Trojaner-Board
Seite 3 von 4 12 3 4
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Windows Vista - Datei mit chinesischen Zeichen im System32 Ordner (https://www.trojaner-board.de/140484-windows-vista-datei-chinesischen-zeichen-system32-ordner.html)

schrauber 02.09.2013 07:37
Teste mal ein paar Tage und melde dich mit einem frisches FRST Logfile.

Glas1990 02.09.2013 08:49
Guten Morgen,

mach ich so. Danke erst mal im Voraus und bis zum Ende der Woche. :Boogie:

schrauber 02.09.2013 13:48
ok :)

Glas1990 02.09.2013 18:15
Hat gehalten bis heute Mittag :headbang:

Leider ist das Ding wieder da.

schrauber 02.09.2013 19:31
frisches FRST log bitte.

Glas1990 03.09.2013 08:39
Guten Morgen, hier das FRST


FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-09-2013
Ran by Nina&Martin (administrator) on KNUT on 03-09-2013 09:36:46
Running from C:\Users\Nina&Martin\Desktop
Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\Apoint.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
(Microsoft Corporation) C:\Program Files\Microsoft LifeCam\MSCamS32.exe
(Sony Corporation) C:\Program Files\Sony\Network Utility\NSUService.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
(TomTom) C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Conexant Systems, Inc.) C:\Windows\system32\DRIVERS\xaudio.exe
(Vodafone) C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe
(Microsoft Corporation) C:\Windows\system32\iashost.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\Apntex.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe
(Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Apoint] - C:\Program Files\Apoint\Apoint.exe [118784 2007-06-10] (Alps Electric Co., Ltd.)
HKLM\...\Run: [GrooveMonitor] - C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [347192 2013-08-20] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [iTunesHelper] - C:\Program Files\iTunes\iTunesHelper.exe [152392 2013-08-16] (Apple Inc.)
HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
Winlogon\Notify\VESWinlogon: VESWinlogon.dll (Sony Corporation)
HKLM\...\Policies\Explorer: [NoDrives] 0
HKCU\...\Policies\Explorer: [NoDrives] 0
HKU\Default\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2009-04-11] (Microsoft Corporation)
HKU\Default\...\Run: [NSUFloatingUI] - C:\Program Files\Sony\Network Utility\LANUtil.exe [ 2008-07-17] (Sony Corporation)
HKU\Gast\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2009-04-11] (Microsoft Corporation)
HKU\Gast\...\Run: [NSUFloatingUI] - C:\Program Files\Sony\Network Utility\LANUtil.exe [ 2008-07-17] (Sony Corporation)
BootExecute: autocheck autochk * sdnclean.exe

==================== Internet (Whitelisted) ====================

ProxyServer: :0
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {E5EA0B27-AF39-4A9A-B2E2-0942A67A3F3D} URL = hxxp://www.google.de/search?hl=de&q={searchTerms}&meta=
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Nina&Martin\AppData\Roaming\Mozilla\Firefox\Profiles\jv8ds93g.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files\Mozilla Firefox\plugins\npdivx32.dll No File
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.3 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WLPG,version=14.0.8064.0206 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @real.com/nppl3260;version=16.0.0.282 - C:\Program Files\Mozilla Firefox\plugins\nppl3260.dll No File
FF Plugin: @real.com/nprpplugin;version=16.0.0.282 - C:\Program Files\Mozilla Firefox\plugins\nprpplugin.dll No File
FF Plugin: @videolan.org/vlc,version=2.0.4 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Flagfox - C:\Users\Nina&Martin\AppData\Roaming\Mozilla\Firefox\Profiles\jv8ds93g.default\Extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}
FF Extension: No Name - C:\Users\Nina&Martin\AppData\Roaming\Mozilla\Firefox\Profiles\jv8ds93g.default\Extensions\{E4091D66-127C-11DB-903A-DE80D2EFDFE8}
FF Extension: artur.dubovoy - C:\Users\Nina&Martin\AppData\Roaming\Mozilla\Firefox\Profiles\jv8ds93g.default\Extensions\artur.dubovoy@gmail.com.xpi
FF Extension: No Name - C:\Users\Nina&Martin\AppData\Roaming\Mozilla\Firefox\Profiles\jv8ds93g.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
FF Extension: No Name - C:\Users\Nina&Martin\AppData\Roaming\Mozilla\Firefox\Profiles\jv8ds93g.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi
FF Extension: No Name - C:\Users\Nina&Martin\AppData\Roaming\Mozilla\Firefox\Profiles\jv8ds93g.default\Extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}.xpi

========================== Services (Whitelisted) =================

S2 AntiVirMailService; C:\Program Files\Avira\AntiVir Desktop\avmailc.exe [622648 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-08-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-08-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-08-20] (Avira Operations GmbH & Co. KG)
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 NSUService; C:\Program Files\Sony\Network Utility\NSUService.exe [233472 2008-07-17] (Sony Corporation)
S3 PACSPTISVR; C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe [57344 2006-12-14] ()
S3 SPTISRV; C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe [69632 2006-12-14] (Sony Corporation)
R2 VMCService; C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [9216 2010-07-09] (Vodafone)
S3 FirebirdServerMAGIXInstance;
S4 gusvc;

