| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Ungewünschte Werbebanner FirefoxWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
01.03.2015, 15:52
| #1 |
 |  Ungewünschte Werbebanner Firefox Hallo, ich fürchte ich habe mir Malware eingefangen. Ich bekomme neuerdings Schmuddel-Werbung eingeblendet (Abnehmen in 2 Tagen..., Muskeln, Software-Download-hier...), die es vorher in der Form nicht gab. Hier das Ergebnis der letzten Malwarbytes-Suche, für die ich mir extra Premium gekauft habe: Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 28.02.2015 Suchlauf-Zeit: 17:33:50 Logdatei: logfile-28.txt Administrator: Ja Version: 2.00.4.1028 Malware Datenbank: v2015.02.28.03 Rootkit Datenbank: v2015.02.25.01 Lizenz: Premium Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: Anette-NB Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 346883 Verstrichene Zeit: 31 Min, 0 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Warnen PUM: Aktiviert Prozesse: 0 (Keine schädliche Elemente erkannt) Module: 0 (Keine schädliche Elemente erkannt) Registrierungsschlüssel: 0 (Keine schädliche Elemente erkannt) Registrierungswerte: 0 (Keine schädliche Elemente erkannt) Registrierungsdaten: 0 (Keine schädliche Elemente erkannt) Ordner: 0 (Keine schädliche Elemente erkannt) Dateien: 0 (Keine schädliche Elemente erkannt) Physische Sektoren: 0 (Keine schädliche Elemente erkannt) (end) Das scheint ohne Befund. Was kann ich tun? Vielen Dank vorab für die Hilfe. Gruß, Annoo |
|
01.03.2015, 16:05
| #2 |
| /// the machine /// TB-Ausbilder    | Ungewünschte Werbebanner Firefox hi,
__________________Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ |
|
01.03.2015, 17:08
| #3 |
| | Ungewünschte Werbebanner Firefox Hallo,
__________________hier FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-02-2015 Ran by xxx (administrator) on xxx-HP on 01-03-2015 16:41:37 Running from C:\Users\xxx\Downloads Loaded Profiles: xxx (Available profiles: xxx) Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 9 (Default browser: FF) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (AMD) C:\Windows\System32\atiesrxx.exe (AMD) C:\Windows\System32\atieclxx.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Crawler.com) C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe (Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Sony) C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe (Copernic Inc.) C:\Program Files (x86)\Copernic Desktop Search - Home\DesktopSearchService.exe (TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe (Softland) C:\Program Files (x86)\Softland\FBackup 5\bTray.exe (Lavasoft) C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe () C:\Program Files\Hewlett-Packard\HP LaunchBox\HPTaskBar1.exe (Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP LaunchBox\HPTaskBar2.exe (Dropbox, Inc.) C:\Users\xxx\AppData\Roaming\Dropbox\bin\Dropbox.exe (Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe (Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe (DATA BECKER GmbH & Co KG) C:\Program Files (x86)\Common Files\DATA BECKER Shared\DBService.exe (SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE (SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE (EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe (Softland) C:\Program Files (x86)\Softland\FBackup 5\bService.exe (Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe (Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe () C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanionInfo.exe (Nero AG) C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Crawler.com) C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe (TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe (Lavasoft Limited) C:\Program Files (x86)\Lavasoft\Web Companion\TcpService\2.2.9.5\LavasoftTcpService.exe (Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\ielowutil.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe (SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_IAMTEDE.EXE ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6602856 2011-01-11] (Realtek Semiconductor) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2799912 2011-06-10] (Synaptics Incorporated) HKLM\...\Run: [SetDefault] => C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe [42808 2011-06-27] (Hewlett-Packard Development Company, L.P.) HKLM\...\Run: [SpywareTerminatorShield] => C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe [2777736 2013-04-03] (Crawler.com) HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-07-05] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [HPQuickWebProxy] => C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe [168504 2011-06-28] (Hewlett-Packard Company) HKLM-x32\...\Run: [Easybits Recovery] => C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe HKLM-x32\...\Run: [NeroCheck] => C:\Windows\SysWOW64\NeroCheck.exe [155648 2001-07-09] (Ahead Software Gmbh) HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [578944 2012-03-05] (Hewlett-Packard Development Company, L.P.) HKLM-x32\...\Run: [HPOSD] => C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960 2011-08-19] (Hewlett-Packard Development Company, L.P.) HKLM-x32\...\Run: [] => [X] HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [127792 2015-02-12] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-11-24] (Avira Operations GmbH & Co. KG) HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1 HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\Run: [Sony PC Companion] => C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe [466144 2014-11-27] (Sony) HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\Run: [EPSON SX100 Series] => C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIEDE.EXE [221696 2008-02-05] (SEIKO EPSON CORPORATION) HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\Run: [Copernic Desktop Search - Home] => C:\Program Files (x86)\Copernic Desktop Search - Home\DesktopSearchService.exe [1692200 2013-01-28] (Copernic Inc.) HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\Run: [TomTomHOME.exe] => C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248176 2014-06-05] (TomTom) HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\Run: [FBackup 5 Tray Agent] => C:\Program Files (x86)\Softland\FBackup 5\bTray.exe [7862840 2014-09-30] (Softland) HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\Run: [Web Companion] => C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe [1467200 2014-11-27] (Lavasoft) HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [30877280 2014-12-11] (Skype Technologies S.A.) HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\MountPoints2: {6d057867-0d7f-11e4-8c71-2c768ae69a2d} - G:\Startme.exe Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk ShortcutTarget: Microsoft Office.lnk -> C:\Program Files (x86)\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation) Startup: C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk ShortcutTarget: Adobe Gamma.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.) Startup: C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\xxx\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\xxx\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\xxx\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\xxx\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\xxx\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\xxx\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\xxx\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\xxx\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\xxx\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-1588870830-359060440-1081868607-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ HKU\S-1-5-21-1588870830-359060440-1081868607-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/CQNOT/4 URLSearchHook: HKU\S-1-5-21-1588870830-359060440-1081868607-1001 - (No Name) - {5786d022-540e-4699-b350-b4be0ae94b79} - No File SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms} SearchScopes: HKLM -> {F508C8AB-762D-4759-BA05-C8D219F6E582} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms} SearchScopes: HKLM-x32 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=CPNTDF SearchScopes: HKLM-x32 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms} SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms} SearchScopes: HKLM-x32 -> {F508C8AB-762D-4759-BA05-C8D219F6E582} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms} SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-1588870830-359060440-1081868607-1001 -> {70DDF8F1-81D4-4DFA-B8E3-6E3A6E6EA9EF} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms} SearchScopes: HKU\S-1-5-21-1588870830-359060440-1081868607-1001 -> {85A60A59-D3D8-468F-B598-FB4393789EF4} URL = https://www.google.de/search?q={searchTerms} SearchScopes: HKU\S-1-5-21-1588870830-359060440-1081868607-1001 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms} SearchScopes: HKU\S-1-5-21-1588870830-359060440-1081868607-1001 -> {F508C8AB-762D-4759-BA05-C8D219F6E582} URL = BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard) BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard) Toolbar: HKU\S-1-5-21-1588870830-359060440-1081868607-1001 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File Handler-x32: http - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: http - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: https - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: https - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: ipp - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: msdaipp - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: msdaipp - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation) Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation) Winsock: Catalog9 01 C:\Windows\SysWOW64\LavasoftTcpService.dll [312424] (Lavasoft Limited) Winsock: Catalog9 02 C:\Windows\SysWOW64\LavasoftTcpService.dll [312424] (Lavasoft Limited) Winsock: Catalog9 03 C:\Windows\SysWOW64\LavasoftTcpService.dll [312424] (Lavasoft Limited) Winsock: Catalog9 04 C:\Windows\SysWOW64\LavasoftTcpService.dll [312424] (Lavasoft Limited) Winsock: Catalog9 15 C:\Windows\SysWOW64\LavasoftTcpService.dll [312424] (Lavasoft Limited) Winsock: Catalog9-x64 01 C:\Windows\system32\LavasoftTcpService64.dll [358736] (Lavasoft Limited) Winsock: Catalog9-x64 02 C:\Windows\system32\LavasoftTcpService64.dll [358736] (Lavasoft Limited) Winsock: Catalog9-x64 03 C:\Windows\system32\LavasoftTcpService64.dll [358736] (Lavasoft Limited) Winsock: Catalog9-x64 04 C:\Windows\system32\LavasoftTcpService64.dll [358736] (Lavasoft Limited) Winsock: Catalog9-x64 15 C:\Windows\system32\LavasoftTcpService64.dll [358736] (Lavasoft Limited) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\4c8imuhi.default FF NewTab: hxxp://www.google.de/ FF SelectedSearchEngine: Google FF Homepage: hxxp://www.google.de/ FF Keyword.URL: hxxp://www.google.de FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll () FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1216156.dll (Adobe Systems, Inc.) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @videolan.org/vlc,version=2.0.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\9\NP_wtapp.dll () FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKU\S-1-5-21-1588870830-359060440-1081868607-1001: sony.com/MediaGoDetector -> C:\Program Files (x86)\Sony\Media Go\npMediaGoDetector.dll (Sony Network Entertainment International LLC) FF SearchPlugin: C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\4c8imuhi.default\searchplugins\google-images.xml FF SearchPlugin: C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\4c8imuhi.default\searchplugins\google-maps.xml FF Extension: 20-20 3D Viewer - IKEA - C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\4c8imuhi.default\Extensions\2020Player_IKEA@2020Technologies.com [2014-11-17] FF Extension: Avira Browser Safety - C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\4c8imuhi.default\Extensions\abs@avira.com [2015-02-27] FF Extension: Adblock Plus - C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\4c8imuhi.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-08-11] FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2015-01-18] FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-01-18] FF HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\Firefox\Extensions: [{57319509-7821-41B0-9FDF-3B58F146AE33}] - c:\program files (x86)\copernic desktop search - home\firefoxconnector FF Extension: Copernic Desktop Search - Search Firefox content - c:\program files (x86)\copernic desktop search - home\firefoxconnector [2013-07-31] Chrome: ======= CHR StartupUrls: Default -> "hxxp://www.google.de/" CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter} CHR Profile: C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Docs) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-03] CHR Extension: (Google Drive) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-03] CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-02-21] CHR Extension: (YouTube) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-03] CHR Extension: (Google Search) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-03] CHR Extension: (Avira Browser Safety) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2015-02-21] CHR Extension: (Skype Click to Call) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2015-02-21] CHR Extension: (Google Wallet) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-03] CHR Extension: (Gmail) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-03] CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2014-07-18] (Adobe Systems) [File not signed] R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [365568 2011-07-05] (Advanced Micro Devices, Inc.) [File not signed] R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-11-24] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-11-24] (Avira Operations GmbH & Co. KG) R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [184056 2015-02-12] (Avira Operations GmbH & Co. KG) R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation) R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation) R2 DBService; C:\Program Files (x86)\Common Files\DATA BECKER Shared\DBService.exe [189776 2010-10-28] (DATA BECKER GmbH & Co KG) R2 ezSharedSvc; C:\Windows\SysWOW64\ezSharedSvcHost.exe [514232 2010-04-23] (EasyBits Software AS) [File not signed] R2 FBackup5Srv; C:\Program Files (x86)\Softland\FBackup 5\bService.exe [4642360 2014-09-30] (Softland) S3 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [227904 2014-03-12] (WildTangent) R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2013-11-04] (Hewlett-Packard Company) [File not signed] R2 IconMan_R; C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [1817088 2010-12-28] (Realsil Microelectronics Inc.) [File not signed] R2 LavasoftTcpService; C:\Program Files (x86)\Lavasoft\Web Companion\TcpService\2.2.9.5\LavasoftTcpService.exe [1351512 2014-11-27] (Lavasoft Limited) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation) S2 SearchProtectionService; C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.WinService.exe [15208 2014-11-27] () R2 ST2012_Svc; C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe [1149104 2013-04-03] (Crawler.com) S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-11-24] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-11-24] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-11-24] (Avira Operations GmbH & Co. KG) S3 ggsomc; C:\Windows\System32\DRIVERS\ggsomc.sys [30424 2014-07-17] (Sony Mobile Communications) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-03-01] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation) R2 sp_rsdrv2; C:\Windows\System32\DRIVERS\stflt.sys [51496 2013-11-12] (Windows (R) Win 7 DDK provider) ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-03-01 16:41 - 2015-03-01 16:43 - 00027825 _____ () C:\Users\xxx\Downloads\FRST.txt 2015-03-01 16:41 - 2015-03-01 16:42 - 00000000 ____D () C:\FRST 2015-03-01 16:38 - 2015-03-01 16:38 - 02092544 _____ (Farbar) C:\Users\xxx\Downloads\FRST64.exe 2015-02-28 19:39 - 2015-02-28 19:39 - 00001203 _____ () C:\Users\xxx\Desktop\vorher.txt 2015-02-28 18:42 - 2015-02-28 18:42 - 00000000 _____ () C:\Users\xxx\defogger_reenable 2015-02-28 18:41 - 2015-02-28 18:44 - 00000480 _____ () C:\Users\xxx\Downloads\defogger_disable.log 2015-02-28 18:41 - 2015-02-28 18:41 - 00000252 _____ () C:\Users\xxx\Downloads\defogger_enable.log 2015-02-28 18:39 - 2015-02-28 18:39 - 00050477 _____ () C:\Users\xxx\Downloads\Defogger.exe 2015-02-28 16:57 - 2015-03-01 09:06 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\10777241.sys 2015-02-28 16:44 - 2015-02-28 16:44 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2015-02-28 16:43 - 2015-02-28 16:43 - 20447120 _____ (Malwarebytes Corporation ) C:\Users\xxx\Downloads\mbam_premium.exe 2015-02-28 14:58 - 2015-02-28 16:48 - 00000348 _____ () C:\Windows\Tasks\HPCeeScheduleForxxx.job 2015-02-28 14:58 - 2015-02-28 14:58 - 00003210 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForxxx 2015-02-28 14:47 - 2015-02-28 14:44 - 00043064 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys 2015-02-27 23:04 - 2015-02-27 23:04 - 00000000 ____D () C:\Users\xxx\AppData\Roaming\Avira 2015-02-27 22:58 - 2015-02-27 22:58 - 00000000 ____D () C:\Users\xxx\Documents\Updater 2015-02-27 22:58 - 2014-11-24 10:23 - 00131608 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys 2015-02-27 22:58 - 2014-11-24 10:23 - 00119272 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys 2015-02-27 22:58 - 2014-11-24 10:23 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys 2015-02-27 22:54 - 2015-02-27 23:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira 2015-02-27 22:51 - 2015-02-27 22:51 - 04582672 _____ (Avira Operations & Co. KG) C:\Users\xxx\Downloads\avira_de_av_5876132996__ws.exe 2015-02-27 21:07 - 2015-02-27 22:36 - 00000000 ____D () C:\AdwCleaner 2015-02-27 21:07 - 2015-02-27 21:07 - 02126848 _____ () C:\Users\xxx\Downloads\AdwCleaner_4.111.exe 2015-02-26 20:02 - 2015-03-01 08:56 - 00000392 _____ () C:\Windows\setupact.log 2015-02-26 20:02 - 2015-02-28 14:35 - 00135182 _____ () C:\Windows\PFRO.log 2015-02-26 20:02 - 2015-02-26 20:02 - 00000000 _____ () C:\Windows\setuperr.log 2015-02-26 18:18 - 2015-03-01 16:22 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2015-02-26 18:18 - 2015-02-28 16:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2015-02-26 18:18 - 2015-02-28 16:44 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2015-02-26 18:18 - 2014-11-21 07:08 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2015-02-26 18:18 - 2014-11-21 07:07 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2015-02-26 18:18 - 2014-11-21 07:07 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2015-02-26 18:14 - 2015-02-26 18:17 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\xxx\Downloads\mbam-setup-2.0.4.1028.exe 2015-02-25 23:19 - 2015-01-09 00:44 - 00419936 _____ () C:\Windows\SysWOW64\locale.nls 2015-02-25 23:19 - 2015-01-09 00:43 - 00419936 _____ () C:\Windows\system32\locale.nls 2015-02-25 20:10 - 2015-01-09 04:14 - 00950272 _____ (Microsoft Corporation) C:\Windows\system32\perftrack.dll 2015-02-25 20:10 - 2015-01-09 04:14 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\wdi.dll 2015-02-25 20:10 - 2015-01-09 04:14 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\powertracker.dll 2015-02-25 20:10 - 2015-01-09 03:48 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdi.dll 2015-02-25 18:22 - 2015-02-25 19:00 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird 2015-02-15 11:50 - 2015-01-23 05:07 - 02339840 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2015-02-15 11:50 - 2015-01-23 04:59 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2015-02-15 11:50 - 2015-01-23 04:00 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2015-02-15 11:50 - 2015-01-23 03:51 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2015-02-14 14:18 - 2015-01-14 04:08 - 17878016 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2015-02-14 14:18 - 2015-01-14 03:59 - 10924032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2015-02-14 14:18 - 2015-01-14 03:59 - 00448512 _____ (Microsoft Corporation) C:\Windows\system32\html.iec 2015-02-14 14:18 - 2015-01-14 03:49 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2015-02-14 14:18 - 2015-01-14 03:49 - 01388032 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2015-02-14 14:18 - 2015-01-14 03:47 - 01494016 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2015-02-14 14:18 - 2015-01-14 03:47 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2015-02-14 14:18 - 2015-01-14 03:47 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2015-02-14 14:18 - 2015-01-14 03:47 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2015-02-14 14:18 - 2015-01-14 03:46 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2015-02-14 14:18 - 2015-01-14 03:46 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2015-02-14 14:18 - 2015-01-14 03:45 - 02157056 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2015-02-14 14:18 - 2015-01-14 03:45 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2015-02-14 