} -  No File
Toolbar: HKLM-x32 - No Name - {A13C2648-91D4-4bf3-BC6D-0079707C4389} -  No File
DPF: HKLM-x32 {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Laxman\AppData\Roaming\Mozilla\Firefox\Profiles\ec69wxq4.default
FF NewTab: chrome://lightning/content/newtab.html
FF Homepage: hxxp://uk.yahoo.com/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: ReloadEvery - C:\Users\Laxman\AppData\Roaming\Mozilla\Firefox\Profiles\ec69wxq4.default\Extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644}.xpi [2013-03-16]
FF HKLM-x32\...\Firefox\Extensions: [{F04D2D30-776C-4d02-8627-8E4385ECA58D}] - C:\ProgramData\Norton\{92622AAD-05E8-4459-B256-765CE1E929FB}\NST_2014.7.0.47\coFFPlgn
FF Extension: Norton Identity Safe Toolbar - C:\ProgramData\Norton\{92622AAD-05E8-4459-B256-765CE1E929FB}\NST_2014.7.0.47\coFFPlgn [2014-06-29]
FF HKLM-x32\...\Firefox\Extensions:  - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: 卡巴斯基網址顧問 - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com [2014-06-29]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: 虛擬鍵盤 - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-06-29]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: 惡意網站攔截器 - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com [2014-06-29]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Chặn quảng cáo - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com [2014-06-29]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com [2014-06-29]
FF HKCU\...\Firefox\Extensions: [{77f1dfb8-d6ce-4f47-bc6a-979e2a14d42a}] - C:\Program Files (x86)\TubeSaver\131.xpi

Chrome: 
=======
CHR HomePage: hxxp://www.yahoo.de/
CHR RestoreOnStartup: "hxxp://www.yahoo.de/"
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\25.0.1364.172\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\25.0.1364.172\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\25.0.1364.172\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll No File
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll No File
CHR Extension: (Modul zur Link-Untersuchung) - C:\Users\Laxman\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj [2014-06-29]
CHR Extension: (Sicherer Zahlungsverkehr) - C:\Users\Laxman\AppData\Local\Google\Chrome\User Data\Default\Extensions\hakdifolhalapjijoafobooafbilfakh [2014-06-29]
CHR Extension: (Modul zum Sperren von gefährlichen Webseiten) - C:\Users\Laxman\AppData\Local\Google\Chrome\User Data\Default\Extensions\hghkgaeecgjhjkannahfamoehjmkjail [2014-06-29]
CHR Extension: (Virtual Keyboard) - C:\Users\Laxman\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh [2014-06-29]
CHR Extension: (Norton Identity Protection) - C:\Users\Laxman\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk [2013-06-13]
CHR Extension: (Anti-Banner) - C:\Users\Laxman\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman [2014-06-29]
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\urladvisor.crx [2014-05-28]
CHR HKLM-x32\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\online_banking_chrome.crx [2014-05-28]
CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\content_blocker_chrome.crx [2014-05-28]
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\virtkbd.crx [2014-05-28]
CHR HKLM-x32\...\Chrome\Extension: [nppllibpnmahfaklnpggkibhkapjkeob] - C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.0.47\Exts\Chrome.crx [2014-05-28]
CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\ab.crx [2014-05-28]

==================== Services (Whitelisted) =================

R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe [214512 2014-05-28] (Kaspersky Lab ZAO)
R2 Fabs; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [1155072 2009-02-03] (MAGIX AG) [File not signed]
S3 FirebirdServerMAGIXInstance; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [3276800 2008-08-07] (MAGIX®) [File not signed]
R2 MWLService; C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [311592 2009-08-06] (Egis Technology Inc.)
S2 NCO; C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.0.47\NST.exe [130104 2014-05-14] (Symantec Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15122208 2013-10-18] (NVIDIA Corporation)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe [2412344 2014-01-28] (TuneUp Software)

