Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: Bundestrojaner in neuer Form eingefangen

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.

Antwort
Alt 27.10.2014, 14:40   #1
mayer
 
Bundestrojaner in neuer Form eingefangen - Standard

Bundestrojaner in neuer Form eingefangen



Hallo Trojaner-Spezialisten
ich benötigte Eure geschätzte Hilfe, denn ich habe mir irgendwie den neuen "Bundestrojaner" eingefangen.

Neu, weil alte Reparaturmaßnahmen wie Starten im abgesicherten Modus, Löschen der neuen exe.-Dateien und Einsatz des Windows Unlockers nicht greifen. Abgesicherter Modus funktioniert nicht, System startet jedes Mal gleich wieder neu. Zudem sind alle Wiederherstellungspunkte anscheinend gelöscht. Da haben diese miesen Abzocker volle Arbeit geleistet.

Habt Ihr Trojaner-Spezialisten schon ein "Gegengift" entwickelt? Bitte um Hilfe, insbesondere um überhaupt wieder in den PC zu kommen. Bei weiteren Maßnahmen mit Maybytes, Adaware etc. bin ich dann wieder etwas fitter (was mich nicht davor geschützt hat, mir dieses neue Teil einzufangen.

Infektionszeit 27.10.2014 ca. 10-12 Uhr
Zudem hatte ich vom 24.-27.10. einen Virus namens BOO/cidox.B, den ich dann mit TDSS-Killer entfernt habe.

Zwecks Bundestrojaner habe mit FRST ein Log erstellt:

Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-11-2013 (ATTENTION: ====> FRST version is 337 days old and could be outdated)
Ran by SYSTEM on MININT-7AM5CBC on 27-10-2014 14:51:06
Running from J:\
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Recovery

The current controlset is ControlSet002
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11545192 2010-11-02] (Realtek Semiconductor)
HKLM\...\Run: [AtherosBtStack] - C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [613536 2010-10-27] (Atheros Communications)
HKLM\...\Run: [AthBtTray] - C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [379040 2010-10-27] (Atheros Commnucations)
HKLM\...\Run: [Acronis Scheduler2 Service] - C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [377640 2009-05-15] (Acronis)
HKLM\...\Run: [SpywareTerminatorShield] - C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe [2774936 2014-05-13] (Crawler.com)
HKLM\...\Run: [SpywareTerminatorUpdater] - C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe [3681688 2014-05-13] (Crawler.com)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [ISUSScheduler] - C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe [69632 2004-04-13] (InstallShield Software Corporation)
HKLM-x32\...\Run: [WinampAgent] - C:\Program Files (x86)\Winamp\winampa.exe [74752 2011-12-09] (Nullsoft, Inc.)
HKLM-x32\...\Run: [TrueImageMonitor.exe] - C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe [4393112 2009-05-15] (Acronis)
HKLM-x32\...\Run: [AcronisTimounterMonitor] - C:\Program Files (x86)\Acronis\TrueImageHome\TimounterMonitor.exe [962640 2009-05-15] (Acronis)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642808 2012-12-19] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [162856 2013-06-10] (Geek Software GmbH)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [703736 2014-10-01] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] - C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Avira Systray] - C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [165168 2014-09-23] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation)
HKU\michl\...\Run: [ISUSPM Startup] - C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe [196608 2004-04-17] (InstallShield Software Corporation)
HKU\michl\...\Run: [SpybotSD TeaTimer] - C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2260480 2009-03-05] (Safer-Networking Ltd.)
HKU\michl\...\Run: [HydraVisionDesktopManager] - C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe [393216 2011-07-28] (AMD)
HKU\michl\...\Run: [rfxsrvtray] - "d:\Radio Streams\Tobit Radio.fx\Client\rfx-tray.exe"
HKU\michl\...\Run: [AdobeBridge] - [x]
HKU\michl\...\Run: [CCleaner Monitoring] - C:\Program Files\CCleaner\CCleaner64.exe [6501656 2014-10-23] (Piriform Ltd)
Startup: C:\Users\michl\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\program.lnk
ShortcutTarget: program.lnk -> C:\PROGRA~3\E9DDD8AA.cpp (Sun Microsystems, Inc.)
Startup: C:\Users\michl\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Officejet 4620 series.lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Officejet 4620 series.lnk -> C:\Program Files\HP\HP Officejet 4620 series\bin\HPStatusBL.dll (Hewlett-Packard Co.)

==================== Services (Whitelisted) =================

S2 ADExchange; C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe [43624 2012-08-14] (ArcSoft, Inc.)
S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-10-01] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-10-01] (Avira Operations GmbH & Co. KG)
S2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [160560 2014-09-23] (Avira Operations GmbH & Co. KG)
S2 ClickToRunSvc; C:\PROGRAM FILES\MICROSOFT OFFICE 15\CLIENTX64\OFFICECLICKTORUN.EXE [2436280 2014-09-25] (Microsoft Corporation)
S2 PSI_SVC_2_x64; c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe [337776 2014-04-30] (arvato digital services llc)
S3 SandraAgentSrv; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2013.SP6\RpcAgentSrv.exe [71832 2008-10-02] (SiSoftware)
S2 ST2012_Svc; C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe [1146304 2014-05-13] (Crawler.com)
S2 Winmgmt; C:\ProgramData\AA8DDD9E.dot [332800 2014-10-27] ()
S2 Radio.fx; d:\Radio Streams\Tobit Radio.fx\Server\rfx-server.exe [x]

