Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: Windows7, Virenbefall von W32 Infector.Gen9, TR Patched.Gen und TR.Crypt.Xpack.74223

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.

Antwort
Alt 02.07.2014, 17:41   #1
ds1
 
Windows7,  Virenbefall von W32 Infector.Gen9, TR Patched.Gen und TR.Crypt.Xpack.74223 - Standard

Windows7, Virenbefall von W32 Infector.Gen9, TR Patched.Gen und TR.Crypt.Xpack.74223



Hallo liebe Community,

mein PC (Win7, 64bit) ist seit einigen Tagen von Viren befallen (gemeldet werden "W32 Infector.Gen9", „TR Patched.Gen“ sowie "TR.Crypt.Xpack.74223“), die ich einfach nicht mehr loswerde. Ich hatte vor ein paar Tagen den Anhang einer Mail geöffnet (mir unbekannter Absender). Den Anhang hatte ich vorher allerdings von Avira durchchecken lassen, das Programm hatte nichts gefunden. Anschließend habe ich die Mail gelöscht. Danach funktionierte das Flash-Plugin von Firefox nicht mehr (erst nach Neuinstallation von Firefox). Seitdem meldet Avira immer wieder Virenzugriffe, v.a. in den Ordner Windows/System 32 und Windows/microsoftNET/framework. Malwarebytes findet interessanterweise gar nichts. Änderungen am System sind mir drei aufgefallen: erstens besagter Absturz des Flash-Plugins, zweitens die ungewollte Deaktivierung von Windows-Updates (ich musste den Dienst manuell wieder aktivieren) und drittens das sich häufende Abstürzen von Programmen (z.B. Outlook oder Word).
So, vielen lieben Dank für jede Hilfe im Voraus!

liebe Grüße,

David


Hier nun die Logs, Avira und GMER habe ich angehängt weils sonst zu lang werden würde.


Defogger
Code:
ATTFilter
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 16:41 on 02/07/2014 (David)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         
FRST
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-07-2014
Ran by David (administrator) on DAVID-PC on 02-07-2014 16:42:53
Running from C:\Users\David\Desktop
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTsysTray8.exe
(Dropbox, Inc.) C:\Users\David\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(CHENGDU YIWO Tech Development Co., Ltd) D:\Programme (selten genutzt)\EaseUS Partition Master 9.3.0\bin\EpmNews.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe
(Geek Software GmbH) D:\Programme (selten genutzt)\PDF24\pdf24.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\LBTWiz.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
() C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\VS7DEBUG\mdm.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\LogiAppBroker.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [3091224 2013-07-31] (Logitech, Inc.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13513288 2013-03-29] (Realtek Semiconductor)
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [286704 2013-04-30] (Intel Corporation)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2199840 2014-04-30] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\nvspcap64.dll [1225920 2014-04-30] (NVIDIA Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [737872 2014-06-03] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2013-04-11] (Intel Corporation)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [134616 2013-03-12] (Intel Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [EaseUS EPM tray] => D:\Programme (selten genutzt)\EaseUS Partition Master 9.3.0\bin\EpmNews.exe [2081792 2013-03-29] (CHENGDU YIWO Tech Development Co., Ltd)
HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] => C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [707472 2014-03-12] (Cisco Systems, Inc.)
HKLM-x32\...\Run: [PDFPrint] => D:\Programme (selten genutzt)\PDF24\pdf24.exe [191016 2014-05-14] (Geek Software GmbH)
HKLM Group Policy restriction on software: C:\Program Files (x86)\Avira\AntiVir Desktop\avnotify.exe <====== ATTENTION
HKLM Group Policy restriction on software: %HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot% <====== ATTENTION
HKLM Group Policy restriction on software: %HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir% <====== ATTENTION
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKLM\...\Policies\Explorer: [TaskbarNoNotification] 0
HKLM\...\Policies\Explorer: [HideSCAHealth] 1
HKU\S-1-5-21-464703811-3678935648-1620229932-1000\...\Policies\Explorer: [TaskbarNoNotification] 0
HKU\S-1-5-21-464703811-3678935648-1620229932-1000\...\Policies\Explorer: [HideSCAHealth] 0
HKU\S-1-5-21-464703811-3678935648-1620229932-1000\...\MountPoints2: {edb8cdca-7b92-11e3-8f7f-806e6f6e6963} - E:\ASRSetup.exe
HKU\S-1-5-21-464703811-3678935648-1620229932-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Policies\Explorer: [TaskbarNoNotification] 0
HKU\S-1-5-21-464703811-3678935648-1620229932-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Policies\Explorer: [HideSCAHealth] 0
HKU\S-1-5-21-464703811-3678935648-1620229932-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {edb8cdca-7b92-11e3-8f7f-806e6f6e6963} - E:\ASRSetup.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\iSCTsysTray.lnk
ShortcutTarget: iSCTsysTray.lnk -> C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTsysTray8.exe (Intel Corporation)
Startup: C:\Users\David\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\David\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: GDriveBlacklistedOverlay -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll (Google)
ShellIconOverlayIdentifiers: GDriveSharedEditOverlay -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll (Google)
ShellIconOverlayIdentifiers: GDriveSharedViewOverlay -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll (Google)
ShellIconOverlayIdentifiers: GDriveSyncedOverlay -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll (Google)
ShellIconOverlayIdentifiers: GDriveSyncingOverlay -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll (Google)
ShellIconOverlayIdentifiers-x32: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 1 (GFS Unread Stub) -> {99FD978C-D287-4F50-827F-B2C658EDA8E7} => C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 2 (GFS Stub) -> {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} => C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 2.5 (GFS Unread Folder) -> {920E6DB1-9907-4370-B3A0-BAFC03D81399} => C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 3 (GFS Folder) -> {16F3DD56-1AF5-4347-846D-7C10C4192619} => C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 4 (GFS Unread Mark) -> {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} => C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/?gws_rd=ssl
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xBD98587EA20FCF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Logitech SetPoint - {AF949550-9094-4807-95EC-D1C317803333} - C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll (Logitech, Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Logitech SetPoint - {AF949550-9094-4807-95EC-D1C317803333} - C:\Program Files\Logitech\SetPointP\32-bit\SetPointSmooth.dll (Logitech, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\94xit4ha.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_125.dll ()
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin: @videolan.org/vlc,version=2.1.1 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.4 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_125.dll ()
FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.0.72 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll No File
FF Plugin-x32: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Adblock Plus - C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\94xit4ha.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-12]
FF HKLM-x32\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt
FF Extension: Logitech SetPoint - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt [2014-01-12]
FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2014-01-12]

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-06-03] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-06-03] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1039952 2014-06-03] (Avira Operations GmbH & Co. KG)
S3 clr_optimization_v2.0.50727_64; C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe [684032 2014-06-23] (Microsoft Corporation) [File not signed]
S3 Fax; C:\Windows\system32\fxssvc.exe [1290240 2014-06-23] (Microsoft Corporation) [File not signed]
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15344 2013-04-30] (Intel Corporation)
S2 idsvc; C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe [1450496 2014-06-23] (Microsoft Corporation) [File not signed]
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [731648 2013-02-13] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [820184 2013-02-13] (Intel(R) Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-03-12] (Intel Corporation)
R2 ISCTAgent; C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe [182248 2013-03-14] ()
S3 iumsvc; C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [174368 2014-02-28] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-03-12] (Intel Corporation)
S2 LBTServ; C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe [950784 2014-06-23] (Logitech, Inc.) [File not signed]
R2 MDM; C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [335872 2006-10-26] (Microsoft Corporation) [File not signed]
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1617696 2014-04-30] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [21007192 2014-04-30] (NVIDIA Corporation)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [75136 2014-01-26] ()
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [239176 2013-02-19] (Realtek Semiconductor)
S2 sppsvc; C:\Windows\system32\sppsvc.exe [4122624 2014-06-23] (Microsoft Corporation) [File not signed]
S2 VSS; C:\Windows\system32\vssvc.exe [2200576 2014-06-23] (Microsoft Corporation) [File not signed]
S2 wbengine; C:\Windows\system32\wbengine.exe [2103808 2014-06-23] (Microsoft Corporation) [File not signed]
S2 AdobeFlashPlayerUpdateSvc; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [X]
S4 gupdatem; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc [X]
S2 MozillaMaintenance; "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe" [X]
S2 odserv; "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE" [X]
S2 ose; "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE" [X]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [112080 2014-04-29] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-04-29] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [84720 2013-12-09] (Avira Operations GmbH & Co. KG)
R3 e1dexpress; C:\Windows\System32\DRIVERS\e1d62x64.sys [496400 2013-02-26] (Intel Corporation)
S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [17480 2013-03-07] ()
S3 epmntdrv; C:\Windows\SysWOW64\epmntdrv.sys [13896 2013-03-07] ()
S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9800 2013-03-07] ()
S3 EuGdiDrv; C:\Windows\SysWOW64\EuGdiDrv.sys [9160 2013-03-07] ()
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28656 2013-04-30] (Intel Corporation)
R3 ikbevent; C:\Windows\System32\DRIVERS\ikbevent.sys [21048 2013-03-14] ()
R3 imsevent; C:\Windows\System32\DRIVERS\imsevent.sys [21048 2013-03-14] ()
R3 ISCT; C:\Windows\System32\DRIVERS\ISCTD64.sys [46568 2013-03-14] ()
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-07-02] (Malwarebytes Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [18776 2014-04-30] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation)
S3 vpnva; C:\Windows\System32\DRIVERS\vpnva64-6.sys [52592 2014-03-12] (Cisco Systems, Inc.)
R3 WPRO_41_2001; C:\Windows\System32\drivers\WPRO_41_2001.sys [34752 2014-07-02] ()

