![]() |
|
Plagegeister aller Art und deren Bekämpfung: Hi TR/trash.gen und PuPWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
![]() | #1 |
![]() ![]() | ![]() Hi TR/trash.gen und PuP Hi, ich habe anscheinend einigeplagegeister auf dem rechner. Die virensoftware ist ein paar mal angesprungen, das problem scheint aber nicht weg zu sein. Habe schon mehrere Programme ausproiert und alle haben etwas gefunden. Ich habe FRST laufen lassen, kann aber mit dem log nichts anfangen. Kann sich das mal jemand ansehen? Avira läuft grade noch, hat aber schon wieder TR/trash.gen gefunden. ![]() Logs kommen gleich.. FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 28-09-2014 02 Ran by Mattes (administrator) on MATTES-NOTEBOOK on 29-09-2014 21:08:00 Running from C:\Users\Mattes\Desktop Loaded Profile: Mattes (Available profiles: Mattes) Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe (Hewlett-Packard Company) C:\Windows\System32\hpservice.exe (Validity Sensors, Inc.) C:\Windows\System32\vcsFPService.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (AVM Berlin) C:\Program Files\FRITZ!Fernzugang\avmike.exe (AVM Berlin) C:\Program Files\FRITZ!Fernzugang\certsrv.exe (Freemake) C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe () E:\Program Files\MATLAB\R2013a\bin\win64\MATLABStartupAccelerator.exe (IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Samsung) C:\Program Files (x86)\Samsung\Kies\Kies.exe (Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe () C:\Program Files (x86)\HP HD Webcam [Fixed]\Monitor.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Elaborate Bytes AG) C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe (Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe () C:\ProgramData\DatacardService\HWDeviceService64.exe () C:\Program Files\ShrewSoft\VPN Client\iked.exe (Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe () C:\Program Files\ShrewSoft\VPN Client\ipsecd.exe () C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe (AVM Berlin) C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe (Skype Technologies) C:\Program Files (x86)\Skype\Updater\Updater.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Farbar) C:\Users\Mattes\Desktop\FRST64(4).exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1128448 2011-03-04] (IDT, Inc.) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3011824 2013-01-29] (Synaptics Incorporated) HKLM-x32\...\Run: [HP HD Webcam [Fixed]_Monitor] => C:\Program Files (x86)\HP HD Webcam [Fixed]\monitor.exe [267128 2010-11-26] () HKLM-x32\...\Run: [QLBController] => C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe [312376 2011-03-21] (Hewlett-Packard Company) HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [112152 2011-01-17] (Intel Corporation) HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-26] (Intel Corporation) HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [751184 2014-08-18] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [VirtualCloneDrive] => C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [88984 2013-03-10] (Elaborate Bytes AG) HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311616 2014-02-14] (Samsung Electronics Co., Ltd.) HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [164656 2014-08-27] (Avira Operations GmbH & Co. KG) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKU\S-1-5-21-3184967406-190654464-996919038-1000\...\Run: [KiesPreload] => C:\Program Files (x86)\Samsung\Kies\Kies.exe [1564992 2014-02-14] (Samsung) HKU\S-1-5-21-3184967406-190654464-996919038-1000\...\Run: [KiesAirMessage] => C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup HKU\S-1-5-21-3184967406-190654464-996919038-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22037608 2014-08-27] (Skype Technologies S.A.) HKU\S-1-5-21-3184967406-190654464-996919038-1000\...\MountPoints2: G - G:\AutoRun.exe HKU\S-1-5-21-3184967406-190654464-996919038-1000\...\MountPoints2: {1809afe6-dfb7-11e3-a7e8-101f74e6a4e2} - G:\AutoRun.exe HKU\S-1-5-21-3184967406-190654464-996919038-1000\...\MountPoints2: {28aa49f0-335b-11e3-9b41-806e6f6e6963} - D:\SWSETUP\APPINSTL\hpsoftwaresetup.exe HKU\S-1-5-21-3184967406-190654464-996919038-1000\...