==================== Drivers (Whitelisted) ====================

S3 AF15BDA; C:\Windows\System32\DRIVERS\AF15BDA.sys [483200 2009-06-03] (ITETech                  )
R3 Afc; C:\Windows\System32\drivers\Afc.sys [18688 2006-11-10] (Arcsoft, Inc.)
R2 Aspi32; C:\Windows\System32\Drivers\Aspi32.sys [25244 1999-09-10] (Adaptec)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [88840 2013-09-02] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136672 2013-08-20] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-03-27] (Avira Operations GmbH & Co. KG)
R0 CLFS; C:\Windows\System32\CLFS.sys [245736 2009-04-11] (Microsoft Corporation)
S3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2010-06-14] ()
S3 hwusbfake; C:\Windows\System32\DRIVERS\ewusbfake.sys [101120 2009-11-04] (Huawei Technologies Co., Ltd.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\mbamswissarmy.sys [40776 2013-09-03] (Malwarebytes Corporation)
R3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [613480 2011-10-31] (Realtek Semiconductor Corporation                          )
R1 RtlProt; C:\Windows\System32\DRIVERS\rtlprot.sys [25896 2007-04-23] (Windows (R) Codename Longhorn DDK provider)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [716272 2008-03-02] ()
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-10-05] (Avira GmbH)
R1 StarOpen; C:\Windows\System32\Drivers\StarOpen.sys [5632 2006-07-24] ()
R3 ti21sony; C:\Windows\System32\drivers\ti21sony.sys [812544 2007-06-06] (Texas Instruments)
S3 vodafone_K3805-z_dc_enum; C:\Windows\System32\DRIVERS\vodafone_K3805-z_dc_enum.sys [80000 2010-03-01] (Vodafone)
S3 VX1000; C:\Windows\System32\DRIVERS\VX1000.sys [1956096 2009-06-26] (Microsoft Corporation)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-19] (Microsoft Corporation)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]
S3 catchme; \??\C:\Users\NINA&M~1\AppData\Local\Temp\catchme.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
S3 PCASp50; System32\Drivers\PCASp50.sys [x]
S4 UIUSys; system32\DRIVERS\UIUSYS.SYS [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-03 09:18 - 2013-09-03 09:18 - 00040776 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamswissarmy.sys
2013-09-02 09:34 - 2013-09-02 09:34 - 00123424 _____ C:\Users\NINA&M~1\AppData\Local\GDIPFONTCACHEV1.DAT
2013-09-02 09:22 - 2013-09-02 09:22 - 00425568 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-01 08:19 - 2013-09-01 08:19 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-09-01 08:19 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-08-29 11:44 - 2013-08-29 11:44 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-08-29 11:44 - 2013-08-29 11:44 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-08-29 08:39 - 2013-08-29 08:39 - 00054833 _____ C:\Users\Nina&Martin\Desktop\bookmarks-2013-08-29.json
2013-08-28 21:17 - 2013-08-29 20:15 - 00021304 _____ C:\Users\Nina&Martin\Desktop\Addition.txt
2013-08-28 21:14 - 2013-08-28 21:14 - 00000000 ____D C:\FRST
2013-08-28 18:13 - 2013-09-02 18:57 - 00145597 _____ C:\Windows\WindowsUpdate.log
2013-08-28 12:27 - 2013-08-28 12:27 - 00000000 ____D C:\Users\NINA&M~1\AppData\Local\Downloaded Installations
2013-08-28 12:25 - 2013-08-28 12:25 - 00000000 ____D C:\Users\Nina&Martin\Documents\TomTom
2013-08-28 12:25 - 2013-08-28 12:25 - 00000000 ____D C:\ProgramData\TomTom
2013-08-28 12:24 - 2013-08-28 12:30 - 00000000 ____D C:\Program Files\TomTom HOME 2
2013-08-28 12:24 - 2013-08-28 12:24 - 00000000 ____D C:\Users\Nina&Martin\AppData\Roaming\TomTom
2013-08-28 12:24 - 2013-08-28 12:24 - 00000000 ____D C:\Users\NINA&M~1\AppData\Local\TomTom
2013-08-28 12:24 - 2013-08-28 12:24 - 00000000 ____D C:\Program Files\TomTom International B.V
2013-08-28 12:23 - 2013-08-28 12:23 - 00000000 ____D C:\Program Files\TomTom DesktopSuite
2013-08-28 11:34 - 2013-08-28 11:35 - 00001504 _____ C:\DelFix.txt
2013-08-28 09:35 - 2013-08-02 06:09 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-27 07:30 - 2013-08-27 07:30 - 00000000 ____D C:\Users\Nina&Martin\AppData\Roaming\Malwarebytes
2013-08-27 07:29 - 2013-08-27 07:29 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-26 14:55 - 2013-08-28 11:32 - 00000000 ____D C:\Windows\erdnt
2013-08-26 12:09 - 2013-08-26 12:40 - 00000000 ____D C:\Users\Nina&Martin\Desktop\P2
2013-08-24 16:22 - 2011-10-31 05:57 - 00613480 _____ (Realtek Semiconductor Corporation                          ) C:\Windows\system32\Drivers\RTL8192cu.sys
2013-08-24 10:05 - 2008-10-16 21:59 - 00005116 _____ C:\Windows\system32\ucuiinfo.ini
2013-08-24 10:05 - 2008-06-23 16:20 - 00004096 ____N C:\Windows\system32\Drivers\RT2870.bin
2013-08-24 10:05 - 2008-05-20 17:23 - 00200704 ____N () C:\Windows\system32\UpdateDriver.exe
2013-08-24 10:04 - 2013-08-24 10:04 - 00000000 ____D C:\Program Files\Belkin
2013-08-20 17:20 - 2013-08-20 17:22 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-08-14 20:37 - 2013-07-25 04:40 - 12334080 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-14 20:37 - 2013-07-25 04:32 - 01800704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-14 20:37 - 2013-07-25 04:30 - 09738752 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-14 20:37 - 2013-07-25 04:26 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-14 20:37 - 2013-07-25 04:26 - 01104384 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-14 20:37 - 2013-07-25 04:25 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-08-14 20:37 - 2013-07-25 04:24 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-08-14 20:37 - 2013-07-25 04:24 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-14 20:37 - 2013-07-25 04:23 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-14 20:37 - 2013-07-25 04:23 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-14 20:37 - 2013-07-25 04:23 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-14 20:37 - 2013-07-25 04:23 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-08-14 20:37 - 2013-07-25 04:23 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-08-14 20:37 - 2013-07-25 04:22 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-14 20:37 - 2013-07-25 04:22 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-14 20:37 - 2013-07-25 04:22 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-08-14 20:01 - 2013-07-17 21:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-14 20:01 - 2013-07-10 11:47 - 00783360 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-14 20:01 - 2013-07-09 14:10 - 01205168 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-14 20:01 - 2013-07-08 06:55 - 03603904 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2013-08-14 20:01 - 2013-07-08 06:55 - 03551680 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-14 20:01 - 2013-07-08 06:20 - 00172544 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-14 20:01 - 2013-07-08 06:16 - 00992768 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-14 20:01 - 2013-07-08 06:16 - 00133120 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-14 20:01 - 2013-07-08 06:16 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-14 20:01 - 2013-07-05 06:53 - 00905664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-14 20:01 - 2013-06-15 15:22 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\icaapi.dll
2013-08-14 20:01 - 2013-06-15 13:23 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-13 13:50 - 2013-08-13 14:54 - 00000000 ____D C:\Users\Nina&Martin\Documents\DoublePlayer
2013-08-12 12:54 - 2013-08-12 12:54 - 00000000 ____D C:\Windows\Downloaded Installations
2013-08-12 10:05 - 2010-12-01 09:31 - 00451072 _____ C:\Windows\system32\ISSRemoveSP.exe