==================== Drivers (Whitelisted) ====================

S3 Apowersoft_AudioDevice; C:\Windows\System32\drivers\Apowersoft_AudioDevice.sys [31920 2013-06-01] (Wondershare)
S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-01] (Avira Operations GmbH & Co. KG)
S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-01] (Avira Operations GmbH & Co. KG)
S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-05-27] (Avira Operations GmbH & Co. KG)
S3 LGDDCDevice; C:\Windows\SysWow64\LGI2CDriver.sys [16384 2010-08-04] (LG Soft India)
S3 LGII2CDevice; C:\Windows\SysWow64\LGPII2CDriver.sys [19968 2011-02-11] ()
S2 sp_rsdrv2; C:\Windows\System32\DRIVERS\stflt.sys [51496 2013-02-04] (Windows (R) Win 7 DDK provider)
S0 tdrpman228; C:\Windows\System32\DRIVERS\tdrpm228.sys [1462304 2012-01-18] (Acronis)
S3 SANDRA; \??\C:\PROGRAM FILES\SISOFTWARE\SISOFTWARE SANDRA LITE 2013.SP4\WNT500X64\Sandra.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-10-27 14:50 - 2014-10-27 14:50 - 00000000 ____D C:\FRST
2014-10-27 12:10 - 2014-10-27 14:43 - 00000840 _____ C:\Windows\setupact.log
2014-10-27 12:10 - 2014-10-27 12:10 - 00000000 _____ C:\Windows\setuperr.log
2014-10-27 11:48 - 2014-10-27 11:48 - 00208896 _____ (Sun Microsystems, Inc.) C:\ProgramData\E9DDD8AA.cpp
2014-10-27 11:17 - 2014-10-27 11:17 - 00000000 ____D C:\Users\michl\AppData\Local\{0D64FD04-F4DA-4F52-92B3-2CB3E74AA9C2}
2014-10-27 01:05 - 2014-10-27 01:05 - 00332800 ____T C:\ProgramData\AA8DDD9E.dot
2014-10-26 22:56 - 2014-10-26 22:56 - 04974864 _____ (Piriform Ltd) C:\Users\michl\Downloads\ccsetup419.exe
2014-10-26 22:51 - 2014-10-26 22:51 - 00000000 ____D C:\TDSSKiller_Quarantine
2014-10-26 22:39 - 2014-10-26 22:39 - 00000593 _____ C:\Users\michl\Desktop\PC-Notfallklinik • Virus BOO-Cidox.B.website
2014-10-26 18:36 - 2014-07-10 12:38 - 04181856 _____ (Kaspersky Lab ZAO) C:\Users\michl\Downloads\TDSSKiller.exe
2014-10-26 18:33 - 2014-10-26 18:34 - 04161313 _____ C:\Users\michl\Downloads\tdsskiller.zip
2014-10-26 13:48 - 2014-10-26 13:48 - 00000000 ____D C:\Users\michl\AppData\Local\{E5D20496-6275-4418-A52F-470413C61203}
2014-10-26 01:06 - 2014-10-26 22:52 - 00000000 ___HD C:\Users\michl\AppData\Roaming\1A828502
2014-10-25 11:59 - 2014-10-25 12:00 - 00000000 ____D C:\Users\michl\AppData\Local\{028D5695-5ED2-430D-9F60-8B581DA6C9EB}
2014-10-24 23:39 - 2014-10-24 23:39 - 00000419 _____ C:\Users\michl\Desktop\Wie verwende ich das Avira Rescue System.website
2014-10-24 21:35 - 2014-10-24 21:35 - 00000000 ____D C:\Users\michl\AppData\Local\{BABB6C3B-26D6-4191-BC15-1EEE451F1DA2}
2014-10-24 09:16 - 2014-10-24 09:16 - 00000000 ____D C:\Users\michl\AppData\Local\{A11D2BD3-0A90-4F19-9045-B8F22017233A}
2014-10-23 21:08 - 2014-10-23 21:09 - 00000000 ____D C:\Users\michl\AppData\Local\{1B3EC223-131F-4F84-8B41-74792648F5D1}
2014-10-23 09:08 - 2014-10-23 09:08 - 00000000 ____D C:\Users\michl\AppData\Local\{0EDC8143-207C-4048-B7B4-1E1E5A2246F8}
2014-10-22 13:45 - 2014-10-22 13:45 - 00000000 ____D C:\Users\michl\AppData\Local\{C9408D38-4DC0-4441-8DE1-6B3031363FF4}
2014-10-21 19:35 - 2014-10-21 19:35 - 00000000 ____D C:\Users\michl\AppData\Local\{8D4BC65C-2277-4196-B6FD-E40853D133A1}
2014-10-21 06:52 - 2014-10-21 06:52 - 00000000 ____D C:\Users\michl\AppData\Local\{6AB32BAE-7B3E-4E76-B78E-455E97D8973B}
2014-10-20 16:44 - 2014-10-20 16:44 - 00000435 _____ C:\Users\michl\Desktop\Paper Cutout Vectors, Photos and PSD files  Free Download.website
2014-10-20 11:33 - 2014-10-20 11:34 - 00000000 ____D C:\Users\michl\AppData\Local\{AE9085D3-17B8-488F-B6BF-E7109C4278F1}
2014-10-19 23:33 - 2014-10-19 23:33 - 00000000 ____D C:\Users\michl\AppData\Local\{AF6F6B46-A921-452D-852C-E4436C77120D}
2014-10-19 11:32 - 2014-10-19 11:32 - 00000000 ____D C:\Users\michl\AppData\Local\{A659E336-53F7-45A1-891C-B9ED3F31EFA7}
2014-10-18 16:29 - 2014-10-18 16:29 - 00000000 ____D C:\Users\michl\AppData\Local\{686A0D5E-42D4-4D4E-AC74-B4ED210205B5}
2014-10-18 01:42 - 2014-10-18 01:43 - 00000000 ____D C:\Users\michl\AppData\Local\{DB3D0EFA-4ADB-4F06-AA23-5763E4B99C06}
2014-10-17 13:05 - 2014-10-17 13:05 - 00000000 ____D C:\Users\michl\AppData\Local\{89B744C7-FD8D-4372-B71D-A2F6DC5085AF}
2014-10-17 01:04 - 2014-10-17 01:04 - 00000000 ____D C:\Users\michl\AppData\Local\{078C211E-18D0-43F8-BEFA-83401FF48F79}
2014-10-16 13:00 - 2014-10-16 13:01 - 00000000 ____D C:\Users\michl\AppData\Local\{BAEA00D7-0493-4E8B-9A2A-8CEB2F868687}
2014-10-16 00:02 - 2014-10-16 00:03 - 00000000 ____D C:\Users\michl\AppData\Local\{28A0704E-D785-4CEE-8973-80E8C83EE2D6}
2014-10-15 22:49 - 2014-10-15 22:49 - 00319912 _____ (Oracle Corporation) C:\Windows\System32\javaws.exe
2014-10-15 22:49 - 2014-10-15 22:49 - 00189352 _____ (Oracle Corporation) C:\Windows\System32\javaw.exe
2014-10-15 22:49 - 2014-10-15 22:49 - 00189352 _____ (Oracle Corporation) C:\Windows\System32\java.exe
2014-10-15 22:49 - 2014-10-15 22:49 - 00111016 _____ (Oracle Corporation) C:\Windows\System32\WindowsAccessBridge-64.dll
2014-10-15 22:30 - 2014-10-10 03:05 - 00507392 _____ (Microsoft Corporation) C:\Windows\System32\aepdu.dll
2014-10-15 22:30 - 2014-10-10 03:05 - 00276480 _____ (Microsoft Corporation) C:\Windows\System32\generaltel.dll
2014-10-15 22:30 - 2014-10-10 03:00 - 00424448 _____ (Microsoft Corporation) C:\Windows\System32\aeinv.dll
2014-10-15 22:30 - 2014-10-07 03:54 - 00378552 _____ (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2014-10-15 22:30 - 2014-10-07 03:04 - 00331448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-10-15 22:30 - 2014-09-29 01:58 - 03198976 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys
2014-10-15 22:30 - 2014-09-25 23:50 - 13619200 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2014-10-15 22:30 - 2014-09-25 23:46 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-10-15 22:30 - 2014-09-25 23:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-10-15 22:30 - 2014-09-25 23:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-10-15 22:30 - 2014-09-25 23:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-10-15 22:30 - 2014-09-25 23:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-10-15 22:30 - 2014-09-25 23:31 - 02108416 _____ (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2014-10-15 22:30 - 2014-09-19 03:25 - 23631360 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2014-10-15 22:30 - 2014-09-19 02:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2014-10-15 22:30 - 2014-09-19 02:55 - 00004096 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollectorres.dll