\MountPoints2: {6dd02dbe-c7cf-11e3-80a9-101f74e6a4e2} - G:\Startme.exe HKU\S-1-5-21-3184967406-190654464-996919038-1000\...\MountPoints2: {757a1577-3ab7-11e3-857f-101f74e6a4e2} - F:\SETUP.EXE HKU\S-1-5-21-3184967406-190654464-996919038-1000\...\MountPoints2: {bd622160-9fc1-11e3-8725-101f74e6a4e2} - H:\AutoRun.exe HKU\S-1-5-21-3184967406-190654464-996919038-1000\...\MountPoints2: {bd62216c-9fc1-11e3-8725-101f74e6a4e2} - H:\AutoRun.exe HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2013-10-13] (Microsoft Corporation) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x9129F4D071C7CE01 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation) BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> E:\Program Files\MS Office\Office15\URLREDIR.DLL (Microsoft Corporation) DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - E:\Program Files\MS Office\Office15\MSOSB.DLL (Microsoft Corporation) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 Tcpip\..\Interfaces\{11AB3C3A-0357-4BB0-BA7B-6F82B9BECFB7}: [NameServer] 210.22.70.3 210.22.84.3 Tcpip\..\Interfaces\{9CE28F86-7BF0-4FA6-B39E-87116B2FBCC6}: [NameServer] 192.168.42.1 Tcpip\..\Interfaces\{E2A75314-FB4D-47F1-BA35-717A9B815D8D}: [NameServer] 210.22.70.3 210.22.84.3 FireFox: ======== FF ProfilePath: C:\Users\Mattes\AppData\Roaming\Mozilla\Firefox\Profiles\iohbk117.default FF Homepage: www.google.de FF NetworkProxy: "type", 4 FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll () FF Plugin: @microsoft.com/GENUINE -> disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll () FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll No File FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> E:\PROGRA~1\MSOFFI~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> E:\PROGRA~1\MSOFFI~1\Office15\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @videolan.org/vlc,version=2.0.6 -> E:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: Avira Browser Safety - C:\Users\Mattes\AppData\Roaming\Mozilla\Firefox\Profiles\iohbk117.default\Extensions\abs@avira.com [2014-09-04] FF Extension: NoScript - C:\Users\Mattes\AppData\Roaming\Mozilla\Firefox\Profiles\iohbk117.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2013-10-13] FF Extension: Adblock Plus - C:\Users\Mattes\AppData\Roaming\Mozilla\Firefox\Profiles\iohbk117.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-10-13] Chrome: ======= CHR Profile: C:\Users\Mattes\AppData\Local\Google\Chrome\User Data\Default Code:
ATTFilter ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-08-18] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-18] (Avira Operations GmbH & Co. KG) S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1021520 2014-08-18] (Avira Operations GmbH & Co. KG) R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [160048 2014-08-27] (Avira Operations GmbH & Co. KG) R2 avmike; C:\Program Files\FRITZ!Fernzugang\avmike.exe [337824 2012-11-28] (AVM Berlin) R2 certsrv; C:\Program Files\FRITZ!Fernzugang\certsrv.exe [143776 2012-11-28] (AVM Berlin) R2 Freemake Improver; C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [108032 2014-09-18] (Freemake) [File not signed] R2 hpHotkeyMonitor; C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\HpHotkeyMonitor.exe [293944 2011-03-21] (Hewlett-Packard Company) R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [339456 2010-11-16] () [File not signed] R2 iked; C:\Program Files\ShrewSoft\VPN Client\iked.exe [1127736 2013-07-01] () R2 ipsecd; C:\Program Files\ShrewSoft\VPN Client\ipsecd.exe [810808 2013-07-01] () S2 Mobile Partner. RunOuc; C:\Program Files (x86)\Mobile Partner\UpdateDog\ouc.exe [218624 2014-03-03] () [File not signed] R2 nwtsrv; C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe [191328 2013-06-10] (AVM Berlin) S3 OpenVPNService; C:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe [32568 2013-08-22] (The OpenVPN Project) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-07-08] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-05-27] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-09-30] (Avira Operations GmbH & Co. KG) R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [42040 