==================== One Month Modified Files and Folders =======

2013-09-03 09:36 - 2013-09-03 09:36 - 01084685 _____ (Farbar) C:\Users\Nina&Martin\Desktop\FRST.exe
2013-09-03 09:29 - 2006-11-02 14:47 - 00003696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-03 09:29 - 2006-11-02 14:47 - 00003696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-03 09:27 - 2006-11-02 15:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-03 09:18 - 2013-09-03 09:18 - 00040776 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamswissarmy.sys
2013-09-03 09:17 - 2012-04-04 10:18 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-02 18:57 - 2013-08-28 18:13 - 00145597 _____ C:\Windows\WindowsUpdate.log
2013-09-02 18:57 - 2006-11-02 15:01 - 00032586 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-09-02 17:05 - 2012-07-06 22:32 - 00000000 ____D C:\Users\Nina&Martin\AppData\Roaming\vlc
2013-09-02 17:04 - 2007-12-22 14:35 - 00211968 _____ C:\Users\NINA&M~1\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-09-02 15:52 - 2012-10-05 07:55 - 00088840 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-09-02 09:34 - 2013-09-02 09:34 - 00123424 _____ C:\Users\NINA&M~1\AppData\Local\GDIPFONTCACHEV1.DAT
2013-09-02 09:22 - 2013-09-02 09:22 - 00425568 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-01 16:35 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\system32\LogFiles
2013-09-01 12:14 - 2012-03-25 10:25 - 00000000 ____D C:\Users\NINA&M~1\AppData\Local\Paint.NET
2013-09-01 10:40 - 2006-11-02 12:33 - 01576870 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-01 08:19 - 2013-09-01 08:19 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-08-29 22:50 - 2013-03-04 10:43 - 00000000 ____D C:\Users\Public\Documents\Adobe PDF
2013-08-29 22:47 - 2007-08-06 10:02 - 00000000 ____D C:\Program Files\Adobe
2013-08-29 22:45 - 2007-08-06 10:02 - 00000000 ____D C:\Program Files\Common Files\Adobe
2013-08-29 20:15 - 2013-08-28 21:17 - 00021304 _____ C:\Users\Nina&Martin\Desktop\Addition.txt
2013-08-29 13:50 - 2012-03-25 10:26 - 00000000 ____D C:\Program Files\Paint.NET
2013-08-29 11:44 - 2013-08-29 11:44 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-08-29 11:44 - 2013-08-29 11:44 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-08-29 09:15 - 2010-12-26 01:05 - 00000000 ____D C:\Users\Nina&Martin\AppData\Roaming\Macromedia
2013-08-29 08:39 - 2013-08-29 08:39 - 00054833 _____ C:\Users\Nina&Martin\Desktop\bookmarks-2013-08-29.json
2013-08-28 21:14 - 2013-08-28 21:14 - 00000000 ____D C:\FRST
2013-08-28 12:30 - 2013-08-28 12:24 - 00000000 ____D C:\Program Files\TomTom HOME 2
2013-08-28 12:27 - 2013-08-28 12:27 - 00000000 ____D C:\Users\NINA&M~1\AppData\Local\Downloaded Installations
2013-08-28 12:25 - 2013-08-28 12:25 - 00000000 ____D C:\Users\Nina&Martin\Documents\TomTom
2013-08-28 12:25 - 2013-08-28 12:25 - 00000000 ____D C:\ProgramData\TomTom
2013-08-28 12:24 - 2013-08-28 12:24 - 00000000 ____D C:\Users\Nina&Martin\AppData\Roaming\TomTom
2013-08-28 12:24 - 2013-08-28 12:24 - 00000000 ____D C:\Users\NINA&M~1\AppData\Local\TomTom
2013-08-28 12:24 - 2013-08-28 12:24 - 00000000 ____D C:\Program Files\TomTom International B.V
2013-08-28 12:23 - 2013-08-28 12:23 - 00000000 ____D C:\Program Files\TomTom DesktopSuite
2013-08-28 12:23 - 2007-12-22 14:35 - 00001356 _____ C:\Users\NINA&M~1\AppData\Local\d3d9caps.dat
2013-08-28 11:35 - 2013-08-28 11:34 - 00001504 _____ C:\DelFix.txt
2013-08-28 11:34 - 2013-07-14 07:20 - 00000000 ____D C:\Windows\ERUNT
2013-08-28 11:32 - 2013-08-26 14:55 - 00000000 ____D C:\Windows\erdnt
2013-08-28 11:21 - 2007-12-22 14:35 - 00000000 ____D C:\Users\Nina&Martin
2013-08-27 07:30 - 2013-08-27 07:30 - 00000000 ____D C:\Users\Nina&Martin\AppData\Roaming\Malwarebytes
2013-08-27 07:29 - 2013-08-27 07:29 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-26 15:16 - 2007-12-23 07:46 - 00000000 ____D C:\Users\Administrator
2013-08-26 15:16 - 2006-11-02 13:18 - 00000000 ___RD C:\Users\Public
2013-08-26 15:13 - 2006-11-02 12:23 - 00000215 _____ C:\Windows\system.ini
2013-08-26 12:40 - 2013-08-26 12:09 - 00000000 ____D C:\Users\Nina&Martin\Desktop\P2
2013-08-24 10:05 - 2007-08-03 16:56 - 00000000 ___HD C:\Program Files\InstallShield Installation Information
2013-08-24 10:04 - 2013-08-24 10:04 - 00000000 ____D C:\Program Files\Belkin
2013-08-22 13:17 - 2012-04-04 10:18 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-08-22 13:17 - 2011-05-15 17:24 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-08-20 18:17 - 2012-01-15 23:36 - 00000000 ____D C:\ProgramData\RFA_Backups
2013-08-20 17:22 - 2013-08-20 17:20 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-08-20 17:22 - 2010-12-20 20:01 - 00000000 ____D C:\Program Files\iTunes
2013-08-20 17:21 - 2008-01-07 21:42 - 00000000 ____D C:\Program Files\Common Files\Apple
2013-08-20 10:27 - 2012-10-05 07:55 - 00136672 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-08-19 12:29 - 2007-12-28 14:42 - 00000000 ____D C:\Users\Nina&Martin\AppData\Roaming\Canon
2013-08-15 11:38 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\Microsoft.NET
2013-08-14 22:16 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\rescache
2013-08-14 21:51 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\system32\de-DE
2013-08-14 20:54 - 2013-07-17 05:13 - 00000000 ____D C:\Windows\system32\MRT
2013-08-14 20:51 - 2006-11-02 12:24 - 75778376 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2013-08-14 20:49 - 2007-08-06 09:58 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-08-13 14:54 - 2013-08-13 13:50 - 00000000 ____D C:\Users\Nina&Martin\Documents\DoublePlayer
2013-08-12 12:58 - 2006-11-02 12:23 - 00000268 _____ C:\Windows\win.ini
2013-08-12 12:54 - 2013-08-12 12:54 - 00000000 ____D C:\Windows\Downloaded Installations
2013-08-12 07:43 - 2012-01-12 18:15 - 00000000 ____D C:\Program Files\Defraggler