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-07-02 16:42 - 2014-07-02 16:43 - 00021625 _____ () C:\Users\David\Desktop\FRST.txt
2014-07-02 16:42 - 2014-07-02 16:42 - 02083840 _____ (Farbar) C:\Users\David\Desktop\FRST64.exe
2014-07-02 16:42 - 2014-07-02 16:42 - 00000000 ____D () C:\FRST
2014-07-02 16:41 - 2014-07-02 16:41 - 00000472 _____ () C:\Users\David\Desktop\defogger_disable.log
2014-07-02 16:41 - 2014-07-02 16:41 - 00000000 _____ () C:\Users\David\defogger_reenable
2014-07-02 16:40 - 2014-07-02 16:40 - 00050477 _____ () C:\Users\David\Desktop\Defogger.exe
2014-07-02 16:32 - 2014-07-02 16:32 - 00094656 _____ (CACE Technologies) C:\Windows\system32\WPRO_41_2001woem.tmp
2014-07-02 16:31 - 2014-07-02 16:32 - 00000168 _____ () C:\Windows\setupact.log
2014-07-02 16:31 - 2014-07-02 16:31 - 00001074 _____ () C:\Windows\PFRO.log
2014-07-02 16:31 - 2014-07-02 16:31 - 00000000 _____ () C:\Windows\setuperr.log
2014-07-02 15:06 - 2014-07-02 16:31 - 00025101 _____ () C:\Windows\WindowsUpdate.log
2014-07-02 15:03 - 2014-07-02 15:03 - 00000000 ____D () C:\Users\David\AppData\Roaming\DAEMON Tools Lite
2014-07-02 15:03 - 2014-07-02 15:03 - 00000000 ____D () C:\ProgramData\DAEMON Tools Lite
2014-07-02 15:00 - 2014-07-02 15:00 - 00002772 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-07-02 15:00 - 2014-07-02 15:00 - 00000822 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-07-02 15:00 - 2014-07-02 15:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2014-07-02 15:00 - 2014-07-02 15:00 - 00000000 ____D () C:\Program Files\CCleaner
2014-07-02 14:59 - 2014-07-02 14:59 - 03736040 _____ (Piriform Ltd) C:\Users\David\Downloads\ccsetup415_slim.exe
2014-07-02 14:59 - 2014-07-02 14:59 - 03736040 _____ (Piriform Ltd) C:\Users\David\Downloads\ccsetup415_slim (1).exe
2014-07-01 18:59 - 2014-07-01 18:59 - 00219136 _____ () C:\Windows\system32\ldadgom.exe
2014-06-25 17:25 - 2014-07-01 19:52 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-06-25 17:25 - 2014-06-25 17:25 - 00001159 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-06-25 16:14 - 2014-06-25 16:14 - 00284288 _____ (Mozilla) C:\Users\David\Downloads\Firefox Setup Stub 30.0.exe
2014-06-25 16:12 - 2014-06-25 16:12 - 00000000 __SHD () C:\Users\David\AppData\Local\EmieUserList
2014-06-25 16:12 - 2014-06-25 16:12 - 00000000 __SHD () C:\Users\David\AppData\Local\EmieSiteList
2014-06-25 15:52 - 2014-06-25 15:52 - 00000000 ____D () C:\Users\David\AppData\Local\Adobe
2014-06-25 15:21 - 2014-06-25 15:21 - 00000030 _____ () C:\AVScanner.ini
2014-06-25 15:21 - 2014-06-25 15:21 - 00000000 ____D () C:\ProgramData\McAfee
2014-06-23 19:59 - 2014-07-01 18:59 - 00000003 _____ () C:\ProgramData\ccajbcba34.nls
2014-06-23 19:15 - 2014-07-02 16:33 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-23 19:15 - 2014-06-23 19:15 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-23 19:15 - 2014-06-23 19:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-23 19:15 - 2014-06-23 19:15 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-06-23 19:15 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-06-23 19:15 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-06-23 19:05 - 2014-07-02 16:42 - 00000000 ____D () C:\Users\David\AppData\Roaming\Enkue
2014-06-23 19:05 - 2014-06-23 19:05 - 00000000 ____D () C:\Users\David\AppData\Roaming\Qahe
2014-06-18 18:37 - 2014-06-30 13:18 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-06-18 15:37 - 2014-06-18 15:37 - 00000219 _____ () C:\Users\David\Desktop\Team Fortress 2.url
2014-06-17 14:22 - 2014-06-17 14:22 - 00000000 ____D () C:\Users\David\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2014-06-15 18:17 - 2014-04-25 04:34 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2014-06-15 18:17 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll
2014-06-15 18:17 - 2014-04-05 04:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-06-15 18:17 - 2014-04-05 04:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2014-06-15 18:17 - 2014-03-26 16:44 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-06-15 18:17 - 2014-03-26 16:44 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-06-15 18:17 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2014-06-15 18:17 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-06-15 18:17 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2014-06-15 18:17 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-06-15 18:17 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2014-06-15 18:17 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-06-15 18:17 - 2013-11-26 13:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-06-15 16:56 - 2014-05-30 12:21 - 23414784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-06-15 16:56 - 2014-05-30 12:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-06-15 16:56 - 2014-05-30 12:02 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-06-15 16:56 - 2014-05-30 11:45 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-06-15 16:56 - 2014-05-30 11:39 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-06-15 16:56 - 2014-05-30 11:39 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-06-15 16:56 - 2014-05-30 11:38 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-06-15 16:56 - 2014-05-30 11:28 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-06-15 16:56 - 2014-05-30 11:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-06-15 16:56 - 2014-05-30 11:24 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-06-15 16:56 - 2014-05-30 11:21 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-06-15 16:56 - 2014-05-30 11:21 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-06-15 16:56 - 2014-05-30 11:20 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-06-15 16:56 - 2014-05-30 11:18 - 17271296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-06-15 16:56 - 2014-05-30 11:11 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-06-15 16:56 - 2014-05-30 11:08 - 05782528 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-06-15 16:56 - 2014-05-30 11:06 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-06-15 16:56 - 2014-05-30 11:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-06-15 16:56 - 2014-05-30 10:55 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-06-15 16:56 - 2014-05-30 10:49 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-06-15 16:56 - 2014-05-30 10:46 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-06-15 16:56 - 2014-05-30 10:44 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-06-15 16:56 - 2014-05-30 10:44 - 00295424 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-06-15 16:56 - 2014-05-30 10:43 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-06-15 16:56 - 2014-05-30 10:42 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-06-15 16:56 - 2014-05-30 10:38 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-06-15 16:56 - 2014-05-30 10:35 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-06-15 16:56 - 2014-05-30 10:34 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-06-15 16:56 - 2014-05-30 10:33 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-06-15 16:56 - 2014-05-30 10:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-06-15 16:56 - 2014-05-30 10:29 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-06-15 16:56 - 2014-05-30 10:28 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-06-15 16:56 - 2014-05-30 10:27 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-06-15 16:56 - 2014-05-30 10:24 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-06-15 16:56 - 2014-05-30 10:23 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-06-15 16:56 - 2014-05-30 10:16 - 00368128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-06-15 16:56 - 2014-05-30 10:10 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-06-15 16:56 - 2014-05-30 10:06 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-06-15 16:56 - 2014-05-30 10:04 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-06-15 16:56 - 2014-05-30 10:02 - 00242688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-06-15 16:56 - 2014-05-30 09:56 - 04244992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-06-15 16:56 - 2014-05-30 09:56 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-06-15 16:56 - 2014-05-30 09:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-06-15 16:56 - 2014-05-30 09:50 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-06-15 16:56 - 2014-05-30 09:49 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-06-15 16:56 - 2014-05-30 09:43 - 13522944 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-06-15 16:56 - 2014-05-30 09:40 - 11725312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-06-15 16:56 - 2014-05-30 09:30 - 01398272 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-06-15 16:56 - 2014-05-30 09:21 - 01790976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-06-15 16:56 - 2014-05-30 09:15 - 01143296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-06-15 16:56 - 2014-05-30 09:13 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-06-15 16:56 - 2014-05-30 09:13 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-06-15 16:56 - 2014-05-08 11:32 - 03178496 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-06-15 16:56 - 2014-05-08 11:32 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2014-06-04 17:55 - 2014-06-04 17:55 - 00000219 _____ () C:\Users\David\Desktop\Half-Life 2 Episode Two.url

==================== One Month Modified Files and Folders =======

2014-07-02 16:43 - 2014-07-02 16:42 - 00021625 _____ () C:\Users\David\Desktop\FRST.txt
2014-07-02 16:42 - 2014-07-02 16:42 - 02083840 _____ (Farbar) C:\Users\David\Desktop\FRST64.exe
2014-07-02 16:42 - 2014-07-02 16:42 - 00000000 ____D () C:\FRST
2014-07-02 16:42 - 2014-06-23 19:05 - 00000000 ____D () C:\Users\David\AppData\Roaming\Enkue
2014-07-02 16:41 - 2014-07-02 16:41 - 00000472 _____ () C:\Users\David\Desktop\defogger_disable.log
2014-07-02 16:41 - 2014-07-02 16:41 - 00000000 _____ () C:\Users\David\defogger_reenable
2014-07-02 16:41 - 2014-01-12 16:10 - 00000000 ____D () C:\Users\David
2014-07-02 16:40 - 2014-07-02 16:40 - 00050477 _____ () C:\Users\David\Desktop\Defogger.exe
2014-07-02 16:40 - 2014-01-12 23:18 - 00000000 ____D () C:\Outlook Dateien
2014-07-02 16:39 - 2009-07-14 06:45 - 00021856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-07-02 16:39 - 2009-07-14 06:45 - 00021856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-07-02 16:38 - 2009-07-14 07:13 - 00787696 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-07-02 16:34 - 2014-04-29 11:17 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-07-02 16:33 - 2014-06-23 19:15 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-07-02 16:32 - 2014-07-02 16:32 - 00094656 _____ (CACE Technologies) C:\Windows\system32\WPRO_41_2001woem.tmp
2014-07-02 16:32 - 2014-07-02 16:31 - 00000168 _____ () C:\Windows\setupact.log
2014-07-02 16:32 - 2014-01-12 17:23 - 00000000 ____D () C:\Users\David\AppData\Roaming\DropboxMaster
2014-07-02 16:32 - 2014-01-12 17:22 - 00000000 ____D () C:\Users\David\AppData\Roaming\Dropbox
2014-07-02 16:32 - 2014-01-12 17:15 - 00034752 _____ () C:\Windows\system32\Drivers\WPRO_41_2001.sys
2014-07-02 16:31 - 2014-07-02 16:31 - 00001074 _____ () C:\Windows\PFRO.log
2014-07-02 16:31 - 2014-07-02 16:31 - 00000000 _____ () C:\Windows\setuperr.log
2014-07-02 16:31 - 2014-07-02 15:06 - 00025101 _____ () C:\Windows\WindowsUpdate.log
2014-07-02 16:31 - 2014-04-29 11:17 - 00001104 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-07-02 16:31 - 2014-01-12 16:29 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-07-02 16:31 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-07-02 16:15 - 2014-04-26 22:44 - 00000000 ____D () C:\Users\David\AppData\Local\CrashDumps
2014-07-02 16:01 - 2014-02-22 18:19 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-07-02 15:49 - 2014-01-13 14:07 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-07-02 15:03 - 2014-07-02 15:03 - 00000000 ____D () C:\Users\David\AppData\Roaming\DAEMON Tools Lite
2014-07-02 15:03 - 2014-07-02 15:03 - 00000000 ____D () C:\ProgramData\DAEMON Tools Lite
2014-07-02 15:01 - 2014-04-05 12:30 - 00000000 ____D () C:\Windows\Minidump
2014-07-02 15:01 - 2014-01-13 01:07 - 00000000 ____D () C:\Windows\Panther
2014-07-02 15:00 - 2014-07-02 15:00 - 00002772 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-07-02 15:00 - 2014-07-02 15:00 - 00000822 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-07-02 15:00 - 2014-07-02 15:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2014-07-02 15:00 - 2014-07-02 15:00 - 00000000 ____D () C:\Program Files\CCleaner
2014-07-02 14:59 - 2014-07-02 14:59 - 03736040 _____ (Piriform Ltd) C:\Users\David\Downloads\ccsetup415_slim.exe
2014-07-02 14:59 - 2014-07-02 14:59 - 03736040 _____ (Piriform Ltd) C:\Users\David\Downloads\ccsetup415_slim (1).exe
2014-07-01 19:52 - 2014-06-25 17:25 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-07-01 19:47 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-07-01 18:59 - 2014-07-01 18:59 - 00219136 _____ () C:\Windows\system32\ldadgom.exe
2014-07-01 18:59 - 2014-06-23 19:59 - 00000003 _____ () C:\ProgramData\ccajbcba34.nls
2014-07-01 18:40 - 2014-04-29 11:17 - 00000000 ____D () C:\Program Files (x86)\Google
2014-06-30 13:18 - 2014-06-18 18:37 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-06-26 18:21 - 2014-05-17 12:12 - 00003718 _____ () C:\Windows\System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473
2014-06-25 17:25 - 2014-06-25 17:25 - 00001159 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-06-25 16:14 - 2014-06-25 16:14 - 00284288 _____ (Mozilla) C:\Users\David\Downloads\Firefox Setup Stub 30.0.exe
2014-06-25 16:12 - 2014-06-25 16:12 - 00000000 __SHD () C:\Users\David\AppData\Local\EmieUserList
2014-06-25 16:12 - 2014-06-25 16:12 - 00000000 __SHD () C:\Users\David\AppData\Local\EmieSiteList
2014-06-25 15:52 - 2014-06-25 15:52 - 00000000 ____D () C:\Users\David\AppData\Local\Adobe
2014-06-25 15:21 - 2014-06-25 15:21 - 00000030 _____ () C:\AVScanner.ini
2014-06-25 15:21 - 2014-06-25 15:21 - 00000000 ____D () C:\ProgramData\McAfee
2014-06-25 15:21 - 2014-01-13 14:07 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-06-25 15:21 - 2014-01-13 14:07 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-06-25 15:21 - 2014-01-13 14:07 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-06-25 13:12 - 2009-07-14 07:32 - 00000000 ____D () C:\Program Files\Windows Sidebar
2014-06-25 13:02 - 2009-07-14 07:32 - 00000000 ____D () C:\Program Files\Windows Photo Viewer
2014-06-25 12:58 - 2011-04-12 10:28 - 00000000 ____D () C:\Program Files\Windows Journal
2014-06-25 12:58 - 2009-07-14 07:32 - 00000000 ____D () C:\Program Files\Windows Defender
2014-06-24 16:20 - 2009-07-14 07:32 - 00000000 ____D () C:\Program Files\DVD Maker
2014-06-24 15:35 - 2014-04-29 11:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2014-06-24 15:25 - 2014-03-18 15:08 - 00000000 ____D () C:\Program Files\7-Zip
2014-06-24 11:04 - 2014-01-12 16:14 - 00000000 ____D () C:\Users\David\AppData\Roaming\vlc
2014-06-23 19:15 - 2014-06-23 19:15 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-23 19:15 - 2014-06-23 19:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-23 19:15 - 2014-06-23 19:15 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-06-23 19:15 - 2014-01-12 16:44 - 00000000 ____D () C:\Users\David\AppData\Roaming\Malwarebytes
2014-06-23 19:15 - 2014-01-12 16:44 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-23 19:12 - 2010-11-21 05:25 - 02103808 ____T (Microsoft Corporation) C:\Windows\system32\wbengine.exe
2014-06-23 19:12 - 2010-11-21 05:23 - 04122624 ____T (Microsoft Corporation) C:\Windows\system32\sppsvc.exe
2014-06-23 19:12 - 2010-11-21 05:23 - 02200576 ____T (Microsoft Corporation) C:\Windows\system32\VSSVC.exe
2014-06-23 19:11 - 2010-11-21 05:25 - 01290240 ____T (Microsoft Corporation) C:\Windows\system32\FXSSVC.exe
2014-06-23 19:05 - 2014-06-23 19:05 - 00000000 ____D () C:\Users\David\AppData\Roaming\Qahe
2014-06-19 17:29 - 2014-04-29 11:17 - 00004104 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-06-19 17:29 - 2014-04-29 11:17 - 00003852 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-06-18 15:37 - 2014-06-18 15:37 - 00000219 _____ () C:\Users\David\Desktop\Team Fortress 2.url
2014-06-17 14:22 - 2014-06-17 14:22 - 00000000 ____D () C:\Users\David\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2014-06-15 18:17 - 2014-01-12 17:50 - 00000000 ____D () C:\Windows\system32\MRT
2014-06-15 18:16 - 2014-01-12 17:50 - 95414520 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-06-04 17:55 - 2014-06-04 17:55 - 00000219 _____ () C:\Users\David\Desktop\Half-Life 2 Episode Two.url