==================== Drivers (Whitelisted) ====================

R0 34385472; C:\Windows\System32\DRIVERS\34385472.sys [460888 2014-06-29] (Kaspersky Lab ZAO)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R1 ccSet_NST; C:\Windows\system32\drivers\NSTx64\7DE07000.02F\ccSetx64.sys [162392 2014-02-21] (Symantec Corporation)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458336 2014-05-28] (Kaspersky Lab ZAO)
S4 klflt; C:\Windows\System32\DRIVERS\klflt.sys [115296 2014-05-28] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [625248 2014-05-28] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [29792 2014-05-28] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29280 2014-05-28] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2014-05-28] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2013-05-14] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178272 2014-05-28] (Kaspersky Lab ZAO)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-09-28] (NVIDIA Corporation)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesDriver64.sys [11880 2012-11-16] (TuneUp Software)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-07-03 20:54 - 2014-07-03 20:56 - 00018522 _____ () C:\Users\Laxman\Downloads\FRST.txt
2014-07-03 20:51 - 2014-07-03 20:54 - 00000000 ____D () C:\FRST
2014-07-03 20:51 - 2014-07-03 20:51 - 00448512 _____ (OldTimer Tools) C:\Users\Laxman\Downloads\TFC.exe
2014-07-03 20:50 - 2014-07-03 20:51 - 02083840 _____ (Farbar) C:\Users\Laxman\Downloads\FRST64.exe
2014-07-03 20:47 - 2014-07-03 20:47 - 00537974 _____ () C:\Users\Laxman\Downloads\noscript-2.6.8.31.xpi (1).zip
2014-07-03 20:31 - 2014-07-03 20:39 - 00000609 _____ () C:\DelFix.txt
2014-07-03 20:26 - 2014-07-03 20:26 - 00700980 _____ () C:\Users\Laxman\Downloads\adblock_edge-2.0.7-sm+an+tb+fx-windows.xpi
2014-07-03 20:25 - 2014-07-03 20:25 - 00537974 _____ () C:\Users\Laxman\Downloads\noscript-2.6.8.31.xpi.zip
2014-07-03 17:22 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-07-03 17:22 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-07-03 17:22 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-07-03 17:22 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-07-03 17:21 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-07-03 17:21 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-07-03 17:21 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-07-03 17:21 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2014-07-03 17:21 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-07-03 17:21 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-07-03 17:21 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-07-03 17:21 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-07-03 17:21 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-07-03 17:21 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2014-07-01 10:59 - 2014-07-01 10:59 - 00002262 _____ () C:\Users\Laxman\Downloads\the_shoemakers_daughter.mid
2014-06-29 10:32 - 2014-06-29 11:32 - 00460888 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\34385472.sys
2014-06-29 10:31 - 2014-06-29 10:31 - 00001128 _____ () C:\Users\Public\Desktop\Kaspersky Internet Security.lnk
2014-06-29 10:31 - 2014-06-29 10:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Internet Security
2014-06-29 10:31 - 2013-05-06 09:13 - 00110176 _____ (Kaspersky Lab ZAO) C:\Windows\system32\klfphc.dll
2014-06-29 10:30 - 2014-07-03 20:41 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-06-29 10:30 - 2014-06-29 10:30 - 00000000 ____D () C:\Windows\ELAMBKUP
2014-06-29 10:30 - 2014-06-29 10:30 - 00000000 ____D () C:\Program Files (x86)\Kaspersky Lab
2014-06-29 10:30 - 2014-05-28 16:38 - 00625248 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2014-06-29 10:30 - 2014-05-28 16:38 - 00115296 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klflt.sys
2014-06-29 10:11 - 2014-06-29 10:18 - 245907264 _____ () C:\Users\Laxman\Downloads\kis14.0.0.4651abcdefg_de_6138.exe
2014-06-29 09:56 - 2014-06-29 09:56 - 00000000 ____D () C:\Program Files\Enigma Software Group
2014-06-29 09:56 - 2014-06-29 09:56 - 00000000 _____ () C:\autoexec.bat
2014-06-29 09:55 - 2014-06-29 16:48 - 00000000 ____D () C:\Windows\1F7E4FF9D2E542589AE1E16E6CB3252A.TMP
2014-06-29 08:50 - 2014-06-29 08:51 - 00000000 ____D () C:\NPE
2014-06-28 19:10 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-06-27 21:00 - 2014-06-29 18:01 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-06-24 09:59 - 2014-06-24 09:59 - 00000000 ____D () C:\Windows\System32\Tasks\Norton Identity Safe
2014-06-23 21:36 - 2014-06-29 17:03 - 00000000 ____D () C:\Program Files (x86)\Norton Identity Safe
2014-06-23 21:36 - 2014-06-23 21:36 - 00000000 ____D () C:\Windows\system32\Drivers\NSTx64