2014-07-27] (Avira Operations GmbH & Co. KG) S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [256000 2014-03-03] (Huawei Technologies Co., Ltd.) R3 NWIM; C:\Windows\System32\DRIVERS\avmnwim.sys [412024 2011-07-05] (AVM Berlin) R3 SPUVCbv; C:\Windows\System32\Drivers\SPUVCbv_x64.sys [2611704 2011-01-12] (Sunplus Technology) ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-09-29 20:50 - 2014-09-29 20:41 - 02108928 _____ (Farbar) C:\Users\Mattes\Desktop\FRST64(4).exe 2014-09-29 20:41 - 2014-09-29 20:41 - 02108928 _____ (Farbar) C:\Users\Mattes\Downloads\FRST64(4).exe 2014-09-29 12:23 - 2014-09-29 12:23 - 00700448 _____ () C:\Windows\Minidump\092914-68827-01.dmp 2014-09-29 08:15 - 2014-09-29 21:08 - 00013932 _____ () C:\Users\Mattes\Desktop\FRST.txt 2014-09-29 08:14 - 2014-09-29 08:14 - 02108928 _____ (Farbar) C:\Users\Mattes\Downloads\FRST64(3).exe 2014-09-29 08:14 - 2014-09-29 08:14 - 02108928 _____ (Farbar) C:\Users\Mattes\Desktop\FRST64(3).exe 2014-09-29 08:12 - 2014-09-29 08:12 - 00854417 _____ () C:\Users\Mattes\Downloads\SecurityCheck.exe 2014-09-28 22:23 - 2014-09-28 22:23 - 02347384 _____ (ESET) C:\Users\Mattes\Downloads\esetsmartinstaller_enu(2).exe 2014-09-28 22:22 - 2014-09-28 22:22 - 00441592 _____ (Bleeping Computer, LLC) C:\Users\Mattes\Downloads\sc-cleaner(1).exe 2014-09-28 22:21 - 2014-09-28 22:21 - 00001801 _____ () C:\Users\Mattes\Desktop\JRT.txt 2014-09-28 22:19 - 2014-09-28 22:19 - 01699276 _____ (Thisisu) C:\Users\Mattes\Downloads\JRT(1).exe 2014-09-28 22:14 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll 2014-09-28 22:07 - 2014-09-28 22:07 - 01373475 _____ () C:\Users\Mattes\Downloads\AdwCleaner_3.310.exe 2014-09-28 21:22 - 2014-09-28 21:22 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Mattes\Downloads\mbam-setup-2.0.2.1012(1).exe 2014-09-28 09:58 - 2014-09-28 09:58 - 00000000 ___RD () C:\Program Files (x86)\Skype 2014-09-28 09:58 - 2014-09-28 09:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype 2014-09-25 03:02 - 2014-09-25 03:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight 2014-09-25 03:01 - 2014-09-25 03:01 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2014-09-25 03:01 - 2014-09-25 03:01 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight 2014-09-24 23:31 - 2014-09-24 23:31 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-09-24 22:29 - 2014-09-10 00:11 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2014-09-24 22:29 - 2014-09-09 23:47 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll 2014-09-24 22:26 - 2014-09-24 22:26 - 00001083 _____ () C:\Users\Public\Desktop\Audiograbber.lnk 2014-09-24 22:26 - 2014-09-24 22:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audiograbber 2014-09-24 22:26 - 2014-09-24 22:26 - 00000000 ____D () C:\Program Files (x86)\Audiograbber 2014-09-24 22:20 - 2014-09-24 22:21 - 00000000 ____D () C:\Users\Mattes\Documents\Freemake 2014-09-24 22:20 - 2014-09-24 22:21 - 00000000 ____D () C:\ProgramData\Freemake 2014-09-24 22:20 - 2014-09-24 22:20 - 00001280 _____ () C:\Users\Public\Desktop\Freemake Audio Converter.lnk 2014-09-24 22:20 - 2014-09-24 22:20 - 00000000 ____D () C:\Users\Mattes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Freemake 2014-09-24 22:20 - 2014-09-24 22:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Freemake 2014-09-24 22:20 - 2014-09-24 22:20 - 00000000 ____D () C:\Program Files (x86)\Freemake 2014-09-24 22:18 - 2014-09-24 22:19 - 01261672 _____ (Ellora Assets Corporation ) C:\Users\Mattes\Downloads\FreemakeAudioConverterSetup.exe 2014-09-14 17:30 - 2014-09-14 17:30 - 00700808 _____ () C:\Windows\Minidump\091414-48531-01.dmp 2014-09-13 11:20 - 2014-08-19 20:05 - 00374968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-09-13 11:20 - 2014-08-19 19:39 - 00327872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2014-09-13 11:20 - 2014-08-19 01:01 - 23591424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-09-13 11:20 - 2014-08-19 00:29 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-09-13 11:20 - 2014-08-19 00:29 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-09-13 11:20 - 2014-08-19 00:26 - 