Some content of TEMP:
====================
C:\Users\David\AppData\Local\Temp\avgnt.exe
C:\Users\David\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpvcws9r.dll


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-07-01 19:40

==================== End Of Log ============================
         
Addition
Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-07-2014
Ran by David at 2014-07-02 16:43:09
Running from C:\Users\David\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Out of date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Out of date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

2007 Microsoft Office Suite Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
2007 Microsoft Office Suite Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.125 - Adobe Systems Incorporated)
Adobe Photoshop Lightroom 3.6 64-bit (HKLM\...\{D4F66BBA-D79E-4F11-9B06-70C3D75A2958}) (Version: 3.6.1 - Adobe)
Adobe Reader XI (11.0.07) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)
ASRock App Charger v1.0.5 (HKLM\...\ASRock App Charger_is1) (Version:  - ASRock Inc.)
Assassin's Creed Brotherhood (HKLM-x32\...\{BE4BA698-8533-4F77-9559-C7F3F78C0B05}) (Version: 1.03 - Ubisoft)
Assassin's Creed II (HKLM-x32\...\{8570BEE8-0CA3-4977-9AB1-80ED93F0513C}) (Version: 1.01 - Ubisoft)
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.4.672 - Avira)
CCleaner (HKLM\...\CCleaner) (Version: 4.15 - Piriform)
Cisco AnyConnect Secure Mobility Client  (HKLM-x32\...\Cisco AnyConnect Secure Mobility Client) (Version: 3.1.05160 - Cisco Systems, Inc.)
Cisco AnyConnect Secure Mobility Client (x32 Version: 3.1.05160 - Cisco Systems, Inc.) Hidden
Citavi 4 (HKLM-x32\...\{CC0A85B2-734A-45B3-B678-05F6A6499AC7}) (Version: 4.3.0.15 - Swiss Academic Software)
Dropbox (HKCU\...\Dropbox) (Version: 2.8.2 - Dropbox, Inc.)
EaseUS Partition Master 9.3.0 (HKLM-x32\...\EaseUS Partition Master_is1) (Version:  - EaseUS)
eReg (x32 Version: 1.20.138.34 - Logitech, Inc.) Hidden
FreeFileSync 6.1 (HKLM-x32\...\FreeFileSync) (Version: 6.1 - Zenju)
Google Drive (HKLM-x32\...\{D9F75285-4864-461D-83DA-8D056BAC44D1}) (Version: 1.16.6866.4367 - Google, Inc.)
Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden
Half-Life 2: Episode Two (HKLM-x32\...\Steam App 420) (Version:  - Valve)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.0.0.1323 - Intel Corporation)
Intel(R) Network Connections 18.2.63.0 (HKLM\...\PROSetDX) (Version: 18.2.63.0 - Intel)
Intel(R) Network Connections 18.2.63.0 (Version: 18.2.63.0 - Intel) Hidden
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.6.0.1033 - Intel Corporation)
Intel(R) Rapid Storage Technology (Version: 12.6.0.1033 - Intel Corporation) Hidden
Intel(R) Smart Connect Technology 4.1 x64 (HKLM\...\{1EF24D7D-7B14-4EBA-A686-9E91C9C6763D}) (Version: 4.1.40.2143 - Intel)
Intel(R) Update Manager (HKLM-x32\...\{12914061-EB9B-4AE7-AC7E-0B8A607C7DF4}) (Version: 2.3.1338 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 2.0.0.102 - Intel Corporation)
Intel® Trusted Connect Service Client (Version: 1.27.798.1 - Intel Corporation) Hidden
Java 7 Update 51 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417051FF}) (Version: 7.0.510 - Oracle)
Logitech SetPoint 6.61 (HKLM\...\sp6) (Version: 6.61.15 - Logitech)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 30.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 30.0 (x86 de)) (Version: 30.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 30.0 - Mozilla)
Nexus Mod Manager (HKLM\...\6af12c54-643b-4752-87d0-8335503010de_is1) (Version: 0.49.1 - Black Tree Gaming)
NVIDIA 3D Vision Controller Driver 337.88 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 337.88 - NVIDIA Corporation)
NVIDIA 3D Vision Driver 337.88 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 337.88 - NVIDIA Corporation)
NVIDIA Control Panel 337.88 (Version: 337.88 - NVIDIA Corporation) Hidden
NVIDIA GeForce Experience 2.0.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.0.1 - NVIDIA Corporation)
NVIDIA Graphics Driver 337.88 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 337.88 - NVIDIA Corporation)
NVIDIA HD Audio Driver 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.154.1168 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.13.1220 - NVIDIA Corporation) Hidden
NVIDIA PhysX System Software 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
NVIDIA ShadowPlay 12.4.67 (Version: 12.4.67 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.12.6514 - NVIDIA Corporation) Hidden
NVIDIA Update 12.4.67 (Version: 12.4.67 - NVIDIA Corporation) Hidden
NVIDIA Update Core (Version: 12.4.67 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.23 (Version: 1.2.23 - NVIDIA Corporation) Hidden
PDF24 Creator 6.4.1 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
PDF-Viewer (HKLM\...\{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1) (Version: 2.5.214.0 - Tracker Software Products Ltd)
Portal (HKLM-x32\...\Steam App 400) (Version:  - Valve)
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.990 - Even Balance, Inc.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6873 - Realtek Semiconductor Corp.)
SHIELD Streaming (Version: 2.1.108 - NVIDIA Corporation) Hidden
StarCraft II (HKLM-x32\...\StarCraft II) (Version:  - Blizzard Entertainment)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
Team Fortress 2 (HKLM-x32\...\Steam App 440) (Version:  - Valve)
The Elder Scrolls V: Skyrim (HKLM-x32\...\Steam App 72850) (Version:  - Bethesda Game Studios)
TL-WN751ND Driver (HKLM-x32\...\{14770694-6C1C-4137-95F9-6F934D8491B4}) (Version: 1.00.0000 - TP-LINK)
TP-LINK Wireless Configuration Utility (HKLM-x32\...\{319D91C6-3D44-436C-9F79-36C0D22372DC}) (Version: 2.01.0012 - TP-LINK)
Ubisoft Game Launcher (HKLM-x32\...\{888F1505-C2B3-4FDE-835D-36353EBD4754}) (Version: 1.0.0.0 - UBISOFT)
VC_CRT_x64 (Version: 1.02.0000 - Intel Corporation) Hidden
VLC media player 2.1.4 (HKLM\...\VLC media player) (Version: 2.1.4 - VideoLAN)
YTD Video Downloader 4.8 (HKLM-x32\...\{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}) (Version: 4.8 - GreenTree Applications SRL)

==================== Restore Points  =========================

Could not list Restore Points. Check "winmgmt" service or repair WMI.