2014-10-15 22:30 - 2014-09-19 02:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-10-15 22:30 - 2014-09-19 02:41 - 02796032 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2014-10-15 22:30 - 2014-09-19 02:40 - 00547328 _____ (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2014-10-15 22:30 - 2014-09-19 02:40 - 00066048 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2014-10-15 22:30 - 2014-09-19 02:39 - 00048640 _____ (Microsoft Corporation) C:\Windows\System32\ieetwproxystub.dll
2014-10-15 22:30 - 2014-09-19 02:38 - 00083968 _____ (Microsoft Corporation) C:\Windows\System32\MshtmlDac.dll
2014-10-15 22:30 - 2014-09-19 02:36 - 05829632 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2014-10-15 22:30 - 2014-09-19 02:31 - 00051200 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2014-10-15 22:30 - 2014-09-19 02:30 - 00033792 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2014-10-15 22:30 - 2014-09-19 02:27 - 00595968 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2014-10-15 22:30 - 2014-09-19 02:26 - 00139264 _____ (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2014-10-15 22:30 - 2014-09-19 02:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-10-15 22:30 - 2014-09-19 02:25 - 00758272 _____ (Microsoft Corporation) C:\Windows\System32\jscript9diag.dll
2014-10-15 22:30 - 2014-09-19 02:25 - 00111616 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollector.exe
2014-10-15 22:30 - 2014-09-19 02:18 - 00940032 _____ (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2014-10-15 22:30 - 2014-09-19 02:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-10-15 22:30 - 2014-09-19 02:14 - 00446464 _____ (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2014-10-15 22:30 - 2014-09-19 02:06 - 00072704 _____ (Microsoft Corporation) C:\Windows\System32\JavaScriptCollectionAgent.dll
2014-10-15 22:30 - 2014-09-19 02:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-10-15 22:30 - 2014-09-19 02:01 - 00195584 _____ (Microsoft Corporation) C:\Windows\System32\msrating.dll
2014-10-15 22:30 - 2014-09-19 02:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-10-15 22:30 - 2014-09-19 02:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-10-15 22:30 - 2014-09-19 02:00 - 00085504 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2014-10-15 22:30 - 2014-09-19 01:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-10-15 22:30 - 2014-09-19 01:58 - 00289280 _____ (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2014-10-15 22:30 - 2014-09-19 01:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-10-15 22:30 - 2014-09-19 01:54 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-10-15 22:30 - 2014-09-19 01:53 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-10-15 22:30 - 2014-09-19 01:51 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-10-15 22:30 - 2014-09-19 01:50 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-10-15 22:30 - 2014-09-19 01:49 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-10-15 22:30 - 2014-09-19 01:42 - 00731136 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2014-10-15 22:30 - 2014-09-19 01:42 - 00710656 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2014-10-15 22:30 - 2014-09-19 01:40 - 01249280 _____ (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll
2014-10-15 22:30 - 2014-09-19 01:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-10-15 22:30 - 2014-09-19 01:33 - 02309632 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2014-10-15 22:30 - 2014-09-19 01:32 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-10-15 22:30 - 2014-09-19 01:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-10-15 22:30 - 2014-09-19 01:18 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-10-15 22:30 - 2014-09-19 01:14 - 01447936 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2014-10-15 22:30 - 2014-09-19 00:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-10-15 22:30 - 2014-09-19 00:59 - 00775168 _____ (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2014-10-15 22:30 - 2014-09-19 00:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-10-15 22:30 - 2014-09-19 00:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-10-15 22:30 - 2014-06-18 23:23 - 01943696 _____ (Microsoft Corporation) C:\Windows\System32\dfshim.dll
2014-10-15 22:30 - 2014-06-18 23:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfshim.dll
2014-10-15 22:30 - 2014-06-18 23:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscorier.dll
2014-10-15 22:30 - 2014-06-18 23:23 - 00156312 _____ (Microsoft Corporation) C:\Windows\System32\mscorier.dll
2014-10-15 22:30 - 2014-06-18 23:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscories.dll
2014-10-15 22:30 - 2014-06-18 23:23 - 00073880 _____ (Microsoft Corporation) C:\Windows\System32\mscories.dll
2014-10-15 22:28 - 2014-09-18 03:00 - 03241472 _____ (Microsoft Corporation) C:\Windows\System32\msi.dll
2014-10-15 22:28 - 2014-09-18 02:32 - 02363904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-10-15 22:28 - 2014-09-13 02:58 - 00077312 _____ (Microsoft Corporation) C:\Windows\System32\packager.dll
2014-10-15 22:28 - 2014-09-13 02:40 - 00067072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2014-10-15 22:28 - 2014-09-04 06:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\System32\rastls.dll
2014-10-15 22:28 - 2014-09-04 06:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll
2014-10-15 22:28 - 2014-08-29 03:07 - 05780480 _____ (Microsoft Corporation) C:\Windows\System32\mstscax.dll
2014-10-15 22:28 - 2014-08-29 03:07 - 03179520 _____ (Microsoft Corporation) C:\Windows\System32\rdpcorets.dll
2014-10-15 22:28 - 2014-08-29 03:07 - 00322560 _____ (Microsoft Corporation) C:\Windows\System32\aaclient.dll
2014-10-15 22:28 - 2014-08-29 03:07 - 00044032 _____ (Microsoft Corporation) C:\Windows\System32\tsgqec.dll
2014-10-15 22:28 - 2014-08-29 03:06 - 01125888 _____ (Microsoft Corporation) C:\Windows\System32\mstsc.exe