17455104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-09-13 11:20 - 2014-08-19 00:20 - 02793984 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-09-13 11:20 - 2014-08-19 00:19 - 05833728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-09-13 11:20 - 2014-08-19 00:15 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-09-13 11:20 - 2014-08-19 00:15 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-09-13 11:20 - 2014-08-19 00:14 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-09-13 11:20 - 2014-08-19 00:14 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-09-13 11:20 - 2014-08-19 00:08 - 04232704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-09-13 11:20 - 2014-08-19 00:08 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-09-13 11:20 - 2014-08-19 00:08 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-09-13 11:20 - 2014-08-19 00:05 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-09-13 11:20 - 2014-08-19 00:03 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-09-13 11:20 - 2014-08-19 00:03 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-09-13 11:20 - 2014-08-19 00:03 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-09-13 11:20 - 2014-08-18 23:57 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-09-13 11:20 - 2014-08-18 23:56 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-09-13 11:20 - 2014-08-18 23:51 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-09-13 11:20 - 2014-08-18 23:46 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-09-13 11:20 - 2014-08-18 23:45 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-09-13 11:20 - 2014-08-18 23:45 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-09-13 11:20 - 2014-08-18 23:44 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2014-09-13 11:20 - 2014-08-18 23:44 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-09-13 11:20 - 2014-08-18 23:42 - 02185728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-09-13 11:20 - 2014-08-18 23:40 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-09-13 11:20 - 2014-08-18 23:39 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-09-13 11:20 - 2014-08-18 23:39 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-09-13 11:20 - 2014-08-18 23:39 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-09-13 11:20 - 2014-08-18 23:38 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-09-13 11:20 - 2014-08-18 23:37 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-09-13 11:20 - 2014-08-18 23:36 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-09-13 11:20 - 2014-08-18 23:35 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-09-13 11:20 - 2014-08-18 23:27 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-09-13 11:20 - 2014-08-18 23:25 - 00727040 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-09-13 11:20 - 2014-08-18 23:25 - 00707072 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-09-13 11:20 - 2014-08-18 23:23 - 02104832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-09-13 11:20 - 2014-08-18 23:23 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2014-09-13 11:20 - 2014-08-18 23:22 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2014-09-13 11:20 - 2014-08-18 23:19 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-09-13 11:20 - 2014-08-18 23:17 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-09-13 11:20 - 2014-08-18 23:17 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-09-13 11:20 - 2014-08-18 23:16 - 13588480 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-09-13 11:20 - 2014-08-18 23:15 - 11769856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-09-13 11:20 - 2014-08-18 23:15 - 02310656 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-09-13 11:20 - 2014-08-18 23:09 - 00603136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-09-13 11:20 - 2014-08-18 23:08 - 02014208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-09-13 11:20 - 2014-08-18 23:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2014-09-13 11:20 - 2014-08-18 22:55 - 01447424 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-09-13 11:20 - 2014-08-18 22:46 - 01812992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-09-13 