14:18 - 2015-01-14 03:45 - 00282112 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2015-02-14 14:18 - 2015-01-14 03:44 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2015-02-14 14:18 - 2015-01-14 03:44 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2015-02-14 14:18 - 2015-01-14 03:44 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2015-02-14 14:18 - 2015-01-14 03:44 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll 2015-02-14 14:18 - 2015-01-14 03:44 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe 2015-02-14 14:18 - 2015-01-14 03:44 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe 2015-02-14 14:18 - 2015-01-14 02:51 - 12371456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2015-02-14 14:18 - 2015-01-14 02:49 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec 2015-02-14 14:18 - 2015-01-14 02:46 - 09742336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2015-02-14 14:18 - 2015-01-14 02:43 - 01139712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2015-02-14 14:18 - 2015-01-14 02:42 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2015-02-14 14:18 - 2015-01-14 02:42 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2015-02-14 14:18 - 2015-01-14 02:41 - 01802752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2015-02-14 14:18 - 2015-01-14 02:41 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2015-02-14 14:18 - 2015-01-14 02:41 - 00421376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2015-02-14 14:18 - 2015-01-14 02:41 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll 2015-02-14 14:18 - 2015-01-14 02:41 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2015-02-14 14:18 - 2015-01-14 02:41 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2015-02-14 14:18 - 2015-01-14 02:40 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2015-02-14 14:18 - 2015-01-14 02:40 - 00353792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2015-02-14 14:18 - 2015-01-14 02:40 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2015-02-14 14:18 - 2015-01-14 02:40 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2015-02-14 14:18 - 2015-01-14 02:40 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2015-02-14 14:18 - 2015-01-14 02:40 - 00041472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll 2015-02-14 14:18 - 2015-01-14 02:40 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe 2015-02-14 14:18 - 2015-01-14 02:40 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe 2015-02-14 13:12 - 2015-02-14 13:12 - 00161792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll 2015-02-14 13:12 - 2015-02-14 13:12 - 00074752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe 2015-02-14 13:11 - 2015-02-14 13:11 - 03695416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat 2015-02-14 13:11 - 2015-02-14 13:11 - 03695416 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat 2015-02-14 13:11 - 2015-02-14 13:11 - 00534528 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00434176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00403248 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00353584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00267776 _____ (Microsoft Corporation) C:\Windows\system32\ieaksie.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00249344 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00227840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieaksie.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00222208 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00203776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe 2015-02-14 13:11 - 2015-02-14 13:11 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieakui.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\ieakui.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00162304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00160256 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe 2015-02-14 13:11 - 2015-02-14 13:11 - 00160256 _____ (Microsoft Corporation) C:\Windows\system32\ieakeng.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00152064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe 2015-02-14 13:11 - 2015-02-14 13:11 - 00150528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe 2015-02-14 13:11 - 2015-02-14 13:11 - 00149504 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00145920 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00135168 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00130560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieakeng.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00123392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00118784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00114176 _____ (Microsoft Corporation) C:\Windows\system32\admparse.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00110592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00101888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\admparse.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00091648 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe 2015-02-14 13:11 - 2015-02-14 13:11 - 00089088 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe 2015-02-14 13:11 - 2015-02-14 13:11 - 00089088 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2015-02-14 13:11 - 2015-02-14 13:11 - 00086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00078848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe 2015-02-14 13:11 - 2015-02-14 13:11 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx 2015-02-14 13:11 - 2015-02-14 13:11 - 00074752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ie4uinit.exe 2015-02-14 13:11 - 2015-02-14 13:11 - 00066048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00063488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx 2015-02-14 13:11 - 2015-02-14 13:11 - 00054272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00049664 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00035840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00031744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00023552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll 2015-02-13 11:03 - 2015-02-26 18:27 - 00000000 ____D () C:\Users\xxx\AppData\Local\PDFCreator 2015-02-11 22:09 - 2015-02-11 22:09 - 00010495 _____ () C:\Users\xxx\Downloads\anette_elster_11.02.2015.pfx 2015-02-11 16:33 - 2015-02-14 13:54 - 00001405 _____ () C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk 2015-02-11 08:03 - 2015-02-04 04:16 - 00894976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll 2015-02-11 08:03 - 2015-02-04 04:16 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll 2015-02-11 08:03 - 2015-02-04 04:16 - 00609280 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll 2015-02-11 08:03 - 2015-02-04 04:16 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll 2015-02-11 08:03 - 2015-02-04 04:16 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2015-02-11 08:03 - 2015-02-04 04:16 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll 2015-02-11 08:03 - 2015-02-04 04:13 - 01098752 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2015-02-11 08:03 - 2015-01-28 00:36 - 01239720 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe 2015-02-11 08:01 - 2015-01-15 09:14 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2015-02-11 08:01 - 2015-01-15 09:14 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys 2015-02-11 08:01 - 2015-01-15 09:09 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2015-02-11 08:01 - 2015-01-15 09:09 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll 2015-02-11 08:01 - 2015-01-15 09:09 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe 2015-02-11 08:01 - 2015-01-15 09:09 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll 2015-02-11 08:01 - 2015-01-15 09:09 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll 2015-02-11 08:01 - 2015-01-15 09:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe 2015-02-11 08:01 - 2015-01-15 09:06 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll 2015-02-11 08:01 - 2015-01-15 09:06 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll 2015-02-11 08:01 - 2015-01-15 09:04 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll 2015-02-11 08:01 - 2015-01-15 08:42 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe 2015-02-11 08:01 - 2015-01-15 08:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2015-02-11 08:01 - 2015-01-15 08:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2015-02-11 08:01 - 2015-01-15 08:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll 2015-02-11 08:01 - 2015-01-15 08:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll 2015-02-11 08:01 - 2015-01-15 08:37 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll 2015-02-11 08:01 - 2015-01-15 05:22 - 00458824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys 2015-02-11 08:01 - 2015-01-13 04:10 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2015-02-11 08:01 - 2015-01-13 03:49 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll 2015-02-11 08:00 - 2014-12-12 06:31 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll 2015-02-11 08:00 - 2014-12-12 06:07 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll 2015-02-11 08:00 - 2014-07-07 03:07 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll 2015-02-11 08:00 - 2014-07-07 03:06 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll 2015-02-11 08:00 - 2014-07-07 02:40 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll 2015-02-11 08:00 - 2014-07-07 02:40 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll 2015-02-11 07:59 - 2014-11-26 04:53 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll 2015-02-11 07:59 - 2014-11-26 04:32 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll 2015-02-11 07:59 - 2014-10-04 03:10 - 03722752 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll 2015-02-11 07:59 - 2014-10-04 02:42 - 03221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll 2015-02-11 07:59 - 2014-10-04 02:42 - 00131584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll 2015-02-11 07:56 - 2015-01-14 07:09 - 05554112 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2015-02-11 07:56 - 2015-01-14 07:05 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll 2015-02-11 07:56 - 2015-01-14 07:05 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll 2015-02-11 07:56 - 2015-01-14 07:04 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe 2015-02-11 07:56 - 2015-01-14 06:44 - 03972544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2015-02-11 07:56 - 2015-01-14 06:44 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2015-02-11 07:56 - 2015-01-14 06:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll 2015-02-11 07:56 - 2014-12-08 04:09 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll 2015-02-11 07:56 - 2014-12-08 03:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll 2015-02-11 07:53 - 2015-01-09 03:03 - 03201536 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2015-02-10 23:01 - 2015-02-10 23:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator 2015-02-10 23:00 - 2015-02-26 17:47 - 00000000 ____D () C:\Program Files\PDFCreator 2015-02-10 23:00 - 2015-02-10 23:00 - 00000000 ____D () C:\Users\xxx\AppData\Roaming\Opera Software 2015-02-10 23:00 - 2015-02-10 23:00 - 00000000 ____D () C:\Users\xxx\AppData\Local\Opera Software 2015-02-10 23:00 - 2015-01-22 16:14 - 00114872 _____ (pdfforge GmbH) C:\Windows\system32\pdfcmon.dll 2015-02-10 22:58 - 2015-02-11 15:59 - 00000000 ____D () C:\Program Files (x86)\Opera 2015-02-10 22:49 - 2015-02-10 22:49 - 27721680 _____ (pdfforge ) C:\Users\xxx\Downloads\PDFCreator-2_0_2-setup(1).exe 2015-02-10 16:50 - 2015-02-10 16:50 - 00001464 _____ () C:\Users\Public\Desktop\ElsterFormular.lnk 2015-02-10 16:50 - 2015-02-10 16:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ElsterFormular 2015-02-10 16:48 - 2015-02-10 16:48 - 00000000 ____D () C:\Program Files (x86)\ElsterFormular 2015-02-10 16:45 - 2015-02-10 16:46 - 215975048 _____ (Landesfinanzdirektion Thüringen) C:\Users\xxx\Downloads\ElsterFormular-16.0.20150113k.exe 2015-02-05 11:21 - 2015-02-05 11:21 - 115978680 _____ (Landesfinanzdirektion Thüringen) C:\Users\xxx\Downloads\ElsterFormular-16.0.20150113p.exe 2015-02-05 11:13 - 2015-02-05 11:14 - 176389328 _____ (Landesfinanzdirektion Thüringen) C:\Users\xxx\Downloads\ElsterFormular-16.0.20150113u(1).exe 2015-02-05 09:14 - 2015-02-05 09:14 - 05070512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe 2015-02-04 21:24 - 2015-02-10 10:49 - 00000000 ____D () C:\Users\xxx\Desktop\steuerformulare 2015-02-04 21:22 - 2015-02-10 16:51 - 00000000 ____D () C:\Users\xxx\AppData\Roaming\elsterformular 2015-02-04 20:52 - 2015-02-05 11:23 - 00000000 ____D () C:\ProgramData\elsterformular 2015-02-04 20:43 - 2015-02-04 20:45 - 176389328 _____ (Landesfinanzdirektion Thüringen) C:\Users\xxx\Downloads\ElsterFormular-16.0.20150113u.exe 2015-02-01 13:13 - 2015-02-01 13:13 - 00000000 ____D () C:\Users\xxx\Documents\Steuer-Sparbuch 2015-02-01 12:58 - 2015-02-01 13:16 - 27721680 _____ (pdfforge ) C:\Users\xxx\Downloads\PDFCreator-2_0_2-setup.exe 2015-02-01 12:14 - 2015-02-01 12:14 - 00000000 ____D () C:\Users\xxx\AppData\Roaming\Buhl Data Service 2015-02-01 12:14 - 2015-02-01 12:14 - 00000000 ____D () C:\Users\xxx\AppData\Local\Buhl Data Service 2015-02-01 12:10 - 2015-02-01 12:17 - 00000000 ____D () C:\Users\xxx\AppData\Local\Buhl 2015-02-01 12:10 - 2015-02-01 12:14 - 00000103 _____ () C:\Windows\wiso.ini 2015-02-01 11:50 - 2015-02-01 11:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WISO Steuer-Sparbuch 2015 2015-02-01 11:46 - 2015-02-01 11:46 - 00000000 ____D () C:\Program Files (x86)\WISO 2015-02-01 11:44 - 2015-02-01 12:10 - 00000000 ____D () C:\ProgramData\Buhl Data Service GmbH ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-03-01 16:45 - 2012-01-28 21:58 - 00000000 ____D () C:\Users\xxx\AppData\Roaming\Skype 2015-03-01 16:34 - 2011-11-07 10:37 - 01225638 _____ () C:\Windows\WindowsUpdate.log 2015-03-01 16:14 - 2015-01-22 12:57 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2015-03-01 09:13 - 2009-07-14 05:45 - 00031856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-03-01 09:13 - 2009-07-14 05:45 - 00031856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-03-01 09:09 - 2012-01-26 15:23 - 00003962 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{DA7BE238-D6AB-4111-8246-3DC85ACF4280} 2015-03-01 09:05 - 2011-08-09 21:16 - 00700134 _____ () C:\Windows\system32\perfh007.dat 2015-03-01 09:05 - 2011-08-09 21:16 - 00149984 _____ () C:\Windows\system32\perfc007.dat 2015-03-01 09:05 - 2009-07-14 06:13 - 01622300 _____ () C:\Windows\system32\PerfStringBackup.INI 2015-03-01 09:02 - 2014-09-22 17:53 - 00000000 ___RD () C:\Users\xxx\Dropbox 2015-03-01 09:01 - 2014-04-08 08:19 - 00000000 ____D () C:\Users\xxx\AppData\Roaming\Dropbox 2015-03-01 08:56 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-02-28 18:42 - 2012-01-26 15:18 - 00000000 ____D () C:\Users\xxx 2015-02-28 17:01 - 2013-02-08 18:09 - 00053248 _____ () C:\Users\xxx\Documents\laggie.xls 2015-02-28 14:56 - 2012-02-07 10:23 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log 2015-02-27 22:58 - 2014-03-22 23:39 - 00000000 ____D () C:\ProgramData\Avira 2015-02-27 22:58 - 2014-03-22 23:39 - 00000000 ____D () C:\Program Files (x86)\Avira 2015-02-27 22:53 - 2014-08-05 09:35 - 00000000 ____D () C:\ProgramData\Package Cache 2015-02-27 22:11 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache 2015-02-27 20:59 - 2013-11-12 11:45 - 00000000 ____D () C:\ProgramData\Spyware Terminator 2015-02-27 20:57 - 2014-06-18 15:26 - 00000000 ____D () C:\Users\xxx\AppData\Roaming\SoftGrid Client 2015-02-26 20:02 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\TAPI 2015-02-26 17:42 - 2012-03-03 18:11 - 00000000 ____D () C:\Users\xxx\AppData\Local\CrashDumps 2015-02-26 17:42 - 2007-01-02 02:25 - 00000000 ____D () C:\Windows\Panther 2015-02-26 12:03 - 2014-07-22 13:57 - 00000000 ____D () C:\Users\xxx\Documents\privat 2015-02-26 07:06 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing 2015-02-25 18:21 - 2015-01-18 14:17 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2015-02-25 18:21 - 2012-05-09 22:42 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2015-02-23 08:27 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows\system32\FxsTmp 2015-02-21 18:16 - 2014-05-03 18:27 - 00000000 ____D () C:\Program Files (x86)\Google 2015-02-14 13:54 - 2012-01-26 15:23 - 00001439 _____ () C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2015-02-14 13:49 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions 2015-02-12 06:45 - 2009-07-14 05:45 - 00329504 _____ () C:\Windows\system32\FNTCACHE.DAT 2015-02-12 06:43 - 2014-12-10 16:39 - 00000000 ____D () C:\Windows\system32\appraiser 2015-02-12 06:43 - 2014-05-14 13:26 - 00000000 ___SD () C:\Windows\system32\CompatTel 2015-02-11 23:54 - 2014-06-18 13:45 - 00000000 ____D () C:\ProgramData\Microsoft Help 2015-02-11 23:49 - 2013-08-19 10:40 - 00000000 ____D () C:\Windows\system32\MRT 2015-02-11 23:36 - 2012-01-31 13:14 - 116773704 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2015-02-11 16:40 - 2012-01-26 15:21 - 00079648 _____ () C:\Users\xxx\AppData\Local\GDIPFONTCACHEV1.DAT 2015-02-11 07:25 - 2014-09-22 12:34 - 00000000 ____D () C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox 2015-02-10 22:51 - 2013-08-02 09:33 - 00000000 ____D () C:\Users\xxx\Documents\steuern 2015-02-06 13:44 - 2014-07-21 13:36 - 00000000 ____D () C:\Users\xxx\Documents\Uni 2015-02-05 09:14 - 2015-01-22 12:57 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2015-02-05 09:14 - 2015-01-22 12:57 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2015-02-05 09:14 - 2015-01-22 12:57 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2015-02-01 11:46 - 2011-08-09 12:26 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information 2015-01-31 16:17 - 2012-02-18 16:17 - 00000000 _____ () C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt ==================== Files in the root of some directories ======= 2014-12-01 13:18 - 2014-12-01 16:47 - 2929335 _____ () C:\Program Files (x86)\MysticThumbs.zip 2014-09-19 19:28 - 2014-09-19 19:28 - 0000000 _____ () C:\Users\xxx\AppData\Roaming\downloads.m3u Files to move or delete: ==================== C:\Users\xxx\ccsetup412.exe Some content of TEMP: ==================== C:\Users\xxx\AppData\Local\Temp\avgnt.exe C:\Users\xxx\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpqofgcj.dll C:\Users\xxx\AppData\Local\Temp\Quarantine.exe C:\Users\xxx\AppData\Local\Temp\sqlite3.dll ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-02-27 21:37 ==================== End Of Log ============================ --- --- --- und hier Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 29-02-2015
Ran by xxx at 2015-03-01 17:03:19
Running from C:\Users\xxx\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Ad-Aware Web Companion (x32 Version: 1.0.813.1538 - Lavasoft) Hidden
Adobe Connect 9 Add-in (HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\Adobe Connect 9 Add-in) (Version: 11,9,966,0 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Photoshop CS2 (HKLM-x32\...\Adobe Photoshop CS2 - {236BB7C4-4419-42FD-0407-1E257A25E34D}) (Version: 9.0 - Adobe Systems, Inc.)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.1 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.1.6.156 - Adobe Systems, Inc.)
Advertising Center (x32 Version: 0.0.0.1 - Nero AG) Hidden
Agatha Christie - Peril at End House (x32 Version: 2.2.0.95 - WildTangent) Hidden
ATI Catalyst Install Manager (HKLM\...\{6153098B-60DB-6A9F-EA0F-B006A96B57D5}) (Version: 3.0.829.0 - ATI Technologies, Inc.)
Avira (HKLM-x32\...\{d9ed6dcf-6bfc-4fbb-802e-81dd5b767d6e}) (Version: 1.1.32.25147 - Avira Operations & Co. KG)
Avira (x32 Version: 1.1.32.25147 - Avira Operations & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.7.468 - Avira)
Bejeweled 3 (x32 Version: 2.2.0.97 - WildTangent) Hidden
Blasterball 3 (x32 Version: 2.2.0.97 - WildTangent) Hidden
Bounce Symphony (x32 Version: 2.2.0.97 - WildTangent) Hidden
Cake Mania (x32 Version: 2.2.0.95 - WildTangent) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.12 - Piriform)
Chronicles of Albian (x32 Version: 2.2.0.95 - WildTangent) Hidden
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Compaq Setup Manager (HKLM-x32\...\{AE856388-AFAD-4753-81DF-D96B19D0A17C}) (Version: 1.1.13476.3753 - Hewlett-Packard Company)
Copernic Desktop Search - Home (HKLM-x32\...\CopernicDesktopSearch2) (Version: - Copernic Inc.)
Corel Graphics Suite 11 (HKLM-x32\...\InstallShield_{07A540AB-D785-11D5-8E89-0090275862A0}) (Version: 11 - Corel Corporation)
Corel Graphics Suite 11 (x32 Version: 11 - Corel Corporation) Hidden
Cradle of Rome 2 (x32 Version: 2.2.0.95 - WildTangent) Hidden
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.5.1.4119 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DATA BECKER capella studio & scan 2.0 (HKLM-x32\...\capella studio & scan 2.0_is1) (Version: 6.0.17.0 - DATA BECKER GmbH & Co. KG)
DolbyFiles (x32 Version: 0.1 - Nero AG) Hidden
Dropbox (HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\Dropbox) (Version: 3.2.6 - Dropbox, Inc.)