2014-10-15 22:28 - 2014-08-29 02:44 - 04922368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-10-15 22:28 - 2014-08-29 02:44 - 01050112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2014-10-15 22:28 - 2014-08-29 02:44 - 00269312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2014-10-15 22:28 - 2014-08-29 02:44 - 00037376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2014-10-15 22:28 - 2014-07-17 03:07 - 00681984 _____ (Microsoft Corporation) C:\Windows\System32\termsrv.dll
2014-10-15 22:28 - 2014-07-17 03:07 - 00455168 _____ (Microsoft Corporation) C:\Windows\System32\winlogon.exe
2014-10-15 22:28 - 2014-07-17 03:07 - 00235520 _____ (Microsoft Corporation) C:\Windows\System32\winsta.dll
2014-10-15 22:28 - 2014-07-17 03:07 - 00150528 _____ (Microsoft Corporation) C:\Windows\System32\rdpcorekmts.dll
2014-10-15 22:28 - 2014-07-17 03:07 - 00086528 _____ (Microsoft Corporation) C:\Windows\System32\TSpkg.dll
2014-10-15 22:28 - 2014-07-17 03:07 - 00022016 _____ (Microsoft Corporation) C:\Windows\System32\credssp.dll
2014-10-15 22:28 - 2014-07-17 02:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winsta.dll
2014-10-15 22:28 - 2014-07-17 02:39 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-10-15 22:28 - 2014-07-17 02:39 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-10-15 22:28 - 2014-07-17 02:21 - 00212480 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\rdpwd.sys
2014-10-15 22:28 - 2014-07-17 02:21 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tssecsrv.sys
2014-10-15 11:54 - 2014-10-15 11:54 - 00000000 ____D C:\Users\michl\AppData\Local\{62161E35-5DC5-4575-B160-AD89DAC8D8A4}
2014-10-14 17:59 - 2014-10-14 17:59 - 00000515 _____ C:\Users\michl\Desktop\The Artist Website Template  WIX.website
2014-10-14 15:05 - 2014-10-14 15:05 - 00000000 ____D C:\Users\michl\AppData\Local\{DC9B42E5-77D0-41B6-A6DD-F835571B279C}
2014-10-14 03:04 - 2014-10-14 03:05 - 00000000 ____D C:\Users\michl\AppData\Local\{D78B6E71-6DC8-407A-8D53-351FF0BD84B6}
2014-10-13 11:41 - 2014-10-13 11:41 - 00000000 ____D C:\Users\michl\AppData\Local\{4C26007E-A97C-4BAD-9773-DD6D6F1E7006}
2014-10-12 23:08 - 2014-10-12 23:08 - 00000000 ____D C:\Users\michl\AppData\Local\{FFF8E011-33E3-4902-BCBC-9D9851714F07}
2014-10-12 11:03 - 2014-10-12 11:03 - 00000000 ____D C:\Users\michl\AppData\Local\{9DE33F2C-6968-421C-ACDB-D051B176E009}
2014-10-11 22:57 - 2014-10-11 22:57 - 00000000 ____D C:\Users\michl\AppData\Local\{DA5FC6E2-1640-4A40-8667-B6E23234C0EA}
2014-10-11 10:22 - 2014-10-11 10:23 - 00000000 ____D C:\Users\michl\AppData\Local\{1156B1E8-48A9-46A4-AE60-1F811E4749EF}
2014-10-10 12:04 - 2014-10-10 12:04 - 00000000 ____D C:\Users\michl\AppData\Local\{D1E70BD4-BB8E-4E83-BD85-91AEE44EE666}
2014-10-09 23:28 - 2014-10-09 23:28 - 00000000 ____D C:\Users\michl\AppData\Local\{440EFE67-3A90-4274-9696-53824B076F19}
2014-10-09 11:27 - 2014-10-09 11:27 - 00000000 ____D C:\Users\michl\AppData\Local\{5F5546EE-B590-485E-9612-EBC357245E71}
2014-10-09 01:38 - 2014-10-09 01:38 - 00000537 _____ C:\Users\michl\Desktop\Venedig im Herbst Biennale und la dolce vita in der Lagunenstadt - TRAVELBOOK.de.website
2014-10-08 23:26 - 2014-10-08 23:26 - 00000000 ____D C:\Users\michl\AppData\Local\{827FFF84-208D-4443-A34B-FB15EDD8CFEE}
2014-10-08 20:58 - 2014-10-08 20:58 - 00000840 _____ C:\Users\michl\Desktop\Website des Jahres 2014.website
2014-10-08 11:25 - 2014-10-08 11:25 - 00000000 ____D C:\Users\michl\AppData\Local\{DF4ADCEB-D100-4F25-9BF9-DBEEDC26C4B6}
2014-10-07 23:25 - 2014-10-07 23:25 - 00000000 ____D C:\Users\michl\AppData\Local\{A39AD201-B863-4C2E-8FF2-269CC88AD3EF}
2014-10-07 11:24 - 2014-10-07 11:24 - 00000000 ____D C:\Users\michl\AppData\Local\{E0CE4AC2-33A4-41E6-AC31-E09F63A3EB7B}
2014-10-06 23:20 - 2014-10-06 23:21 - 00000000 ____D C:\Users\michl\AppData\Local\{5B5C60EF-E055-4606-8074-6A25C2DA4ACE}
2014-10-06 11:20 - 2014-10-06 11:20 - 00000000 ____D C:\Users\michl\AppData\Local\{946969FF-462B-42FA-A8B0-1F6BE651C554}
2014-10-05 22:58 - 2014-10-05 22:58 - 00000000 ____D C:\Users\michl\AppData\Local\{AAA7BB37-3FD0-4E22-959C-0B9A176FAC9A}
2014-10-05 10:47 - 2014-10-05 10:47 - 00000000 ____D C:\Users\michl\AppData\Local\{8D708B1A-1C45-429A-9DAC-98EB56BDE186}
2014-10-04 15:17 - 2014-10-04 15:17 - 00000000 ____D C:\Users\michl\AppData\Local\{3E301C69-E57A-47D8-A971-6442FB02B293}
2014-10-04 02:27 - 2014-10-16 01:30 - 00000478 _____ C:\Users\michl\Desktop\Download Facebook, Youtube Videos.website
2014-10-03 22:30 - 2014-10-03 22:30 - 00000000 ____D C:\Users\michl\AppData\Local\{DF7439C3-9574-44EF-9910-8F8B618B24E8}
2014-10-03 18:14 - 2014-10-04 03:27 - 00000494 _____ C:\Users\michl\Desktop\corel draw randanschnitt - Google-Suche.website
2014-10-03 14:18 - 2014-10-03 14:18 - 00001243 _____ C:\Users\michl\Desktop\TreeSize.lnk
2014-10-03 10:29 - 2014-10-03 10:29 - 00000000 ____D C:\Users\michl\AppData\Local\{18CBB337-E2BB-47EA-9D3F-802F1D854F7A}
2014-10-02 21:26 - 2014-10-02 21:27 - 00000000 ____D C:\Users\michl\AppData\Local\{0692D679-121E-45CB-A351-DA02B5042D8A}
2014-10-02 09:26 - 2014-10-02 09:26 - 00000000 ____D C:\Users\michl\AppData\Local\{88AF46EA-78EE-4C02-8F53-257C33141769}
2014-10-01 20:39 - 2014-10-01 20:39 - 00000000 ____D C:\Users\michl\AppData\Local\{8CA17510-4CDA-4DA4-B28C-E6CD7D5D6B86}
2014-10-01 06:48 - 2014-10-01 06:49 - 00000000 ____D C:\Users\michl\AppData\Local\{AB1C24AD-2A7D-46E9-9C2F-DF0AB75C14B5}
2014-10-01 06:33 - 2014-09-25 03:08 - 00371712 _____ (Microsoft Corporation) C:\Windows\System32\qdvd.dll
2014-10-01 06:33 - 2014-09-25 02:40 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2014-09-30 10:58 - 2014-09-30 10:58 - 00000000 ____D C:\Users\michl\AppData\Local\{2A012B63-C483-4781-8FB3-A9FB8AC2E374}
2014-09-29 22:57 - 2014-09-29 22:57 - 00000000 ____D C:\Users\michl\AppData\Local\{B34C39C2-A003-44B7-91A4-FAC2FCD494D0}
2014-09-29 10:56 - 2014-09-29 10:56 - 00000000 ____D C:\Users\michl\AppData\Local\{0821A00D-F454-473B-AD07-CA07ABE16B61}
2014-09-28 11:52 - 2014-09-28 11:52 - 00000000 ____D C:\Users\michl\AppData\Local\{5A59412C-DAE3-4631-8F26-BCB5D52F1D0D}
2014-09-27 23:25 - 2014-09-27 23:25 - 00000000 ____D C:\Users\michl\AppData\Local\{0EEA0510-AA4F-4064-9EA0-44B50C6FDAB6}
2014-09-27 11:06 - 2014-09-27 11:06 - 00000000 ____D C:\Users\michl\AppData\Local\{FCB3FCEC-F8BA-4E0C-BC84-9DD330DACDA6}
2014-09-27 02:46 - 2014-10-08 10:51 - 00000600 _____ C:\Users\michl\Desktop\Mercedes-Benz C 180 KOMPRESSOR T-MODELL - HSN-TSN 0999-AKO - Typklassen Autoversicherung - Autoampel.website