2014-06-15 07:52 - 2014-06-15 07:52 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-06-12 19:11 - 2014-05-30 12:21 - 23414784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-06-12 19:11 - 2014-05-30 12:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-06-12 19:11 - 2014-05-30 12:02 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-06-12 19:11 - 2014-05-30 11:45 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-06-12 19:11 - 2014-05-30 11:39 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-06-12 19:11 - 2014-05-30 11:39 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-06-12 19:11 - 2014-05-30 11:38 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-06-12 19:11 - 2014-05-30 11:28 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-06-12 19:11 - 2014-05-30 11:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-06-12 19:11 - 2014-05-30 11:24 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-06-12 19:11 - 2014-05-30 11:21 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-06-12 19:11 - 2014-05-30 11:21 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-06-12 19:11 - 2014-05-30 11:20 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-06-12 19:11 - 2014-05-30 11:18 - 17271296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-06-12 19:11 - 2014-05-30 11:11 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-06-12 19:11 - 2014-05-30 11:08 - 05782528 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-06-12 19:11 - 2014-05-30 11:06 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-06-12 19:11 - 2014-05-30 11:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-06-12 19:11 - 2014-05-30 10:55 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-06-12 19:11 - 2014-05-30 10:49 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-06-12 19:11 - 2014-05-30 10:46 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-06-12 19:11 - 2014-05-30 10:44 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-06-12 19:11 - 2014-05-30 10:44 - 00295424 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-06-12 19:11 - 2014-05-30 10:43 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-06-12 19:11 - 2014-05-30 10:42 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-06-12 19:11 - 2014-05-30 10:38 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-06-12 19:11 - 2014-05-30 10:35 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-06-12 19:11 - 2014-05-30 10:34 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-06-12 19:11 - 2014-05-30 10:33 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-06-12 19:11 - 2014-05-30 10:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-06-12 19:11 - 2014-05-30 10:29 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-06-12 19:11 - 2014-05-30 10:28 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-06-12 19:11 - 2014-05-30 10:27 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-06-12 19:11 - 2014-05-30 10:24 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-06-12 19:11 - 2014-05-30 10:23 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-06-12 19:11 - 2014-05-30 10:16 - 00368128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-06-12 19:11 - 2014-05-30 10:10 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-06-12 19:11 - 2014-05-30 10:06 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-06-12 19:11 - 2014-05-30 10:04 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-06-12 19:11 - 2014-05-30 10:02 - 00242688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-06-12 19:11 - 2014-05-30 09:56 - 04244992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-06-12 19:11 - 2014-05-30 09:56 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-06-12 19:11 - 2014-05-30 09:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-06-12 19:11 - 2014-05-30 09:50 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-06-12 19:11 - 2014-05-30 09:49 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-06-12 19:11 - 2014-05-30 09:43 - 13522944 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-06-12 19:11 - 2014-05-30 09:40 - 11725312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-06-12 19:11 - 2014-05-30 09:30 - 01398272 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-06-12 19:11 - 2014-05-30 09:21 - 01790976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-06-12 19:11 - 2014-05-30 09:15 - 01143296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-06-12 19:11 - 2014-05-30 09:13 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-06-12 19:11 - 2014-05-30 09:13 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-06-12 19:11 - 2014-04-25 04:34 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2014-06-12 19:11 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll
2014-06-12 19:11 - 2014-04-05 04:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-06-12 19:11 - 2014-04-05 04:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2014-06-12 19:11 - 2014-03-26 16:44 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-06-12 19:11 - 2014-03-26 16:44 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-06-12 19:11 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2014-06-12 19:11 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-06-12 19:11 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2014-06-12 19:11 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-06-12 19:11 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2014-06-12 19:11 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-06-12 19:08 - 2014-06-08 11:13 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-06-12 19:08 - 2014-06-08 11:08 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-06-10 08:49 - 2014-06-10 08:49 - 04447041 _____ () C:\Users\Laxman\Desktop\Sewing for Baby.pdf.5tn3hh5.partial
2014-06-07 21:33 - 2014-06-07 21:34 - 00000000 ____D () C:\Program Files (x86)\Dark Tales - Der Untergang des Hauses Usher von Edgar Allan Poe Sammleredition
2014-06-07 21:33 - 2014-06-07 21:33 - 00000000 ____D () C:\Users\Laxman\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dark Tales - Der Untergang des Hauses Usher von Edgar Allan Poe Sammleredition
2014-06-07 21:33 - 2014-06-07 21:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dark Tales - Der Untergang des Hauses Usher von Edgar Allan Poe Sammleredition