Druckerdeinstallation für EPSON SX100 Series (HKLM\...\EPSON SX100 Series) (Version: - SEIKO EPSON Corporation)
DVD Shrink 3.2 (HKLM-x32\...\DVD Shrink_is1) (Version: - DVD Shrink)
ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 16.0.20150113 - Landesfinanzdirektion Thüringen)
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version: - )
ESU for Microsoft Windows 7 SP1 (HKLM-x32\...\{E96CAA2A-0244-4A2A-8403-0C3C9534778B}) (Version: 2.1.1 - Hewlett-Packard)
Farm Frenzy (x32 Version: 2.2.0.95 - WildTangent) Hidden
FATE (x32 Version: 2.2.0.97 - WildTangent) Hidden
FBackup 5 (x32 Version: 5.1.596 - Softland) Hidden
FBackup 5.1 (HKLM-x32\...\{9cf473bc-b88f-4803-b486-c57e0541c8ec}) (Version: 5.1.596.0 - Softland)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Governor of Poker 2 Premium Edition (x32 Version: 2.2.0.95 - WildTangent) Hidden
Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
HP Documentation (HKLM-x32\...\{68A55875-B6DD-41E8-8CF6-F193D9C47051}) (Version: 1.1.0.0 - Hewlett-Packard)
HP Games (HKLM-x32\...\WildTangent hp Master Uninstall) (Version: 1.0.2.5 - WildTangent)
HP Launch Box (HKLM\...\{9CAB2212-0732-4827-8EC4-61D8EF0AA65B}) (Version: 1.0.11 - Hewlett-Packard Company)
HP On Screen Display (HKLM-x32\...\{ED1BD69A-07E3-418C-91F1-D856582581BF}) (Version: 1.3.5 - Hewlett-Packard Company)
HP Power Manager (HKLM-x32\...\{872B1C80-38EC-4A31-A25C-980820593900}) (Version: 1.2.3 - Hewlett-Packard Company)
HP Quick Launch (HKLM-x32\...\{53B17A98-5BF0-40BC-AAFF-850A357975AC}) (Version: 2.7.2 - Hewlett-Packard Company)
HP QuickWeb (HKLM-x32\...\{8B52057C-15DB-433E-957C-E279BC7D07E3}) (Version: 3.1.0.9742 - Hewlett-Packard Company)
HP Setup (HKLM-x32\...\{5036764A-435D-40C9-869C-31085A3D741D}) (Version: 8.7.4751.3798 - Hewlett-Packard Company)
HP Software Framework (HKLM-x32\...\{D2462056-BA75-4B2C-8267-DFEA2B6AC4AE}) (Version: 4.6.10.1 - Hewlett-Packard Company)
HP Support Assistant (HKLM-x32\...\{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}) (Version: 7.4.45.4 - Hewlett-Packard Company)
ImagXpress (x32 Version: 7.0.74.0 - Nero AG) Hidden
Jewel Quest Solitaire (x32 Version: 2.2.0.95 - WildTangent) Hidden
Jewel Quest: The Sleepless Star - Collector's Edition (x32 Version: 2.2.0.95 - WildTangent) Hidden
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Kodu Game Lab (HKLM-x32\...\{7DE737B3-B287-4107-8D41-B10E039991CC}) (Version: 1.2.88 - Microsoft Research)
LavasoftTcpService (x32 Version: 2.2.9.5 - Lavasoft) Hidden
Lexware kundenmanager 2011 (HKLM-x32\...\{B2EFA385-09C9-4E52-B4B3-AD15A6D3773B}) (Version: 13.4.4100 - Lexware GmbH & Co. KG)
Lexware kundenmanager 2011 System (HKLM-x32\...\{1846A764-A6C1-46D2-B245-DAEDB2FDF5C9}) (Version: 8.00.0000 - Haufe-Lexware GmbH & Co. KG)
Lexware Outlook AddIn 2011 (HKLM-x32\...\{31D94784-FBE0-49F3-A1A5-F6F0AEDD8A93}) (Version: 13.4.4002 - Lexware GmbH & Co. KG)
Mah Jong Medley (x32 Version: 2.2.0.95 - WildTangent) Hidden
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Media Go (HKLM-x32\...\{F66C4A41-C3A8-4523-AB6C-BAA1DB38305C}) (Version: 2.7.357 - Sony)
Media Go Network Downloader (HKLM-x32\...\{5562F05F-908C-4F15-9B3C-98D5FD32DCAB}) (Version: 1.5.19.0 - Sony)
Media Go Video Playback Engine 2.4.103.12040 (HKLM-x32\...\{7C5AEEE1-6D7C-8922-4548-7BF9096077EC}) (Version: 2.4.103.12040 - Sony)
Menu Templates - Starter Kit (x32 Version: 9.4.2.0 - Nero AG) Hidden
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Access Runtime 2010 (HKLM-x32\...\Office14.AccessRT) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office 2000 Premium (HKLM-x32\...\{00000407-78E1-11D2-B60F-006097C998E7}) (Version: 9.00.2816 - Microsoft Corporation)
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Starter 2010 - Deutsch (HKLM-x32\...\{90140011-0066-0407-0000-0000000FF1CE}) (Version: 14.0.5128.5002 - Microsoft Corporation)
Microsoft PowerPoint Viewer (HKLM-x32\...\{95140000-00AF-0407-0000-0000000FF1CE}) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Reader (HKLM-x32\...\{B6F7DBE7-2FE2-458F-A738-B10832746036}) (Version: - )
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Sync Framework Runtime v1.0 (x86) de (HKLM-x32\...\{DC39A078-4D4C-4EF2-9CAF-69D342D74125}) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Sync Framework Services v1.0 (x86) de (HKLM-x32\...\{E8D33431-67EA-4DC1-B443-EE989DE532BC}) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{4fcf070a-daac-45e9-a8b0-6850941f7ed8}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 3.1 (HKLM-x32\...\{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}) (Version: 3.1.10527.0 - Microsoft Corporation)
Movie Templates - Starter Kit (x32 Version: 9.4.2.0 - Nero AG) Hidden
Mozilla Firefox 36.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 36.0 (x86 de)) (Version: 36.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 33.0 - Mozilla)
Mozilla Thunderbird 31.5.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 31.5.0 (x86 de)) (Version: 31.5.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MyFreeCodec (HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\MyFreeCodec) (Version: - )
Mystery of Mortlake Mansion (x32 Version: 2.2.0.97 - WildTangent) Hidden
MysticThumbs (HKLM\...\{ED321628-843E-4319-8C6D-CB3C919323AC}) (Version: 1.9.8 - MysticCoder)
Namco All-Stars: PAC-MAN (x32 Version: 2.2.0.95 - WildTangent) Hidden
Nero 9 Essentials (HKLM-x32\...\{cd57ddf3-08b3-4ceb-affd-0032c2adebb4}) (Version: - Nero AG)
Nvu 1.0 (HKLM-x32\...\Nvu_is1) (Version: 1.0 - Thorsten Fritz)
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 2.0.2 - pdfforge)
pdfforge Toolbar v9.2 (HKLM-x32\...\{65775F96-910D-4A8F-9695-5BA891879603}) (Version: 9.2 - Spigot, Inc.) <==== ATTENTION
Penguins! (x32 Version: 2.2.0.95 - WildTangent) Hidden
PL-2303 USB-to-Serial (HKLM-x32\...\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}) (Version: - )
PL-2303 Vista Driver Installer (HKLM-x32\...\{EEC010D0-1252-4E1D-BAD9-F1B8F414535C}) (Version: 3.0.1.0 - Prolific)
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.95 - WildTangent) Hidden
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Ralink RT5390 802.11b/g/n WiFi Adapter (HKLM-x32\...\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}) (Version: 3.2.12.0 - Ralink)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.42.304.2011 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6287 - Realtek Semiconductor Corp.)
Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.1.7600.77 - Realtek Semiconductor Corp.)
Recovery Manager (x32 Version: 2.0.0 - Hewlett-Packard) Hidden
Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.6.2.14014_6 - Samsung Electronics Co., Ltd.)
Samsung Kies (x32 Version: 2.6.2.14014_6 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.33.0 - SAMSUNG Electronics Co., Ltd.)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-001C-0000-0000-0000000FF1CE}_Office14.AccessRT_{54846D1D-E5D5-4A28-AA6D-7208259007EA}) (Version: - Microsoft)
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
Slingo Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Sony Mobile Update Engine (HKLM-x32\...\Update Engine) (Version: 2.14.9.201406230908 - Sony Mobile Communications AB)
Sony PC Companion 2.10.245 (HKLM-x32\...\{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}) (Version: 2.10.245 - Sony)
Spyware Terminator 2012 (HKLM-x32\...\{56736259-613E-4A3B-B428-6235F2E76F44}_is1) (Version: 3.0.0.82 - Crawler.com)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics TouchPad Driver (HKLM\...\SynTPDeinstKey) (Version: 15.3.11.0 - Synaptics Incorporated)
The Matrix Trilogy 3D Code Screen Saver v3.4 (HKLM-x32\...\Matrix3D) (Version: - )
TomTom HOME (HKLM-x32\...\{7A2BB1C8-903D-4585-9F3B-CADD67D07D37}) (Version: 2.9.8 - Ihr Firmenname)
TomTom HOME Visual Studio Merge Modules (HKLM-x32\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden
Vacation Quest - The Hawaiian Islands (x32 Version: 2.2.0.97 - WildTangent) Hidden
VBA (2627.01) (x32 Version: 6.03.00.9188 - Microsoft Corporation) Hidden
Virtual Villagers - The Secret City (x32 Version: 2.2.0.95 - WildTangent) Hidden
VLC media player 2.0.0 (HKLM-x32\...\VLC media player) (Version: 2.0.0 - VideoLAN)
Web Companion (HKLM-x32\...\{89C9F6E5-50D4-400C-AB96-5A947584D4D6}_WebCompanion) (Version: 1.0.813.1538 - Lavasoft)
WildTangent Games App für HP (x32 Version: 4.0.11.7 - WildTangent) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
WISO Steuer-Sparbuch 2015 (HKLM-x32\...\{64688129-C2AF-42FE-B153-E74529FCDE34}) (Version: 22.00.8811 - Buhl Data Service GmbH)
Zuma Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-1588870830-359060440-1081868607-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\xxx\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1588870830-359060440-1081868607-1001_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\xxx\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1588870830-359060440-1081868607-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\xxx\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1588870830-359060440-1081868607-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\xxx\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1588870830-359060440-1081868607-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\xxx\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1588870830-359060440-1081868607-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\xxx\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1588870830-359060440-1081868607-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\xxx\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1588870830-359060440-1081868607-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\xxx\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1588870830-359060440-1081868607-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\xxx\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1588870830-359060440-1081868607-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\xxx\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
==================== Restore Points =========================
14-02-2015 20:43:34 Windows Update
15-02-2015 19:00:23 Windows-Sicherung
16-02-2015 06:55:23 Windows Update
19-02-2015 07:53:39 Windows Update
23-02-2015 16:42:35 Windows-Sicherung
24-02-2015 07:23:24 Windows Update
25-02-2015 23:17:35 Windows Update
27-02-2015 22:50:28 Removed Avira Savings Advisor
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {0222CE49-FC2F-42D4-9A6D-66203BB811B9} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2014-05-12] (Hewlett-Packard Company)
Task: {0886729C-A494-4BDC-B872-AC975CC58F16} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2011-06-15] (CyberLink)
Task: {309C5C92-B46A-4099-BB7A-F8803EC41046} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {48B2D921-B795-4CF1-BE2C-30D38EA8F7B3} - System32\Tasks\{9CEC0B83-F181-4C71-85BB-DEF3163407F5} => C:\Program Files (x86)\SlySoft\AnyDVD\AnyDVD.exe
Task: {513FCC22-2490-4C77-B0B1-07D0F299AF79} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2015-01-21] (Hewlett-Packard)
Task: {58A4A4A7-8771-46AE-ABBB-9C35427D3741} - System32\Tasks\HPCeeScheduleForxxx => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13] (Hewlett-Packard)
Task: {69E92A86-9C2D-4C79-ACB6-9E16AFAA1DA7} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-05] (Adobe Systems Incorporated)
Task: {709EE61F-CC9C-4A49-AF4D-357C10484D82} - System32\Tasks\CCleanerSkipUAC => C:\PROGRAM FILES\CCLEANER\CCLEANER.EXE [2014-03-18] (Piriform Ltd)
Task: {8C59E1F1-B3A2-439B-92F8-B4CD9DFE8E18} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {A6A52D45-E225-4AA9-8BD9-2AEF78960E65} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {A6F48233-8F29-4B90-822A-BC33CEED12E1} - System32\Tasks\{CEC61C62-A15F-4F5C-8692-5D5C157D2D00} => Firefox.exe hxxp://ui.skype.com/ui/0/6.14.59.104/de/abandoninstall?page=tsMain
Task: {AEB83D01-CC94-4057-B77E-07F4A6EB9555} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {F8826F1B-0E3B-459A-8F17-DFB654F0AA5E} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2015-01-21] (Hewlett-Packard)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\HPCeeScheduleForxxx.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
==================== Loaded Modules (whitelisted) ==============
2011-07-05 11:27 - 2011-07-05 11:27 - 00073728 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll
2011-06-27 15:18 - 2011-06-27 15:18 - 00107320 _____ () C:\Program Files\Hewlett-Packard\HP LaunchBox\HPTaskBar1.exe
2014-07-17 13:34 - 2014-06-23 08:07 - 00113376 _____ () C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanionInfo.exe
2011-07-05 11:27 - 2011-07-05 11:27 - 00103424 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2011-07-05 11:13 - 2011-07-05 11:13 - 00243712 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2011-06-17 13:42 - 2011-06-17 13:42 - 00016384 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2014-07-17 13:34 - 2012-04-30 10:57 - 00039936 _____ () C:\Program Files (x86)\Sony\Sony PC Companion\TMonitorAPI.dll
2014-07-17 13:34 - 2014-12-04 14:18 - 00241152 _____ () C:\Program Files (x86)\Sony\Sony PC Companion\MExplorer.dll
2011-07-07 13:54 - 2011-07-07 13:54 - 00233984 _____ () C:\Program Files (x86)\Sony\Sony PC Companion\Report.dll
2014-07-17 13:34 - 2013-05-20 11:58 - 00620718 _____ () C:\Program Files (x86)\Sony\Sony PC Companion\sqlite3.dll
2014-07-17 13:34 - 2010-01-11 15:44 - 00053248 _____ () C:\Program Files (x86)\Sony\Sony PC Companion\VObject.dll
2014-06-12 09:19 - 2014-06-12 09:19 - 00643584 _____ () C:\Program Files (x86)\Sony\Sony PC Companion\PhoneUpdate.dll
2014-09-30 09:50 - 2014-09-30 09:50 - 00472064 ____R () C:\Program Files (x86)\Softland\FBackup 5\bResourceStrings.bpl
2014-09-30 09:35 - 2014-09-30 09:35 - 00642016 ____R () C:\Program Files (x86)\Softland\FBackup 5\sqlite3.dll
2014-11-27 10:42 - 2014-11-27 10:42 - 00067392 _____ () C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll
2014-11-27 10:42 - 2014-11-27 10:42 - 00169320 _____ () C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll
2014-11-27 10:42 - 2014-11-27 10:42 - 00088392 _____ () C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.adblocker.dll
2014-11-27 10:42 - 2014-11-27 10:42 - 00033136 _____ () C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Repositories.dll
2014-11-27 10:42 - 2014-11-27 10:42 - 00015696 _____ () C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.SqlLite.dll
2014-11-27 10:43 - 2014-11-27 10:43 - 00041304 _____ () C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.PUP.Management.dll
2014-11-27 10:42 - 2014-11-27 10:42 - 00235336 _____ () C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Filtering.dll
2014-11-27 10:42 - 2014-11-27 10:42 - 00039256 _____ () C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dll
2015-02-10 22:00 - 2015-02-10 22:00 - 00750080 _____ () C:\Users\xxx\AppData\Roaming\Dropbox\bin\libGLESv2.dll
2015-03-01 09:00 - 2015-03-01 09:00 - 00043008 _____ () c:\Users\xxx\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpqofgcj.dll
2015-02-10 22:00 - 2015-02-10 22:00 - 00047616 _____ () C:\Users\xxx\AppData\Roaming\Dropbox\bin\libEGL.dll
2015-02-10 22:00 - 2015-02-10 22:00 - 00865280 _____ () C:\Users\xxx\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll
2015-02-10 22:00 - 2015-02-10 22:00 - 00200704 _____ () C:\Users\xxx\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll
2015-02-25 18:23 - 2015-02-25 18:23 - 03348080 _____ () C:\Program Files (x86)\Mozilla Thunderbird\mozjs.dll
2015-02-25 18:23 - 2015-02-25 18:23 - 00158832 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAP32V60.dll
2015-02-25 18:23 - 2015-02-25 18:23 - 00023152 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAPPR32V60.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\FBackup5Srv => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\FBackup5Srv => ""="Service"
==================== EXE Association (whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1588870830-359060440-1081868607-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.178.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma Loader.exe.lnk => C:\Windows\pss\Adobe Gamma Loader.exe.lnk.CommonStartup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
MSCONFIG\startupreg: Copernic Desktop Search - Home => "C:\Program Files (x86)\Copernic Desktop Search - Home\DesktopSearchService.exe" /tray
MSCONFIG\startupreg: KiesAirMessage => C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup
MSCONFIG\startupreg: KiesPreload => C:\Program Files (x86)\Samsung\Kies\Kies.exe /preload
MSCONFIG\startupreg: KiesTrayAgent => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
MSCONFIG\startupreg: NeroFilterCheck => C:\Windows\system32\NeroCheck.exe
MSCONFIG\startupreg: PDFPrint => C:\Program Files (x86)\PDF24\pdf24.exe
==================== Accounts: =============================
Administrator (S-1-5-21-1588870830-359060440-1081868607-500 - Administrator - Disabled)
xxx (S-1-5-21-1588870830-359060440-1081868607-1001 - Administrator - Enabled) => C:\Users\xxx
Gast (S-1-5-21-1588870830-359060440-1081868607-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1588870830-359060440-1081868607-1003 - Limited - Enabled)
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (03/01/2015 09:08:49 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: wmpnetwk.exe, Version: 12.0.7601.17514, Zeitstempel: 0x4ce7ae7f
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000e0b546
ID des fehlerhaften Prozesses: 0x1908
Startzeit der fehlerhaften Anwendung: 0xwmpnetwk.exe0
Pfad der fehlerhaften Anwendung: wmpnetwk.exe1
Pfad des fehlerhaften Moduls: wmpnetwk.exe2
Berichtskennung: wmpnetwk.exe3
Error: (03/01/2015 09:00:00 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/28/2015 04:54:20 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: DATA BECKER Update Service.exe, Version: 0.0.4.1, Zeitstempel: 0x4d89246b
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea8e7
Ausnahmecode: 0xc0000374
Fehleroffset: 0x000ce753
ID des fehlerhaften Prozesses: 0x880
Startzeit der fehlerhaften Anwendung: 0xDATA BECKER Update Service.exe0
Pfad der fehlerhaften Anwendung: DATA BECKER Update Service.exe1
Pfad des fehlerhaften Moduls: DATA BECKER Update Service.exe2
Berichtskennung: DATA BECKER Update Service.exe3
Error: (02/28/2015 04:52:31 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/28/2015 02:41:37 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: DATA BECKER Update Service.exe, Version: 0.0.4.1, Zeitstempel: 0x4d89246b
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea8e7
Ausnahmecode: 0xc0000374
Fehleroffset: 0x000ce753
ID des fehlerhaften Prozesses: 0x7a4
Startzeit der fehlerhaften Anwendung: 0xDATA BECKER Update Service.exe0
Pfad der fehlerhaften Anwendung: DATA BECKER Update Service.exe1
Pfad des fehlerhaften Moduls: DATA BECKER Update Service.exe2
Berichtskennung: DATA BECKER Update Service.exe3
Error: (02/28/2015 02:37:23 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/27/2015 10:38:22 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/27/2015 09:50:29 PM) (Source: SideBySide) (EventID: 9) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Das Stammelement der Manifestdatei muss assembliert sein.
Error: (02/27/2015 09:04:33 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: DATA BECKER Update Service.exe, Version: 0.0.4.1, Zeitstempel: 0x4d89246b
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea8e7
Ausnahmecode: 0xc0000374
Fehleroffset: 0x000ce753
ID des fehlerhaften Prozesses: 0xeb8
Startzeit der fehlerhaften Anwendung: 0xDATA BECKER Update Service.exe0
Pfad der fehlerhaften Anwendung: DATA BECKER Update Service.exe1
Pfad des fehlerhaften Moduls: DATA BECKER Update Service.exe2
Berichtskennung: DATA BECKER Update Service.exe3
Error: (02/27/2015 09:00:37 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (03/01/2015 09:09:23 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Media Player-Netzwerkfreigabedienst" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (03/01/2015 09:07:16 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Microsoft .NET Framework NGEN v4.0.30319_X64 erreicht.
Error: (03/01/2015 09:06:46 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Microsoft .NET Framework NGEN v4.0.30319_X86 erreicht.
Error: (03/01/2015 09:06:07 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "LavasoftTcpService" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (03/01/2015 09:02:15 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows Presentation Foundation-Schriftartcache 3.0.0.0" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (03/01/2015 09:02:15 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Presentation Foundation-Schriftartcache 3.0.0.0 erreicht.
Error: (03/01/2015 09:01:44 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "LavasoftTcpService" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (03/01/2015 08:58:22 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst HPWMISVC erreicht.
Error: (03/01/2015 08:58:15 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst IE Search Set erreicht.
Error: (02/28/2015 07:46:31 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
Microsoft Office Sessions:
=========================
Error: (03/01/2015 09:08:49 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: wmpnetwk.exe12.0.7601.175144ce7ae7funknown0.0.0.000000000c00000050000000000e0b546190801d053f6d4d84b98C:\Program Files\Windows Media Player\wmpnetwk.exeunknown309f7c69-bfea-11e4-86e4-2c768ae69a2d
Error: (03/01/2015 09:00:00 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/28/2015 04:54:20 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: DATA BECKER Update Service.exe0.0.4.14d89246bntdll.dll6.1.7601.18247521ea8e7c0000374000ce75388001d0536ebcbba10fC:\Program Files (x86)\Common Files\DATA BECKER Shared\DATA BECKER Update Service.exeC:\Windows\SysWOW64\ntdll.dll0e12170d-bf62-11e4-9144-2c768ae69a2d
Error: (02/28/2015 04:52:31 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/28/2015 02:41:37 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: DATA BECKER Update Service.exe0.0.4.14d89246bntdll.dll6.1.7601.18247521ea8e7c0000374000ce7537a401d0535c3c9cab72C:\Program Files (x86)\Common Files\DATA BECKER Shared\DATA BECKER Update Service.exeC:\Windows\SysWOW64\ntdll.dll83c0f728-bf4f-11e4-8509-2c768ae69a2d
Error: (02/28/2015 02:37:23 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/27/2015 10:38:22 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/27/2015 09:50:29 PM) (Source: SideBySide) (EventID: 9) (User: )
Description: C:\Program Files (x86)\Lexware\kundenmanager8\Programm\Module\adxloader.dll.ManifestC:\Program Files (x86)\Lexware\kundenmanager8\Programm\Module\adxloader.dll.Manifest2
Error: (02/27/2015 09:04:33 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: DATA BECKER Update Service.exe0.0.4.14d89246bntdll.dll6.1.7601.18247521ea8e7c0000374000ce753eb801d052c893e7fde3C:\Program Files (x86)\Common Files\DATA BECKER Shared\DATA BECKER Update Service.exeC:\Windows\SysWOW64\ntdll.dlld862ca7e-bebb-11e4-888e-2c768ae69a2d
Error: (02/27/2015 09:00:37 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
==================== Memory info ===========================
Processor: AMD E-450 APU with Radeon(tm) HD Graphics
Percentage of memory in use: 57%
Total physical RAM: 3690.91 MB
Available physical RAM: 1554.36 MB
Total Pagefile: 7380 MB
Available Pagefile: 4047.12 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:446.19 GB) (Free:367.15 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Recovery) (Fixed) (Total:15.41 GB) (Free:1.68 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (HP_TOOLS) (Fixed) (Total:3.96 GB) (Free:1.01 GB) FAT32
Drive g: (INTENSO) (Fixed) (Total:232.83 GB) (Free:149.6 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: F2DC90A7)
Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=446.2 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=15.4 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=4 GB) - (Type=0C)
Attempted reading MBR returned 0 bytes.