==================== One Month Modified Files and Folders =======

2014-10-27 14:50 - 2014-10-27 14:50 - 00000000 ____D C:\FRST
2014-10-27 14:43 - 2014-10-27 12:10 - 00000840 _____ C:\Windows\setupact.log
2014-10-27 14:43 - 2014-04-16 00:58 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-27 14:43 - 2013-02-04 02:04 - 00000000 ____D C:\ProgramData\Spyware Terminator
2014-10-27 14:43 - 2012-01-13 23:06 - 00000035 _____ C:\Users\Public\Documents\AtherosServiceConfig.ini
2014-10-27 14:43 - 2012-01-13 22:59 - 00000000 ____D C:\Users\michl\Documents\Bluetooth Folder
2014-10-27 14:43 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-10-27 12:10 - 2014-10-27 12:10 - 00000000 _____ C:\Windows\setuperr.log
2014-10-27 12:10 - 2014-02-16 13:46 - 01358009 _____ C:\Windows\WindowsUpdate.log
2014-10-27 12:10 - 2012-01-16 17:19 - 00093608 _____ C:\Users\michl\Desktop\offene2+++.txt
2014-10-27 11:48 - 2014-10-27 11:48 - 00208896 _____ (Sun Microsystems, Inc.) C:\ProgramData\E9DDD8AA.cpp
2014-10-27 11:32 - 2014-04-16 00:58 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-27 11:17 - 2014-10-27 11:17 - 00000000 ____D C:\Users\michl\AppData\Local\{0D64FD04-F4DA-4F52-92B3-2CB3E74AA9C2}
2014-10-27 11:16 - 2013-06-25 07:14 - 00000863 _____ C:\Users\michl\Desktop\Abendzeitung München.website
2014-10-27 11:02 - 2009-07-14 05:45 - 00028912 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-27 11:02 - 2009-07-14 05:45 - 00028912 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-27 11:01 - 2011-04-12 08:43 - 00717444 _____ C:\Windows\System32\perfh007.dat
2014-10-27 11:01 - 2011-04-12 08:43 - 00155004 _____ C:\Windows\System32\perfc007.dat
2014-10-27 11:01 - 2009-07-14 06:13 - 01656676 _____ C:\Windows\System32\PerfStringBackup.INI
2014-10-27 01:05 - 2014-10-27 01:05 - 00332800 ____T C:\ProgramData\AA8DDD9E.dot
2014-10-27 01:05 - 2013-03-08 17:28 - 00000000 ____D C:\Users\michl\AppData\Local\CrashDumps
2014-10-26 23:00 - 2013-02-04 02:25 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2014-10-26 22:56 - 2014-10-26 22:56 - 04974864 _____ (Piriform Ltd) C:\Users\michl\Downloads\ccsetup419.exe
2014-10-26 22:56 - 2013-02-04 01:55 - 00000822 _____ C:\Users\Public\Desktop\CCleaner.lnk
2014-10-26 22:56 - 2013-02-04 01:55 - 00000000 ____D C:\Program Files\CCleaner
2014-10-26 22:52 - 2014-10-26 01:06 - 00000000 ___HD C:\Users\michl\AppData\Roaming\1A828502
2014-10-26 22:51 - 2014-10-26 22:51 - 00000000 ____D C:\TDSSKiller_Quarantine
2014-10-26 22:39 - 2014-10-26 22:39 - 00000593 _____ C:\Users\michl\Desktop\PC-Notfallklinik • Virus BOO-Cidox.B.website
2014-10-26 18:34 - 2014-10-26 18:33 - 04161313 _____ C:\Users\michl\Downloads\tdsskiller.zip
2014-10-26 13:48 - 2014-10-26 13:48 - 00000000 ____D C:\Users\michl\AppData\Local\{E5D20496-6275-4418-A52F-470413C61203}
2014-10-25 12:00 - 2014-10-25 11:59 - 00000000 ____D C:\Users\michl\AppData\Local\{028D5695-5ED2-430D-9F60-8B581DA6C9EB}
2014-10-25 12:00 - 2013-02-04 14:31 - 00000072 _____ C:\Users\Public\LMDebug.log
2014-10-24 23:58 - 2014-07-23 12:06 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\MBAMSwissArmy.sys
2014-10-24 23:39 - 2014-10-24 23:39 - 00000419 _____ C:\Users\michl\Desktop\Wie verwende ich das Avira Rescue System.website
2014-10-24 23:35 - 2013-05-16 22:37 - 00000000 ____D C:\Program Files\Microsoft Office 15
2014-10-24 23:28 - 2014-07-23 12:05 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-10-24 23:28 - 2013-02-04 02:01 - 00001066 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-10-24 23:16 - 2012-01-03 02:52 - 00000000 ____D C:\users\michl
2014-10-24 23:15 - 2014-05-22 22:36 - 00000000 ____D C:\ProgramData\Protexis64
2014-10-24 23:15 - 2013-06-17 06:57 - 00000000 ____D C:\Users\Public\Documents\NetObjects Fusion 12.0
2014-10-24 23:15 - 2012-01-18 15:55 - 00000000 ____D C:\Users\michl\AppData\Roaming\vlc
2014-10-24 23:14 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\registration
2014-10-24 21:35 - 2014-10-24 21:35 - 00000000 ____D C:\Users\michl\AppData\Local\{BABB6C3B-26D6-4191-BC15-1EEE451F1DA2}
2014-10-24 09:16 - 2014-10-24 09:16 - 00000000 ____D C:\Users\michl\AppData\Local\{A11D2BD3-0A90-4F19-9045-B8F22017233A}
2014-10-24 00:49 - 2013-02-07 14:09 - 00000493 _____ C:\Users\michl\Desktop\Wortschatz.website
2014-10-23 21:09 - 2014-10-23 21:08 - 00000000 ____D C:\Users\michl\AppData\Local\{1B3EC223-131F-4F84-8B41-74792648F5D1}
2014-10-23 20:04 - 2013-11-11 23:52 - 00000514 _____ C:\Users\michl\Desktop\Zattoo -webTV.website
2014-10-23 09:08 - 2014-10-23 09:08 - 00000000 ____D C:\Users\michl\AppData\Local\{0EDC8143-207C-4048-B7B4-1E1E5A2246F8}
2014-10-22 18:01 - 2013-05-22 23:24 - 00000000 ____D C:\Users\michl\Documents\Benutzerdefinierte Office-Vorlagen
2014-10-22 13:58 - 2012-01-18 14:12 - 00000000 ____D C:\Users\michl\AppData\Roaming\FileZilla
2014-10-22 13:45 - 2014-10-22 13:45 - 00000000 ____D C:\Users\michl\AppData\Local\{C9408D38-4DC0-4441-8DE1-6B3031363FF4}
2014-10-21 22:17 - 2009-07-14 03:34 - 00000448 _____ C:\Windows\win.ini
2014-10-21 19:35 - 2014-10-21 19:35 - 00000000 ____D C:\Users\michl\AppData\Local\{8D4BC65C-2277-4196-B6FD-E40853D133A1}
2014-10-21 16:59 - 2009-07-14 06:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2014-10-21 06:52 - 2014-10-21 06:52 - 00000000 ____D C:\Users\michl\AppData\Local\{6AB32BAE-7B3E-4E76-B78E-455E97D8973B}
2014-10-20 16:56 - 2013-02-14 01:18 - 00427846 _____ C:\Windows\FontData.fdb
2014-10-20 16:44 - 2014-10-20 16:44 - 00000435 _____ C:\Users\michl\Desktop\Paper Cutout Vectors, Photos and PSD files  Free Download.website
2014-10-20 11:58 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2014-10-20 11:34 - 2014-10-20 11:33 - 00000000 ____D C:\Users\michl\AppData\Local\{AE9085D3-17B8-488F-B6BF-E7109C4278F1}
2014-10-20 00:00 - 2013-11-04 01:27 - 00000631 _____ C:\Users\michl\Desktop\LOTTO Bayern - Meine Daten.website
2014-10-19 23:33 - 2014-10-19 23:33 - 00000000 ____D C:\Users\michl\AppData\Local\{AF6F6B46-A921-452D-852C-E4436C77120D}
2014-10-19 21:27 - 2014-04-16 00:58 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-10-19 21:27 - 2014-04-16 00:58 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-10-19 11:32 - 2014-10-19 11:32 - 00000000 ____D C:\Users\michl\AppData\Local\{A659E336-53F7-45A1-891C-B9ED3F31EFA7}
2014-10-18 16:29 - 2014-10-18 16:29 - 00000000 ____D C:\Users\michl\AppData\Local\{686A0D5E-42D4-4D4E-AC74-B4ED210205B5}
2014-10-18 01:43 - 2014-10-18 01:42 - 00000000 ____D C:\Users\michl\AppData\Local\{DB3D0EFA-4ADB-4F06-AA23-5763E4B99C06}
2014-10-17 13:05 - 2014-10-17 13:05 - 00000000 ____D C:\Users\michl\AppData\Local\{89B744C7-FD8D-4372-B71D-A2F6DC5085AF}
2014-10-17 01:04 - 2014-10-17 01:04 - 00000000 ____D C:\Users\michl\AppData\Local\{078C211E-18D0-43F8-BEFA-83401FF48F79}
2014-10-16 13:01 - 2014-10-16 13:00 - 00000000 ____D C:\Users\michl\AppData\Local\{BAEA00D7-0493-4E8B-9A2A-8CEB2F868687}
2014-10-16 12:58 - 2009-07-14 05:45 - 07546560 _____ C:\Windows\System32\FNTCACHE.DAT
2014-10-16 02:08 - 2014-05-06 22:48 - 00000000 ___SD C:\Windows\System32\CompatTel
2014-10-16 02:02 - 2013-07-24 00:30 - 00000000 ____D C:\Windows\System32\MRT
2014-10-16 02:00 - 2013-02-05 19:19 - 103265616 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2014-10-16 01:30 - 2014-10-04 02:27 - 00000478 _____ C:\Users\michl\Desktop\Download Facebook, Youtube Videos.website
2014-10-16 00:03 - 2014-10-16 00:02 - 00000000 ____D C:\Users\michl\AppData\Local\{28A0704E-D785-4CEE-8973-80E8C83EE2D6}
2014-10-15 22:52 - 2013-10-22 01:07 - 00000000 ____D C:\ProgramData\Oracle
2014-10-15 22:51 - 2014-08-26 12:21 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-10-15 22:51 - 2013-07-03 09:18 - 00000000 ____D C:\Program Files (x86)\Java
2014-10-15 22:49 - 2014-10-15 22:49 - 00319912 _____ (Oracle Corporation) C:\Windows\System32\javaws.exe
2014-10-15 22:49 - 2014-10-15 22:49 - 00189352 _____ (Oracle Corporation) C:\Windows\System32\javaw.exe
2014-10-15 22:49 - 2014-10-15 22:49 - 00189352 _____ (Oracle Corporation) C:\Windows\System32\java.exe