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-03 09:35

==================== End Of Log ============================
--- --- ---

schrauber 03.09.2013 11:13
Ich seh gar keine Chinazeichen im Log.

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
ProxyServer: :0
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {E5EA0B27-AF39-4A9A-B2E2-0942A67A3F3D} URL = hxxp://www.google.de/search?hl=de&q={searchTerms}&meta=
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files\Mozilla Firefox\plugins\npdivx32.dll No File
FF Plugin: @real.com/nppl3260;version=16.0.0.282 - C:\Program Files\Mozilla Firefox\plugins\nppl3260.dll No File
FF Plugin: @real.com/nprpplugin;version=16.0.0.282 - C:\Program Files\Mozilla Firefox\plugins\nprpplugin.dll No File
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Flagfox - C:\Users\Nina&Martin\AppData\Roaming\Mozilla\Firefox\Profiles\jv8ds93g.default\Extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}
FF Extension: No Name - C:\Users\Nina&Martin\AppData\Roaming\Mozilla\Firefox\Profiles\jv8ds93g.default\Extensions\{E4091D66-127C-11DB-903A-DE80D2EFDFE8}
FF Extension: artur.dubovoy - C:\Users\Nina&Martin\AppData\Roaming\Mozilla\Firefox\Profiles\jv8ds93g.default\Extensions\artur.dubovoy@gmail.com.xpi
FF Extension: No Name - C:\Users\Nina&Martin\AppData\Roaming\Mozilla\Firefox\Profiles\jv8ds93g.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
FF Extension: No Name - C:\Users\Nina&Martin\AppData\Roaming\Mozilla\Firefox\Profiles\jv8ds93g.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi
FF Extension: No Name - C:\Users\Nina&Martin\AppData\Roaming\Mozilla\Firefox\Profiles\jv8ds93g.default\Extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}.xpi
S3 FirebirdServerMAGIXInstance;
S4 gusvc;

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.



Falss welche da sind, im abgesicherten Löschen. Dann bitte Firefox aus lassen und checken, ob die Dateien wirklich nur angelegt werden wenn FF gestartet wird.

Glas1990 03.09.2013 15:34
Das mit dem Chinazeichen war mein Fehler - ich hatte es schlauer Weise vorher im abgesicherten Modus entfernt.