Could not read MBR for disk 1.
==================== End Of Log ============================
|
|
02.03.2015, 06:59
| #4 |
| /// the machine /// TB-Ausbilder | Ungewünschte Werbebanner Firefox Lade Dir bitte von hier  Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
Scan mit Combofix
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
02.03.2015, 17:20
| #5 |
| | Ungewünschte Werbebanner Firefox Hallo, pdfforge ist gelöscht (schade, gibt es andere unproblematische kostenlose oder günstige PDF-Maker?). Hier das gewünschte Combofix-File: Code:
ATTFilter ComboFix 15-03-01.01 - xxx-NB 02.03.2015 15:40:41.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.3691.1715 [GMT 1:00]
ausgeführt von:: c:\users\xxx-NB\Downloads\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\xxx-NB\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
c:\users\xxx-NB\AppData\Roaming\Microsoft\Windows\Recent\12-kleine-Weihnachtstueten-Weihnachtstaschen-Geschenktueten-Weihnachten-2200-B2 Zum Heranzoomen mit der Maus über das Bild f.URL
c:\users\xxx~1\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
c:\windows\IsUn0407.exe
c:\windows\SysWow64\SET615F.tmp
c:\windows\SysWow64\SET6BCD.tmp
c:\windows\SysWow64\SET954E.tmp
c:\windows\SysWow64\SETA71C.tmp
.
.
((((((((((((((((((((((( Dateien erstellt von 2015-02-02 bis 2015-03-02 ))))))))))))))))))))))))))))))
.
.
2015-03-02 15:45 . 2015-03-02 15:45 -------- d-----w- c:\users\Default\AppData\Local\temp
2015-03-02 11:34 . 2015-03-02 11:34 -------- d-----w- c:\program files (x86)\VS Revo Group
2015-03-01 15:41 . 2015-03-01 16:18 -------- d-----w- C:\FRST
2015-02-28 15:57 . 2015-03-01 08:06 129752 ----a-w- c:\windows\system32\drivers\10777241.sys
2015-02-28 13:47 . 2015-02-28 13:44 43064 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2015-02-27 22:04 . 2015-02-27 22:04 -------- d-----w- c:\users\xxx-NB\AppData\Roaming\Avira
2015-02-27 21:58 . 2014-11-24 09:23 28600 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2015-02-27 21:58 . 2014-11-24 09:23 131608 ----a-w- c:\windows\system32\drivers\avipbb.sys
2015-02-27 21:58 . 2014-11-24 09:23 119272 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2015-02-27 20:07 . 2015-02-27 21:36 -------- d-----w- C:\AdwCleaner
2015-02-27 07:08 . 2015-01-29 09:07 11910896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{9016A56E-A7E3-4FEE-AA1A-38F07A9F16D6}\mpengine.dll
2015-02-26 17:18 . 2015-03-02 15:53 129752 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-02-26 17:18 . 2014-11-21 06:08 63704 ----a-w- c:\windows\system32\drivers\mwac.sys
2015-02-26 17:18 . 2014-11-21 06:07 93400 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2015-02-26 17:18 . 2014-11-21 06:07 25816 ----a-w- c:\windows\system32\drivers\mbam.sys
2015-02-26 17:18 . 2015-02-28 15:44 -------- d-----w- c:\program files (x86)\ Malwarebytes Anti-Malware
2015-02-25 19:10 . 2015-01-09 03:14 91136 ----a-w- c:\windows\system32\wdi.dll
2015-02-25 19:10 . 2015-01-09 03:14 950272 ----a-w- c:\windows\system32\perftrack.dll
2015-02-25 19:10 . 2015-01-09 03:14 29696 ----a-w- c:\windows\system32\powertracker.dll
2015-02-25 19:10 . 2015-01-09 02:48 76800 ----a-w- c:\windows\SysWow64\wdi.dll
2015-02-25 17:22 . 2015-02-25 18:00 -------- d-----w- c:\program files (x86)\Mozilla Thunderbird
2015-02-25 17:21 . 2015-02-25 17:21 3466856 ----a-w- c:\program files (x86)\Mozilla Firefox\d3dcompiler_47.dll
2015-02-25 17:21 . 2015-02-25 17:21 970912 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcr120.dll
2015-02-25 17:21 . 2015-02-25 17:21 455328 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcp120.dll
2015-02-25 17:21 . 2015-02-25 17:21 169584 ----a-w- c:\program files (x86)\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll
2015-02-15 10:50 . 2015-01-23 03:00 1810944 ----a-w- c:\windows\SysWow64\jscript9.dll
2015-02-15 10:50 . 2015-01-23 04:07 2339840 ----a-w- c:\windows\system32\jscript9.dll
2015-02-15 10:50 . 2015-01-23 03:59 816640 ----a-w- c:\windows\system32\jscript.dll
2015-02-14 12:49 . 2015-02-14 12:49 -------- d-----w- c:\windows\SysWow64\wbem\en-US
2015-02-14 12:49 . 2015-02-14 12:49 -------- d-----w- c:\windows\system32\wbem\en-US
2015-02-14 12:12 . 2015-02-14 12:12 74752 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2015-02-14 12:12 . 2015-02-14 12:12 161792 ----a-w- c:\windows\SysWow64\msls31.dll
2015-02-13 10:03 . 2015-02-26 17:27 -------- d-----w- c:\users\xxx-NB\AppData\Local\PDFCreator
2015-02-11 07:03 . 2015-02-04 03:16 609280 ----a-w- c:\windows\system32\generaltel.dll
2015-02-11 07:03 . 2015-02-04 03:16 894976 ----a-w- c:\windows\system32\appraiser.dll
2015-02-11 07:03 . 2015-02-04 03:13 1098752 ----a-w- c:\windows\system32\aeinv.dll
2015-02-11 07:03 . 2015-02-04 03:16 762368 ----a-w- c:\windows\system32\invagent.dll
2015-02-11 07:03 . 2015-02-04 03:16 414720 ----a-w- c:\windows\system32\devinv.dll
2015-02-11 07:03 . 2015-01-27 23:36 1239720 ----a-w- c:\windows\system32\aitstatic.exe
2015-02-11 07:03 . 2015-02-04 03:16 227328 ----a-w- c:\windows\system32\aepdu.dll
2015-02-11 07:03 . 2015-02-04 03:16 192000 ----a-w- c:\windows\system32\aepic.dll
2015-02-11 07:00 . 2014-12-12 05:31 1480192 ----a-w- c:\windows\system32\crypt32.dll
2015-02-11 07:00 . 2014-12-12 05:07 1174528 ----a-w- c:\windows\SysWow64\crypt32.dll
2015-02-11 07:00 . 2014-07-07 02:07 229376 ----a-w- c:\windows\system32\wintrust.dll
2015-02-11 07:00 . 2014-07-07 02:06 187904 ----a-w- c:\windows\system32\cryptsvc.dll
2015-02-11 07:00 . 2014-07-07 01:40 179200 ----a-w- c:\windows\SysWow64\wintrust.dll
2015-02-11 07:00 . 2014-07-07 01:40 143872 ----a-w- c:\windows\SysWow64\cryptsvc.dll
2015-02-11 06:59 . 2014-11-26 03:53 861696 ----a-w- c:\windows\system32\oleaut32.dll
2015-02-11 06:59 . 2014-11-26 03:32 571904 ----a-w- c:\windows\SysWow64\oleaut32.dll
2015-02-11 06:59 . 2014-10-04 02:10 3722752 ----a-w- c:\windows\system32\mstscax.dll
2015-02-11 06:59 . 2014-10-04 01:42 3221504 ----a-w- c:\windows\SysWow64\mstscax.dll
2015-02-11 06:59 . 2014-10-04 01:42 131584 ----a-w- c:\windows\SysWow64\aaclient.dll
2015-02-11 06:56 . 2014-12-08 03:09 406528 ----a-w- c:\windows\system32\scesrv.dll
2015-02-11 06:56 . 2014-12-08 02:46 308224 ----a-w- c:\windows\SysWow64\scesrv.dll
2015-02-11 06:56 . 2015-01-14 06:09 5554112 ----a-w- c:\windows\system32\ntoskrnl.exe
2015-02-11 06:56 . 2015-01-14 05:44 3972544 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2015-02-11 06:56 . 2015-01-14 05:44 3917760 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2015-02-11 06:56 . 2015-01-14 06:05 503808 ----a-w- c:\windows\system32\srcore.dll
2015-02-11 06:56 . 2015-01-14 06:04 296960 ----a-w- c:\windows\system32\rstrui.exe
2015-02-11 06:56 . 2015-01-14 06:05 50176 ----a-w- c:\windows\system32\srclient.dll
2015-02-11 06:56 . 2015-01-14 05:41 43008 ----a-w- c:\windows\SysWow64\srclient.dll
2015-02-11 06:53 . 2015-01-09 02:03 3201536 ----a-w- c:\windows\system32\win32k.sys
2015-02-10 22:00 . 2015-01-22 15:14 114872 ----a-w- c:\windows\system32\pdfcmon.dll
2015-02-10 22:00 . 2015-02-26 16:47 -------- d-----w- c:\program files\PDFCreator
2015-02-10 22:00 . 2015-02-10 22:00 -------- d-----w- c:\users\xxx-NB\AppData\Local\Opera Software
2015-02-10 22:00 . 2015-02-10 22:00 -------- d-----w- c:\users\xxx-NB\AppData\Roaming\Opera Software
2015-02-10 21:58 . 2015-02-11 14:59 -------- d-----w- c:\program files (x86)\Opera
2015-02-10 15:48 . 2015-02-10 15:48 -------- d-----w- c:\program files (x86)\ElsterFormular
2015-02-05 08:14 . 2015-02-05 08:14 5070512 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe
2015-02-04 20:22 . 2015-02-10 15:51 -------- d-----w- c:\users\xxx-NB\AppData\Roaming\elsterformular
2015-02-04 19:52 . 2015-02-05 10:23 -------- d-----w- c:\programdata\elsterformular
2015-02-01 11:14 . 2015-02-01 11:14 -------- d-----w- c:\users\xxx-NB\AppData\Roaming\Buhl Data Service
2015-02-01 11:14 . 2015-02-01 11:14 -------- d-----w- c:\users\xxx-NB\AppData\Local\Buhl Data Service
2015-02-01 11:10 . 2015-02-01 11:17 -------- d-----w- c:\users\xxx-NB\AppData\Local\Buhl
2015-02-01 10:46 . 2015-02-01 10:46 -------- d-----w- c:\program files (x86)\WISO
2015-02-01 10:44 . 2015-02-01 11:10 -------- d-----w- c:\programdata\Buhl Data Service GmbH
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-02-11 22:36 . 2012-01-31 12:14 116773704 ----a-w- c:\windows\system32\MRT.exe
2015-02-05 08:14 . 2015-01-22 11:57 71344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-02-05 08:14 . 2015-01-22 11:57 701616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-12-22 23:41 . 2010-11-21 03:27 298120 ------w- c:\windows\system32\MpSigStub.exe
2014-12-19 03:06 . 2015-01-15 07:45 210432 ----a-w- c:\windows\system32\profsvc.dll
2014-12-19 01:46 . 2015-01-14 06:35 141312 ----a-w- c:\windows\system32\drivers\mrxdav.sys
2014-12-11 17:47 . 2015-01-14 06:36 52736 ----a-w- c:\windows\system32\TSWbPrxy.exe
2014-12-06 04:17 . 2015-01-14 06:35 303616 ----a-w- c:\windows\system32\nlasvc.dll
2014-12-06 03:50 . 2015-01-14 06:35 52224 ----a-w- c:\windows\SysWow64\nlaapi.dll
2014-12-06 03:50 . 2015-01-14 06:35 156672 ----a-w- c:\windows\SysWow64\ncsi.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sony PC Companion"="c:\program files (x86)\Sony\Sony PC Companion\PCCompanion.exe" [2014-11-27 466144]
"Copernic Desktop Search - Home"="c:\program files (x86)\Copernic Desktop Search - Home\DesktopSearchService.exe" [2013-01-28 1692200]
"TomTomHOME.exe"="c:\program files (x86)\TomTom HOME 2\TomTomHOMERunner.exe" [2014-06-05 248176]
"FBackup 5 Tray Agent"="c:\program files (x86)\Softland\FBackup 5\bTray.exe" [2014-09-30 7862840]
"Web Companion"="c:\program files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe" [2014-11-27 1467200]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2014-12-11 30877280]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-07-05 336384]
"HPQuickWebProxy"="c:\program files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe" [2011-06-28 168504]
"NeroCheck"="c:\windows\SysWOW64\NeroCheck.exe" [2001-07-09 155648]
"HP Quick Launch"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" [2012-03-05 578944]
"HPOSD"="c:\program files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe" [2011-08-19 379960]
"Avira Systray"="c:\program files (x86)\Avira\My Avira\Avira.OE.Systray.exe" [2015-02-12 127792]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2014-11-24 702768]
.
c:\users\xxx-NB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
Dropbox.lnk - c:\users\xxx-NB\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2015-2-11 42555824]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files (x86)\Microsoft Office\Office\OSA9.EXE -b -l [1999-2-17 65588]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"EnableShellExecuteHooks"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\FBackup5Srv]
@="Service"
.
R2 Avira.OE.ServiceHost;Avira Service Host;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 GamesAppIntegrationService;GamesAppIntegrationService;c:\program files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe;c:\program files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [x]
R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [x]
R3 ggflt;SOMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys;c:\windows\SYSNATIVE\DRIVERS\ggflt.sys [x]
R3 ggsomc;SOMC USB Flash Driver;c:\windows\system32\DRIVERS\ggsomc.sys;c:\windows\SYSNATIVE\DRIVERS\ggsomc.sys [x]
R3 Sony PC Companion;Sony PC Companion;c:\program files (x86)\Sony\Sony PC Companion\PCCService.exe;c:\program files (x86)\Sony\Sony PC Companion\PCCService.exe [x]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTAZL6.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTDPV6.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTCNXT6.SYS [x]
R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;%TsUsbGD.DeviceDesc.Generic%;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 amd_sata;amd_sata;c:\windows\system32\DRIVERS\amd_sata.sys;c:\windows\SYSNATIVE\DRIVERS\amd_sata.sys [x]
S0 amd_xata;amd_xata;c:\windows\system32\DRIVERS\amd_xata.sys;c:\windows\SYSNATIVE\DRIVERS\amd_xata.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 c2cautoupdatesvc;Skype Click to Call Updater;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [x]
S2 c2cpnrsvc;Skype Click to Call PNR Service;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [x]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x]
S2 DBService;DATA BECKER Update Service;c:\program files (x86)\Common Files\DATA BECKER Shared\DBService.exe;c:\program files (x86)\Common Files\DATA BECKER Shared\DBService.exe [x]
S2 ezSharedSvc;Easybits Services for Windows;c:\windows\System32\ezSharedSvcHost.exe;c:\windows\SYSNATIVE\ezSharedSvcHost.exe [x]
S2 FBackup5Srv;FBackup 5 Service;c:\program files (x86)\Softland\FBackup 5\bService.exe;c:\program files (x86)\Softland\FBackup 5\bService.exe [x]
S2 HPClientSvc;HP Client Services;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe [x]
S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [x]
S2 HPWMISVC;HPWMISVC;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [x]
S2 IconMan_R;IconMan_R;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [x]
S2 LavasoftTcpService;LavasoftTcpService;c:\program files (x86)\Lavasoft\Web Companion\TcpService\2.2.9.5\LavasoftTcpService.exe;c:\program files (x86)\Lavasoft\Web Companion\TcpService\2.2.9.5\LavasoftTcpService.exe [x]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [x]
S2 MBAMService;MBAMService;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [x]
S2 SearchProtectionService;IE Search Set;c:\program files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.WinService.exe;c:\program files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.WinService.exe [x]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [x]
S2 sp_rsdrv2;Spyware Terminator Driver Filter;c:\windows\system32\DRIVERS\stflt.sys;c:\windows\SYSNATIVE\DRIVERS\stflt.sys [x]
S2 ST2012_Svc;Spyware Terminator 2012 Realtime Shield Service;c:\program files (x86)\Spyware Terminator\st_rsser64.exe;c:\program files (x86)\Spyware Terminator\st_rsser64.exe [x]
S2 TomTomHOMEService;TomTomHOMEService;c:\program files (x86)\TomTom HOME 2\TomTomHOMEService.exe;c:\program files (x86)\TomTom HOME 2\TomTomHOMEService.exe [x]
S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys;c:\windows\SYSNATIVE\DRIVERS\amdiox64.sys [x]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys;c:\windows\SYSNATIVE\DRIVERS\clwvd.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys;c:\windows\SYSNATIVE\drivers\MBAMSwissArmy.sys [x]
S3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]
S3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys;c:\windows\SYSNATIVE\DRIVERS\netr28x.sys [x]
S3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys;c:\windows\SYSNATIVE\DRIVERS\RtsPStor.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [x]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys;c:\windows\SYSNATIVE\DRIVERS\usbfilter.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - MBAMSWISSARMY
.
Inhalt des "geplante Tasks" Ordners
.
2015-03-02 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-22 08:14]
.
2015-02-28 c:\windows\Tasks\HPCeeScheduleForxxx-NB.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13 20:15]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt1"]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12 185824 ----a-w- c:\users\xxx-NB\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt2"]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12 185824 ----a-w- c:\users\xxx-NB\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt3"]
@="{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12 185824 ----a-w- c:\users\xxx-NB\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt4"]
@="{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12 185824 ----a-w- c:\users\xxx-NB\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt5"]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12 185824 ----a-w- c:\users\xxx-NB\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt6"]
@="{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12 185824 ----a-w- c:\users\xxx-NB\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt7"]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12 185824 ----a-w- c:\users\xxx-NB\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt8"]
@="{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12 185824 ----a-w- c:\users\xxx-NB\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2011-01-11 6602856]
"SetDefault"="c:\program files\Hewlett-Packard\HP LaunchBox\SetDefault.exe" [2011-06-27 42808]
"SpywareTerminatorShield"="c:\program files (x86)\Spyware Terminator\SpywareTerminatorShield.exe" [2013-04-03 2777736]
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\xxx-NB\AppData\Roaming\Mozilla\Firefox\Profiles\4c8imuhi.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - prefs.js: keyword.URL - hxxp://www.google.de
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
URLSearchHooks-{5786d022-540e-4699-b350-b4be0ae94b79} - (no file)
Wow6432Node-HKLM-Run-Easybits Recovery - c:\program files (x86)\EasyBits For Kids\ezRecover.exe
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE} - c:\program files (x86)\InstallShield Installation Information\{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}\setup.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\windows\SysWOW64\ezSharedSvcHost.exe
c:\program files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
c:\program files (x86)\ Malwarebytes Anti-Malware \mbam.exe
c:\program files (x86)\CyberLink\YouCam\YCMMirage.exe
c:\program files (x86)\Adobe\Reader 11.0\Reader\Reader_sl.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2015-03-02 17:05:01 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2015-03-02 16:04
.
Vor Suchlauf: 16 Verzeichnis(se), 394.045.059.072 Bytes frei
Nach Suchlauf: 24 Verzeichnis(se), 393.972.158.464 Bytes frei
.