==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {092FE30F-B29C-4B0A-ACE8-401E4CF359A7} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: {2AAD9973-B783-435B-833C-5D6C0271C75F} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: {2B83F3BA-BCF6-4DA3-96B0-FB6A2ACFCCDA} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473-Logon => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2014-02-28] ()
Task: {40020DF3-2662-4DC9-B635-93DC557DDA0D} - System32\Tasks\Outlook Synchro Wöchentlich => C:\Program Files\FreeFileSync\FreeFileSync.exe [2014-01-01] (freefilesync.sourceforge.net)
Task: {4E963F89-E378-4877-8B1C-B0249E895C2E} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-06-24] (Piriform Ltd)
Task: {645A7ADC-758D-49BE-9E49-EB702D745ED6} - System32\Tasks\Studium Sicherung Wöchentlich => C:\Program Files\FreeFileSync\FreeFileSync.exe [2014-01-01] (freefilesync.sourceforge.net)
Task: {6BF16DFF-ECF3-4577-BCBD-8F49D852E268} - System32\Tasks\Sicherung Täglich => C:\Program Files\FreeFileSync\FreeFileSync.exe [2014-01-01] (freefilesync.sourceforge.net)
Task: {74736EDB-8D9E-412D-B41A-8505B60662A1} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2014-02-28] ()
Task: {79D7DF48-81C0-496F-AB67-24A3BBFEDA43} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {AD7AF642-E812-429F-8065-1EA4146D0533} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2014-01-12 16:29 - 2014-05-20 03:25 - 00116568 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2013-03-14 15:42 - 2013-03-14 15:42 - 00182248 _____ () C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe
2013-03-14 15:42 - 2013-03-14 15:42 - 00059880 _____ () C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\NetworkHeuristic.dll
2014-01-26 18:51 - 2014-01-26 18:51 - 00075136 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2014-03-12 22:53 - 2014-03-12 22:53 - 00063376 _____ () C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\zlib1.dll
2014-07-02 16:32 - 2014-07-02 16:32 - 00043008 _____ () c:\users\david\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpvcws9r.dll
2013-08-23 21:01 - 2013-08-23 21:01 - 25100288 _____ () C:\Users\David\AppData\Roaming\Dropbox\bin\libcef.dll
2014-01-12 17:00 - 2013-03-12 14:19 - 01199576 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2014-06-25 17:25 - 2014-06-06 06:38 - 03852912 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-01-12 17:09 - 2013-07-18 00:56 - 00430080 _____ () C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox\components\FirefoxPickerCommunication.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== EXE Association (whitelisted) =============


==================== MSCONFIG/TASK MANAGER disabled items =========


==================== Faulty Device Manager Devices =============

Name: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
Description: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: vpnva
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (07/02/2014 04:33:44 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/02/2014 04:32:08 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: infocard.exe, version: 3.0.4506.5420, time stamp: 0x4c2ca1b4
Faulting module name: KERNELBASE.dll, version: 6.1.7601.18409, time stamp: 0x5315a05a
Exception code: 0xe0434f4d
Fault offset: 0x000000000000940d
Faulting process id: 0x824
Faulting application start time: 0xinfocard.exe0
Faulting application path: infocard.exe1
Faulting module path: infocard.exe2
Report Id: infocard.exe3

Error: (07/02/2014 04:15:33 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: hl2.exe, version: 0.0.0.0, time stamp: 0x537503fc
Faulting module name: ntdll.dll, version: 6.1.7601.18247, time stamp: 0x521ea8e7
Exception code: 0xc0000374
Fault offset: 0x000ce753
Faulting process id: 0x468
Faulting application start time: 0xhl2.exe0
Faulting application path: hl2.exe1
Faulting module path: hl2.exe2
Report Id: hl2.exe3

Error: (07/02/2014 04:01:07 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: hl2.exe, version: 0.0.0.0, time stamp: 0x537503fc
Faulting module name: ntdll.dll, version: 6.1.7601.18247, time stamp: 0x521ea8e7
Exception code: 0xc0000374
Fault offset: 0x000ce753
Faulting process id: 0x2a8
Faulting application start time: 0xhl2.exe0
Faulting application path: hl2.exe1
Faulting module path: hl2.exe2
Report Id: hl2.exe3

Error: (07/02/2014 03:52:57 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: hl2.exe, version: 0.0.0.0, time stamp: 0x537503fc
Faulting module name: ntdll.dll, version: 6.1.7601.18247, time stamp: 0x521ea8e7
Exception code: 0xc0000374
Fault offset: 0x000ce753
Faulting process id: 0xb34
Faulting application start time: 0xhl2.exe0
Faulting application path: hl2.exe1
Faulting module path: hl2.exe2
Report Id: hl2.exe3

Error: (07/02/2014 03:47:09 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: hl2.exe, version: 0.0.0.0, time stamp: 0x537503fc
Faulting module name: ntdll.dll, version: 6.1.7601.18247, time stamp: 0x521ea8e7
Exception code: 0xc0000374
Fault offset: 0x000ce753
Faulting process id: 0x1630
Faulting application start time: 0xhl2.exe0
Faulting application path: hl2.exe1
Faulting module path: hl2.exe2
Report Id: hl2.exe3

Error: (07/02/2014 03:42:09 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: hl2.exe, version: 0.0.0.0, time stamp: 0x537503fc
Faulting module name: ntdll.dll, version: 6.1.7601.18247, time stamp: 0x521ea8e7
Exception code: 0xc0000374
Fault offset: 0x000ce753
Faulting process id: 0x12b8
Faulting application start time: 0xhl2.exe0
Faulting application path: hl2.exe1
Faulting module path: hl2.exe2
Report Id: hl2.exe3

Error: (07/02/2014 03:33:25 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: hl2.exe, version: 0.0.0.0, time stamp: 0x537503fc
Faulting module name: ntdll.dll, version: 6.1.7601.18247, time stamp: 0x521ea8e7
Exception code: 0xc0000374
Fault offset: 0x000ce753
Faulting process id: 0x460
Faulting application start time: 0xhl2.exe0
Faulting application path: hl2.exe1
Faulting module path: hl2.exe2
Report Id: hl2.exe3

Error: (07/02/2014 02:15:03 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/02/2014 02:13:27 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: infocard.exe, version: 3.0.4506.5420, time stamp: 0x4c2ca1b4
Faulting module name: KERNELBASE.dll, version: 6.1.7601.18409, time stamp: 0x5315a05a
Exception code: 0xe0434f4d
Fault offset: 0x000000000000940d
Faulting process id: 0x818
Faulting application start time: 0xinfocard.exe0
Faulting application path: infocard.exe1
Faulting module path: infocard.exe2
Report Id: infocard.exe3


System errors:
=============
Error: (07/02/2014 04:43:09 PM) (Source: DCOM) (EventID: 10000) (User: )
Description: C:\Windows\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}2{883FF1FC-09E1-48E5-8E54-E2469ACB0CFD}

Error: (07/02/2014 04:41:26 PM) (Source: DCOM) (EventID: 10000) (User: )
Description: C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}2{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

Error: (07/02/2014 04:32:12 PM) (Source: DCOM) (EventID: 10001) (User: )
Description: C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}2{C39EE728-D419-4BD4-A3EF-EDA059DBD935}

Error: (07/02/2014 04:32:11 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Logitech Bluetooth Service service terminated unexpectedly.  It has done this 1 time(s).

Error: (07/02/2014 04:32:10 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Office Source Engine service failed to start due to the following error: 
%%2

Error: (07/02/2014 04:32:10 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Microsoft Office Diagnostics Service service failed to start due to the following error: 
%%2

Error: (07/02/2014 04:32:10 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Mozilla Maintenance Service service failed to start due to the following error: 
%%2

Error: (07/02/2014 04:32:09 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Windows CardSpace service failed to start due to the following error: 
%%1053

Error: (07/02/2014 04:32:09 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Windows CardSpace service to connect.

Error: (07/02/2014 04:31:52 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Adobe Flash Player Update Service service failed to start due to the following error: 
%%2


Microsoft Office Sessions:
=========================
Error: (06/24/2014 03:54:50 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 3486 seconds with 300 seconds of active time.  This session ended with a crash.

Error: (05/30/2014 06:28:20 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 25 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (05/19/2014 07:30:00 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6612.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 3871 seconds with 3180 seconds of active time.  This session ended with a crash.


==================== Memory info =========================== 

Percentage of memory in use: 14%
Total physical RAM: 16303.44 MB
Available physical RAM: 14016.12 MB
Total Pagefile: 32605.05 MB
Available Pagefile: 30042.55 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:232.79 GB) (Free:98.13 GB) NTFS
Drive d: (Daten) (Fixed) (Total:931.51 GB) (Free:859.53 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: C29EA567)
Partition 1: (Not Active) - (Size=932 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: 3FE067CE)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=233 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         
Angehängte Dateien
Dateityp: log gmer.log (79,6 KB, 98x aufgerufen)

Alt 02.07.2014, 18:08   #2
deeprybka
/// TB-Ausbilder
/// Anleitungs-Guru
 
Windows7,  Virenbefall von W32 Infector.Gen9, TR Patched.Gen und TR.Crypt.Xpack.74223 - Standard

Windows7, Virenbefall von W32 Infector.Gen9, TR Patched.Gen und TR.Crypt.Xpack.74223





Mein Name ist Jürgen und ich werde Dir bei Deinem Problem behilflich sein. Zusammen schaffen wir das...
  • Bitte arbeite alle Schritte der Reihe nach ab.
  • Lese die Anleitungen sorgfältig durch bevor Du beginnst. Wenn es Probleme gibt oder Du etwas nicht verstehst, dann stoppe mit Deiner Ausführung und beschreibe mir das Problem.
  • Führe bitte nur Scans durch, zu denen Du von mir aufgefordert wurdest.
  • Bitte kein Crossposting (posten in mehreren Foren).
  • Installiere oder deinstalliere während der Bereinigung keine Software, außer Du wurdest dazu aufgefordert.
  • Speichere alle unsere Tools auf dem Desktop ab.
  • Poste die Logfiles direkt in Deinen Thread in Code-Tags.
  • Bedenke, dass wir hier alle während unserer Freizeit tätig sind, wenn du innerhalb von 24 Stunden nichts von mir liest, dann schreibe mir bitte eine PM.

Hinweis:
Ich kann Dir niemals eine Garantie geben, dass wir alle schädlichen Dateien finden werden.
Eine Formatierung ist meist der schnellere und immer der sicherste Weg, aber auch nur bei wirklicher Malware empfehlenswert.
Adware & Co. können wir sehr gut entfernen.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis Du mein clean bekommst.