So ... ich habe jetzt:

1. das Fixlist.txt erstellt und mit Hilfe von FSRT "gefixt"
2. danach im abgesicherten Modus die "chinesische" Datei entfernt und aus dem Papierkorb gelöscht
3. hab das Notebook so lange laufen lassen bis die "Datei" wieder kam - der Firefox war bis dahin nicht in Benutzung
4. hier die Fixlist.txt
Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 03-09-2013
Ran by Nina&Martin at 2013-09-03 14:58:48 Run:1
Running from C:\Users\Nina&Martin\Desktop
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
ProxyServer: :0
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {E5EA0B27-AF39-4A9A-B2E2-0942A67A3F3D} URL = hxxp://www.google.de/search?hl=de&q={searchTerms}&meta=
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files\Mozilla Firefox\plugins\npdivx32.dll No File
FF Plugin: @real.com/nppl3260;version=16.0.0.282 - C:\Program Files\Mozilla Firefox\plugins\nppl3260.dll No File
FF Plugin: @real.com/nprpplugin;version=16.0.0.282 - C:\Program Files\Mozilla Firefox\plugins\nprpplugin.dll No File
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Flagfox - C:\Users\Nina&Martin\AppData\Roaming\Mozilla\Firefox\Profiles\jv8ds93g.default\Extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}
FF Extension: No Name - C:\Users\Nina&Martin\AppData\Roaming\Mozilla\Firefox\Profiles\jv8ds93g.default\Extensions\{E4091D66-127C-11DB-903A-DE80D2EFDFE8}
FF Extension: artur.dubovoy - C:\Users\Nina&Martin\AppData\Roaming\Mozilla\Firefox\Profiles\jv8ds93g.default\Extensions\artur.dubovoy@gmail.com.xpi
FF Extension: No Name - C:\Users\Nina&Martin\AppData\Roaming\Mozilla\Firefox\Profiles\jv8ds93g.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
FF Extension: No Name - C:\Users\Nina&Martin\AppData\Roaming\Mozilla\Firefox\Profiles\jv8ds93g.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi
FF Extension: No Name - C:\Users\Nina&Martin\AppData\Roaming\Mozilla\Firefox\Profiles\jv8ds93g.default\Extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}.xpi
S3 FirebirdServerMAGIXInstance;
S4 gusvc;
*****************

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => Value deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E5EA0B27-AF39-4A9A-B2E2-0942A67A3F3D} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{E5EA0B27-AF39-4A9A-B2E2-0942A67A3F3D} => Key not found.
HKCR\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} => Key deleted successfully.
HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0 => Key deleted successfully.
C:\Program Files\Mozilla Firefox\plugins\npdivx32.dll not found.
HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=16.0.0.282 => Key deleted successfully.
C:\Program Files\Mozilla Firefox\plugins\nppl3260.dll not found.
HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=16.0.0.282 => Key deleted successfully.
C:\Program Files\Mozilla Firefox\plugins\nprpplugin.dll not found.
C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml => Moved successfully.
C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml => Moved successfully.
C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml => Moved successfully.
C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml => Moved successfully.
C:\Users\Nina&Martin\AppData\Roaming\Mozilla\Firefox\Profiles\jv8ds93g.default\Extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b} => Moved successfully.
C:\Users\Nina&Martin\AppData\Roaming\Mozilla\Firefox\Profiles\jv8ds93g.default\Extensions\{E4091D66-127C-11DB-903A-DE80D2EFDFE8} => Moved successfully.
C:\Users\Nina&Martin\AppData\Roaming\Mozilla\Firefox\Profiles\jv8ds93g.default\Extensions\artur.dubovoy@gmail.com.xpi => Moved successfully.
C:\Users\Nina&Martin\AppData\Roaming\Mozilla\Firefox\Profiles\jv8ds93g.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi => Moved successfully.
C:\Users\Nina&Martin\AppData\Roaming\Mozilla\Firefox\Profiles\jv8ds93g.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi => Moved successfully.
C:\Users\Nina&Martin\AppData\Roaming\Mozilla\Firefox\Profiles\jv8ds93g.default\Extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}.xpi => Moved successfully.
FirebirdServerMAGIXInstance => Service deleted successfully.
gusvc => Service deleted successfully.

==== End of Fixlog ====
und hier ein neues

FRST

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-09-2013
Ran by Nina&Martin (administrator) on KNUT on 03-09-2013 16:32:49
Running from C:\Users\Nina&Martin\Desktop
Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\Apoint.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
(Microsoft Corporation) C:\Program Files\Microsoft LifeCam\MSCamS32.exe
(Sony Corporation) C:\Program Files\Sony\Network Utility\NSUService.exe
(TomTom) C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Conexant Systems, Inc.) C:\Windows\system32\DRIVERS\xaudio.exe
(Vodafone) C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Windows\system32\iashost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\Apntex.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe
(Microsoft Corporation) c:\program files\windows defender\MpCmdRun.exe
(Sony Corporation) C:\Program Files\Sony\Network Utility\LANUtil.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe
(Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Apoint] - C:\Program Files\Apoint\Apoint.exe [118784 2007-06-10] (Alps Electric Co., Ltd.)
HKLM\...\Run: [GrooveMonitor] - C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [347192 2013-08-20] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [iTunesHelper] - C:\Program Files\iTunes\iTunesHelper.exe [152392 2013-08-16] (Apple Inc.)
HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
Winlogon\Notify\VESWinlogon: VESWinlogon.dll (Sony Corporation)
HKLM\...\Policies\Explorer: [NoDrives] 0
HKCU\...\Policies\Explorer: [NoDrives] 0
HKU\Default\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2009-04-11] (Microsoft Corporation)
HKU\Default\...\Run: [NSUFloatingUI] - C:\Program Files\Sony\Network Utility\LANUtil.exe [ 2008-07-17] (Sony Corporation)
HKU\Gast\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2009-04-11] (Microsoft Corporation)
HKU\Gast\...\Run: [NSUFloatingUI] - C:\Program Files\Sony\Network Utility\LANUtil.exe [ 2008-07-17] (Sony Corporation)
BootExecute: autocheck autochk * sdnclean.exe

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Nina&Martin\AppData\Roaming\Mozilla\Firefox\Profiles\jv8ds93g.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.3 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WLPG,version=14.0.8064.0206 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.4 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