- - End Of File - - 8EAF2071F82A04B3F672F36D9C7B25EB
A36C5E4F47E84449FF07ED3517B43A31
Annoo |
|
03.03.2015, 07:08
| #6 |
| /// the machine /// TB-Ausbilder | Ungewünschte Werbebanner Firefox Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ --> Ungewünschte Werbebanner Firefox |
|
03.03.2015, 09:41
| #7 |
| | Logfiles divers Hallo Schrauber, hier nun die Logfiles: Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 03.03.2015 Suchlauf-Zeit: 07:35:56 Logdatei: malwarbytes-logfile.txt Administrator: Ja Version: 2.00.4.1028 Malware Datenbank: v2015.03.03.01 Rootkit Datenbank: v2015.02.25.01 Lizenz: Premium Malware Schutz: Aktiviert Bösartiger Webseiten Schutz: Aktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: xxx-NB Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 361630 Verstrichene Zeit: 49 Min, 35 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Warnen PUM: Aktiviert Prozesse: 0 (Keine schädliche Elemente erkannt) Module: 0 (Keine schädliche Elemente erkannt) Registrierungsschlüssel: 0 (Keine schädliche Elemente erkannt) Registrierungswerte: 0 (Keine schädliche Elemente erkannt) Registrierungsdaten: 0 (Keine schädliche Elemente erkannt) Ordner: 0 (Keine schädliche Elemente erkannt) Dateien: 0 (Keine schädliche Elemente erkannt) Physische Sektoren: 0 (Keine schädliche Elemente erkannt) (end) Code:
ATTFilter # AdwCleaner v4.111 - Bericht erstellt 03/03/2015 um 08:49:56
# Aktualisiert 18/02/2015 von Xplode
# Datenbank : 2015-03-02.3 [Server]
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (x64)
# Benutzername : xxx-NB - xxx-NB-HP
# Gestarted von : C:\Users\xxx-NB\Downloads\AdwCleaner_4.111(1).exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\Users\xxx-NB\Documents\Updater
***** [ Geplante Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
***** [ Internetbrowser ] *****
-\\ Internet Explorer v9.0.8112.16609
-\\ Mozilla Firefox v36.0 (x86 de)
-\\ Google Chrome v
-\\ Opera v0.0.0.0
*************************
AdwCleaner[R0].txt - [8586 Bytes] - [27/02/2015 21:07:30]
AdwCleaner[R1].txt - [1027 Bytes] - [03/03/2015 08:28:51]
AdwCleaner[S0].txt - [8388 Bytes] - [27/02/2015 22:36:10]
AdwCleaner[S1].txt - [951 Bytes] - [03/03/2015 08:49:56]
########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1009 Bytes] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.3 (03.01.2015:1)
OS: Windows 7 Home Premium x64
Ran by xxx-NB on 03.03.2015 at 9:00:43,93
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{85A60A59-D3D8-468F-B598-FB4393789EF4}
~~~ Files
~~~ Folders
Successfully deleted: [Folder] "C:\Program Files (x86)\myfree codec"
~~~ FireFox
Successfully deleted the following from C:\Users\xxx-NB\AppData\Roaming\mozilla\firefox\profiles\4c8imuhi.default\prefs.js
user_pref("CT2481020_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\":1360769101122,\"isWithState\":\"\",\"timeFromStart\":0,\"timeFromPrev\":0}
Emptied folder: C:\Users\xxx-NB\AppData\Roaming\mozilla\firefox\profiles\4c8imuhi.default\minidumps [186 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 03.03.2015 at 9:11:51,99
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-03-2015 Ran by xxx-NB (administrator) on xxx-NB-HP on 03-03-2015 09:28:23 Running from C:\Users\xxx-NB\Downloads Loaded Profiles: xxx-NB (Available profiles: xxx-NB) Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 9 (Default browser: IE) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (AMD) C:\Windows\System32\atiesrxx.exe (AMD) C:\Windows\System32\atieclxx.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe (Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Crawler.com) C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe (Sony) C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe (Copernic Inc.) C:\Program Files (x86)\Copernic Desktop Search - Home\DesktopSearchService.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe () C:\Program Files\Hewlett-Packard\HP LaunchBox\HPTaskBar1.exe (Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP LaunchBox\HPTaskBar2.exe (Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe (DATA BECKER GmbH & Co KG) C:\Program Files (x86)\Common Files\DATA BECKER Shared\DBService.exe (Softland) C:\Program Files (x86)\Softland\FBackup 5\bTray.exe (Lavasoft) C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe (Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe (SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE (Dropbox, Inc.) C:\Users\xxx-NB\AppData\Roaming\Dropbox\bin\Dropbox.exe (SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE () C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanionInfo.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe (Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe (Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe (Lavasoft Limited) C:\Program Files (x86)\Lavasoft\Web Companion\TcpService\2.2.9.5\LavasoftTcpService.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (Nero AG) C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Crawler.com) C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe (TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_305.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_305.exe (Copernic Inc.) C:\Program Files (x86)\Copernic Desktop Search - Home\DesktopSearch.exe (Farbar) C:\Users\xxx-NB\Downloads\FRST64(1).exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6602856 2011-01-11] (Realtek Semiconductor) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2799912 2011-06-10] (Synaptics Incorporated) HKLM\...\Run: [SetDefault] => C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe [42808 2011-06-27] (Hewlett-Packard Development Company, L.P.) HKLM\...\Run: [SpywareTerminatorShield] => C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe [2777736 2013-04-03] (Crawler.com) HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-07-05] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [HPQuickWebProxy] => C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe [168504 2011-06-28] (Hewlett-Packard Company) HKLM-x32\...\Run: [NeroCheck] => C:\Windows\SysWOW64\NeroCheck.exe [155648 2001-07-09] (Ahead Software Gmbh) HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [578944 2012-03-05] (Hewlett-Packard Development Company, L.P.) HKLM-x32\...\Run: [HPOSD] => C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960 2011-08-19] (Hewlett-Packard Development Company, L.P.) HKLM-x32\...\Run: [] => [X] HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [127792 2015-02-12] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-11-24] (Avira Operations GmbH & Co. KG) HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1 HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\Run: [Sony PC Companion] => C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe [466144 2014-11-27] (Sony) HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\Run: [Copernic Desktop Search - Home] => C:\Program Files (x86)\Copernic Desktop Search - Home\DesktopSearchService.exe [1692200 2013-01-28] (Copernic Inc.) HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\Run: [TomTomHOME.exe] => C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248176 2014-06-05] (TomTom) HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\Run: [FBackup 5 Tray Agent] => C:\Program Files (x86)\Softland\FBackup 5\bTray.exe [7862840 2014-09-30] (Softland) HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\Run: [Web Companion] => C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe [1467200 2014-11-27] (Lavasoft) HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [30877280 2014-12-11] (Skype Technologies S.A.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk ShortcutTarget: Microsoft Office.lnk -> C:\Program Files (x86)\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation) Startup: C:\Users\xxx-NB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk ShortcutTarget: Adobe Gamma.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.) Startup: C:\Users\xxx-NB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\xxx-NB\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\xxx-NB\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\xxx-NB\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\xxx-NB\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\xxx-NB\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\xxx-NB\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\xxx-NB\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\xxx-NB\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\xxx-NB\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-1588870830-359060440-1081868607-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome HKU\S-1-5-21-1588870830-359060440-1081868607-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ HKU\S-1-5-21-1588870830-359060440-1081868607-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms} SearchScopes: HKLM -> {F508C8AB-762D-4759-BA05-C8D219F6E582} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms} SearchScopes: HKLM-x32 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms} SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms} SearchScopes: HKLM-x32 -> {F508C8AB-762D-4759-BA05-C8D219F6E582} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms} SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-1588870830-359060440-1081868607-1001 -> {70DDF8F1-81D4-4DFA-B8E3-6E3A6E6EA9EF} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms} SearchScopes: HKU\S-1-5-21-1588870830-359060440-1081868607-1001 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms} SearchScopes: HKU\S-1-5-21-1588870830-359060440-1081868607-1001 -> {F508C8AB-762D-4759-BA05-C8D219F6E582} URL = BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard) BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard) Toolbar: HKU\S-1-5-21-1588870830-359060440-1081868607-1001 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File Handler-x32: http - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: http - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: https - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: https - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: ipp - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: msdaipp - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: msdaipp - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation) Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\xxx-NB\AppData\Roaming\Mozilla\Firefox\Profiles\4c8imuhi.default FF NewTab: hxxp://www.google.de/ FF SelectedSearchEngine: Google FF Homepage: hxxp://www.google.de/ FF Keyword.URL: hxxp://www.google.de FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll () FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1216156.dll (Adobe Systems, Inc.) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @videolan.org/vlc,version=2.0.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\9\NP_wtapp.dll () FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKU\S-1-5-21-1588870830-359060440-1081868607-1001: sony.com/MediaGoDetector -> C:\Program Files (x86)\Sony\Media Go\npMediaGoDetector.dll (Sony Network Entertainment International LLC) FF SearchPlugin: C:\Users\xxx-NB\AppData\Roaming\Mozilla\Firefox\Profiles\4c8imuhi.default\searchplugins\google-images.xml FF SearchPlugin: C:\Users\xxx-NB\AppData\Roaming\Mozilla\Firefox\Profiles\4c8imuhi.default\searchplugins\google-maps.xml FF Extension: 20-20 3D Viewer - IKEA - C:\Users\xxx-NB\AppData\Roaming\Mozilla\Firefox\Profiles\4c8imuhi.default\Extensions\2020Player_IKEA@2020Technologies.com [2014-11-17] FF Extension: Avira Browser Safety - C:\Users\xxx-NB\AppData\Roaming\Mozilla\Firefox\Profiles\4c8imuhi.default\Extensions\abs@avira.com [2015-02-27] FF Extension: Adblock Plus - C:\Users\xxx-NB\AppData\Roaming\Mozilla\Firefox\Profiles\4c8imuhi.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-08-11] FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2015-01-18] FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-01-18] FF HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\Firefox\Extensions: [{57319509-7821-41B0-9FDF-3B58F146AE33}] - c:\program files (x86)\copernic desktop search - home\firefoxconnector FF Extension: Copernic Desktop Search - Search Firefox content - c:\program files (x86)\copernic desktop search - home\firefoxconnector [2013-07-31] Chrome: ======= CHR StartupUrls: Default -> "hxxp://www.google.de/" CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter} CHR Profile: C:\Users\xxx-NB\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Docs) - C:\Users\xxx-NB\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-03] CHR Extension: (Google Drive) - C:\Users\xxx-NB\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-03] CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\xxx-NB\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-02-21] CHR Extension: (YouTube) - C:\Users\xxx-NB\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-03] CHR Extension: (Google Search) - C:\Users\xxx-NB\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-03] CHR Extension: (Avira Browser Safety) - C:\Users\xxx-NB\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2015-02-21] CHR Extension: (Skype Click to Call) - C:\Users\xxx-NB\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2015-02-21] CHR Extension: (Google Wallet) - C:\Users\xxx-NB\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-03] CHR Extension: (Gmail) - C:\Users\xxx-NB\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-03] CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2014-07-18] (Adobe Systems) [File not signed] R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [365568 2011-07-05] (Advanced Micro Devices, Inc.) [File not signed] R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-11-24] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-11-24] (Avira Operations GmbH & Co. KG) R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [184056 2015-02-12] (Avira Operations GmbH & Co. KG) R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation) R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation) R2 DBService; C:\Program Files (x86)\Common Files\DATA BECKER Shared\DBService.exe [189776 2010-10-28] (DATA BECKER GmbH & Co KG) R2 ezSharedSvc; C:\Windows\SysWOW64\ezSharedSvcHost.exe [514232 2010-04-23] (EasyBits Software AS) [File not signed] S2 FBackup5Srv; C:\Program Files (x86)\Softland\FBackup 5\bService.exe [4642360 2014-09-30] (Softland) S3 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [227904 2014-03-12] (WildTangent) R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2013-11-04] (Hewlett-Packard Company) [File not signed] R2 IconMan_R; C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [1817088 2010-12-28] (Realsil Microelectronics Inc.) [File not signed] R2 LavasoftTcpService; C:\Program Files (x86)\Lavasoft\Web Companion\TcpService\2.2.9.5\LavasoftTcpService.exe [1351512 2014-11-27] (Lavasoft Limited) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation) S2 SearchProtectionService; C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.WinService.exe [15208 2014-11-27] () R2 ST2012_Svc; C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe [1149104 2013-04-03] (Crawler.com) S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-11-24] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-11-24] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-11-24] (Avira Operations GmbH & Co. KG) S3 ggsomc; C:\Windows\System32\DRIVERS\ggsomc.sys [30424 2014-07-17] (Sony Mobile Communications) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-03-03] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation) R2 sp_rsdrv2; C:\Windows\System32\DRIVERS\stflt.sys [51496 2013-11-12] (Windows (R) Win 7 DDK provider) S3 catchme; \??\C:\ComboFix\catchme.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-03-03 09:27 - 2015-03-03 09:27 - 02092544 _____ (Farbar) C:\Users\xxx-NB\Downloads\FRST64(1).exe 2015-03-03 09:11 - 2015-03-03 09:11 - 00001437 _____ () C:\Users\xxx-NB\Desktop\JRT.txt 2015-03-03 09:00 - 2015-03-03 09:00 - 01388333 _____ (Thisisu) C:\Users\xxx-NB\Downloads\JRT.exe 2015-03-03 08:27 - 2015-03-03 08:27 - 02126848 _____ () C:\Users\xxx-NB\Downloads\AdwCleaner_4.111(1).exe 2015-03-02 17:21 - 2015-03-02 17:21 - 00026096 _____ () C:\Users\xxx-NB\Documents\ComboFix-AN.txt 2015-03-02 17:05 - 2015-03-02 17:05 - 00026171 _____ () C:\ComboFix.txt 2015-03-02 15:35 - 2015-03-02 17:05 - 00000000 ____D () C:\Qoobox 2015-03-02 15:35 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe 2015-03-02 15:35 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe 2015-03-02 15:35 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2015-03-02 15:35 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2015-03-02 15:35 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2015-03-02 15:35 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe 2015-03-02 15:35 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe 2015-03-02 15:35 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe 2015-03-02 15:34 - 2015-03-02 17:00 - 00000000 ____D () C:\Windows\erdnt 2015-03-02 15:33 - 2015-03-02 15:33 - 05612482 ____R (Swearware) C:\Users\xxx-NB\Downloads\ComboFix.exe 2015-03-02 12:34 - 2015-03-02 12:34 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\xxx-NB\Downloads\revosetup95.exe 2015-03-02 12:34 - 2015-03-02 12:34 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group 2015-03-02 11:26 - 2015-03-02 11:27 - 00103576 _____ () C:\Users\xxx-NB\Downloads\abasan2.ttf 2015-03-01 16:45 - 2015-03-01 17:16 - 00040115 _____ () C:\Users\xxx-NB\Downloads\Addition.txt 2015-03-01 16:41 - 2015-03-03 09:28 - 00026655 _____ () C:\Users\xxx-NB\Downloads\FRST.txt 2015-03-01 16:41 - 2015-03-03 09:28 - 00000000 ____D () C:\FRST 2015-03-01 16:38 - 2015-03-01 16:38 - 02092544 _____ (Farbar) C:\Users\xxx-NB\Downloads\FRST64.exe 2015-02-28 18:42 - 2015-02-28 18:42 - 00000000 _____ () C:\Users\xxx-NB\defogger_reenable 2015-02-28 18:41 - 2015-02-28 18:44 - 00000480 _____ () C:\Users\xxx-NB\Downloads\defogger_disable.log 2015-02-28 18:41 - 2015-02-28 18:41 - 00000252 _____ () C:\Users\xxx-NB\Downloads\defogger_enable.log 2015-02-28 18:39 - 2015-02-28 18:39 - 00050477 _____ () C:\Users\xxx-NB\Downloads\Defogger.exe 2015-02-28 16:57 - 2015-03-01 09:06 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\10777241.sys 2015-02-28 16:44 - 2015-02-28 16:44 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2015-02-28 16:43 - 2015-02-28 16:43 - 20447120 _____ (Malwarebytes Corporation ) C:\Users\xxx-NB\Downloads\mbam_premium.exe 2015-02-28 14:58 - 2015-02-28 16:48 - 00000348 _____ () C:\Windows\Tasks\HPCeeScheduleForxxx-NB.job 2015-02-28 14:58 - 2015-02-28 14:58 - 00003210 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForxxx-NB 2015-02-28 14:47 - 2015-02-28 14:44 - 00043064 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys 2015-02-27 23:04 - 2015-02-27 23:04 - 00000000 ____D () C:\Users\xxx-NB\AppData\Roaming\Avira 2015-02-27 22:58 - 2014-11-24 10:23 - 00131608 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys 2015-02-27 22:58 - 2014-11-24 10:23 - 00119272 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys 2015-02-27 22:58 - 2014-11-24 10:23 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys 2015-02-27 22:54 - 2015-02-27 23:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira 2015-02-27 22:51 - 2015-02-27 22:51 - 04582672 _____ (Avira Operations & Co. KG) C:\Users\xxx-NB\Downloads\avira_de_av_5876132996__ws.exe 2015-02-27 21:07 - 2015-03-03 08:49 - 00000000 ____D () C:\AdwCleaner 2015-02-27 21:07 - 2015-02-27 21:07 - 02126848 _____ () C:\Users\xxx-NB\Downloads\AdwCleaner_4.111.exe 2015-02-26 20:02 - 2015-03-03 08:52 - 00000672 _____ () C:\Windows\setupact.log 2015-02-26 20:02 - 2015-03-02 16:48 - 00135728 _____ () C:\Windows\PFRO.log 2015-02-26 20:02 - 2015-02-26 20:02 - 00000000 _____ () C:\Windows\setuperr.log 2015-02-26 18:18 - 2015-03-03 08:58 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2015-02-26 18:18 - 2015-02-28 16:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2015-02-26 18:18 - 2015-02-28 16:44 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2015-02-26 18:18 - 2014-11-21 07:08 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2015-02-26 18:18 - 2014-11-21 07:07 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2015-02-26 18:18 - 2014-11-21 07:07 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2015-02-26 18:14 - 2015-02-26 18:17 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\xxx-NB\Downloads\mbam-setup-2.0.4.1028.exe 2015-02-25 23:19 - 2015-01-09 00:44 - 00419936 _____ () C:\Windows\SysWOW64\locale.nls 2015-02-25 23:19 - 2015-01-09 00:43 - 00419936 _____ () C:\Windows\system32\locale.nls 2015-02-25 20:10 - 2015-01-09 04:14 - 00950272 _____ (Microsoft Corporation) C:\Windows\system32\perftrack.dll 2015-02-25 20:10 - 2015-01-09 04:14 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\wdi.dll 2015-02-25 20:10 - 2015-01-09 04:14 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\powertracker.dll 2015-02-25 20:10 - 2015-01-09 03:48 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdi.dll 2015-02-25 18:22 - 2015-02-25 19:00 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird 2015-02-15 11:50 - 2015-01-23 05:07 - 02339840 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2015-02-15 11:50 - 2015-01-23 04:59 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2015-02-15 11:50 - 2015-01-23 04:00 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2015-02-15 11:50 - 2015-01-23 03:51 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2015-02-14 14:18 - 2015-01-14 04:08 - 17878016 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2015-02-14 14:18 - 2015-01-14 03:59 - 10924032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2015-02-14 14:18 - 2015-01-14 03:59 - 00448512 _____ (Microsoft Corporation) C:\Windows\system32\html.iec 2015-02-14 14:18 - 2015-01-14 03:49 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2015-02-14 14:18 - 2015-01-14 03:49 - 01388032 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2015-02-14 14:18 - 2015-01-14 03:47 - 01494016 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2015-02-14 14:18 - 2015-01-14 03:47 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2015-02-14 14:18 - 2015-01-14 