2014-10-15 22:49 - 2014-10-15 22:49 - 00111016 _____ (Oracle Corporation) C:\Windows\System32\WindowsAccessBridge-64.dll
2014-10-15 22:49 - 2012-01-18 17:17 - 00000000 ____D C:\Program Files\Java
2014-10-15 11:54 - 2014-10-15 11:54 - 00000000 ____D C:\Users\michl\AppData\Local\{62161E35-5DC5-4575-B160-AD89DAC8D8A4}
2014-10-14 17:59 - 2014-10-14 17:59 - 00000515 _____ C:\Users\michl\Desktop\The Artist Website Template  WIX.website
2014-10-14 15:05 - 2014-10-14 15:05 - 00000000 ____D C:\Users\michl\AppData\Local\{DC9B42E5-77D0-41B6-A6DD-F835571B279C}
2014-10-14 13:09 - 2014-09-10 23:37 - 00001097 _____ C:\Users\Public\Desktop\Avira.lnk
2014-10-14 13:09 - 2014-06-22 19:52 - 00000000 ____D C:\Program Files (x86)\Avira
2014-10-14 13:09 - 2014-05-22 22:35 - 00000000 ____D C:\ProgramData\Package Cache
2014-10-14 03:05 - 2014-10-14 03:04 - 00000000 ____D C:\Users\michl\AppData\Local\{D78B6E71-6DC8-407A-8D53-351FF0BD84B6}
2014-10-13 23:27 - 2012-01-18 14:33 - 00000000 ____D C:\Users\michl\AppData\Roaming\Winamp
2014-10-13 11:41 - 2014-10-13 11:41 - 00000000 ____D C:\Users\michl\AppData\Local\{4C26007E-A97C-4BAD-9773-DD6D6F1E7006}
2014-10-12 23:08 - 2014-10-12 23:08 - 00000000 ____D C:\Users\michl\AppData\Local\{FFF8E011-33E3-4902-BCBC-9D9851714F07}
2014-10-12 11:03 - 2014-10-12 11:03 - 00000000 ____D C:\Users\michl\AppData\Local\{9DE33F2C-6968-421C-ACDB-D051B176E009}
2014-10-11 22:57 - 2014-10-11 22:57 - 00000000 ____D C:\Users\michl\AppData\Local\{DA5FC6E2-1640-4A40-8667-B6E23234C0EA}
2014-10-11 10:23 - 2014-10-11 10:22 - 00000000 ____D C:\Users\michl\AppData\Local\{1156B1E8-48A9-46A4-AE60-1F811E4749EF}
2014-10-10 12:04 - 2014-10-10 12:04 - 00000000 ____D C:\Users\michl\AppData\Local\{D1E70BD4-BB8E-4E83-BD85-91AEE44EE666}
2014-10-10 03:05 - 2014-10-15 22:30 - 00507392 _____ (Microsoft Corporation) C:\Windows\System32\aepdu.dll
2014-10-10 03:05 - 2014-10-15 22:30 - 00276480 _____ (Microsoft Corporation) C:\Windows\System32\generaltel.dll
2014-10-10 03:00 - 2014-10-15 22:30 - 00424448 _____ (Microsoft Corporation) C:\Windows\System32\aeinv.dll
2014-10-09 23:28 - 2014-10-09 23:28 - 00000000 ____D C:\Users\michl\AppData\Local\{440EFE67-3A90-4274-9696-53824B076F19}
2014-10-09 11:27 - 2014-10-09 11:27 - 00000000 ____D C:\Users\michl\AppData\Local\{5F5546EE-B590-485E-9612-EBC357245E71}
2014-10-09 01:38 - 2014-10-09 01:38 - 00000537 _____ C:\Users\michl\Desktop\Venedig im Herbst Biennale und la dolce vita in der Lagunenstadt - TRAVELBOOK.de.website
2014-10-08 23:26 - 2014-10-08 23:26 - 00000000 ____D C:\Users\michl\AppData\Local\{827FFF84-208D-4443-A34B-FB15EDD8CFEE}
2014-10-08 20:58 - 2014-10-08 20:58 - 00000840 _____ C:\Users\michl\Desktop\Website des Jahres 2014.website
2014-10-08 11:25 - 2014-10-08 11:25 - 00000000 ____D C:\Users\michl\AppData\Local\{DF4ADCEB-D100-4F25-9BF9-DBEEDC26C4B6}
2014-10-08 10:51 - 2014-09-27 02:46 - 00000600 _____ C:\Users\michl\Desktop\Mercedes-Benz C 180 KOMPRESSOR T-MODELL - HSN-TSN 0999-AKO - Typklassen Autoversicherung - Autoampel.website
2014-10-07 23:25 - 2014-10-07 23:25 - 00000000 ____D C:\Users\michl\AppData\Local\{A39AD201-B863-4C2E-8FF2-269CC88AD3EF}
2014-10-07 11:24 - 2014-10-07 11:24 - 00000000 ____D C:\Users\michl\AppData\Local\{E0CE4AC2-33A4-41E6-AC31-E09F63A3EB7B}
2014-10-07 03:54 - 2014-10-15 22:30 - 00378552 _____ (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2014-10-07 03:04 - 2014-10-15 22:30 - 00331448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-10-06 23:21 - 2014-10-06 23:20 - 00000000 ____D C:\Users\michl\AppData\Local\{5B5C60EF-E055-4606-8074-6A25C2DA4ACE}
2014-10-06 11:20 - 2014-10-06 11:20 - 00000000 ____D C:\Users\michl\AppData\Local\{946969FF-462B-42FA-A8B0-1F6BE651C554}
2014-10-05 22:58 - 2014-10-05 22:58 - 00000000 ____D C:\Users\michl\AppData\Local\{AAA7BB37-3FD0-4E22-959C-0B9A176FAC9A}
2014-10-05 10:47 - 2014-10-05 10:47 - 00000000 ____D C:\Users\michl\AppData\Local\{8D708B1A-1C45-429A-9DAC-98EB56BDE186}
2014-10-04 15:17 - 2014-10-04 15:17 - 00000000 ____D C:\Users\michl\AppData\Local\{3E301C69-E57A-47D8-A971-6442FB02B293}
2014-10-04 03:27 - 2014-10-03 18:14 - 00000494 _____ C:\Users\michl\Desktop\corel draw randanschnitt - Google-Suche.website
2014-10-03 22:30 - 2014-10-03 22:30 - 00000000 ____D C:\Users\michl\AppData\Local\{DF7439C3-9574-44EF-9910-8F8B618B24E8}
2014-10-03 16:45 - 2013-02-19 01:10 - 00000638 _____ C:\Users\michl\Desktop\Webmaster-Tools.website
2014-10-03 14:18 - 2014-10-03 14:18 - 00001243 _____ C:\Users\michl\Desktop\TreeSize.lnk
2014-10-03 14:14 - 2014-03-21 20:44 - 00000538 _____ C:\Users\michl\Desktop\Schoener-Fernsehen.website
2014-10-03 10:29 - 2014-10-03 10:29 - 00000000 ____D C:\Users\michl\AppData\Local\{18CBB337-E2BB-47EA-9D3F-802F1D854F7A}
2014-10-02 21:27 - 2014-10-02 21:26 - 00000000 ____D C:\Users\michl\AppData\Local\{0692D679-121E-45CB-A351-DA02B5042D8A}
2014-10-02 17:27 - 2014-08-24 17:11 - 00000559 _____ C:\Users\michl\Desktop\freisteller  clipping Magic +++++++
2014-10-02 14:53 - 2010-11-21 04:27 - 00278152 ____N (Microsoft Corporation) C:\Windows\System32\MpSigStub.exe
2014-10-02 09:26 - 2014-10-02 09:26 - 00000000 ____D C:\Users\michl\AppData\Local\{88AF46EA-78EE-4C02-8F53-257C33141769}
2014-10-01 20:39 - 2014-10-01 20:39 - 00000000 ____D C:\Users\michl\AppData\Local\{8CA17510-4CDA-4DA4-B28C-E6CD7D5D6B86}
2014-10-01 12:53 - 2014-06-22 19:52 - 00131608 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avipbb.sys
2014-10-01 12:53 - 2014-06-22 19:52 - 00119272 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avgntflt.sys
2014-10-01 12:53 - 2013-05-06 13:02 - 00043064 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avnetflt.sys
2014-10-01 12:18 - 2014-08-17 18:26 - 00000855 _____ C:\Users\michl\Desktop\Corel Praxis - Broschüren erstellen.website
2014-10-01 12:18 - 2014-07-02 02:38 - 00000476 _____ C:\Users\michl\Desktop\VITAL Print-Mediadaten der Zeitschrift VITAL - Brand Media.website
2014-10-01 10:22 - 2013-02-07 14:07 - 00000000 ____D C:\Users\michl\Desktop\grafik + webdesign + fusion
2014-10-01 10:21 - 2013-11-03 19:04 - 00000000 ____D C:\Users\michl\Desktop\wordpress infos++
2014-10-01 10:21 - 2013-02-07 14:07 - 00000000 ____D C:\Users\michl\Desktop\++ jetzt anschauen +++
2014-10-01 10:19 - 2014-08-17 12:54 - 00000000 ____D C:\Users\michl\Desktop\reise 2014
2014-10-01 10:19 - 2013-10-15 00:22 - 00000000 ____D C:\Users\michl\Desktop\wok + abnehmen
2014-10-01 10:11 - 2014-07-23 12:05 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbamchameleon.sys
2014-10-01 10:11 - 2014-07-23 12:05 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\mwac.sys
2014-10-01 10:11 - 2013-02-04 02:01 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2014-10-01 06:49 - 2014-10-01 06:48 - 00000000 ____D C:\Users\michl\AppData\Local\{AB1C24AD-2A7D-46E9-9C2F-DF0AB75C14B5}
2014-09-30 17:10 - 2013-02-07 14:08 - 00008654 _____ C:\Users\michl\Desktop\bayern fußball2.txt
2014-09-30 10:58 - 2014-09-30 10:58 - 00000000 ____D C:\Users\michl\AppData\Local\{2A012B63-C483-4781-8FB3-A9FB8AC2E374}
2014-09-29 23:14 - 2012-01-03 03:14 - 00801184 _____ C:\Users\michl\AppData\Local\GDIPFONTCACHEV1.DAT
2014-09-29 22:57 - 2014-09-29 22:57 - 00000000 ____D C:\Users\michl\AppData\Local\{B34C39C2-A003-44B7-91A4-FAC2FCD494D0}
2014-09-29 10:56 - 2014-09-29 10:56 - 00000000 ____D C:\Users\michl\AppData\Local\{0821A00D-F454-473B-AD07-CA07ABE16B61}
2014-09-29 01:58 - 2014-10-15 22:30 - 03198976 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys
2014-09-28 22:59 - 2013-07-31 16:41 - 00000808 _____ C:\Users\michl\Desktop\kölner EXPRESS.website
2014-09-28 11:52 - 2014-09-28 11:52 - 00000000 ____D C:\Users\michl\AppData\Local\{5A59412C-DAE3-4631-8F26-BCB5D52F1D0D}
2014-09-27 23:25 - 2014-09-27 23:25 - 00000000 ____D C:\Users\michl\AppData\Local\{0EEA0510-AA4F-4064-9EA0-44B50C6FDAB6}
2014-09-27 11:06 - 2014-09-27 11:06 - 00000000 ____D C:\Users\michl\AppData\Local\{FCB3FCEC-F8BA-4E0C-BC84-9DD330DACDA6}