Los geht's:


Schritt 1
Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

__________________

__________________

Alt 02.07.2014, 20:22   #3
ds1
 
Windows7,  Virenbefall von W32 Infector.Gen9, TR Patched.Gen und TR.Crypt.Xpack.74223 - Standard

Windows7, Virenbefall von W32 Infector.Gen9, TR Patched.Gen und TR.Crypt.Xpack.74223



Hallo Jürgen,

lieben Dank für die schnelle Antwort!
Antivira habe ich deaktiviert, Combofix hat trotzdem gemeckert, lief aber problemlos durch. Hier ist die Log-Datei:

Code:
ATTFilter
ComboFix 14-06-30.01 - David 02.07.2014  20:12:50.1.4 - x64
Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1033.18.16303.14192 [GMT 2:00]
ausgeführt von:: c:\users\David\Desktop\ComboFix.exe
AV: Avira Desktop *Enabled/Outdated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Desktop *Enabled/Outdated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-06-02 bis 2014-07-02  ))))))))))))))))))))))))))))))
.
.
2014-07-02 18:14 . 2014-07-02 18:14	--------	d-----w-	c:\users\Default\AppData\Local\temp
2014-07-02 18:14 . 2014-07-02 18:14	--------	d-----w-	c:\users\David\AppData\Roaming\Qahe
2014-07-02 18:03 . 2014-07-02 18:03	94656	----a-w-	c:\windows\system32\WPRO_41_2001woem.tmp
2014-07-02 14:42 . 2014-07-02 14:43	--------	d-----w-	C:\FRST
2014-07-02 13:03 . 2014-07-02 13:03	--------	d-----w-	c:\users\David\AppData\Roaming\DAEMON Tools Lite
2014-07-02 13:03 . 2014-07-02 13:03	--------	d-----w-	c:\programdata\DAEMON Tools Lite
2014-07-02 13:00 . 2014-07-02 13:00	--------	d-----w-	c:\program files\CCleaner
2014-07-01 16:59 . 2014-07-01 16:59	219136	----a-w-	c:\windows\system32\ldadgom.exe
2014-06-25 15:25 . 2014-07-01 17:52	--------	d-----w-	c:\program files (x86)\Mozilla Maintenance Service
2014-06-25 14:12 . 2014-06-25 14:12	--------	d-sh--w-	c:\users\David\AppData\Local\EmieUserList
2014-06-25 14:12 . 2014-06-25 14:12	--------	d-sh--w-	c:\users\David\AppData\Local\EmieSiteList
2014-06-25 13:52 . 2014-06-25 13:52	--------	d-----w-	c:\users\David\AppData\Local\Adobe
2014-06-25 13:21 . 2014-06-25 13:21	--------	d-----w-	c:\programdata\McAfee
2014-06-23 17:15 . 2014-07-02 14:33	122584	----a-w-	c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-06-23 17:15 . 2014-06-23 17:15	--------	d-----w-	c:\program files (x86)\ Malwarebytes Anti-Malware 
2014-06-23 17:15 . 2014-05-12 05:26	63704	----a-w-	c:\windows\system32\drivers\mwac.sys
2014-06-23 17:15 . 2014-05-12 05:26	91352	----a-w-	c:\windows\system32\drivers\mbamchameleon.sys
2014-06-23 17:05 . 2014-07-02 18:03	--------	d-----w-	c:\users\David\AppData\Roaming\Enkue
2014-06-15 14:56 . 2014-05-08 09:32	3178496	----a-w-	c:\windows\system32\rdpcorets.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-07-02 18:03 . 2014-01-12 15:15	34752	----a-w-	c:\windows\system32\drivers\WPRO_41_2001.sys
2014-06-25 13:21 . 2014-01-13 12:07	71344	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-06-25 13:21 . 2014-01-13 12:07	699056	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2014-06-23 17:12 . 2010-11-21 03:25	2103808	----atw-	c:\windows\system32\wbengine.exe
2014-06-23 17:12 . 2010-11-21 03:23	2200576	----atw-	c:\windows\system32\VSSVC.exe
2014-06-23 17:12 . 2010-11-21 03:23	4122624	----atw-	c:\windows\system32\sppsvc.exe
2014-06-23 17:11 . 2010-11-21 03:25	1290240	----atw-	c:\windows\system32\FXSSVC.exe
2014-06-15 16:16 . 2014-01-12 15:50	95414520	----a-w-	c:\windows\system32\MRT.exe
2014-05-20 02:44 . 2014-05-26 17:10	9735256	----a-w-	c:\windows\SysWow64\nvcuda.dll
2014-05-20 02:44 . 2014-05-26 17:10	9697640	----a-w-	c:\windows\SysWow64\nvopencl.dll
2014-05-20 02:44 . 2014-05-26 17:10	895776	----a-w-	c:\windows\system32\NvIFR64.dll
2014-05-20 02:44 . 2014-05-26 17:10	892704	----a-w-	c:\windows\system32\NvFBC64.dll
2014-05-20 02:44 . 2014-05-26 17:10	867784	----a-w-	c:\windows\SysWow64\NvIFR.dll
2014-05-20 02:44 . 2014-05-26 17:10	861128	----a-w-	c:\windows\SysWow64\NvFBC.dll
2014-05-20 02:44 . 2014-05-26 17:10	837056	----a-w-	c:\windows\SysWow64\nvumdshim.dll
2014-05-20 02:44 . 2014-05-26 17:10	492376	----a-w-	c:\windows\system32\nvEncodeAPI64.dll
2014-05-20 02:44 . 2014-05-26 17:10	416712	----a-w-	c:\windows\SysWow64\nvEncodeAPI.dll
2014-05-20 02:44 . 2014-05-26 17:10	382240	----a-w-	c:\windows\system32\NvIFROpenGL.dll
2014-05-20 02:44 . 2014-05-26 17:10	354016	----a-w-	c:\windows\system32\nvoglshim64.dll
2014-05-20 02:44 . 2014-05-26 17:10	335704	----a-w-	c:\windows\SysWow64\NvIFROpenGL.dll
2014-05-20 02:44 . 2014-05-26 17:10	31520	----a-w-	c:\windows\system32\nvhdap64.dll
2014-05-20 02:44 . 2014-05-26 17:10	3141976	----a-w-	c:\windows\system32\nvcuvid.dll
2014-05-20 02:44 . 2014-05-26 17:10	31387936	----a-w-	c:\windows\system32\nvoglv64.dll
2014-05-20 02:44 . 2014-05-26 17:10	305600	----a-w-	c:\windows\SysWow64\nvoglshim32.dll
2014-05-20 02:44 . 2014-05-26 17:10	2953672	----a-w-	c:\windows\SysWow64\nvcuvid.dll
2014-05-20 02:44 . 2014-05-26 17:10	2785568	----a-w-	c:\windows\system32\nvcuvenc.dll
2014-05-20 02:44 . 2014-05-26 17:10	25256224	----a-w-	c:\windows\system32\nvcompiler.dll
2014-05-20 02:44 . 2014-05-26 17:10	2412376	----a-w-	c:\windows\SysWow64\nvcuvenc.dll
2014-05-20 02:44 . 2014-05-26 17:10	24025376	----a-w-	c:\windows\SysWow64\nvoglv32.dll
2014-05-20 02:44 . 2014-05-26 17:10	197408	----a-w-	c:\windows\system32\drivers\nvhda64v.sys
2014-05-20 02:44 . 2014-05-26 17:10	1889112	----a-w-	c:\windows\system32\nvdispco6433788.dll
2014-05-20 02:44 . 2014-05-26 17:10	17561544	----a-w-	c:\windows\SysWow64\nvcompiler.dll
2014-05-20 02:44 . 2014-05-26 17:10	166568	----a-w-	c:\windows\system32\nvinitx.dll
2014-05-20 02:44 . 2014-05-26 17:10	1541576	----a-w-	c:\windows\system32\nvdispgenco6433788.dll
2014-05-20 02:44 . 2014-05-26 17:10	1515296	----a-w-	c:\windows\system32\nvhdagenco6420103.dll
2014-05-20 02:44 . 2014-05-26 17:10	146480	----a-w-	c:\windows\SysWow64\nvinit.dll
2014-05-20 02:44 . 2014-05-26 17:10	14434704	----a-w-	c:\windows\SysWow64\nvd3dum.dll
2014-05-20 02:44 . 2014-05-26 17:10	12688328	----a-w-	c:\windows\system32\drivers\nvlddmkm.sys
2014-05-20 02:44 . 2014-05-26 17:10	11644928	----a-w-	c:\windows\system32\nvcuda.dll
2014-05-20 02:44 . 2014-05-26 17:10	11599072	----a-w-	c:\windows\system32\nvopencl.dll
2014-05-20 02:44 . 2014-01-12 14:29	61216	----a-w-	c:\windows\system32\OpenCL.dll
2014-05-20 02:44 . 2014-01-12 14:29	52056	----a-w-	c:\windows\SysWow64\OpenCL.dll
2014-05-20 02:44 . 2014-01-12 14:26	18531568	----a-w-	c:\windows\system32\nvwgf2umx.dll
2014-05-20 02:44 . 2014-01-12 14:26	952952	----a-w-	c:\windows\system32\nvumdshimx.dll
2014-05-20 02:44 . 2014-01-12 14:26	16003912	----a-w-	c:\windows\SysWow64\nvwgf2um.dll
2014-05-20 02:44 . 2014-01-12 14:26	17480432	----a-w-	c:\windows\system32\nvd3dumx.dll
2014-05-20 02:44 . 2014-01-12 14:26	3109248	----a-w-	c:\windows\system32\nvapi64.dll
2014-05-20 02:44 . 2014-01-12 14:26	2730208	----a-w-	c:\windows\SysWow64\nvapi.dll
2014-05-20 01:25 . 2014-01-12 14:29	6769096	----a-w-	c:\windows\system32\nvcpl.dll
2014-05-20 01:25 . 2014-01-12 14:29	3514144	----a-w-	c:\windows\system32\nvsvc64.dll
2014-05-20 01:25 . 2014-01-12 14:29	927520	----a-w-	c:\windows\system32\nvvsvc.exe
2014-05-20 01:25 . 2014-01-12 14:29	62808	----a-w-	c:\windows\system32\nvshext.dll
2014-05-20 01:25 . 2014-01-12 14:29	387528	----a-w-	c:\windows\system32\nvmctray.dll
2014-05-19 23:10 . 2014-05-26 17:11	601432	----a-w-	c:\windows\SysWow64\nvStreaming.exe
2014-05-14 23:49 . 2014-01-12 14:29	3774821	----a-w-	c:\windows\system32\nvcoproc.bin
2014-05-12 05:25 . 2014-01-12 14:44	25816	----a-w-	c:\windows\system32\drivers\mbam.sys
2014-04-30 18:27 . 2014-05-26 17:11	1081112	----a-w-	c:\windows\SysWow64\nvspcap.dll
2014-04-30 18:26 . 2014-05-26 17:11	1225920	----a-w-	c:\windows\system32\nvspcap64.dll
2014-04-29 08:48 . 2014-01-12 14:33	130584	----a-w-	c:\windows\system32\drivers\avipbb.sys
2014-04-29 08:48 . 2014-01-12 14:33	112080	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2014-04-12 02:22 . 2014-05-15 07:32	95680	----a-w-	c:\windows\system32\drivers\ksecdd.sys
2014-04-12 02:22 . 2014-05-15 07:32	155072	----a-w-	c:\windows\system32\drivers\ksecpkg.sys
2014-04-12 02:19 . 2014-05-15 07:32	29184	----a-w-	c:\windows\system32\sspisrv.dll
2014-04-12 02:19 . 2014-05-15 07:32	136192	----a-w-	c:\windows\system32\sspicli.dll
2014-04-12 02:19 . 2014-05-15 07:32	28160	----a-w-	c:\windows\system32\secur32.dll
2014-04-12 02:19 . 2014-05-15 07:32	1460736	----a-w-	c:\windows\system32\lsasrv.dll
2014-04-12 02:19 . 2014-05-15 07:32	31232	----a-w-	c:\windows\system32\lsass.exe
2014-04-12 02:12 . 2014-05-15 07:32	22016	----a-w-	c:\windows\SysWow64\secur32.dll
2014-04-12 02:10 . 2014-05-15 07:32	96768	----a-w-	c:\windows\SysWow64\sspicli.dll
2014-04-09 13:13 . 2014-04-09 13:13	489064	----a-w-	C:\SecurityScanner.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54	131248	----a-w-	c:\users\David\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54	131248	----a-w-	c:\users\David\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54	131248	----a-w-	c:\users\David\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54	131248	----a-w-	c:\users\David\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2014-06-03 737872]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"USB3MON"="c:\program files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [2013-04-11 292848]
"IMSS"="c:\program files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe" [2013-03-12 134616]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-12-21 959904]
"EaseUS EPM tray"="d:\programme (selten genutzt)\EaseUS Partition Master 9.3.0\bin\EpmNews.exe" [2013-03-29 2081792]
"Cisco AnyConnect Secure Mobility Agent for Windows"="c:\program files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe" [2014-03-12 707472]
"PDFPrint"="d:\programme (selten genutzt)\PDF24\pdf24.exe" [2014-05-14 191016]
.
c:\users\David\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\David\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2014-5-20 33322312]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
iSCTsysTray.lnk - c:\program files\Intel\Intel(R) Smart Connect Technology Agent\iSCTsysTray8.exe [2013-3-14 248296]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"TaskbarNoNotification"= 0 (0x0)
"HideSCAHealth"= 1 (0x1)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"TaskbarNoNotification"= 0 (0x0)
.
R3 acsock;acsock;c:\windows\system32\DRIVERS\acsock64.sys;c:\windows\SYSNATIVE\DRIVERS\acsock64.sys [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys;c:\windows\SYSNATIVE\epmntdrv.sys [x]
R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys;c:\windows\SYSNATIVE\EuGdiDrv.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 Intel(R) Capability Licensing Service TCP IP Interface;Intel(R) Capability Licensing Service TCP IP Interface;c:\program files\Intel\iCLS Client\SocketHeciServer.exe;c:\program files\Intel\iCLS Client\SocketHeciServer.exe [x]
R3 iumsvc;Intel(R) Update Manager;c:\program files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe;c:\program files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R4 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\avwebg7.exe;c:\program files (x86)\Avira\AntiVir Desktop\avwebg7.exe [x]
S0 iaStorA;iaStorA;c:\windows\system32\DRIVERS\iaStorA.sys;c:\windows\SYSNATIVE\DRIVERS\iaStorA.sys [x]
S0 iaStorF;iaStorF;c:\windows\system32\DRIVERS\iaStorF.sys;c:\windows\SYSNATIVE\DRIVERS\iaStorF.sys [x]
S0 iusb3hcs;Intel(R) USB 3.0 Host Controller Switch Driver;c:\windows\system32\DRIVERS\iusb3hcs.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hcs.sys [x]
S1 AsrAppCharger;AsrAppCharger;c:\windows\system32\DRIVERS\AsrAppCharger.sys;c:\windows\SYSNATIVE\DRIVERS\AsrAppCharger.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 avnetflt;avnetflt;c:\windows\system32\DRIVERS\avnetflt.sys;c:\windows\SYSNATIVE\DRIVERS\avnetflt.sys [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]
S2 Intel(R) ME Service;Intel(R) ME Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [x]
S2 Intel(R) PROSet Monitoring Service;Intel(R) PROSet Monitoring Service;c:\windows\system32\IProsetMonitor.exe;c:\windows\SYSNATIVE\IProsetMonitor.exe [x]
S2 ISCTAgent;Intel(R) Smart Connect Technology Agent;c:\program files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe ;c:\program files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe  [x]
S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [x]
S2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]
S2 RtkAudioService;Realtek Audio Service;c:\program files\Realtek\Audio\HDA\RtkAudioService64.exe;c:\program files\Realtek\Audio\HDA\RtkAudioService64.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 vpnagent;Cisco AnyConnect Secure Mobility Agent;c:\program files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe;c:\program files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe [x]
S3 e1dexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver D;c:\windows\system32\DRIVERS\e1d62x64.sys;c:\windows\SYSNATIVE\DRIVERS\e1d62x64.sys [x]
S3 ikbevent;Intel Upper keyboard Class Filter Driver;c:\windows\system32\DRIVERS\ikbevent.sys;c:\windows\SYSNATIVE\DRIVERS\ikbevent.sys [x]
S3 imsevent;Intel Upper Mouse Class Filter Driver;c:\windows\system32\DRIVERS\imsevent.sys;c:\windows\SYSNATIVE\DRIVERS\imsevent.sys [x]
S3 ISCT;Intel(R) Smart Connect Technology Device Driver;c:\windows\system32\DRIVERS\ISCTD64.sys;c:\windows\SYSNATIVE\DRIVERS\ISCTD64.sys [x]
S3 iusb3hub;Intel(R) USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\iusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hub.sys [x]
S3 iusb3xhc;Intel(R) USB 3.0 eXtensible Host Controller Driver;c:\windows\system32\DRIVERS\iusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3xhc.sys [x]
S3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;c:\windows\system32\DRIVERS\LEqdUsb.Sys;c:\windows\SYSNATIVE\DRIVERS\LEqdUsb.Sys [x]
S3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;c:\windows\system32\DRIVERS\LHidEqd.Sys;c:\windows\SYSNATIVE\DRIVERS\LHidEqd.Sys [x]
S3 NvStreamKms;NvStreamKms;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [x]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
S3 WPRO_41_2001;WinPcap Packet Driver (WPRO_41_2001);c:\windows\system32\drivers\WPRO_41_2001.sys;c:\windows\SYSNATIVE\drivers\WPRO_41_2001.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54	164016	----a-w-	c:\users\David\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54	164016	----a-w-	c:\users\David\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54	164016	----a-w-	c:\users\David\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54	164016	----a-w-	c:\users\David\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2014-06-05 15:46	777032	----a-w-	c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2014-06-05 15:46	777032	----a-w-	c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedViewOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]
2014-06-05 15:46	777032	----a-w-	c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2014-06-05 15:46	777032	----a-w-	c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2014-06-05 15:46	777032	----a-w-	c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2013-07-31 3091224]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2013-03-29 13513288]
"IAStorIcon"="c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe" [2013-04-30 36352]
"NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2014-04-30 2199840]
"ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2014-04-30 1225920]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = https://www.google.de/?gws_rd=ssl
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\David\AppData\Roaming\Mozilla\Firefox\Profiles\94xit4ha.default\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-07-02  20:16:14
ComboFix-quarantined-files.txt  2014-07-02 18:16
.
Vor Suchlauf: 106.807.304.192 bytes free
Nach Suchlauf: 106.422.263.808 bytes free
.
- - End Of File - - D231B8DB0A3548AC1F686560F2259209
A36C5E4F47E84449FF07ED3517B43A31
         