03:47 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2015-02-14 14:18 - 2015-01-14 03:47 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2015-02-14 14:18 - 2015-01-14 03:46 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2015-02-14 14:18 - 2015-01-14 03:46 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2015-02-14 14:18 - 2015-01-14 03:45 - 02157056 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2015-02-14 14:18 - 2015-01-14 03:45 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2015-02-14 14:18 - 2015-01-14 03:45 - 00282112 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2015-02-14 14:18 - 2015-01-14 03:44 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2015-02-14 14:18 - 2015-01-14 03:44 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2015-02-14 14:18 - 2015-01-14 03:44 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2015-02-14 14:18 - 2015-01-14 03:44 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll 2015-02-14 14:18 - 2015-01-14 03:44 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe 2015-02-14 14:18 - 2015-01-14 03:44 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe 2015-02-14 14:18 - 2015-01-14 02:51 - 12371456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2015-02-14 14:18 - 2015-01-14 02:49 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec 2015-02-14 14:18 - 2015-01-14 02:46 - 09742336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2015-02-14 14:18 - 2015-01-14 02:43 - 01139712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2015-02-14 14:18 - 2015-01-14 02:42 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2015-02-14 14:18 - 2015-01-14 02:42 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2015-02-14 14:18 - 2015-01-14 02:41 - 01802752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2015-02-14 14:18 - 2015-01-14 02:41 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2015-02-14 14:18 - 2015-01-14 02:41 - 00421376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2015-02-14 14:18 - 2015-01-14 02:41 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll 2015-02-14 14:18 - 2015-01-14 02:41 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2015-02-14 14:18 - 2015-01-14 02:41 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2015-02-14 14:18 - 2015-01-14 02:40 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2015-02-14 14:18 - 2015-01-14 02:40 - 00353792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2015-02-14 14:18 - 2015-01-14 02:40 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2015-02-14 14:18 - 2015-01-14 02:40 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2015-02-14 14:18 - 2015-01-14 02:40 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2015-02-14 14:18 - 2015-01-14 02:40 - 00041472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll 2015-02-14 14:18 - 2015-01-14 02:40 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe 2015-02-14 14:18 - 2015-01-14 02:40 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe 2015-02-14 13:12 - 2015-02-14 13:12 - 00161792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll 2015-02-14 13:12 - 2015-02-14 13:12 - 00074752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe 2015-02-14 13:11 - 2015-02-14 13:11 - 03695416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat 2015-02-14 13:11 - 2015-02-14 13:11 - 03695416 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat 2015-02-14 13:11 - 2015-02-14 13:11 - 00534528 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00434176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00403248 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00353584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00267776 _____ (Microsoft Corporation) C:\Windows\system32\ieaksie.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00249344 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00227840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieaksie.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00222208 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00203776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe 2015-02-14 13:11 - 2015-02-14 13:11 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieakui.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\ieakui.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00162304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00160256 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe 2015-02-14 13:11 - 2015-02-14 13:11 - 00160256 _____ (Microsoft Corporation) C:\Windows\system32\ieakeng.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00152064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe 2015-02-14 13:11 - 2015-02-14 13:11 - 00150528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe 2015-02-14 13:11 - 2015-02-14 13:11 - 00149504 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00145920 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00135168 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00130560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieakeng.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00123392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00118784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00114176 _____ (Microsoft Corporation) C:\Windows\system32\admparse.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00110592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00101888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\admparse.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00091648 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe 2015-02-14 13:11 - 2015-02-14 13:11 - 00089088 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe 2015-02-14 13:11 - 2015-02-14 13:11 - 00089088 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2015-02-14 13:11 - 2015-02-14 13:11 - 00086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00078848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe 2015-02-14 13:11 - 2015-02-14 13:11 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx 2015-02-14 13:11 - 2015-02-14 13:11 - 00074752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ie4uinit.exe 2015-02-14 13:11 - 2015-02-14 13:11 - 00066048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00063488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx 2015-02-14 13:11 - 2015-02-14 13:11 - 00054272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00049664 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00035840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00031744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00023552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll 2015-02-13 11:03 - 2015-02-26 18:27 - 00000000 ____D () C:\Users\xxx-NB\AppData\Local\PDFCreator 2015-02-11 22:09 - 2015-02-11 22:09 - 00010495 _____ () C:\Users\xxx-NB\Downloads\xxx_elster_11.02.2015.pfx 2015-02-11 16:33 - 2015-02-14 13:54 - 00001405 _____ () C:\Users\xxx-NB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk 2015-02-11 08:03 - 2015-02-04 04:16 - 00894976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll 2015-02-11 08:03 - 2015-02-04 04:16 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll 2015-02-11 08:03 - 2015-02-04 04:16 - 00609280 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll 2015-02-11 08:03 - 2015-02-04 04:16 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll 2015-02-11 08:03 - 2015-02-04 04:16 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2015-02-11 08:03 - 2015-02-04 04:16 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll 2015-02-11 08:03 - 2015-02-04 04:13 - 01098752 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2015-02-11 08:03 - 2015-01-28 00:36 - 01239720 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe 2015-02-11 08:01 - 2015-01-15 09:14 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2015-02-11 08:01 - 2015-01-15 09:14 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys 2015-02-11 08:01 - 2015-01-15 09:09 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2015-02-11 08:01 - 2015-01-15 09:09 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll 2015-02-11 08:01 - 2015-01-15 09:09 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe 2015-02-11 08:01 - 2015-01-15 09:09 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll 2015-02-11 08:01 - 2015-01-15 09:09 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll 2015-02-11 08:01 - 2015-01-15 09:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe 2015-02-11 08:01 - 2015-01-15 09:06 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll 2015-02-11 08:01 - 2015-01-15 09:06 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll 2015-02-11 08:01 - 2015-01-15 09:04 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll 2015-02-11 08:01 - 2015-01-15 08:42 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe 2015-02-11 08:01 - 2015-01-15 08:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2015-02-11 08:01 - 2015-01-15 08:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2015-02-11 08:01 - 2015-01-15 08:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll 2015-02-11 08:01 - 2015-01-15 08:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll 2015-02-11 08:01 - 2015-01-15 08:37 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll 2015-02-11 08:01 - 2015-01-15 05:22 - 00458824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys 2015-02-11 08:01 - 2015-01-13 04:10 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2015-02-11 08:01 - 2015-01-13 03:49 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll 2015-02-11 08:00 - 2014-12-12 06:31 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll 2015-02-11 08:00 - 2014-12-12 06:07 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll 2015-02-11 08:00 - 2014-07-07 03:07 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll 2015-02-11 08:00 - 2014-07-07 03:06 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll 2015-02-11 08:00 - 2014-07-07 02:40 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll 2015-02-11 08:00 - 2014-07-07 02:40 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll 2015-02-11 07:59 - 2014-11-26 04:53 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll 2015-02-11 07:59 - 2014-11-26 04:32 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll 2015-02-11 07:59 - 2014-10-04 03:10 - 03722752 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll 2015-02-11 07:59 - 2014-10-04 02:42 - 03221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll 2015-02-11 07:59 - 2014-10-04 02:42 - 00131584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll 2015-02-11 07:56 - 2015-01-14 07:09 - 05554112 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2015-02-11 07:56 - 2015-01-14 07:05 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll 2015-02-11 07:56 - 2015-01-14 07:05 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll 2015-02-11 07:56 - 2015-01-14 07:04 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe 2015-02-11 07:56 - 2015-01-14 06:44 - 03972544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2015-02-11 07:56 - 2015-01-14 06:44 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2015-02-11 07:56 - 2015-01-14 06:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll 2015-02-11 07:56 - 2014-12-08 04:09 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll 2015-02-11 07:56 - 2014-12-08 03:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll 2015-02-11 07:53 - 2015-01-09 03:03 - 03201536 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2015-02-10 23:01 - 2015-02-10 23:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator 2015-02-10 23:00 - 2015-02-26 17:47 - 00000000 ____D () C:\Program Files\PDFCreator 2015-02-10 23:00 - 2015-02-10 23:00 - 00000000 ____D () C:\Users\xxx-NB\AppData\Roaming\Opera Software 2015-02-10 23:00 - 2015-02-10 23:00 - 00000000 ____D () C:\Users\xxx-NB\AppData\Local\Opera Software 2015-02-10 23:00 - 2015-01-22 16:14 - 00114872 _____ (pdfforge GmbH) C:\Windows\system32\pdfcmon.dll 2015-02-10 22:58 - 2015-02-11 15:59 - 00000000 ____D () C:\Program Files (x86)\Opera 2015-02-10 22:49 - 2015-02-10 22:49 - 27721680 _____ (pdfforge ) C:\Users\xxx-NB\Downloads\PDFCreator-2_0_2-setup(1).exe 2015-02-10 16:50 - 2015-02-10 16:50 - 00001464 _____ () C:\Users\Public\Desktop\ElsterFormular.lnk 2015-02-10 16:50 - 2015-02-10 16:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ElsterFormular 2015-02-10 16:48 - 2015-02-10 16:48 - 00000000 ____D () C:\Program Files (x86)\ElsterFormular 2015-02-10 16:45 - 2015-02-10 16:46 - 215975048 _____ (Landesfinanzdirektion Thüringen) C:\Users\xxx-NB\Downloads\ElsterFormular-16.0.20150113k.exe 2015-02-05 11:21 - 2015-02-05 11:21 - 115978680 _____ (Landesfinanzdirektion Thüringen) C:\Users\xxx-NB\Downloads\ElsterFormular-16.0.20150113p.exe 2015-02-05 11:13 - 2015-02-05 11:14 - 176389328 _____ (Landesfinanzdirektion Thüringen) C:\Users\xxx-NB\Downloads\ElsterFormular-16.0.20150113u(1).exe 2015-02-05 09:14 - 2015-02-05 09:14 - 05070512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe 2015-02-04 21:24 - 2015-02-10 10:49 - 00000000 ____D () C:\Users\xxx-NB\Desktop\steuerformulare 2015-02-04 21:22 - 2015-02-10 16:51 - 00000000 ____D () C:\Users\xxx-NB\AppData\Roaming\elsterformular 2015-02-04 20:52 - 2015-02-05 11:23 - 00000000 ____D () C:\ProgramData\elsterformular 2015-02-04 20:43 - 2015-02-04 20:45 - 176389328 _____ (Landesfinanzdirektion Thüringen) C:\Users\xxx-NB\Downloads\ElsterFormular-16.0.20150113u.exe 2015-02-01 13:13 - 2015-02-01 13:13 - 00000000 ____D () C:\Users\xxx-NB\Documents\Steuer-Sparbuch 2015-02-01 12:58 - 2015-02-01 13:16 - 27721680 _____ (pdfforge ) C:\Users\xxx-NB\Downloads\PDFCreator-2_0_2-setup.exe 2015-02-01 12:14 - 2015-02-01 12:14 - 00000000 ____D () C:\Users\xxx-NB\AppData\Roaming\Buhl Data Service 2015-02-01 12:14 - 2015-02-01 12:14 - 00000000 ____D () C:\Users\xxx-NB\AppData\Local\Buhl Data Service 2015-02-01 12:10 - 2015-02-01 12:17 - 00000000 ____D () C:\Users\xxx-NB\AppData\Local\Buhl 2015-02-01 12:10 - 2015-02-01 12:14 - 00000103 _____ () C:\Windows\wiso.ini 2015-02-01 11:50 - 2015-02-01 11:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WISO Steuer-Sparbuch 2015 2015-02-01 11:46 - 2015-02-01 11:46 - 00000000 ____D () C:\Program Files (x86)\WISO 2015-02-01 11:44 - 2015-02-01 12:10 - 00000000 ____D () C:\ProgramData\Buhl Data Service GmbH ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-03-03 09:28 - 2012-01-28 21:58 - 00000000 ____D () C:\Users\xxx-NB\AppData\Roaming\Skype 2015-03-03 09:14 - 2015-01-22 12:57 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2015-03-03 09:04 - 2009-07-14 05:45 - 00031856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-03-03 09:04 - 2009-07-14 05:45 - 00031856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-03-03 08:55 - 2014-09-22 17:53 - 00000000 ___RD () C:\Users\xxx-NB\Dropbox 2015-03-03 08:55 - 2014-04-08 08:19 - 00000000 ____D () C:\Users\xxx-NB\AppData\Roaming\Dropbox 2015-03-03 08:52 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-03-03 08:50 - 2011-11-07 10:37 - 01340383 _____ () C:\Windows\WindowsUpdate.log 2015-03-02 17:16 - 2012-01-26 15:21 - 00080040 _____ () C:\Users\xxx-NB\AppData\Local\GDIPFONTCACHEV1.DAT 2015-03-02 17:05 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default 2015-03-02 16:54 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini 2015-03-02 16:50 - 2009-07-14 05:45 - 00330216 _____ () C:\Windows\system32\FNTCACHE.DAT 2015-03-02 09:50 - 2012-01-26 15:23 - 00003962 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{DA7BE238-D6AB-4111-8246-3DC85ACF4280} 2015-03-01 09:05 - 2011-08-09 21:16 - 00700134 _____ () C:\Windows\system32\perfh007.dat 2015-03-01 09:05 - 2011-08-09 21:16 - 00149984 _____ () C:\Windows\system32\perfc007.dat 2015-03-01 09:05 - 2009-07-14 06:13 - 01622300 _____ () C:\Windows\system32\PerfStringBackup.INI 2015-02-28 18:42 - 2012-01-26 15:18 - 00000000 ____D () C:\Users\xxx-NB 2015-02-28 17:01 - 2013-02-08 18:09 - 00053248 _____ () C:\Users\xxx-NB\Documents\laggie.xls 2015-02-28 14:56 - 2012-02-07 10:23 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log 2015-02-27 22:58 - 2014-03-22 23:39 - 00000000 ____D () C:\ProgramData\Avira 2015-02-27 22:58 - 2014-03-22 23:39 - 00000000 ____D () C:\Program Files (x86)\Avira 2015-02-27 22:53 - 2014-08-05 09:35 - 00000000 ____D () C:\ProgramData\Package Cache 2015-02-27 22:11 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache 2015-02-27 20:59 - 2013-11-12 11:45 - 00000000 ____D () C:\ProgramData\Spyware Terminator 2015-02-27 20:57 - 2014-06-18 15:26 - 00000000 ____D () C:\Users\xxx-NB\AppData\Roaming\SoftGrid Client 2015-02-26 20:02 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\TAPI 2015-02-26 17:42 - 2012-03-03 18:11 - 00000000 ____D () C:\Users\xxx-NB\AppData\Local\CrashDumps 2015-02-26 17:42 - 2007-01-02 02:25 - 00000000 ____D () C:\Windows\Panther 2015-02-26 12:03 - 2014-07-22 13:57 - 00000000 ____D () C:\Users\xxx-NB\Documents\privat 2015-02-26 07:06 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing 2015-02-25 18:21 - 2015-01-18 14:17 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2015-02-25 18:21 - 2012-05-09 22:42 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2015-02-23 08:27 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows\system32\FxsTmp 2015-02-21 18:16 - 2014-05-03 18:27 - 00000000 ____D () C:\Program Files (x86)\Google 2015-02-14 13:54 - 2012-01-26 15:23 - 00001439 _____ () C:\Users\xxx-NB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2015-02-14 13:49 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions 2015-02-12 06:43 - 2014-12-10 16:39 - 00000000 ____D () C:\Windows\system32\appraiser 2015-02-12 06:43 - 2014-05-14 13:26 - 00000000 ___SD () C:\Windows\system32\CompatTel 2015-02-11 23:54 - 2014-06-18 13:45 - 00000000 ____D () C:\ProgramData\Microsoft Help 2015-02-11 23:49 - 2013-08-19 10:40 - 00000000 ____D () C:\Windows\system32\MRT 2015-02-11 23:36 - 2012-01-31 13:14 - 116773704 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2015-02-11 07:25 - 2014-09-22 12:34 - 00000000 ____D () C:\Users\xxx-NB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox 2015-02-10 22:51 - 2013-08-02 09:33 - 00000000 ____D () C:\Users\xxx-NB\Documents\steuern 2015-02-06 13:44 - 2014-07-21 13:36 - 00000000 ____D () C:\Users\xxx-NB\Documents\Uni 2015-02-05 09:14 - 2015-01-22 12:57 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2015-02-05 09:14 - 2015-01-22 12:57 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2015-02-05 09:14 - 2015-01-22 12:57 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2015-02-01 11:46 - 2011-08-09 12:26 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information ==================== Files in the root of some directories ======= 2014-12-01 13:18 - 2014-12-01 16:47 - 2929335 _____ () C:\Program Files (x86)\MysticThumbs.zip 2014-09-19 19:28 - 2014-09-19 19:28 - 0000000 _____ () C:\Users\xxx-NB\AppData\Roaming\downloads.m3u Files to move or delete: ==================== C:\Users\xxx-NB\ccsetup412.exe Some content of TEMP: ==================== C:\Users\xxx-NB\AppData\Local\Temp\avgnt.exe C:\Users\xxx-NB\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmplxg1wn.dll C:\Users\xxx-NB\AppData\Local\Temp\Quarantine.exe C:\Users\xxx-NB\AppData\Local\Temp\sqlite3.dll ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-02-27 21:37 ==================== End Of Log ============================ --- --- --- Gruss, Annoo |
|
03.03.2015, 09:47
| #8 |
| /// the machine /// TB-Ausbilder | Ungewünschte Werbebanner FirefoxESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
03.03.2015, 10:00
| #9 |
| | Installationsproblem Hallo, bei der Installation von ESET erscheint folgende Fehlermeldung: "Updates funktionieren nicht. Ist ein Proxy eingerichtet?" Was tun? Gruß, Annoo |
|
03.03.2015, 15:57
| #10 |
| /// the machine /// TB-Ausbilder | Ungewünschte Werbebanner Firefox Lass ESET weg. Lade Dir bitte von hier  Emsisoft Emergency Kit herunter.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
03.03.2015, 17:36
| #11 |
| | Ungewünschte Werbebanner Firefox Hallo, soll ich das Emsisoft Emergency Kit herunter laden nachdem ich den SecurityCheck gemacht habe oder soll ich den SecurityCheck auch auslassen? Gruß Annoo Ach und ich kann seit heute mein Corel Draw nicht mehr öffnen, ich bekomme die Fehlermeldung Microsoft Visual C++ Runtime error, "abnormal programm termination".  Hängt das damit zusammen und was kann ich dagegen tun?Gruß und Danke vorab Annoo |
|
04.03.2015, 08:40
| #12 |
| /// the machine /// TB-Ausbilder | Ungewünschte Werbebanner Firefox Microsoft Visual C++ Runtime deinstallieren, über Windows Update neu laden. Reihenfolge von EEK und Securitycheck is egal
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
04.03.2015, 16:07
| #13 |
| | Ungewünschte Werbebanner Firefox Hallo, hier die Datan bzw. Funde: Code:
ATTFilter Results of screen317's Security Check version 0.99.96 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 11 ``````````````Antivirus/Firewall Check:`````````````` Avira Desktop Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` Ad-Aware Spyware Terminator 2012 Java 64-bit 8 Update 31 Adobe Flash Player 16.0.0.305 Adobe Reader XI Mozilla Firefox (36.0) Mozilla Thunderbird (31.5.0) ````````Process Check: objlist.exe by Laurent```````` Ad-Aware AAWService.exe is disabled! Ad-Aware AAWTray.exe is disabled! Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbam.exe Avira Antivir avgnt.exe Avira Antivir avguard.exe Malwarebytes Anti-Malware mbamscheduler.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` Code:
ATTFilter Emsisoft Emergency Kit - Version 9.0
Letztes Update: 04.03.2015 11:04:18
Benutzerkonto: xxx-NB-HP\xxx-NB
Scan-Einstellungen:
Scan Methode: Detail-Scan
Objekte: Rootkits, Speicher, Traces, C:\, D:\, E:\, G:\, Q:\
PUPs-Erkennung: An
Archiv-Scan: An
ADS Scan: An
Dateitypen-Filter: Aus
Erweitertes Caching: An
Direkter Festplattenzugriff: Aus
Scan-Beginn: 04.03.2015 11:05:57
Value: HKEY_USERS\S-1-5-21-1588870830-359060440-1081868607-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLETASKMGR gefunden: Setting.DisableTaskMgr (A)
Value: HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLEREGISTRYTOOLS gefunden: Setting.DisableRegistryTools (A)