========================== Services (Whitelisted) =================

S2 AntiVirMailService; C:\Program Files\Avira\AntiVir Desktop\avmailc.exe [622648 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-08-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-08-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-08-20] (Avira Operations GmbH & Co. KG)
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 NSUService; C:\Program Files\Sony\Network Utility\NSUService.exe [233472 2008-07-17] (Sony Corporation)
S3 PACSPTISVR; C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe [57344 2006-12-14] ()
S3 SPTISRV; C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe [69632 2006-12-14] (Sony Corporation)
R2 VMCService; C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [9216 2010-07-09] (Vodafone)

==================== Drivers (Whitelisted) ====================

S3 AF15BDA; C:\Windows\System32\DRIVERS\AF15BDA.sys [483200 2009-06-03] (ITETech                  )
R3 Afc; C:\Windows\System32\drivers\Afc.sys [18688 2006-11-10] (Arcsoft, Inc.)
R2 Aspi32; C:\Windows\System32\Drivers\Aspi32.sys [25244 1999-09-10] (Adaptec)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [88840 2013-09-02] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136672 2013-08-20] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-03-27] (Avira Operations GmbH & Co. KG)
R0 CLFS; C:\Windows\System32\CLFS.sys [245736 2009-04-11] (Microsoft Corporation)
S3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2010-06-14] ()
S3 hwusbfake; C:\Windows\System32\DRIVERS\ewusbfake.sys [101120 2009-11-04] (Huawei Technologies Co., Ltd.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [613480 2011-10-31] (Realtek Semiconductor Corporation                          )
R1 RtlProt; C:\Windows\System32\DRIVERS\rtlprot.sys [25896 2007-04-23] (Windows (R) Codename Longhorn DDK provider)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [716272 2008-03-02] ()
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-10-05] (Avira GmbH)
R1 StarOpen; C:\Windows\System32\Drivers\StarOpen.sys [5632 2006-07-24] ()
R3 ti21sony; C:\Windows\System32\drivers\ti21sony.sys [812544 2007-06-06] (Texas Instruments)
S3 vodafone_K3805-z_dc_enum; C:\Windows\System32\DRIVERS\vodafone_K3805-z_dc_enum.sys [80000 2010-03-01] (Vodafone)
S3 VX1000; C:\Windows\System32\DRIVERS\VX1000.sys [1956096 2009-06-26] (Microsoft Corporation)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-19] (Microsoft Corporation)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]
S3 catchme; \??\C:\Users\NINA&M~1\AppData\Local\Temp\catchme.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
S3 PCASp50; System32\Drivers\PCASp50.sys [x]
S4 UIUSys; system32\DRIVERS\UIUSYS.SYS [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-03 15:01 - 2013-09-03 15:01 - 00425568 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-03 09:36 - 2013-09-03 09:36 - 01084685 _____ (Farbar) C:\Users\Nina&Martin\Desktop\FRST.exe
2013-09-01 08:19 - 2013-09-01 08:19 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-09-01 08:19 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-08-29 11:44 - 2013-08-29 11:44 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-08-29 11:44 - 2013-08-29 11:44 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-08-29 08:39 - 2013-08-29 08:39 - 00054833 _____ C:\Users\Nina&Martin\Desktop\bookmarks-2013-08-29.json
2013-08-28 21:17 - 2013-08-29 20:15 - 00021304 _____ C:\Users\Nina&Martin\Desktop\Addition.txt
2013-08-28 21:14 - 2013-08-28 21:14 - 00000000 ____D C:\FRST
2013-08-28 18:13 - 2013-09-03 15:45 - 00178649 _____ C:\Windows\WindowsUpdate.log
2013-08-28 12:27 - 2013-08-28 12:27 - 00000000 ____D C:\Users\NINA&M~1\AppData\Local\Downloaded Installations
2013-08-28 12:25 - 2013-08-28 12:25 - 00000000 ____D C:\Users\Nina&Martin\Documents\TomTom
2013-08-28 12:25 - 2013-08-28 12:25 - 00000000 ____D C:\ProgramData\TomTom
2013-08-28 12:24 - 2013-08-28 12:30 - 00000000 ____D C:\Program Files\TomTom HOME 2
2013-08-28 12:24 - 2013-08-28 12:24 - 00000000 ____D C:\Users\Nina&Martin\AppData\Roaming\TomTom
2013-08-28 12:24 - 2013-08-28 12:24 - 00000000 ____D C:\Users\NINA&M~1\AppData\Local\TomTom
2013-08-28 12:24 - 2013-08-28 12:24 - 00000000 ____D C:\Program Files\TomTom International B.V
2013-08-28 12:23 - 2013-08-28 12:23 - 00000000 ____D C:\Program Files\TomTom DesktopSuite
2013-08-28 11:34 - 2013-08-28 11:35 - 00001504 _____ C:\DelFix.txt
2013-08-28 09:35 - 2013-08-02 06:09 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-27 07:30 - 2013-08-27 07:30 - 00000000 ____D C:\Users\Nina&Martin\AppData\Roaming\Malwarebytes
2013-08-27 07:29 - 2013-08-27 07:29 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-26 14:55 - 2013-08-28 11:32 - 00000000 ____D C:\Windows\erdnt
2013-08-26 12:09 - 2013-08-26 12:40 - 00000000 ____D C:\Users\Nina&Martin\Desktop\P2
2013-08-24 16:22 - 2011-10-31 05:57 - 00613480 _____ (Realtek Semiconductor Corporation                          ) C:\Windows\system32\Drivers\RTL8192cu.sys
2013-08-24 10:05 - 2008-10-16 21:59 - 00005116 _____ C:\Windows\system32\ucuiinfo.ini
2013-08-24 10:05 - 2008-06-23 16:20 - 00004096 ____N C:\Windows\system32\Drivers\RT2870.bin
2013-08-24 10:05 - 2008-05-20 17:23 - 00200704 ____N () C:\Windows\system32\UpdateDriver.exe
2013-08-24 10:04 - 2013-08-24 10:04 - 00000000 ____D C:\Program Files\Belkin
2013-08-20 17:20 - 2013-08-20 17:22 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-08-14 20:37 - 2013-07-25 04:40 - 12334080 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-14 20:37 - 2013-07-25 04:32 - 01800704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-14 20:37 - 2013-07-25 04:30 - 09738752 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-14 20:37 - 2013-07-25 04:26 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-14 20:37 - 2013-07-25 04:26 - 01104384 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-14 20:37 - 2013-07-25 04:25 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-08-14 20:37 - 2013-07-25 04:24 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-08-14 20:37 - 2013-07-25 04:24 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-14 20:37 - 2013-07-25 04:23 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-14 20:37 - 2013-07-25 04:23 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-14 20:37 - 2013-07-25 04:23 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-14 20:37 - 2013-07-25 04:23 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-08-14 20:37 - 2013-07-25 04:23 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-08-14 20:37 - 2013-07-25 04:22 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-14 20:37 - 2013-07-25 04:22 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-14 20:37 - 2013-07-25 04:22 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-08-14 20:01 - 2013-07-17 21:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-14 20:01 - 2013-07-10 11:47 - 00783360 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-14 20:01 - 2013-07-09 14:10 - 01205168 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-14 20:01 - 2013-07-08 06:55 - 03603904 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2013-08-14 20:01 - 2013-07-08 06:55 - 03551680 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-14 20:01 - 2013-07-08 06:20 - 00172544 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-14 20:01 - 2013-07-08 06:16 - 00992768 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-14 20:01 - 2013-07-08 06:16 - 00133120 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-14 20:01 - 2013-07-08 06:16 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-14 20:01 - 2013-07-05 06:53 - 00905664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-14 20:01 - 2013-06-15 15:22 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\icaapi.dll
2013-08-14 20:01 - 2013-06-15 13:23 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-13 13:50 - 2013-08-13 14:54 - 00000000 ____D C:\Users\Nina&Martin\Documents\DoublePlayer
2013-08-12 12:54 - 2013-08-12 12:54 - 00000000 ____D C:\Windows\Downloaded Installations
2013-08-12 10:05 - 2010-12-01 09:31 - 00451072 _____ C:\Windows\system32\ISSRemoveSP.exe