__________________

Alt 02.07.2014, 20:36   #4
deeprybka
/// TB-Ausbilder
/// Anleitungs-Guru
 
Windows7,  Virenbefall von W32 Infector.Gen9, TR Patched.Gen und TR.Crypt.Xpack.74223 - Standard

Windows7, Virenbefall von W32 Infector.Gen9, TR Patched.Gen und TR.Crypt.Xpack.74223



Hi, also es ist so:
Dein Antivirusprogramm zeigt mit "W32/Infector.Gen9 " eigentlich an, dass Dein PC möglicherweise mit einem Fileinfector (Expiro) infiziert ist. Wir prüfen das weiter mit einem schnellen Scan...

Schritt 1
Downloade Dir HitmanProauf Deinen Desktop:

HitmanPro - 32 Bit
HitmanPro - 64 Bit
  • Starte die HitmanPro.exe
  • Klicke auf
  • Entferne den Haken bei
  • Klicke auf
    und
  • Akzeptiere die Lizenzbedingungen und klicke auf
  • Klicke auf

    und auf
  • Wenn der Scan beendet wurde, nichts löschen lassen etc. sondern wähle unten links auf der Button-Leiste
    und speichere die Logdatei auf Deinem Desktop.
  • Schließe HitmanPro und poste mir das Log.
__________________
Gruß
deeprybka

Lob, Kritik, Wünsche?

Spende fürs trojaner-board?
_______________________________________________
„Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer

Alt 02.07.2014, 21:13   #5
ds1
 
Windows7,  Virenbefall von W32 Infector.Gen9, TR Patched.Gen und TR.Crypt.Xpack.74223 - Standard

Windows7, Virenbefall von W32 Infector.Gen9, TR Patched.Gen und TR.Crypt.Xpack.74223



Hi,

aha, so ist das also Hier das Log:

Code:
ATTFilter
Code:
ATTFilter
HitmanPro 3.7.9.220
www.hitmanpro.com

   Computer name . . . . : DAVID-PC
   Windows . . . . . . . : 6.1.1.7601.X64/4
   User name . . . . . . : David-PC\David
   UAC . . . . . . . . . : Disabled
   License . . . . . . . : Free

   Scan date . . . . . . : 2014-07-02 21:10:05
   Scan mode . . . . . . : Normal
   Scan duration . . . . : 1m 59s
   Disk access mode  . . : Direct disk access (SRB)
   Cloud . . . . . . . . : Internet
   Reboot  . . . . . . . : No

   Threats . . . . . . . : 14
   Traces  . . . . . . . : 27

   Objects scanned . . . : 1.236.690
   Files scanned . . . . : 15.069
   Remnants scanned  . . : 214.538 files / 1.007.083 keys

Malware _____________________________________________________________________

   C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
      Size . . . . . . . : 950.784 bytes
      Age  . . . . . . . : 171.2 days (2014-01-12 16:46:27)
      Entropy  . . . . . : 7.3
      SHA-256  . . . . . : 64E34755A20505E6C63BD87BF464FBE1AEDEFF657A7FA3BA31A437DAF8DBD5EC
      Product  . . . . . : Logitech SetPoint
      Publisher  . . . . : Logitech, Inc.
      Description  . . . : Logitech Bluetooth Service
      Version  . . . . . : 5.60.73
      Copyright  . . . . : (C) 1998-2013 Logitech. All rights reserved.
      Service  . . . . . : LBTServ
      LanguageID . . . . : 1033
    > Bitdefender  . . . : Win64.Expiro.Gen.3
      Fuzzy  . . . . . . : 105.0
      Startup
         HKLM\SYSTEM\CurrentControlSet\Services\LBTServ\

   C:\Program Files\Common Files\Microsoft Shared\Ink\mip.exe
      Size . . . . . . . : 2.147.840 bytes
      Age  . . . . . . . : 170.8 days (2014-01-13 01:06:44)
      Entropy  . . . . . : 7.1
      SHA-256  . . . . . : 1A32F3F2D72D82D35CB9248124D661F29E0871AB649A8844C3890C3B35E4F2CF
      Product  . . . . . : Microsoft® Windows® Operating System
      Publisher  . . . . : Microsoft Corporation
      Description  . . . : Math Input Panel Accessory
      Version  . . . . . : 6.1.7601.17514
      Copyright  . . . . : © Microsoft Corporation. All rights reserved.
      LanguageID . . . . : 1033
    > Bitdefender  . . . : Win64.Expiro.Gen.3
      Fuzzy  . . . . . . : 111.0
      References
         C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Math Input Panel.lnk