Files to move or delete:
====================
C:\Users\michl\AppData\Roaming\Camdata.ini
C:\Users\michl\AppData\Roaming\CamLayout.ini
C:\Users\michl\AppData\Roaming\CamShapes.ini
C:\ProgramData\eqqol.pad
C:\ProgramData\rjoof.pad


Some content of TEMP:
====================
C:\Users\michl\AppData\Local\Temp\avgnt.exe
C:\Users\michl\AppData\Local\Temp\jhZT.dll


==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe
[2014-10-15 22:28] - [2014-07-17 03:07] - 0455168 ____A (Microsoft Corporation) 8CEBD9D0A0A879CDE9F36F4383B7CAEA

C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================


==================== BCD ================================

Windows-Start-Manager
---------------------
Bezeichner              {bootmgr}
device                  partition=D:
description             Windows Boot Manager
locale                  de-DE
inherit                 {globalsettings}
default                 {default}
resumeobject            {a0b40205-35aa-11e1-bfd2-db9403c27f7d}
displayorder            {default}
toolsdisplayorder       {memdiag}
timeout                 30

Windows-Startladeprogramm
-------------------------
Bezeichner              {default}
device                  partition=C:
path                    \Windows\system32\winload.exe
description             Windows 7
locale                  de-DE
inherit                 {bootloadersettings}
recoverysequence        {current}
recoveryenabled         Yes
osdevice                partition=C:
systemroot              \Windows
resumeobject            {a0b40205-35aa-11e1-bfd2-db9403c27f7d}
nx                      OptIn

Windows-Startladeprogramm
-------------------------
Bezeichner              {current}
device                  ramdisk=[C:]\Recovery\a0b40207-35aa-11e1-bfd2-db9403c27f7d\Winre.wim,{a0b40208-35aa-11e1-bfd2-db9403c27f7d}
path                    \windows\system32\winload.exe
description             Windows Recovery Environment
inherit                 {bootloadersettings}
osdevice                ramdisk=[C:]\Recovery\a0b40207-35aa-11e1-bfd2-db9403c27f7d\Winre.wim,{a0b40208-35aa-11e1-bfd2-db9403c27f7d}
systemroot              \windows
nx                      OptIn
winpe                   Yes

Wiederaufnahme aus dem Ruhezustand
----------------------------------
Bezeichner              {a0b40205-35aa-11e1-bfd2-db9403c27f7d}
device                  partition=C:
path                    \Windows\system32\winresume.exe
description             Windows Resume Application
locale                  de-DE
inherit                 {resumeloadersettings}
filedevice              partition=C:
filepath                \hiberfil.sys
debugoptionenabled      No

Windows-Speichertestprogramm
----------------------------
Bezeichner              {memdiag}
device                  partition=D:
path                    \boot\memtest.exe
description             Windows-Speicherdiagnose
locale                  de-DE
inherit                 {globalsettings}
badmemoryaccess         Yes

EMS-Einstellungen
-----------------
Bezeichner              {emssettings}
bootems                 Yes

Debuggereinstellungen
---------------------
Bezeichner              {dbgsettings}
debugtype               Serial
debugport               1
baudrate                115200

RAM-Defekte
-----------
Bezeichner              {badmemory}

Globale Einstellungen
---------------------
Bezeichner              {globalsettings}
inherit                 {dbgsettings}
                        {emssettings}
                        {badmemory}

Startladeprogramm-Einstellungen
-------------------------------
Bezeichner              {bootloadersettings}
inherit                 {globalsettings}
                        {hypervisorsettings}

Hypervisoreinstellungen
-------------------
Bezeichner              {hypervisorsettings}
hypervisordebugtype     Serial
hypervisordebugport     1
hypervisorbaudrate      115200

Einstellungen zur Ladeprogrammfortsetzung
-----------------------------------------
Bezeichner              {resumeloadersettings}
inherit                 {globalsettings}

Ger„teoptionen
--------------
Bezeichner              {a0b40208-35aa-11e1-bfd2-db9403c27f7d}
description             Ramdisk Options
ramdisksdidevice        partition=C:
ramdisksdipath          \Recovery\a0b40207-35aa-11e1-bfd2-db9403c27f7d\boot.sdi