==================== One Month Modified Files and Folders =======

2013-09-03 16:29 - 2006-11-02 12:33 - 01576870 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-03 16:17 - 2012-04-04 10:18 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-03 16:13 - 2013-09-03 16:13 - 95638383 _____ C:\Windows\system32\඗䀘ᴼ˜
2013-09-03 15:45 - 2013-08-28 18:13 - 00178649 _____ C:\Windows\WindowsUpdate.log
2013-09-03 15:15 - 2006-11-02 14:47 - 00003696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-03 15:15 - 2006-11-02 14:47 - 00003696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-03 15:13 - 2006-11-02 15:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-03 15:01 - 2013-09-03 15:01 - 00425568 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-03 09:42 - 2006-11-02 15:01 - 00032586 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-09-03 09:36 - 2013-09-03 09:36 - 01084685 _____ (Farbar) C:\Users\Nina&Martin\Desktop\FRST.exe
2013-09-02 17:05 - 2012-07-06 22:32 - 00000000 ____D C:\Users\Nina&Martin\AppData\Roaming\vlc
2013-09-02 17:04 - 2007-12-22 14:35 - 00211968 _____ C:\Users\NINA&M~1\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-09-02 15:52 - 2012-10-05 07:55 - 00088840 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-09-01 16:35 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\system32\LogFiles
2013-09-01 12:14 - 2012-03-25 10:25 - 00000000 ____D C:\Users\NINA&M~1\AppData\Local\Paint.NET
2013-09-01 08:19 - 2013-09-01 08:19 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-08-29 22:50 - 2013-03-04 10:43 - 00000000 ____D C:\Users\Public\Documents\Adobe PDF
2013-08-29 22:47 - 2007-08-06 10:02 - 00000000 ____D C:\Program Files\Adobe
2013-08-29 22:45 - 2007-08-06 10:02 - 00000000 ____D C:\Program Files\Common Files\Adobe
2013-08-29 20:15 - 2013-08-28 21:17 - 00021304 _____ C:\Users\Nina&Martin\Desktop\Addition.txt
2013-08-29 13:50 - 2012-03-25 10:26 - 00000000 ____D C:\Program Files\Paint.NET
2013-08-29 11:44 - 2013-08-29 11:44 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-08-29 11:44 - 2013-08-29 11:44 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-08-29 09:15 - 2010-12-26 01:05 - 00000000 ____D C:\Users\Nina&Martin\AppData\Roaming\Macromedia
2013-08-29 08:39 - 2013-08-29 08:39 - 00054833 _____ C:\Users\Nina&Martin\Desktop\bookmarks-2013-08-29.json
2013-08-28 21:14 - 2013-08-28 21:14 - 00000000 ____D C:\FRST
2013-08-28 12:30 - 2013-08-28 12:24 - 00000000 ____D C:\Program Files\TomTom HOME 2
2013-08-28 12:27 - 2013-08-28 12:27 - 00000000 ____D C:\Users\NINA&M~1\AppData\Local\Downloaded Installations
2013-08-28 12:25 - 2013-08-28 12:25 - 00000000 ____D C:\Users\Nina&Martin\Documents\TomTom
2013-08-28 12:25 - 2013-08-28 12:25 - 00000000 ____D C:\ProgramData\TomTom
2013-08-28 12:24 - 2013-08-28 12:24 - 00000000 ____D C:\Users\Nina&Martin\AppData\Roaming\TomTom
2013-08-28 12:24 - 2013-08-28 12:24 - 00000000 ____D C:\Users\NINA&M~1\AppData\Local\TomTom
2013-08-28 12:24 - 2013-08-28 12:24 - 00000000 ____D C:\Program Files\TomTom International B.V
2013-08-28 12:23 - 2013-08-28 12:23 - 00000000 ____D C:\Program Files\TomTom DesktopSuite
2013-08-28 12:23 - 2007-12-22 14:35 - 00001356 _____ C:\Users\NINA&M~1\AppData\Local\d3d9caps.dat
2013-08-28 11:35 - 2013-08-28 11:34 - 00001504 _____ C:\DelFix.txt
2013-08-28 11:34 - 2013-07-14 07:20 - 00000000 ____D C:\Windows\ERUNT
2013-08-28 11:32 - 2013-08-26 14:55 - 00000000 ____D C:\Windows\erdnt
2013-08-28 11:21 - 2007-12-22 14:35 - 00000000 ____D C:\Users\Nina&Martin
2013-08-27 07:30 - 2013-08-27 07:30 - 00000000 ____D C:\Users\Nina&Martin\AppData\Roaming\Malwarebytes
2013-08-27 07:29 - 2013-08-27 07:29 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-26 15:16 - 2007-12-23 07:46 - 00000000 ____D C:\Users\Administrator
2013-08-26 15:16 - 2006-11-02 13:18 - 00000000 ___RD C:\Users\Public