   C:\Program Files\DVD Maker\DVDMaker.exe
      Size . . . . . . . : 2.859.520 bytes
      Age  . . . . . . . : 170.8 days (2014-01-13 01:06:30)
      Entropy  . . . . . : 6.6
      SHA-256  . . . . . : F677AFFB3C91444A9121ED3DE70D747162A6AB3B0BA5D02A2DE9E3894C5F9457
      Product  . . . . . : Microsoft® Windows® Operating System
      Publisher  . . . . : Microsoft Corporation
      Description  . . . : Windows DVD Maker
      Version  . . . . . : 6.1.7600.16385
      Copyright  . . . . : © Microsoft Corporation. All rights reserved.
      LanguageID . . . . : 1033
    > Bitdefender  . . . : Win64.Expiro.Gen.3
      Fuzzy  . . . . . . : 115.0
      References
         C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk

   C:\Program Files\Windows Defender\MSASCui.exe
      Size . . . . . . . : 1.562.112 bytes
      Age  . . . . . . . : 1814.8 days (2009-07-14 01:53:49)
      Entropy  . . . . . : 7.2
      SHA-256  . . . . . : 248286D716B4026B29AE5DF9EDFBBCA27885EFAACAC90FA1037DBD254D14E70B
      Product  . . . . . : Microsoft® Windows® Operating System
      Publisher  . . . . : Microsoft Corporation
      Description  . . . : Windows Defender User Interface
      Version  . . . . . : 6.1.7600.16385
      Copyright  . . . . : © Microsoft Corporation. All rights reserved.
      LanguageID . . . . : 1033
    > Bitdefender  . . . : Win64.Expiro.Gen.3
      Fuzzy  . . . . . . : 119.0
      References
         HKLM\SOFTWARE\Classes\CLSID\{D8559EB9-20C0-410E-BEDA-7ED416AECC2A}\
         HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace\{D8559EB9-20C0-410E-BEDA-7ED416AECC2A}\

   C:\Program Files\Windows Journal\Journal.exe
      Size . . . . . . . : 2.762.752 bytes
      Age  . . . . . . . : 170.8 days (2014-01-13 01:06:46)
      Entropy  . . . . . : 6.8
      SHA-256  . . . . . : 1B86A2864C85A1846208E8EEF7D5E1CC4BEB5F73D33CAF106BFF36EBA6125472
      Product  . . . . . : Microsoft® Windows® Operating System
      Publisher  . . . . : Microsoft Corporation
      Description  . . . : Windows Journal
      Version  . . . . . : 6.1.7601.17514
      Copyright  . . . . : © Microsoft Corporation. All rights reserved.
      LanguageID . . . . : 1033
    > Bitdefender  . . . : Win64.Expiro.Gen.3
      Fuzzy  . . . . . . : 115.0
      References
         C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Windows Journal.lnk

   C:\Users\David\AppData\Roaming\Qahe\atah.exe
      Size . . . . . . . : 205.312 bytes
      Age  . . . . . . . : 0.0 days (2014-07-02 20:14:34)
      Entropy  . . . . . : 6.1
      SHA-256  . . . . . : 47C770EB2ADC07C26B9EAA12DE5DB4E79473255E4C1053EF12313E170D317E71
    > Bitdefender  . . . : Gen:Variant.Kazy.400556
    > Kaspersky  . . . . : Hoax.Win32.ArchSMS.cbste
      Fuzzy  . . . . . . : 109.0
      Forensic Cluster
         -0.3s C:\Qoobox\Quarantine\C\Users\
         -0.3s C:\Qoobox\Quarantine\C\Users\David\
         -0.3s C:\Qoobox\Quarantine\C\Users\David\AppData\
         -0.3s C:\Qoobox\Quarantine\C\Users\David\AppData\Roaming\Qahe\
         -0.3s C:\Qoobox\Quarantine\C\Users\David\AppData\Roaming\Qahe\
         -0.3s C:\Qoobox\Quarantine\C\Users\David\AppData\Roaming\
          0.0s C:\Users\David\AppData\Roaming\Qahe\
          0.0s C:\Users\David\AppData\Roaming\Qahe\atah.exe

   C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
      Size . . . . . . . : 684.032 bytes
      Age  . . . . . . . : 170.8 days (2014-01-13 01:03:11)
      Entropy  . . . . . : 7.7
      SHA-256  . . . . . : CEBB156317128F52584427008D45893FE078B20110A0AC90B7A656A6DF7AC83C
      Product  . . . . . : Microsoft® .NET Framework
      Publisher  . . . . : Microsoft Corporation
      Description  . . . : .NET Runtime Optimization Service
      Version  . . . . . : 2.0.50727.4927
      Copyright  . . . . : © Microsoft Corporation.  All rights reserved.
      Service  . . . . . : clr_optimization_v2.0.50727_64
      LanguageID . . . . : 1033
    > Bitdefender  . . . : Win64.Expiro.Gen.3
      Fuzzy  . . . . . . : 115.0
      Startup
         HKLM\SYSTEM\CurrentControlSet\Services\clr_optimization_v2.0.50727_64\

   C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
      Size . . . . . . . : 1.450.496 bytes
      Age  . . . . . . . : 170.8 days (2014-01-13 01:03:11)
      Entropy  . . . . . : 7.1
      SHA-256  . . . . . : E09BE3C304F90295899F823D37B43A25F23B236122F9B3CD390DDC138BA75F71
      Product  . . . . . : Microsoft® .NET Framework
      Publisher  . . . . : Microsoft Corporation
      Description  . . . : Windows CardSpace
      Version  . . . . . : 3.0.4506.5420
      Copyright  . . . . : © Microsoft Corporation.  All rights reserved.
      Service  . . . . . : idsvc
      LanguageID . . . . : 1033
    > Bitdefender  . . . : Win64.Expiro.Gen.3
      Fuzzy  . . . . . . : 103.0
      Startup
         HKLM\SYSTEM\CurrentControlSet\Services\idsvc\

   C:\Windows\system32\cjolillp.tmp
      Size . . . . . . . : 711.168 bytes
      Age  . . . . . . . : 0.0 days (2014-07-02 20:57:30)
      Entropy  . . . . . : 7.7
      SHA-256  . . . . . : 9FEF8FEB388F3FDC31B37261484A030FA9DFED3DF51366D34C779385CB90797E
      Product  . . . . . : Internet Explorer
      Publisher  . . . . : Microsoft Corporation
      Description  . . . : IE ETW Collector Service
      Version  . . . . . : 11.00.9600.17126
      Copyright  . . . . : © Microsoft Corporation. All rights reserved.
      LanguageID . . . . : 1033
    > Bitdefender  . . . : Win64.Expiro.Gen.3
      Fuzzy  . . . . . . : 133.0

   C:\Windows\system32\fxssvc.exe
      Size . . . . . . . : 1.290.240 bytes
      Age  . . . . . . . : 170.8 days (2014-01-13 01:03:44)
      Entropy  . . . . . : 7.3
      SHA-256  . . . . . : CC7547B8C4D5CB84B496979A2A865AD294AF34D540849553878CFFF8583F6F15
      Product  . . . . . : Microsoft® Windows® Operating System
      Publisher  . . . . : Microsoft Corporation
      Description  . . . : Fax Service
      Version  . . . . . : 6.1.7601.17514
      Copyright  . . . . : © Microsoft Corporation. All rights reserved.
      Service  . . . . . : Fax
      LanguageID . . . . : 1033
    > Bitdefender  . . . : Win64.Expiro.Gen.3
      Fuzzy  . . . . . . : 125.0
      Startup
         HKLM\SYSTEM\CurrentControlSet\Services\Fax\

   C:\Windows\system32\ldadgom.exe
      Size . . . . . . . : 219.136 bytes
      Age  . . . . . . . : 1.1 days (2014-07-01 18:59:48)
      Entropy  . . . . . : 5.9
      SHA-256  . . . . . : FB5963CEE1CDE82D64CB0B65FD9F774805433192B2E428CBDA3989E42650EDE9
    > Bitdefender  . . . : Gen:Variant.Kazy.402928
    > Kaspersky  . . . . : Hoax.Win32.ArchSMS.cbumd
      Fuzzy  . . . . . . : 111.0
      Forensic Cluster
          0.0s C:\Windows\System32\ldadgom.exe
          0.0s C:\Windows\System32\ldadgom.exe
          0.0s C:\Windows\System32\ldadgom.exe

   C:\Windows\system32\sppsvc.exe
      Size . . . . . . . : 4.122.624 bytes
      Age  . . . . . . . : 170.8 days (2014-01-13 01:04:18)
      Entropy  . . . . . : 7.3
      SHA-256  . . . . . : CCD81AE00CEABF7D20F23B65A3E74B5C068E47BE4033E588BDE80335690679E6
      Product  . . . . . : Microsoft® Windows® Operating System
      Publisher  . . . . : Microsoft Corporation
      Description  . . . : Microsoft Software Protection Platform Service
      Version  . . . . . : 6.1.7601.17514
      Copyright  . . . . : © Microsoft Corporation. All rights reserved.
      Service  . . . . . : sppsvc
      LanguageID . . . . : 1033
    > Bitdefender  . . . : Win64.Expiro.Gen.3
      Fuzzy  . . . . . . : 127.0
      Startup
         HKLM\SYSTEM\CurrentControlSet\Services\sppsvc\

   C:\Windows\system32\vssvc.exe
      Size . . . . . . . : 2.200.576 bytes
      Age  . . . . . . . : 170.8 days (2014-01-13 01:04:23)
      Entropy  . . . . . : 6.7
      SHA-256  . . . . . : 53B8EE58B51E91287830618C569720FA5EC55D18E7868C92635B03E14C160467
      Product  . . . . . : Microsoft® Windows® Operating System
      Publisher  . . . . : Microsoft Corporation
      Description  . . . : Microsoft® Volume Shadow Copy Service
      Version  . . . . . : 6.1.7601.17514
      Copyright  . . . . : © Microsoft Corporation. All rights reserved.
      Service  . . . . . : VSS
      LanguageID . . . . : 1033
    > Bitdefender  . . . : Win64.Expiro.Gen.3
      Fuzzy  . . . . . . : 120.0
      Startup
         HKLM\SYSTEM\CurrentControlSet\Services\VSS\

   C:\Windows\system32\wbengine.exe
      Size . . . . . . . : 2.103.808 bytes
      Age  . . . . . . . : 170.8 days (2014-01-13 01:04:23)
      Entropy  . . . . . : 7.1
      SHA-256  . . . . . : DDD4B6FB10328AB7E93526873691EF8FA0B14877B56668EE96165B53B8CBD798
      Product  . . . . . : Microsoft® Windows® Operating System
      Publisher  . . . . : Microsoft Corporation
      Description  . . . : Microsoft® Block Level Backup Engine Service EXE
      Version  . . . . . : 6.1.7601.17514
      Copyright  . . . . : © Microsoft Corporation. All rights reserved.
      Service  . . . . . : wbengine
      LanguageID . . . . : 1033
    > Bitdefender  . . . : Win64.Expiro.Gen.3
      Fuzzy  . . . . . . : 127.0
      Startup
         HKLM\SYSTEM\CurrentControlSet\Services\wbengine\


Suspicious files ____________________________________________________________

   C:\Users\David\Desktop\FRST64.exe
      Size . . . . . . . : 2.083.840 bytes
      Age  . . . . . . . : 0.2 days (2014-07-02 16:42:16)
      Entropy  . . . . . : 7.5
      SHA-256  . . . . . : 38521AD5A90A95513DF394E9086F182F4AB22E2BA8315C018C1A82BF18D3B01E
      Needs elevation  . : Yes
      Fuzzy  . . . . . . : 24.0
         Program has no publisher information but prompts the user for permission elevation.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Time indicates that the file appeared recently on this computer.
         