Value: HKEY_USERS\S-1-5-21-1588870830-359060440-1081868607-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLEREGISTRYTOOLS gefunden: Setting.DisableRegistryTools (A)
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Conduit\Community Alerts\Alert.dll.vir gefunden: Application.Win32.WebToolbar (A)
C:\Users\xxx-NB\AppData\Roaming\Thunderbird\Profiles\evzxm2sl.default\Mail\mx.freenet.de\Trash -> (message 417) -> [Subject: ￃﾃￅﾓberprￃﾃￂﾼfen Sie die Richtigkeit der Z][Date: Sat, 9 Nov 2013 17:10:20 +0300] -> (MIME part) -> Transaction09112013.rar -> Transaction09112013.scr gefunden: Gen:Heur.FKP.21 (B)
C:\Users\xxx-NB\AppData\Roaming\Thunderbird\Profiles\evzxm2sl.default\Mail\mx.freenet.de\Trash -> (message 418) -> [Subject: Neuer Beitrag Zahlung][Date: Sun, 10 Nov 2013 11:42:51 +0300] -> (MIME part) -> payment_10112013.rar -> payment_10112013.scr gefunden: Gen:Heur.FKP.21 (B)
C:\Users\xxx-NB\AppData\Roaming\Thunderbird\Profiles\evzxm2sl.default\Mail\mx.freenet.de\Trash -> (message 455) -> [Subject: =?UTF-8?B?RGF0ZW4=?=][Date: Wed, 27 Nov 2013 18:15:25 +0400] -> (MIME part) -> =?UTF-8?B?RENJTV9KUEVHMjAxMzI2MTEuc2NyX -> DCIM_JPEG20132611.scr.exe gefunden: Gen:Variant.Zusy.73571 (B)
C:\Users\xxx-NB\AppData\Roaming\Thunderbird\Profiles\kwrs5619.default\Mail\mx.freenet.de\Trash -> (message 417) -> [Subject: ￃﾃￅﾓberprￃﾃￂﾼfen Sie die Richtigkeit der Z][Date: Sat, 9 Nov 2013 17:10:20 +0300] -> (MIME part) -> Transaction09112013.rar -> Transaction09112013.scr gefunden: Gen:Heur.FKP.21 (B)
C:\Users\xxx-NB\AppData\Roaming\Thunderbird\Profiles\kwrs5619.default\Mail\mx.freenet.de\Trash -> (message 418) -> [Subject: Neuer Beitrag Zahlung][Date: Sun, 10 Nov 2013 11:42:51 +0300] -> (MIME part) -> payment_10112013.rar -> payment_10112013.scr gefunden: Gen:Heur.FKP.21 (B)
C:\Users\xxx-NB\AppData\Roaming\Thunderbird\Profiles\kwrs5619.default\Mail\mx.freenet.de\Trash -> (message 455) -> [Subject: =?UTF-8?B?RGF0ZW4=?=][Date: Wed, 27 Nov 2013 18:15:25 +0400] -> (MIME part) -> =?UTF-8?B?RENJTV9KUEVHMjAxMzI2MTEuc2NyX -> DCIM_JPEG20132611.scr.exe gefunden: Gen:Variant.Zusy.73571 (B)
C:\Users\xxx-NB\Downloads\PDFCreator-2_0_2-setup(1).exe gefunden: Application.Win32.InstallMon (A)
C:\Users\xxx-NB\Downloads\PDFCreator-2_0_2-setup.exe gefunden: Application.Win32.InstallMon (A)
G:\xxx-NB-HP\Backup Set 2015-01-15 182435\Backup Files 2015-02-09 091537\Backup files 1.zip -> C\Users\xxx-NB\AppData\Roaming\Thunderbird\Profiles\kwrs5619.default\Mail\Local Folders\Trash -> (message 119) -> [Subject: Unterlagen][Date: Sun, 1 Feb 2015 21:25:50 +0300] -> (MIME part) -> Zahlungsbeleg.zip -> Zahlungsbeleg.scr gefunden: Trojan.Agent.BHNJ (B)
G:\Daten-17-07-14\Thunderbird\Profiles\evzxm2sl.default\Mail\mx.freenet.de\Trash -> (message 417) -> [Subject: ￃﾃￅﾓberprￃﾃￂﾼfen Sie die Richtigkeit der Z][Date: Sat, 9 Nov 2013 17:10:20 +0300] -> (MIME part) -> Transaction09112013.rar -> Transaction09112013.scr gefunden: Gen:Heur.FKP.21 (B)
G:\Daten-17-07-14\Thunderbird\Profiles\evzxm2sl.default\Mail\mx.freenet.de\Trash -> (message 418) -> [Subject: Neuer Beitrag Zahlung][Date: Sun, 10 Nov 2013 11:42:51 +0300] -> (MIME part) -> payment_10112013.rar -> payment_10112013.scr gefunden: Gen:Heur.FKP.21 (B)
G:\Daten-17-07-14\Thunderbird\Profiles\evzxm2sl.default\Mail\mx.freenet.de\Trash -> (message 455) -> [Subject: =?UTF-8?B?RGF0ZW4=?=][Date: Wed, 27 Nov 2013 18:15:25 +0400] -> (MIME part) -> =?UTF-8?B?RENJTV9KUEVHMjAxMzI2MTEuc2NyX -> DCIM_JPEG20132611.scr.exe gefunden: Gen:Variant.Zusy.73571 (B)
Gescannt 255912
Gefunden 16
Scan-Ende: 04.03.2015 16:00:41
Scan-Zeit: 4:54:44
G:\Daten-17-07-14\Thunderbird\Profiles\evzxm2sl.default\Mail\mx.freenet.de\Trash Quarantäne Gen:Variant.Zusy.73571 (B)
G:\xxx-NB-HP\Backup Set 2015-01-15 182435\Backup Files 2015-02-09 091537\Backup files 1.zip Quarantäne Trojan.Agent.BHNJ (B)
C:\Users\xxx-NB\Downloads\PDFCreator-2_0_2-setup.exe Quarantäne Application.Win32.InstallMon (A)
C:\Users\xxx-NB\Downloads\PDFCreator-2_0_2-setup(1).exe Quarantäne Application.Win32.InstallMon (A)
C:\Users\xxx-NB\AppData\Roaming\Thunderbird\Profiles\kwrs5619.default\Mail\mx.freenet.de\Trash Quarantäne Gen:Variant.Zusy.73571 (B)
C:\Users\xxx-NB\AppData\Roaming\Thunderbird\Profiles\evzxm2sl.default\Mail\mx.freenet.de\Trash Quarantäne Gen:Variant.Zusy.73571 (B)
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Conduit\Community Alerts\Alert.dll.vir Quarantäne Application.Win32.WebToolbar (A)
Value: HKEY_USERS\S-1-5-21-1588870830-359060440-1081868607-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLEREGISTRYTOOLS Quarantäne Setting.DisableRegistryTools (A)
Value: HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLEREGISTRYTOOLS Quarantäne Setting.DisableRegistryTools (A)
Value: HKEY_USERS\S-1-5-21-1588870830-359060440-1081868607-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLETASKMGR Quarantäne Setting.DisableTaskMgr (A)
Quarantäne 10
Gruß, Annoo |
|
04.03.2015, 17:27
| #14 |
| /// the machine /// TB-Ausbilder | Ungewünschte Werbebanner Firefox Nö Frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
04.03.2015, 18:16
| #15 |
| | Ungewünschte Werbebanner Firefox Hallo, hier FRST-txt FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-03-2015 Ran by xxx-NB (administrator) on xxx-NB-HP on 04-03-2015 17:36:39 Running from C:\Users\xxx-NB\Downloads Loaded Profiles: xxx-NB (Available profiles: xxx-NB) Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 9 (Default browser: IE) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (AMD) C:\Windows\System32\atiesrxx.exe (AMD) C:\Windows\System32\atieclxx.exe (Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe (Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe (Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe (DATA BECKER GmbH & Co KG) C:\Program Files (x86)\Common Files\DATA BECKER Shared\DBService.exe (SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE (SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE (EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe (Softland) C:\Program Files (x86)\Softland\FBackup 5\bService.exe (Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Crawler.com) C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe (Sony) C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe (Copernic Inc.) C:\Program Files (x86)\Copernic Desktop Search - Home\DesktopSearchService.exe (Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe (TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe () C:\Program Files\Hewlett-Packard\HP LaunchBox\HPTaskBar1.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP LaunchBox\HPTaskBar2.exe (Lavasoft Limited) C:\Program Files (x86)\Lavasoft\Web Companion\TcpService\2.2.9.5\LavasoftTcpService.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Softland) C:\Program Files (x86)\Softland\FBackup 5\bTray.exe (Lavasoft) C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe (Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe () C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanionInfo.exe (Nero AG) C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe () C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.WinService.exe (Dropbox, Inc.) C:\Users\xxx-NB\AppData\Roaming\Dropbox\bin\Dropbox.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Crawler.com) C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe (TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe (Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\ielowutil.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avrestart.exe (Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe (Microsoft Corporation) C:\Windows\splwow64.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe (Copernic Inc.) C:\Program Files (x86)\Copernic Desktop Search - Home\DesktopSearch.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6602856 2011-01-11] (Realtek Semiconductor) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2799912 2011-06-10] (Synaptics Incorporated) HKLM\...\Run: [SetDefault] => C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe [42808 2011-06-27] (Hewlett-Packard Development Company, L.P.) HKLM\...\Run: [SpywareTerminatorShield] => C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe [2777736 2013-04-03] (Crawler.com) HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-07-05] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [HPQuickWebProxy] => C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe [168504 2011-06-28] (Hewlett-Packard Company) HKLM-x32\...\Run: [NeroCheck] => C:\Windows\SysWOW64\NeroCheck.exe [155648 2001-07-09] (Ahead Software Gmbh) HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [578944 2012-03-05] (Hewlett-Packard Development Company, L.P.) HKLM-x32\...\Run: [HPOSD] => C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960 2011-08-19] (Hewlett-Packard Development Company, L.P.) HKLM-x32\...\Run: [] => [X] HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [127792 2015-02-12] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [703280 2015-03-04] (Avira Operations GmbH & Co. KG) HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1 HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\Run: [Sony PC Companion] => C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe [466144 2014-11-27] (Sony) HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\Run: [Copernic Desktop Search - Home] => C:\Program Files (x86)\Copernic Desktop Search - Home\DesktopSearchService.exe [1692200 2013-01-28] (Copernic Inc.) HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\Run: [TomTomHOME.exe] => C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248176 2014-06-05] (TomTom) HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\Run: [FBackup 5 Tray Agent] => C:\Program Files (x86)\Softland\FBackup 5\bTray.exe [7862840 2014-09-30] (Softland) HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\Run: [Web Companion] => C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe [1467200 2014-11-27] (Lavasoft) HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [30877280 2014-12-11] (Skype Technologies S.A.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk ShortcutTarget: Microsoft Office.lnk -> C:\Program Files (x86)\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation) Startup: C:\Users\xxx-NB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk ShortcutTarget: Adobe Gamma.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.) Startup: C:\Users\xxx-NB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\xxx-NB\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\xxx-NB\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\xxx-NB\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\xxx-NB\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\xxx-NB\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\xxx-NB\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\xxx-NB\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\xxx-NB\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\xxx-NB\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-1588870830-359060440-1081868607-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome HKU\S-1-5-21-1588870830-359060440-1081868607-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ HKU\S-1-5-21-1588870830-359060440-1081868607-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms} SearchScopes: HKLM -> {F508C8AB-762D-4759-BA05-C8D219F6E582} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms} SearchScopes: HKLM-x32 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms} SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms} SearchScopes: HKLM-x32 -> {F508C8AB-762D-4759-BA05-C8D219F6E582} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms} SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-1588870830-359060440-1081868607-1001 -> {70DDF8F1-81D4-4DFA-B8E3-6E3A6E6EA9EF} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms} SearchScopes: HKU\S-1-5-21-1588870830-359060440-1081868607-1001 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms} SearchScopes: HKU\S-1-5-21-1588870830-359060440-1081868607-1001 -> {F508C8AB-762D-4759-BA05-C8D219F6E582} URL = BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard) BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard) Toolbar: HKU\S-1-5-21-1588870830-359060440-1081868607-1001 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File Handler-x32: http - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: http - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: https - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: https - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: ipp - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: msdaipp - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: msdaipp - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation) Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\xxx-NB\AppData\Roaming\Mozilla\Firefox\Profiles\4c8imuhi.default FF NewTab: hxxp://www.google.de/ FF SelectedSearchEngine: Google FF Homepage: hxxp://www.google.de/ FF Keyword.URL: hxxp://www.google.de FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll () FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1216156.dll (Adobe Systems, Inc.) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @videolan.org/vlc,version=2.0.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\9\NP_wtapp.dll () FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKU\S-1-5-21-1588870830-359060440-1081868607-1001: sony.com/MediaGoDetector -> C:\Program Files (x86)\Sony\Media Go\npMediaGoDetector.dll (Sony Network Entertainment International LLC) FF SearchPlugin: C:\Users\xxx-NB\AppData\Roaming\Mozilla\Firefox\Profiles\4c8imuhi.default\searchplugins\google-images.xml FF SearchPlugin: C:\Users\xxx-NB\AppData\Roaming\Mozilla\Firefox\Profiles\4c8imuhi.default\searchplugins\google-maps.xml FF Extension: 20-20 3D Viewer - IKEA - C:\Users\xxx-NB\AppData\Roaming\Mozilla\Firefox\Profiles\4c8imuhi.default\Extensions\2020Player_IKEA@2020Technologies.com [2014-11-17] FF Extension: Avira Browser Safety - C:\Users\xxx-NB\AppData\Roaming\Mozilla\Firefox\Profiles\4c8imuhi.default\Extensions\abs@avira.com [2015-02-27] FF Extension: Adblock Plus - C:\Users\xxx-NB\AppData\Roaming\Mozilla\Firefox\Profiles\4c8imuhi.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-08-11] FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2015-01-18] FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-01-18] FF HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\Firefox\Extensions: [{57319509-7821-41B0-9FDF-3B58F146AE33}] - c:\program files (x86)\copernic desktop search - home\firefoxconnector FF Extension: Copernic Desktop Search - Search Firefox content - c:\program files (x86)\copernic desktop search - home\firefoxconnector [2013-07-31] Chrome: ======= CHR StartupUrls: Default -> "hxxp://www.google.de/" CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter} CHR Profile: C:\Users\xxx-NB\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Docs) - C:\Users\xxx-NB\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-03] CHR Extension: (Google Drive) - C:\Users\xxx-NB\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-03] CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\xxx-NB\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-02-21] CHR Extension: (YouTube) - C:\Users\xxx-NB\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-03] CHR Extension: (Google Search) - C:\Users\xxx-NB\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-03] CHR Extension: (Avira Browser Safety) - C:\Users\xxx-NB\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2015-02-21] CHR Extension: (Skype Click to Call) - C:\Users\xxx-NB\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2015-02-21] CHR Extension: (Google Wallet) - C:\Users\xxx-NB\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-03] CHR Extension: (Gmail) - C:\Users\xxx-NB\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-03] CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2014-07-18] (Adobe Systems) [File not signed] R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [365568 2011-07-05] (Advanced Micro Devices, Inc.) [File not signed] R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [432888 2015-03-04] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [432888 2015-03-04] (Avira Operations GmbH & Co. KG) S2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [184056 2015-02-12] (Avira Operations GmbH & Co. KG) R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation) R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation) R2 DBService; C:\Program Files (x86)\Common Files\DATA BECKER Shared\DBService.exe [189776 2010-10-28] (DATA BECKER GmbH & Co KG) R2 ezSharedSvc; C:\Windows\SysWOW64\ezSharedSvcHost.exe [514232 2010-04-23] (EasyBits Software AS) [File not signed] R2 FBackup5Srv; C:\Program Files (x86)\Softland\FBackup 5\bService.exe [4642360 2014-09-30] (Softland) S3 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [227904 2014-03-12] (WildTangent) R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2013-11-04] (Hewlett-Packard Company) [File not signed] R2 IconMan_R; C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [1817088 2010-12-28] (Realsil Microelectronics Inc.) [File not signed] R2 LavasoftTcpService; C:\Program Files (x86)\Lavasoft\Web Companion\TcpService\2.2.9.5\LavasoftTcpService.exe [1351512 2014-11-27] (Lavasoft Limited) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation) R2 SearchProtectionService; C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.WinService.exe [15208 2014-11-27] () R2 ST2012_Svc; C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe [1149104 2013-04-03] (Crawler.com) S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [128536 2015-03-04] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132120 2015-03-04] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-11-24] (Avira Operations GmbH & Co. KG) R3 cleanhlp; C:\EEK\bin\cleanhlp64.sys [57024 2015-03-04] (Emsisoft GmbH) S3 ggsomc; C:\Windows\System32\DRIVERS\ggsomc.sys [30424 2014-07-17] (Sony Mobile Communications) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-03-04] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation) R2 sp_rsdrv2; C:\Windows\System32\DRIVERS\stflt.sys [51496 2013-11-12] (Windows (R) Win 7 DDK provider) S3 catchme; \??\C:\ComboFix\catchme.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-03-04 17:34 - 2015-03-04 17:34 - 00000000 ____D () C:\Users\xxx-NB\Downloads\FRST-OlderVersion 2015-03-04 11:00 - 2015-03-04 11:00 - 00000743 _____ () C:\Users\xxx-NB\Desktop\Start Emsisoft Emergency Kit.lnk 2015-03-04 10:59 - 2015-03-04 11:01 - 00000000 ____D () C:\EEK 2015-03-04 10:34 - 2015-03-04 10:34 - 00852594 _____ () C:\Users\xxx-NB\Downloads\SecurityCheck.exe 2015-03-04 10:20 - 2015-03-04 10:22 - 166189904 _____ () C:\Users\xxx-NB\Downloads\EmsisoftEmergencyKit.exe 2015-03-03 09:56 - 2015-03-03 09:56 - 02347384 _____ (ESET) C:\Users\xxx-NB\Downloads\esetsmartinstaller_deu.exe 2015-03-03 09:56 - 2015-03-03 09:56 - 00000000 ____D () C:\Program Files (x86)\ESET 2015-03-03 09:11 - 2015-03-03 09:11 - 00001437 _____ () C:\Users\xxx-NB\Desktop\JRT.txt 2015-03-03 09:00 - 2015-03-03 09:00 - 01388333 _____ (Thisisu) C:\Users\xxx-NB\Downloads\JRT.exe 2015-03-03 08:27 - 2015-03-03 08:27 - 02126848 _____ () C:\Users\xxx-NB\Downloads\AdwCleaner_4.111(1).exe 2015-03-02 17:21 - 2015-03-02 17:21 - 00026096 _____ () C:\Users\xxx-NB\Documents\ComboFix-AN.txt 2015-03-02 17:05 - 2015-03-02 17:05 - 00026171 _____ () C:\ComboFix.txt 2015-03-02 15:35 - 2015-03-02 17:05 - 00000000 ____D () C:\Qoobox 2015-03-02 15:35 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe 2015-03-02 15:35 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe 2015-03-02 15:35 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2015-03-02 15:35 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2015-03-02 15:35 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2015-03-02 15:35 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe 2015-03-02 15:35 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe 2015-03-02 15:35 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe 2015-03-02 15:34 - 2015-03-02 17:00 - 00000000 ____D () C:\Windows\erdnt 2015-03-02 15:33 - 2015-03-02 15:33 - 05612482 ____R (Swearware) C:\Users\xxx-NB\Downloads\ComboFix.exe 2015-03-02 12:34 - 2015-03-02 12:34 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\xxx-NB\Downloads\revosetup95.exe 2015-03-02 12:34 - 2015-03-02 12:34 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group 2015-03-02 11:26 - 2015-03-02 11:27 - 00103576 _____ () C:\Users\xxx-NB\Downloads\abasan2.ttf 2015-03-01 16:45 - 2015-03-01 17:16 - 00040115 _____ () C:\Users\xxx-NB\Downloads\Addition.txt 2015-03-01 16:41 - 2015-03-04 17:36 - 00027026 _____ () C:\Users\xxx-NB\Downloads\FRST.txt 2015-03-01 16:41 - 2015-03-04 17:36 - 00000000 ____D () C:\FRST 2015-03-01 16:38 - 2015-03-04 17:34 - 02093056 _____ (Farbar) C:\Users\xxx-NB\Downloads\FRST64.exe 2015-02-28 18:42 - 2015-02-28 18:42 - 00000000 _____ () C:\Users\xxx-NB\defogger_reenable 2015-02-28 18:41 - 2015-02-28 18:44 - 00000480 _____ () C:\Users\xxx-NB\Downloads\defogger_disable.log 2015-02-28 18:41 - 2015-02-28 18:41 - 00000252 _____ () C:\Users\xxx-NB\Downloads\defogger_enable.log 2015-02-28 18:39 - 2015-02-28 18:39 - 00050477 _____ () C:\Users\xxx-NB\Downloads\Defogger.exe 2015-02-28 16:57 - 2015-03-01 09:06 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\10777241.sys 2015-02-28 16:44 - 2015-02-28 16:44 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2015-02-28 16:43 - 2015-02-28 16:43 - 20447120 _____ (Malwarebytes Corporation ) C:\Users\xxx-NB\Downloads\mbam_premium.exe 2015-02-28 14:58 - 2015-03-04 14:58 - 00003210 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForxxx-NB 2015-02-28 14:58 - 2015-03-04 14:58 - 00000348 _____ () C:\Windows\Tasks\HPCeeScheduleForxxx-NB.job 2015-02-28 14:47 - 2015-03-04 13:45 - 00044088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys 2015-02-27 23:04 - 2015-02-27 23:04 - 00000000 ____D () C:\Users\xxx-NB\AppData\Roaming\Avira 2015-02-27 22:58 - 2015-03-04 13:45 - 00132120 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys 2015-02-27 22:58 - 2015-03-04 13:45 - 00128536 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys 2015-02-27 