2013-08-26 15:13 - 2006-11-02 12:23 - 00000215 _____ C:\Windows\system.ini
2013-08-26 12:40 - 2013-08-26 12:09 - 00000000 ____D C:\Users\Nina&Martin\Desktop\P2
2013-08-24 10:05 - 2007-08-03 16:56 - 00000000 ___HD C:\Program Files\InstallShield Installation Information
2013-08-24 10:04 - 2013-08-24 10:04 - 00000000 ____D C:\Program Files\Belkin
2013-08-22 13:17 - 2012-04-04 10:18 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-08-22 13:17 - 2011-05-15 17:24 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-08-20 18:17 - 2012-01-15 23:36 - 00000000 ____D C:\ProgramData\RFA_Backups
2013-08-20 17:22 - 2013-08-20 17:20 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-08-20 17:22 - 2010-12-20 20:01 - 00000000 ____D C:\Program Files\iTunes
2013-08-20 17:21 - 2008-01-07 21:42 - 00000000 ____D C:\Program Files\Common Files\Apple
2013-08-20 10:27 - 2012-10-05 07:55 - 00136672 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-08-19 12:29 - 2007-12-28 14:42 - 00000000 ____D C:\Users\Nina&Martin\AppData\Roaming\Canon
2013-08-15 11:38 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\Microsoft.NET
2013-08-14 22:16 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\rescache
2013-08-14 21:51 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\system32\de-DE
2013-08-14 20:54 - 2013-07-17 05:13 - 00000000 ____D C:\Windows\system32\MRT
2013-08-14 20:51 - 2006-11-02 12:24 - 75778376 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2013-08-14 20:49 - 2007-08-06 09:58 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-08-13 14:54 - 2013-08-13 13:50 - 00000000 ____D C:\Users\Nina&Martin\Documents\DoublePlayer
2013-08-12 12:58 - 2006-11-02 12:23 - 00000268 _____ C:\Windows\win.ini
2013-08-12 12:54 - 2013-08-12 12:54 - 00000000 ____D C:\Windows\Downloaded Installations
2013-08-12 07:43 - 2012-01-12 18:15 - 00000000 ____D C:\Program Files\Defraggler
2013-08-07 04:22 - 2009-10-03 09:25 - 00238872 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-03 15:24

==================== End Of Log ============================
--- --- ---

schrauber 03.09.2013 20:29
Kannst Du ungefähr sagen was Du machst wenn sie wieder kommt?

Glas1990 03.09.2013 20:46
Ich habe nach dem Löschen vorhin bewusst nichts geöffnet. Gehört wohl zu den Prozessen die im Hintergrund laufen. Kann ich ich den Prozess feststellen zu dem die Datei gehört?

schrauber 04.09.2013 08:52
Wir sind gerade dabei. Du bist nit der Einzige mit diesen Files, aber die scheinen nicht schädlich oder aktiv zu sein.

SilentRunners
Lade SilentRunners von dieser Seite auf den Desktop runter.
  • Alle Programme schließen und SilentRunners starten.
  • In der Abfrage "nein" wählen, damit die "supplementary searches" ebenfalls ausgeführt werden.
  • Die weitere Abfrage mit "ja" bestätigen.
  • Nun warten, bis SilentRunners mit einem Fenster bestätigt fertig zu sein, dies kann einige Zeit dauern.
  • Das Logfile findest Du danach auf dem Desktop. Dessen Inhalt posten.

Glas1990 04.09.2013 09:33
sorry, ich in da zu einfach zu ... nicht schlau genug.

Ich öffne die Seite und klicke auf "click here for Revision 69.2 (501 KB). ". Dann öffnet sich ein Bildschirm mit gaaaaanz viel Text und kein Programm.

schrauber 04.09.2013 13:07
Rechtsklick drauf machen > Ziel speichern unter.

Glas1990 04.09.2013 16:19
Ich habe mir die Datei runtergeladen (Silent Runners.vbs). Wenn ich diese anklicke, öffnet sich der Editor und ich sehe eine Textdatei. Ich habe nicht die Möglichkeit etwas anzuklicken mit ja / nein.

schrauber 04.09.2013 16:31
Hat sich erledigt. Die Dateien werden von Antivir erstellt, immer bei einem Update. Warum? weiß der Geier warum die so nen Scheiss machen :)


Alle Zeitangaben in WEZ +1. Es ist jetzt 00:46 Uhr.
Seite 3 von 4 12 3 4
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22