Alt 02.07.2014, 21:28   #6
deeprybka
/// TB-Ausbilder
/// Anleitungs-Guru
 
Windows7,  Virenbefall von W32 Infector.Gen9, TR Patched.Gen und TR.Crypt.Xpack.74223 - Standard

Windows7, Virenbefall von W32 Infector.Gen9, TR Patched.Gen und TR.Crypt.Xpack.74223



Naja, das sieht jetzt nicht gerade gut aus...

Code:
ATTFilter
> Bitdefender  . . . : Win64.Expiro.Gen.3
         
Nur mal aus Interesse:

Bitte lasse die Datei aus der Code-Box bei Virustotal überprüfen.
  • Klicke auf Wählen Sie eine
  • Kopiere nun folgendes in die Suchleiste
    Code:
    ATTFilter
    C:\Windows\system32\sppsvc.exe
             
  • und klicke auf Öffnen.
  • Klicke auf Scannen!.
  • Warte bitte bis die Datei vollständig hochgeladen wurde. Solltest Du folgende Meldung bekommen
    Zitat:
    Diese Datei wurde bereits von VirusTotal analysiert...
    klicke auf Neu analysieren.
  • Warte bis dir das Analysedatum angezeigt wird und der Scan abgeschlossen ist.
  • Kopiere den Link aus deiner Adresszeile und poste ihn hier.
Wiederhole die selben Schritte mit folgenden Dateien:
Code:
ATTFilter
C:\Windows\system32\vssvc.exe
         
__________________
--> Windows7, Virenbefall von W32 Infector.Gen9, TR Patched.Gen und TR.Crypt.Xpack.74223

Alt 02.07.2014, 22:00   #7
ds1
 
Windows7,  Virenbefall von W32 Infector.Gen9, TR Patched.Gen und TR.Crypt.Xpack.74223 - Standard

Windows7, Virenbefall von W32 Infector.Gen9, TR Patched.Gen und TR.Crypt.Xpack.74223



Hi,

leider funktioniert das bei mir nicht: Ich kann die genannten Dateien im Explorer zwar sehen (nachdem ich alle versteckten Dateien aufgedeckt habe), aber sie tauchen nicht in der Dropdownliste von Virustotal auf. Dies gilt auch für die anderen Files, die im Ordner System32 liegen.

Ich habe allerdings zwei andere Dateien, die auch mit Expiro.Gen3 infiziert sind, hochladen können, nämlich

Code:
ATTFilter
C:\Program Files\Common Files\Microsoft Shared\Ink\mip.exe

Hier ist der Link: https://www.virustotal.com/de/file/1a32f3f2d72d82d35cb9248124d661f29e0871ab649a8844c3890c3b35e4f2cf/analysis/1404330909/
         
und

Code:
ATTFilter
   C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe

Hier der Link: https://www.virustotal.com/de/file/e09be3c304f90295899f823d37b43a25f23b236122f9b3cd390ddc138ba75f71/analysis/1404331186/
         

Alt 02.07.2014, 22:11   #8
deeprybka
/// TB-Ausbilder
/// Anleitungs-Guru
 
Windows7,  Virenbefall von W32 Infector.Gen9, TR Patched.Gen und TR.Crypt.Xpack.74223 - Standard

Windows7, Virenbefall von W32 Infector.Gen9, TR Patched.Gen und TR.Crypt.Xpack.74223



Hmm...
Also bei mir gehts...

Egal. Leider kann ich Dir nur raten, dass Du Deinen PC komplett platt machen sollst.
Ich würde da nichts davon behalten, sondern formatieren und neu installieren.
Das Zeug verbreitet sich auch übers Netzwerk. Würde von einem anderen (sauberen) PC auch alle "sensiblen" Passwörter ändern. Tut mir leid...
Win64/Expiro is an infectious virus that won?t stop! | Hyphenet IT Security Blog

Keine Windows 7 DVD? http://www.trojaner-board.de/100776-...-download.html
__________________
Gruß
deeprybka

Lob, Kritik, Wünsche?

Spende fürs trojaner-board?
_______________________________________________
„Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer

Alt 02.07.2014, 22:22   #9
ds1
 
Windows7,  Virenbefall von W32 Infector.Gen9, TR Patched.Gen und TR.Crypt.Xpack.74223 - Standard

Windows7, Virenbefall von W32 Infector.Gen9, TR Patched.Gen und TR.Crypt.Xpack.74223



Hm,

ja, das hatte ich schon befürchtet nachdem ich mir gerade ein paar Sachen über den Virus durchgelesen hatte. Naja, kann man nix machen, die TreiberCD´s liegen hier zum Glück noch alle ordentlich verstaut rum. Da der PC auch noch nicht so alt ist, lässt sich auch ne Neuauflage noch verschmerzen.
Eine Frage noch: Ich hab 2 Festplatten auf dem PC, muss ich nur die betroffene (:C) neu aufsetzen oder auch die andere?

liebe Grüße,

David

Ps: Nochmal vielen Dank für die Mühe!
Pps: Daumen hoch für das Schopenhauerzitat von einem Philosophiestudenten

Alt 02.07.2014, 22:25   #10
deeprybka
/// TB-Ausbilder
/// Anleitungs-Guru
 
Windows7,  Virenbefall von W32 Infector.Gen9, TR Patched.Gen und TR.Crypt.Xpack.74223 - Standard

Windows7, Virenbefall von W32 Infector.Gen9, TR Patched.Gen und TR.Crypt.Xpack.74223



Zitat:
Zitat von ds1 Beitrag anzeigen
Pps: Daumen hoch für das Schopenhauerzitat von einem Philosophiestudenten

Ach, ja das habe ich zwischen 20-25 J. auch gründlich studiert...Spinoza, die Stoiker, Epikur...und alles im Originaltext...nur Altgriechisch war heavy...


Ad rem:
Mach alles platt...
__________________
Gruß
deeprybka

Lob, Kritik, Wünsche?

Spende fürs trojaner-board?
_______________________________________________
„Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer

Antwort

Themen zu Windows7, Virenbefall von W32 Infector.Gen9, TR Patched.Gen und TR.Crypt.Xpack.74223
4d36e972-e325-11ce-bfc1-08002be10318, absturz, abstürzen, antivir, antivirus, avira, browser, ccsetup, dllhost.exe, downloader, excel, failed, firefox, flash player, google, helper, mozilla, programm, realtek, registry, rundll, scan, security, software, svchost.exe, tracker, usb, viren, windows



Ähnliche Themen: Windows7, Virenbefall von W32 Infector.Gen9, TR Patched.Gen und TR.Crypt.Xpack.74223


  1. Windows7: Virenbefall
    Log-Analyse und Auswertung - 19.01.2015 (55)
  2. Windows 7 64Bit, Virus: Infector.Gen9
    Log-Analyse und Auswertung - 09.09.2014 (14)
  3. Windows7: Avira meldet Trojaner TR/CRYPT.XPACK.32885
    Log-Analyse und Auswertung - 05.04.2014 (14)
  4. avira findet : tr/crypt.zpack.36522 ,tr/crypt.xpack.gen ,adware/installcore.gen
    Plagegeister aller Art und deren Bekämpfung - 06.01.2014 (4)
  5. TR/Patched.Ren.Gen2 und 'TR/Crypt.XPACK.Gen2'
    Log-Analyse und Auswertung - 16.10.2013 (9)
  6. Datei C:\Windows\System32\services.exe infiziert: W32/Patched.UB, Patched.UA, Patched.ZA
    Plagegeister aller Art und deren Bekämpfung - 19.07.2012 (5)
  7. W32/Patched.UA , TR/ATTRAPS.Gen , TR/ATTRAPS.Gen2 , TR/Crypt.XPACK.Gen
    Log-Analyse und Auswertung - 28.06.2012 (2)
  8. TR/Crypt.XPACK.Gen, TR/Sirefef.BV.2, TR/Crypt.XPACK.Gen3, TR/PSW.Karagany.A.73
    Plagegeister aller Art und deren Bekämpfung - 15.02.2012 (2)
  9. TR/Crypt.XPACK.Gen3 - nach formatierung von C: TR/Crypt.XPACK.Gen2 gefunden
    Plagegeister aller Art und deren Bekämpfung - 17.10.2010 (9)
  10. TR/Crypt.XPACK.Gen3, TR/Crypt.XPACK.Gen2
    Plagegeister aller Art und deren Bekämpfung - 11.10.2010 (4)
  11. Befall mit TR/Crypt.XPACK.Gen und TR/Crypt.XPACK.Gen3
    Plagegeister aller Art und deren Bekämpfung - 21.09.2010 (23)
  12. TR/Dropper.gen und TR/Crypt.XPACK.Gen und TR/Crypt.XPACK.Gen2 und TR/Dldr.Agent.cxyf.3
    Plagegeister aller Art und deren Bekämpfung - 29.07.2010 (32)
  13. tr\crypt.xpack.gen2 und tr\crypt.xpack.gen
    Plagegeister aller Art und deren Bekämpfung - 29.07.2010 (4)
  14. TR/dldr.swizzor.gen2, TR/crypt.xpack.gen, TR/crypt.zpack.gen unter Windows XP
    Plagegeister aller Art und deren Bekämpfung - 16.06.2010 (15)
  15. nach heftigem Virenbefall: PC stürzt ständig ab, AntiVir zeigt TR/Crypt.XPACK.Gen an
    Plagegeister aller Art und deren Bekämpfung - 27.05.2010 (0)
  16. Heftiger Trojaner Befall Crypt.XPACK.Gen/Click.YABECTOR.B.1/ Crypt.PEPM.Gen
    Log-Analyse und Auswertung - 28.12.2009 (1)
  17. TR/Crypt.Xpack.Gen in winshl.dll und TR/Patched.BU.10 in dmserver.dll
    Mülltonne - 16.11.2008 (1)

Zum Thema Windows7, Virenbefall von W32 Infector.Gen9, TR Patched.Gen und TR.Crypt.Xpack.74223 - Hallo liebe Community, mein PC (Win7, 64bit) ist seit einigen Tagen von Viren befallen (gemeldet werden "W32 Infector.Gen9", „TR Patched.Gen“ sowie "TR.Crypt.Xpack.74223“), die ich einfach nicht mehr loswerde. Ich hatte - Windows7, Virenbefall von W32 Infector.Gen9, TR Patched.Gen und TR.Crypt.Xpack.74223...
Archiv
Du betrachtest: Windows7, Virenbefall von W32 Infector.Gen9, TR Patched.Gen und TR.Crypt.Xpack.74223 auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.