==================== One Month Modified Files and Folders =======

2014-07-03 20:56 - 2014-07-03 20:54 - 00018522 _____ () C:\Users\Laxman\Downloads\FRST.txt
2014-07-03 20:54 - 2014-07-03 20:51 - 00000000 ____D () C:\FRST
2014-07-03 20:51 - 2014-07-03 20:51 - 00448512 _____ (OldTimer Tools) C:\Users\Laxman\Downloads\TFC.exe
2014-07-03 20:51 - 2014-07-03 20:50 - 02083840 _____ (Farbar) C:\Users\Laxman\Downloads\FRST64.exe
2014-07-03 20:48 - 2009-07-14 06:45 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-07-03 20:48 - 2009-07-14 06:45 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-07-03 20:47 - 2014-07-03 20:47 - 00537974 _____ () C:\Users\Laxman\Downloads\noscript-2.6.8.31.xpi (1).zip
2014-07-03 20:44 - 2013-03-16 03:41 - 01505912 _____ () C:\Windows\WindowsUpdate.log
2014-07-03 20:41 - 2014-06-29 10:30 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-07-03 20:41 - 2009-07-14 06:51 - 00177799 _____ () C:\Windows\setupact.log
2014-07-03 20:40 - 2013-11-06 09:42 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-07-03 20:40 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-07-03 20:39 - 2014-07-03 20:31 - 00000609 _____ () C:\DelFix.txt
2014-07-03 20:31 - 2013-05-29 19:47 - 00000000 ____D () C:\Windows\ERUNT
2014-07-03 20:29 - 2013-03-17 08:49 - 00001284 _____ () C:\Users\Laxman\AppData\Roaming\wklnhst.dat
2014-07-03 20:29 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\system32\FxsTmp
2014-07-03 20:26 - 2014-07-03 20:26 - 00700980 _____ () C:\Users\Laxman\Downloads\adblock_edge-2.0.7-sm+an+tb+fx-windows.xpi
2014-07-03 20:25 - 2014-07-03 20:25 - 00537974 _____ () C:\Users\Laxman\Downloads\noscript-2.6.8.31.xpi.zip
2014-07-03 19:57 - 2013-03-16 04:51 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-07-03 06:07 - 2009-09-03 11:10 - 16823164 _____ () C:\Windows\PFRO.log
2014-07-02 21:49 - 2014-03-18 08:07 - 00109848 _____ () C:\Users\Laxman\Desktop\mögen die englein.wps
2014-07-01 10:59 - 2014-07-01 10:59 - 00002262 _____ () C:\Users\Laxman\Downloads\the_shoemakers_daughter.mid
2014-07-01 07:24 - 2013-03-16 05:15 - 00000000 ____D () C:\Users\Laxman\Documents\DVDVideoSoft
2014-06-30 20:29 - 2013-03-25 22:45 - 00000000 ____D () C:\Users\Laxman\AppData\Local\Windows Live
2014-06-30 02:51 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-06-29 18:01 - 2014-06-27 21:00 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-06-29 17:03 - 2014-06-23 21:36 - 00000000 ____D () C:\Program Files (x86)\Norton Identity Safe
2014-06-29 16:59 - 2009-09-03 11:27 - 00000000 ____D () C:\ProgramData\Symantec
2014-06-29 16:48 - 2014-06-29 09:55 - 00000000 ____D () C:\Windows\1F7E4FF9D2E542589AE1E16E6CB3252A.TMP
2014-06-29 11:32 - 2014-06-29 10:32 - 00460888 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\34385472.sys
2014-06-29 10:31 - 2014-06-29 10:31 - 00001128 _____ () C:\Users\Public\Desktop\Kaspersky Internet Security.lnk
2014-06-29 10:31 - 2014-06-29 10:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Internet Security
2014-06-29 10:31 - 2011-03-20 19:29 - 00000000 ____D () C:\ProgramData\Kaspersky Lab Setup Files
2014-06-29 10:30 - 2014-06-29 10:30 - 00000000 ____D () C:\Windows\ELAMBKUP
2014-06-29 10:30 - 2014-06-29 10:30 - 00000000 ____D () C:\Program Files (x86)\Kaspersky Lab
2014-06-29 10:23 - 2009-11-09 10:20 - 00000000 ____D () C:\ProgramData\Norton
2014-06-29 10:18 - 2014-06-29 10:11 - 245907264 _____ () C:\Users\Laxman\Downloads\kis14.0.0.4651abcdefg_de_6138.exe