22:58 - 2014-11-24 10:23 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys 2015-02-27 22:54 - 2015-02-27 23:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira 2015-02-27 22:51 - 2015-02-27 22:51 - 04582672 _____ (Avira Operations & Co. KG) C:\Users\xxx-NB\Downloads\avira_de_av_5876132996__ws.exe 2015-02-27 21:07 - 2015-03-03 08:49 - 00000000 ____D () C:\AdwCleaner 2015-02-27 21:07 - 2015-02-27 21:07 - 02126848 _____ () C:\Users\xxx-NB\Downloads\AdwCleaner_4.111.exe 2015-02-26 20:02 - 2015-03-04 07:38 - 00000784 _____ () C:\Windows\setupact.log 2015-02-26 20:02 - 2015-03-02 16:48 - 00135728 _____ () C:\Windows\PFRO.log 2015-02-26 20:02 - 2015-02-26 20:02 - 00000000 _____ () C:\Windows\setuperr.log 2015-02-26 18:18 - 2015-03-04 17:27 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2015-02-26 18:18 - 2015-02-28 16:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2015-02-26 18:18 - 2015-02-28 16:44 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2015-02-26 18:18 - 2014-11-21 07:08 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2015-02-26 18:18 - 2014-11-21 07:07 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2015-02-26 18:18 - 2014-11-21 07:07 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2015-02-26 18:14 - 2015-02-26 18:17 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\xxx-NB\Downloads\mbam-setup-2.0.4.1028.exe 2015-02-25 23:19 - 2015-01-09 00:44 - 00419936 _____ () C:\Windows\SysWOW64\locale.nls 2015-02-25 23:19 - 2015-01-09 00:43 - 00419936 _____ () C:\Windows\system32\locale.nls 2015-02-25 20:10 - 2015-01-09 04:14 - 00950272 _____ (Microsoft Corporation) C:\Windows\system32\perftrack.dll 2015-02-25 20:10 - 2015-01-09 04:14 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\wdi.dll 2015-02-25 20:10 - 2015-01-09 04:14 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\powertracker.dll 2015-02-25 20:10 - 2015-01-09 03:48 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdi.dll 2015-02-25 18:22 - 2015-02-25 19:00 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird 2015-02-15 11:50 - 2015-01-23 05:07 - 02339840 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2015-02-15 11:50 - 2015-01-23 04:59 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2015-02-15 11:50 - 2015-01-23 04:00 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2015-02-15 11:50 - 2015-01-23 03:51 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2015-02-14 14:18 - 2015-01-14 04:08 - 17878016 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2015-02-14 14:18 - 2015-01-14 03:59 - 10924032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2015-02-14 14:18 - 2015-01-14 03:59 - 00448512 _____ (Microsoft Corporation) C:\Windows\system32\html.iec 2015-02-14 14:18 - 2015-01-14 03:49 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2015-02-14 14:18 - 2015-01-14 03:49 - 01388032 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2015-02-14 14:18 - 2015-01-14 03:47 - 01494016 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2015-02-14 14:18 - 2015-01-14 03:47 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2015-02-14 14:18 - 2015-01-14 03:47 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2015-02-14 14:18 - 2015-01-14 03:47 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2015-02-14 14:18 - 2015-01-14 03:46 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2015-02-14 14:18 - 2015-01-14 03:46 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2015-02-14 14:18 - 2015-01-14 03:45 - 02157056 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2015-02-14 14:18 - 2015-01-14 03:45 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2015-02-14 14:18 - 2015-01-14 03:45 - 00282112 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2015-02-14 14:18 - 2015-01-14 03:44 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2015-02-14 14:18 - 2015-01-14 03:44 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2015-02-14 14:18 - 2015-01-14 03:44 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2015-02-14 14:18 - 2015-01-14 03:44 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll 2015-02-14 14:18 - 2015-01-14 03:44 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe 2015-02-14 14:18 - 2015-01-14 03:44 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe 2015-02-14 14:18 - 2015-01-14 02:51 - 12371456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2015-02-14 14:18 - 2015-01-14 02:49 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec 2015-02-14 14:18 - 2015-01-14 02:46 - 09742336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2015-02-14 14:18 - 2015-01-14 02:43 - 01139712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2015-02-14 14:18 - 2015-01-14 02:42 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2015-02-14 14:18 - 2015-01-14 02:42 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2015-02-14 14:18 - 2015-01-14 02:41 - 01802752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2015-02-14 14:18 - 2015-01-14 02:41 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2015-02-14 14:18 - 2015-01-14 02:41 - 00421376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2015-02-14 14:18 - 2015-01-14 02:41 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll 2015-02-14 14:18 - 2015-01-14 02:41 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2015-02-14 14:18 - 2015-01-14 02:41 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2015-02-14 14:18 - 2015-01-14 02:40 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2015-02-14 14:18 - 2015-01-14 02:40 - 00353792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2015-02-14 14:18 - 2015-01-14 02:40 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2015-02-14 14:18 - 2015-01-14 02:40 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2015-02-14 14:18 - 2015-01-14 02:40 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2015-02-14 14:18 - 2015-01-14 02:40 - 00041472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll 2015-02-14 14:18 - 2015-01-14 02:40 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe 2015-02-14 14:18 - 2015-01-14 02:40 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe 2015-02-14 13:12 - 2015-02-14 13:12 - 00161792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll 2015-02-14 13:12 - 2015-02-14 13:12 - 00074752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe 2015-02-14 13:11 - 2015-02-14 13:11 - 03695416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat 2015-02-14 13:11 - 2015-02-14 13:11 - 03695416 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat 2015-02-14 13:11 - 2015-02-14 13:11 - 00534528 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00434176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00403248 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00353584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00267776 _____ (Microsoft Corporation) C:\Windows\system32\ieaksie.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00249344 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00227840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieaksie.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00222208 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00203776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe 2015-02-14 13:11 - 2015-02-14 13:11 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieakui.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\ieakui.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00162304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00160256 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe 2015-02-14 13:11 - 2015-02-14 13:11 - 00160256 _____ (Microsoft Corporation) C:\Windows\system32\ieakeng.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00152064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe 2015-02-14 13:11 - 2015-02-14 13:11 - 00150528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe 2015-02-14 13:11 - 2015-02-14 13:11 - 00149504 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00145920 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00135168 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00130560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieakeng.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00123392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00118784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00114176 _____ (Microsoft Corporation) C:\Windows\system32\admparse.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00110592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00101888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\admparse.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00091648 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe 2015-02-14 13:11 - 2015-02-14 13:11 - 00089088 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe 2015-02-14 13:11 - 2015-02-14 13:11 - 00089088 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2015-02-14 13:11 - 2015-02-14 13:11 - 00086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00078848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe 2015-02-14 13:11 - 2015-02-14 13:11 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx 2015-02-14 13:11 - 2015-02-14 13:11 - 00074752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ie4uinit.exe 2015-02-14 13:11 - 2015-02-14 13:11 - 00066048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00063488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx 2015-02-14 13:11 - 2015-02-14 13:11 - 00054272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00049664 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00035840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00031744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll 2015-02-14 13:11 - 2015-02-14 13:11 - 00023552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll 2015-02-13 11:03 - 2015-02-26 18:27 - 00000000 ____D () C:\Users\xxx-NB\AppData\Local\PDFCreator 2015-02-11 22:09 - 2015-02-11 22:09 - 00010495 _____ () C:\Users\xxx-NB\Downloads\xxx_elster_11.02.2015.pfx 2015-02-11 16:33 - 2015-02-14 13:54 - 00001405 _____ () C:\Users\xxx-NB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk 2015-02-11 08:03 - 2015-02-04 04:16 - 00894976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll 2015-02-11 08:03 - 2015-02-04 04:16 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll 2015-02-11 08:03 - 2015-02-04 04:16 - 00609280 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll 2015-02-11 08:03 - 2015-02-04 04:16 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll 2015-02-11 08:03 - 2015-02-04 04:16 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2015-02-11 08:03 - 2015-02-04 04:16 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll 2015-02-11 08:03 - 2015-02-04 04:13 - 01098752 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2015-02-11 08:03 - 2015-01-28 00:36 - 01239720 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe 2015-02-11 08:01 - 2015-01-15 09:14 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2015-02-11 08:01 - 2015-01-15 09:14 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys 2015-02-11 08:01 - 2015-01-15 09:09 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2015-02-11 08:01 - 2015-01-15 09:09 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll 2015-02-11 08:01 - 2015-01-15 09:09 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe 2015-02-11 08:01 - 2015-01-15 09:09 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll 2015-02-11 08:01 - 2015-01-15 09:09 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll 2015-02-11 08:01 - 2015-01-15 09:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe 2015-02-11 08:01 - 2015-01-15 09:06 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll 2015-02-11 08:01 - 2015-01-15 09:06 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll 2015-02-11 08:01 - 2015-01-15 09:04 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll 2015-02-11 08:01 - 2015-01-15 08:42 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe 2015-02-11 08:01 - 2015-01-15 08:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2015-02-11 08:01 - 2015-01-15 08:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2015-02-11 08:01 - 2015-01-15 08:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll 2015-02-11 08:01 - 2015-01-15 08:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll 2015-02-11 08:01 - 2015-01-15 08:37 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll 2015-02-11 08:01 - 2015-01-15 05:22 - 00458824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys 2015-02-11 08:01 - 2015-01-13 04:10 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2015-02-11 08:01 - 2015-01-13 03:49 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll 2015-02-11 08:00 - 2014-12-12 06:31 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll 2015-02-11 08:00 - 2014-12-12 06:07 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll 2015-02-11 08:00 - 2014-07-07 03:07 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll 2015-02-11 08:00 - 2014-07-07 03:06 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll 2015-02-11 08:00 - 2014-07-07 02:40 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll 2015-02-11 08:00 - 2014-07-07 02:40 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll 2015-02-11 07:59 - 2014-11-26 04:53 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll 2015-02-11 07:59 - 2014-11-26 04:32 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll 2015-02-11 07:59 - 2014-10-04 03:10 - 03722752 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll 2015-02-11 07:59 - 2014-10-04 02:42 - 03221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll 2015-02-11 07:59 - 2014-10-04 02:42 - 00131584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll 2015-02-11 07:56 - 2015-01-14 07:09 - 05554112 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2015-02-11 07:56 - 2015-01-14 07:05 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll 2015-02-11 07:56 - 2015-01-14 07:05 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll 2015-02-11 07:56 - 2015-01-14 07:04 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe 2015-02-11 07:56 - 2015-01-14 06:44 - 03972544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2015-02-11 07:56 - 2015-01-14 06:44 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2015-02-11 07:56 - 2015-01-14 06:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll 2015-02-11 07:56 - 2014-12-08 04:09 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll 2015-02-11 07:56 - 2014-12-08 03:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll 2015-02-11 07:53 - 2015-01-09 03:03 - 03201536 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2015-02-10 23:01 - 2015-02-10 23:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator 2015-02-10 23:00 - 2015-02-26 17:47 - 00000000 ____D () C:\Program Files\PDFCreator 2015-02-10 23:00 - 2015-02-10 23:00 - 00000000 ____D () C:\Users\xxx-NB\AppData\Roaming\Opera Software 2015-02-10 23:00 - 2015-02-10 23:00 - 00000000 ____D () C:\Users\xxx-NB\AppData\Local\Opera Software 2015-02-10 23:00 - 2015-01-22 16:14 - 00114872 _____ (pdfforge GmbH) C:\Windows\system32\pdfcmon.dll 2015-02-10 22:58 - 2015-02-11 15:59 - 00000000 ____D () C:\Program Files (x86)\Opera 2015-02-10 16:50 - 2015-02-10 16:50 - 00001464 _____ () C:\Users\Public\Desktop\ElsterFormular.lnk 2015-02-10 16:50 - 2015-02-10 16:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ElsterFormular 2015-02-10 16:48 - 2015-02-10 16:48 - 00000000 ____D () C:\Program Files (x86)\ElsterFormular 2015-02-10 16:45 - 2015-02-10 16:46 - 215975048 _____ (Landesfinanzdirektion Thüringen) C:\Users\xxx-NB\Downloads\ElsterFormular-16.0.20150113k.exe 2015-02-05 11:21 - 2015-02-05 11:21 - 115978680 _____ (Landesfinanzdirektion Thüringen) C:\Users\xxx-NB\Downloads\ElsterFormular-16.0.20150113p.exe 2015-02-05 11:13 - 2015-02-05 11:14 - 176389328 _____ (Landesfinanzdirektion Thüringen) C:\Users\xxx-NB\Downloads\ElsterFormular-16.0.20150113u(1).exe 2015-02-05 09:14 - 2015-02-05 09:14 - 05070512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe 2015-02-04 21:24 - 2015-02-10 10:49 - 00000000 ____D () C:\Users\xxx-NB\Desktop\steuerformulare 2015-02-04 21:22 - 2015-02-10 16:51 - 00000000 ____D () C:\Users\xxx-NB\AppData\Roaming\elsterformular 2015-02-04 20:52 - 2015-02-05 11:23 - 00000000 ____D () C:\ProgramData\elsterformular 2015-02-04 20:43 - 2015-02-04 20:45 - 176389328 _____ (Landesfinanzdirektion Thüringen) C:\Users\xxx-NB\Downloads\ElsterFormular-16.0.20150113u.exe ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-03-04 17:39 - 2012-01-28 21:58 - 00000000 ____D () C:\Users\xxx-NB\AppData\Roaming\Skype 2015-03-04 17:14 - 2015-01-22 12:57 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2015-03-04 14:17 - 2011-11-07 10:37 - 01411240 _____ () C:\Windows\WindowsUpdate.log 2015-03-04 11:15 - 2012-01-26 15:23 - 00003962 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{DA7BE238-D6AB-4111-8246-3DC85ACF4280} 2015-03-04 07:52 - 2009-07-14 05:45 - 00031856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-03-04 07:52 - 2009-07-14 05:45 - 00031856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-03-04 07:42 - 2014-09-22 17:53 - 00000000 ___RD () C:\Users\xxx-NB\Dropbox 2015-03-04 07:42 - 2014-04-08 08:19 - 00000000 ____D () C:\Users\xxx-NB\AppData\Roaming\Dropbox 2015-03-04 07:38 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-03-03 17:34 - 2012-03-03 18:11 - 00000000 ____D () C:\Users\xxx-NB\AppData\Local\CrashDumps 2015-03-03 09:56 - 2011-08-09 21:16 - 00700134 _____ () C:\Windows\system32\perfh007.dat 2015-03-03 09:56 - 2011-08-09 21:16 - 00149984 _____ () C:\Windows\system32\perfc007.dat 2015-03-03 09:56 - 2009-07-14 06:13 - 01622300 _____ () C:\Windows\system32\PerfStringBackup.INI 2015-03-02 17:16 - 2012-01-26 15:21 - 00080040 _____ () C:\Users\xxx-NB\AppData\Local\GDIPFONTCACHEV1.DAT 2015-03-02 17:05 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default 2015-03-02 16:54 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini 2015-03-02 16:50 - 2009-07-14 05:45 - 00330216 _____ () C:\Windows\system32\FNTCACHE.DAT 2015-02-28 18:42 - 2012-01-26 15:18 - 00000000 ____D () C:\Users\xxx-NB 2015-02-28 17:01 - 2013-02-08 18:09 - 00053248 _____ () C:\Users\xxx-NB\Documents\laggie.xls 2015-02-28 14:56 - 2012-02-07 10:23 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log 2015-02-27 22:58 - 2014-03-22 23:39 - 00000000 ____D () C:\ProgramData\Avira 2015-02-27 22:58 - 2014-03-22 23:39 - 00000000 ____D () C:\Program Files (x86)\Avira 2015-02-27 22:53 - 2014-08-05 09:35 - 00000000 ____D () C:\ProgramData\Package Cache 2015-02-27 22:11 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache 2015-02-27 20:59 - 2013-11-12 11:45 - 00000000 ____D () C:\ProgramData\Spyware Terminator 2015-02-27 20:57 - 2014-06-18 15:26 - 00000000 ____D () C:\Users\xxx-NB\AppData\Roaming\SoftGrid Client 2015-02-26 20:02 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\TAPI 2015-02-26 17:42 - 2007-01-02 02:25 - 00000000 ____D () C:\Windows\Panther 2015-02-26 12:03 - 2014-07-22 13:57 - 00000000 ____D () C:\Users\xxx-NB\Documents\privat 2015-02-26 07:06 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing 2015-02-25 18:21 - 2015-01-18 14:17 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2015-02-25 18:21 - 2012-05-09 22:42 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2015-02-23 08:27 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows\system32\FxsTmp 2015-02-21 18:16 - 2014-05-03 18:27 - 00000000 ____D () C:\Program Files (x86)\Google 2015-02-14 13:54 - 2012-01-26 15:23 - 00001439 _____ () C:\Users\xxx-NB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2015-02-14 13:49 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions 2015-02-12 06:43 - 2014-12-10 16:39 - 00000000 ____D () C:\Windows\system32\appraiser 2015-02-12 06:43 - 2014-05-14 13:26 - 00000000 ___SD () C:\Windows\system32\CompatTel 2015-02-11 23:54 - 2014-06-18 13:45 - 00000000 ____D () C:\ProgramData\Microsoft Help 2015-02-11 23:49 - 2013-08-19 10:40 - 00000000 ____D () C:\Windows\system32\MRT 2015-02-11 23:36 - 2012-01-31 13:14 - 116773704 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2015-02-11 07:25 - 2014-09-22 12:34 - 00000000 ____D () C:\Users\xxx-NB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox 2015-02-10 22:51 - 2013-08-02 09:33 - 00000000 ____D () C:\Users\xxx-NB\Documents\steuern 2015-02-06 13:44 - 2014-07-21 13:36 - 00000000 ____D () C:\Users\xxx-NB\Documents\Uni 2015-02-05 09:14 - 2015-01-22 12:57 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2015-02-05 09:14 - 2015-01-22 12:57 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2015-02-05 09:14 - 2015-01-22 12:57 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater ==================== Files in the root of some directories ======= 2014-12-01 13:18 - 2014-12-01 16:47 - 2929335 _____ () C:\Program Files (x86)\MysticThumbs.zip 2014-09-19 19:28 - 2014-09-19 19:28 - 0000000 _____ () C:\Users\xxx-NB\AppData\Roaming\downloads.m3u Files to move or delete: ==================== C:\Users\xxx-NB\ccsetup412.exe Some content of TEMP: ==================== C:\Users\xxx-NB\AppData\Local\Temp\avgnt.exe C:\Users\xxx-NB\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpumgxi_.dll C:\Users\xxx-NB\AppData\Local\Temp\Quarantine.exe C:\Users\xxx-NB\AppData\Local\Temp\sqlite3.dll ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-02-27 21:37 ==================== End Of Log ============================ --- --- --- Also gut, wenn Dich der gefundene Trojaner auf meiner externen Festplatte nicht nervös macht, darf ich auch nicht nervös sein. Ommmmm.....  Aber die Schmuddelwerbung auf einer bestimmten Seite (ein Forum, das ich seit Jahren besuche) ist immer noch da.  (Ich habe nachgefragt, andere User dort bekommen keine Werbung zumindest nicht solche wie ich...)Gruß, Annoo Geändert von 11annoo (04.03.2015 um 18:43 Uhr) |
|
| Themen zu Ungewünschte Werbebanner Firefox |
| code, datenbank, datum, eingeblendet, elemente, ergebnis, erkannt, extra, firefox, gekauft, malware, malwarebytes, objekte, premium, schei, schutz, schädliche, service, ungewünschte, webseite, webseiten, werbebanner, windows, windows 7 |
dann auf 
und dann auf 
. 
WARNUNG an die MITLESER: 
Linear-Darstellung