==================== Memory info =========================== 

Percentage of memory in use: 7%
Total physical RAM: 16360.76 MB
Available physical RAM: 15159.6 MB
Total Pagefile: 16358.96 MB
Available Pagefile: 15168.01 MB
Total Virtual: 8192 MB
Available Virtual: 8191.87 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:74.43 GB) (Free:12.54 GB) NTFS
Drive d: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (Volume) (Fixed) (Total:69.14 GB) (Free:0.62 GB) NTFS
Drive f: (Geschäft) (Fixed) (Total:298.83 GB) (Free:26.41 GB) NTFS
Drive g: (sicherung) (Fixed) (Total:97.66 GB) (Free:16.15 GB) NTFS
Drive j: () (Removable) (Total:7.46 GB) (Free:7.46 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (Bilder) (Fixed) (Total:465.88 GB) (Free:14.53 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 932 GB) (Disk ID: B0400252)
Partition 1: (Active) - (Size=466 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=299 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=98 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=69 GB) - (Type=OF Extended)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 75 GB) (Disk ID: 25836908)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=74 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (Size: 7 GB) (Disk ID: 00000000)
Partition 1: (Not Active) - (Size=7 GB) - (Type=0B)


LastRegBack: 2014-10-20 11:51

==================== End Of Log ============================
         



Grüße Mayer

Alt 27.10.2014, 14:53   #2
schrauber
/// the machine
/// TB-Ausbilder
 

Bundestrojaner in neuer Form eingefangen - Standard

Bundestrojaner in neuer Form eingefangen



hi,

Drücke bitte die + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
ATTFilter
Startup: C:\Users\michl\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\program.lnk
ShortcutTarget: program.lnk -> C:\PROGRA~3\E9DDD8AA.cpp (Sun Microsystems, Inc.)
S2 Winmgmt; C:\ProgramData\AA8DDD9E.dot [332800 2014-10-27] ()
2014-10-27 11:48 - 2014-10-27 11:48 - 00208896 _____ (Sun Microsystems, Inc.) C:\ProgramData\E9DDD8AA.cpp
2014-10-27 11:17 - 2014-10-27 11:17 - 00000000 ____D C:\Users\michl\AppData\Local\{0D64FD04-F4DA-4F52-92B3-2CB3E74AA9C2}
C:\ProgramData\AA8DDD9E.dot
         
Speichere diese bitte als Fixlist.txt auf deinem USB Stick.
  • Starte deinen Rechner erneut in die Reparaturoptionen
  • Starte nun die FRST.exe erneut und klicke den Entfernen Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.
__________________

__________________

Alt 27.10.2014, 15:30   #3
mayer
 
Bundestrojaner in neuer Form eingefangen - Standard

Computer wieder offen...



Hallo

herzlichen Dank für den Code und die Hilfe. Der infizierte PC ist wieder frei und ich kann die üblichen Programme laufen lassen, wie z.B. Malwarebytes (hat einen Trojaner gefunden und zig Pub..dingens).

Anbei die Fixlog-Datei wie gewünscht:

Code:
ATTFilter
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 24-11-2013
Ran by SYSTEM at 2014-10-27 16:02:53 Run:1
Running from J:\
Boot Mode: Recovery
==============================================

Content of fixlist:
*****************
Startup: C:\Users\michl\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\program.lnk
ShortcutTarget: program.lnk -> C:\PROGRA~3\E9DDD8AA.cpp (Sun Microsystems, Inc.)
S2 Winmgmt; C:\ProgramData\AA8DDD9E.dot [332800 2014-10-27] ()
2014-10-27 11:48 - 2014-10-27 11:48 - 00208896 _____ (Sun Microsystems, Inc.) C:\ProgramData\E9DDD8AA.cpp
2014-10-27 11:17 - 2014-10-27 11:17 - 00000000 ____D C:\Users\michl\AppData\Local\{0D64FD04-F4DA-4F52-92B3-2CB3E74AA9C2}
C:\ProgramData\AA8DDD9E.dot
         
*****************

C:\Users\michl\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\program.lnk => Moved successfully.
C:\PROGRA~3\E9DDD8AA.cpp => Moved successfully.
Winmgmt => Service restored successfully.
"C:\ProgramData\E9DDD8AA.cpp" => File/Directory not found.
C:\Users\michl\AppData\Local\{0D64FD04-F4DA-4F52-92B3-2CB3E74AA9C2} => Moved successfully.
C:\ProgramData\AA8DDD9E.dot => Moved successfully.

==== End of Fixlog ====
         
DANKE fürs Entsperren
__________________

Alt 28.10.2014, 09:16   #4
schrauber
/// the machine
/// TB-Ausbilder
 

Bundestrojaner in neuer Form eingefangen - Standard

Bundestrojaner in neuer Form eingefangen



Nicht einfach irgendwas laufen lassen, wir sind noch nit fertig

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Antwort

Themen zu Bundestrojaner in neuer Form eingefangen
abgesicherter modus fährt automatisch herunter, antivir, avg, avira, bootmgr, bundestrojaner, ccsetup, desktop, explorer, explorer.exe, home, kaspersky, log, löschen, malwarebytes, microsoft, neue, officejet, opera, realtek, registry, server, services.exe, software, spyware, starten, svchost.exe, system, virus, wickel, windows



Ähnliche Themen: Bundestrojaner in neuer Form eingefangen


  1. neuer Bundestrojaner - abgesicherter Modus geht nicht
    Plagegeister aller Art und deren Bekämpfung - 07.01.2014 (6)
  2. Neuer bundestrojaner
    Plagegeister aller Art und deren Bekämpfung - 05.12.2013 (13)
  3. Bundestrojaner eingefangen
    Plagegeister aller Art und deren Bekämpfung - 09.09.2013 (10)
  4. Bundestrojaner eingefangen...
    Log-Analyse und Auswertung - 30.08.2013 (3)
  5. Unwissenheit Plagegeister eingefangen in Form von Spyhunter, ISPY, Deltasearch etc.. Wer weiß vielleicht auch noch mehr!
    Plagegeister aller Art und deren Bekämpfung - 14.07.2013 (26)
  6. Bundestrojaner eingefangen
    Log-Analyse und Auswertung - 21.06.2013 (11)
  7. Bundestrojaner eingefangen?
    Plagegeister aller Art und deren Bekämpfung - 01.05.2013 (11)
  8. Bundestrojaner eingefangen
    Plagegeister aller Art und deren Bekämpfung - 13.01.2013 (21)
  9. Bundestrojaner eingefangen?
    Plagegeister aller Art und deren Bekämpfung - 19.12.2012 (2)
  10. Bundestrojaner eingefangen :-(
    Plagegeister aller Art und deren Bekämpfung - 23.10.2012 (7)
  11. BUNDESTROJANER eingefangen! Was nun?
    Plagegeister aller Art und deren Bekämpfung - 22.08.2012 (9)
  12. Bundestrojaner eingefangen
    Log-Analyse und Auswertung - 16.07.2012 (1)
  13. Bundestrojaner eingefangen
    Log-Analyse und Auswertung - 13.07.2012 (9)
  14. Deutschlandflagge-Trojaner in ganz neuer Form
    Plagegeister aller Art und deren Bekämpfung - 09.04.2012 (31)
  15. Bundestrojaner eingefangen
    Log-Analyse und Auswertung - 13.03.2012 (11)
  16. Neuer fake Bundestrojaner 2.0
    Plagegeister aller Art und deren Bekämpfung - 02.12.2011 (3)
  17. Bundestrojaner eingefangen
    Log-Analyse und Auswertung - 28.08.2011 (4)

Zum Thema Bundestrojaner in neuer Form eingefangen - Hallo Trojaner-Spezialisten ich benötigte Eure geschätzte Hilfe, denn ich habe mir irgendwie den neuen "Bundestrojaner" eingefangen. Neu, weil alte Reparaturmaßnahmen wie Starten im abgesicherten Modus, Löschen der neuen exe.-Dateien und - Bundestrojaner in neuer Form eingefangen...
Archiv
Du betrachtest: Bundestrojaner in neuer Form eingefangen auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.