2014-06-29 09:56 - 2014-06-29 09:56 - 00000000 ____D () C:\Program Files\Enigma Software Group
2014-06-29 09:56 - 2014-06-29 09:56 - 00000000 _____ () C:\autoexec.bat
2014-06-29 08:56 - 2013-04-20 07:48 - 00000000 ____D () C:\Users\Laxman\AppData\Local\NPE
2014-06-29 08:51 - 2014-06-29 08:50 - 00000000 ____D () C:\NPE
2014-06-28 19:10 - 2013-03-16 03:53 - 00000000 ____D () C:\Users\Laxman
2014-06-27 21:09 - 2014-01-25 21:16 - 00000000 ____D () C:\Windows\erdnt
2014-06-24 09:59 - 2014-06-24 09:59 - 00000000 ____D () C:\Windows\System32\Tasks\Norton Identity Safe
2014-06-23 21:56 - 2013-03-16 04:25 - 00000000 ____D () C:\Users\Laxman\Documents\Symantec
2014-06-23 21:36 - 2014-06-23 21:36 - 00000000 ____D () C:\Windows\system32\Drivers\NSTx64
2014-06-23 20:40 - 2013-04-14 07:34 - 00000000 ____D () C:\Users\Laxman\AppData\Local\CrashDumps
2014-06-16 06:45 - 2013-03-16 04:16 - 00000000 ____D () C:\Users\Public\Downloads\Norton
2014-06-15 17:44 - 2013-03-16 09:03 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-06-15 11:51 - 2013-04-13 09:13 - 00003694 _____ () C:\Windows\System32\Tasks\Adobe-Online-Aktualisierungsprogramm
2014-06-15 09:20 - 2014-05-10 08:07 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox.bak
2014-06-15 07:52 - 2014-06-15 07:52 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-06-12 19:51 - 2013-08-15 00:33 - 00000000 ____D () C:\Windows\system32\MRT
2014-06-12 19:45 - 2013-03-16 12:07 - 95414520 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-06-12 19:44 - 2009-09-03 10:54 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-06-12 19:39 - 2014-04-30 09:44 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-06-10 08:49 - 2014-06-10 08:49 - 04447041 _____ () C:\Users\Laxman\Desktop\Sewing for Baby.pdf.5tn3hh5.partial
2014-06-09 10:04 - 2014-01-28 19:25 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-06-08 11:13 - 2014-06-12 19:08 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-06-08 11:08 - 2014-06-12 19:08 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-06-07 21:34 - 2014-06-07 21:33 - 00000000 ____D () C:\Program Files (x86)\Dark Tales - Der Untergang des Hauses Usher von Edgar Allan Poe Sammleredition
2014-06-07 21:34 - 2013-03-23 08:15 - 00016504 _____ () C:\Windows\wininit.ini
2014-06-07 21:33 - 2014-06-07 21:33 - 00000000 ____D () C:\Users\Laxman\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dark Tales - Der Untergang des Hauses Usher von Edgar Allan Poe Sammleredition
2014-06-07 21:33 - 2014-06-07 21:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dark Tales - Der Untergang des Hauses Usher von Edgar Allan Poe Sammleredition
2014-06-07 21:33 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-06-07 21:16 - 2009-09-11 11:00 - 00000000 ____D () C:\ProgramData\Temp
2014-06-07 19:40 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-06-30 02:43

==================== End Of Log ============================
--- --- ---
Alt 04.07.2014, 19:21   #17
schrauber
/// the machine
/// TB-Ausbilder
 
Trojaner soll weg, aber wie? - Standard

Trojaner soll weg, aber wie?


ja logs sind sauber
__________________

__________________
Alt 04.07.2014, 21:12   #18
Kiwini
 
Trojaner soll weg, aber wie? - Standard

Trojaner soll weg, aber wie?


dann vielen dank
__________________
Alt 05.07.2014, 18:11   #19
schrauber
/// the machine
/// TB-Ausbilder
 
Trojaner soll weg, aber wie? - Standard

Trojaner soll weg, aber wie?