11:20 - 2014-08-18 22:38 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-09-13 11:20 - 2014-08-18 22:38 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-09-13 11:20 - 2014-08-18 22:36 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-09-13 11:09 - 2014-06-27 04:08 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll 2014-09-13 11:09 - 2014-06-27 03:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll 2014-09-12 00:23 - 2014-09-05 04:10 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-09-12 00:23 - 2014-09-05 04:05 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-09-12 00:23 - 2014-08-01 13:53 - 01031168 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll 2014-09-12 00:23 - 2014-08-01 13:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll 2014-09-12 00:23 - 2014-07-07 04:06 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2014-09-12 00:23 - 2014-07-07 04:06 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2014-09-12 00:23 - 2014-07-07 03:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll 2014-09-12 00:23 - 2014-07-07 03:40 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2014-09-12 00:23 - 2014-07-07 03:39 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2014-09-12 00:23 - 2014-06-24 05:29 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll 2014-09-12 00:23 - 2014-06-24 04:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll 2014-09-09 18:55 - 2014-09-09 18:55 - 02347384 _____ (ESET) C:\Users\Mattes\Downloads\esetsmartinstaller_enu(1).exe 2014-09-09 18:53 - 2014-09-28 22:23 - 00001802 _____ () C:\sc-cleaner.txt 2014-09-09 18:52 - 2014-09-09 18:52 - 00441592 _____ (Bleeping Computer, LLC) C:\Users\Mattes\Downloads\sc-cleaner.exe 2014-09-09 18:34 - 2014-09-09 18:34 - 01016261 _____ (Thisisu) C:\Users\Mattes\Downloads\JRT.exe 2014-09-09 17:34 - 2014-09-29 16:33 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-09-09 17:34 - 2014-09-28 21:22 - 00001062 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-09-09 17:34 - 2014-09-28 21:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-09-09 17:33 - 2014-09-28 21:22 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-09-09 17:33 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-09-09 17:32 - 2014-09-09 17:32 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Mattes\Downloads\mbam-setup-2.0.2.1012.exe 2014-09-06 00:49 - 2014-09-29 00:36 - 00000000 ____D () C:\Windows\rescache 2014-08-30 21:31 - 2014-08-23 04:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll 2014-08-30 21:31 - 2014-08-23 03:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll 2014-08-30 21:31 - 2014-08-23 02:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-08-30 21:25 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll 2014-08-30 21:25 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll 2014-08-30 21:25 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll 2014-08-30 21:25 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe 2014-08-30 21:25 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll 2014-08-30 21:25 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll 2014-08-30 21:25 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll 2014-08-30 21:25 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll 2014-08-30 21:25 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll 2014-08-30 21:25 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll 2014-08-30 21:25 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll 2014-08-30 21:25 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll 2014-08-30 21:25 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe 2014-08-30 21:25 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe ==================== One Month Modified Files and Folders ======= Code:
ATTFilter (If an entry is included in the fixlist, the file\folder will be moved.) 2014-09-29 21:08 - 2013-10-22 19:08 - 00000548 _____ () C:\Windows\Tasks\MATLAB R2013a Startup Accelerator.job 2014-09-29 21:08 - 2013-10-13 01:24 - 00000000 ____D () C:\FRST 2014-09-29 21:07 - 2013-10-12 22:45 - 00000000 ____D () C:\Users\Mattes\AppData\Roaming\Skype 2014-09-29 21:05 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-09-29 21:05 - 2009-07-14 06:51 - 00043687 _____ () C:\Windows\setupact.log 2014-09-29 21:04 - 2013-10-12 18:31 - 01514497 _____ () C:\Windows\WindowsUpdate.log 2014-09-29 21:01 - 2013-10-12 22:26 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-09-29 16:33 - 2013-10-22 19:26 - 00000000 ____D () C:\Users\Mattes\Documents\MATLAB 2014-09-29 14:20 - 2009-08-30 07:25 - 00703214 _____ () C:\Windows\system32\perfh007.dat 2014-09-29 14:20 - 2009-08-30 07:25 - 00150822 _____ () C:\Windows\system32\perfc007.dat 2014-09-29 14:20 - 2009-07-14 07:13 - 01629372 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-09-29 12:32 - 2009-07-14 06:45 - 00021680 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-09-29 12:32 - 2009-07-14 06:45 - 00021680 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-09-29 12:23 - 2014-03-12 12:51 - 00000000 ____D () C:\Windows\Minidump 2014-09-29 12:22 - 2013-10-12 19:15 - 00448468 _____ () C:\Windows\PFRO.log 2014-09-28 22:16 - 2009-07-14 09:46 - 00000000 ____D () C:\Windows\CSC 2014-09-28 22:16 - 2009-07-14 06:45 - 00000000 ____D () C:\Windows\Setup 2014-09-28 22:15 - 2013-10-13 00:07 - 00000000 ____D () C:\AdwCleaner 2014-09-28 09:58 - 2013-12-02 19:26 - 00002517 _____ () C:\Users\Public\Desktop\Skype.lnk 2014-09-28 09:58 - 2013-10-12 22:45 - 00000000 ____D () C:\ProgramData\Skype 2014-09-28 09:53 - 2013-10-13 14:49 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2014-09-25 23:04 - 2013-10-12 22:26 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-09-25 23:03 - 2013-10-12 22:26 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-09-25 23:03 - 2013-10-12 22:26 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-09-25 20:07 - 2013-10-22 19:44 - 00000000 ____D () C:\Users\Mattes\AppData\Roaming\vlc 2014-09-19 03:01 - 2013-11-06 22:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013 2014-09-19 03:01 - 2013-10-22 19:43 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-09-15 09:06 - 2013-10-12 19:42 - 00278152 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe 2014-09-13 13:03 - 2014-08-18 16:52 - 00000000 ____D () C:\ProgramData\Package Cache 2014-09-13 13:02 - 2014-08-18 16:53 - 00001097 _____ () C:\Users\Public\Desktop\Avira.lnk 2014-09-13 13:02 - 2013-10-13 14:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira 2014-09-13 13:02 - 2013-10-13 14:44 - 00000000 ____D () C:\Program Files (x86)\Avira 2014-09-13 11:30 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF 2014-09-13 11:19 - 2013-10-12 18:59 - 01603652 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI 2014-09-13 11:18 - 2013-10-12 20:30 - 00000000 ____D () C:\Windows\system32\MRT 2014-09-13 11:10 - 2013-10-12 20:30 - 101694776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-09-13 11:09 - 2014-05-07 03:15 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-09-13 11:03 - 2013-10-12 18:49 - 00000000 ____D () C:\Users\Mattes 2014-09-13 11:02 - 2014-03-03 16:48 - 00000000 ____D () C:\Program Files (x86)\Mobile Partner 2014-09-13 11:02 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration 2014-09-09 17:34 - 2013-10-12 23:50 - 00000000 ____D () C:\Users\Mattes\AppData\Roaming\Malwarebytes 2014-09-09 17:33 - 2013-10-12 23:50 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-09-09 17:33 - 2013-10-12 23:50 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware 2014-09-06 00:12 - 2009-07-14 06:45 - 00431712 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-08-31 18:10 - 2013-10-12 19:06 - 00246662 _____ () C:\Windows\DPINST.LOG 2014-08-31 18:07 - 2014-04-22 15:17 - 00001986 _____ () C:\Users\Public\Desktop\Sony PC Companion 2.1.lnk 2014-08-31 18:07 - 2014-04-22 15:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sony 2014-08-31 18:07 - 2013-10-12 19:00 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information 2014-08-31 13:52 - 2013-10-22 20:55 - 00000000 ____D () C:\Users\Mattes\Documents\Outlook-Dateien Some content of TEMP: ==================== C:\Users\Mattes\AppData\Local\Temp\avgnt.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-09-29 00:28 ==================== End Of Log ============================ |