Gern Geschehen
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Antwort
Seite 2 von 2 1 2

Themen zu Trojaner soll weg, aber wie?
backdoor.prorat, java/jshrink.a, msil/toolbar.linkury.d, pup.optional.snapdo, pup.optional.snapdo.a, trojan.vundo, win32/adware.addlyrics.l, win32/adware.addlyrics.w, win32/bundled.toolbar.google.d, win32/dealply.i, win32/nextlive.a, win32/opencandy.a, win32/packed.vmdetector.b, win32/softonicdownloader.e, win32/sweetim.i, win32/sweetim.k, win32/sweetim.l, win32/thinknice.b, win32/toolbar.conduit, win32/toolbar.conduit.b, win32/toolbar.crossrider.h, win32/toolbar.linkury.d, win32/toolbar.linkury.e, win32/toolbar.perion.g, win64/toolbar.crossrider.a


« Mögliches Botnetz? | ADWcleaner lässt sich nicht mehr starten. »


Ähnliche Themen: Trojaner soll weg, aber wie?


  1. Trojaner TR/Dropper.Gen was soll ich tun?
    Log-Analyse und Auswertung - 18.11.2014 (20)
  2. Soll das ein Trojaner sein?
    Plagegeister aller Art und deren Bekämpfung - 07.03.2013 (23)
  3. BKa Trojaner eigefangen,wie soll ich vorgehen?
    Plagegeister aller Art und deren Bekämpfung - 02.02.2012 (7)
  4. Windowssystemfehler und ich soll 50 euro zahlen -> Trojaner?
    Plagegeister aller Art und deren Bekämpfung - 07.12.2011 (65)
  5. BKA-Trojaner und keine Ahnung wie ich ihn beseitigen soll
    Plagegeister aller Art und deren Bekämpfung - 02.08.2011 (9)
  6. Hilfe 5 trojaner was soll ich nur thun???
    Log-Analyse und Auswertung - 02.07.2010 (1)
  7. Habe Trojaner auf PC was soll ich tun?
    Plagegeister aller Art und deren Bekämpfung - 08.01.2010 (2)
  8. Trojaner TR/Crypt.FKM.Gen - Was soll ich tun??
    Plagegeister aller Art und deren Bekämpfung - 06.10.2009 (5)
  9. Trojaner an Bord! Keine Ahnung was ich tun soll
    Plagegeister aller Art und deren Bekämpfung - 12.02.2009 (8)
  10. nur noch firefox - IE soll entfernt werden aber wie????
    Mülltonne - 02.12.2008 (0)
  11. Backdoor-Trojaner?! Was soll ich tun?
    Plagegeister aller Art und deren Bekämpfung - 20.10.2008 (4)
  12. Trojaner ADW ADCLICKER.BJ was soll ich tun??
    Plagegeister aller Art und deren Bekämpfung - 31.01.2008 (14)
  13. IE Explorer will online gehen, soll aber nicht. Trojaner ??
    Plagegeister aller Art und deren Bekämpfung - 05.06.2007 (11)
  14. Hilfe Trojaner, was soll ich tun :-(
    Log-Analyse und Auswertung - 06.10.2005 (4)
  15. Hab Trojaner TR/Drop.Kennval.F was soll ich tun?
    Plagegeister aller Art und deren Bekämpfung - 08.06.2005 (1)
  16. trojaner-avg soll scannen
    Plagegeister aller Art und deren Bekämpfung - 11.12.2004 (1)
  17. Trojaner was soll ich tun?
    Plagegeister aller Art und deren Bekämpfung - 02.08.2004 (4)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema Trojaner soll weg, aber wie? - stocken tut es ein wenig, aber das scheint normal zu sein. ist den das backdoor ding weg? kaspersky und system sind up to date vielen dank Code: Alles auswählen Aufklappen - Trojaner soll weg, aber wie?...
Archiv
Du betrachtest: Trojaner soll weg, aber wie? auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129