Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   GUV-BKA-Trojaner (https://www.trojaner-board.de/144949-guv-bka-trojaner.html)

ADiehm 21.11.2013 12:13
GUV-BKA-Trojaner
 
Habe einen Windows 7 Home-Premium 64-bit-PC mit einem GUV-Trojaner. selbst abgesicherter Modus funktioniert nicht. Habe mir FRST64 einen Scan gemacht.

Hier das Ergebnis des Scans:
FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-11-2013
Ran by SYSTEM on MININT-UFNJ1VL on 21-11-2013 11:55:07
Running from F:\
Windows 7 Home Premium (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Recovery
 
The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.
 
==================== Registry (Whitelisted) ==================
 
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-07-06] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [ATICustomerCare] - C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe [311296 2010-03-04] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-26] (Microsoft Corporation)
HKLM-x32\...\Run: [Microsoft Default Manager] - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe [439568 2010-05-10] (Microsoft Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: [MailCheck IE Broker] - C:\Program Files (x86)\WEB.DE MailCheck\IE\WEB.DE_MailCheck_Broker.exe [1766464 2013-10-16] (1und1 Mail und Media GmbH)
HKU\Hirth\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2012-09-26] (Google Inc.)
HKU\Hirth\...\Run: [Adobe Reader Synchronizer] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AdobeCollabSync.exe [1272704 2013-09-03] (Adobe Systems Incorporated)
HKU\Hirth\...\Run: [GarminExpressTrayApp] - C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [1093464 2013-07-09] (Garmin Ltd or its subsidiaries)
Startup: C:\Users\Hirth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f2vvfrrj.lnk
ShortcutTarget: f2vvfrrj.lnk -> C:\PROGRA~3\jrrfvv2f.dss (Корпорация Майкрософт)
 
==================== Services (Whitelisted) =================
 
S2 Garmin Core Update Service; C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [219480 2013-07-09] (Garmin Ltd or its subsidiaries)
S2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\NIS.exe [275696 2013-10-08] (Symantec Corporation)
S2 Winmgmt; C:\ProgramData\fodh3ow.pss [61024 2013-11-18] (Microsoft Corporation)
 
==================== Drivers (Whitelisted) ====================
 
S1 BHDrvx64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.0.0.100\Definitions\BASHDefs\20131114.001\BHDrvx64.sys [1524824 2013-10-23] (Symantec Corporation)
S1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1501000.012\ccSetx64.sys [162392 2013-09-26] (Symantec Corporation)
S1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-11-21] (Symantec Corporation)
S3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [137648 2013-11-21] (Symantec Corporation)
S1 IDSVia64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.0.0.100\Definitions\IPSDefs\20131120.003\IDSvia64.sys [521816 2013-10-29] (Symantec Corporation)
S3 MHIKEY10; C:\Windows\System32\Drivers\MHIKEY10x64.sys [60288 2010-09-15] (Generic USB smartcard reader)
S3 NAVENG; C:\Program Files (x86)\Norton Internet Security\NortonData\21.0.0.100\Definitions\VirusDefs\20131120.017\ENG64.SYS [126040 2013-10-01] (Symantec Corporation)
S3 NAVEX15; C:\Program Files (x86)\Norton Internet Security\NortonData\21.0.0.100\Definitions\VirusDefs\20131120.017\EX64.SYS [2099288 2013-10-01] (Symantec Corporation)
S1 SRTSP; C:\Windows\System32\Drivers\NISx64\1501000.012\SRTSP64.SYS [858200 2013-09-27] (Symantec Corporation)
S1 SRTSPX; C:\Windows\system32\drivers\NISx64\1501000.012\SRTSPX64.SYS [36952 2013-07-31] (Symantec Corporation)
S3 StarOpen; No ImagePath
S0 SymDS; C:\Windows\System32\drivers\NISx64\1501000.012\SYMDS64.SYS [493656 2013-08-01] (Symantec Corporation)
S0 SymEFA; C:\Windows\System32\drivers\NISx64\1501000.012\SYMEFA64.SYS [1147480 2013-09-27] (Symantec Corporation)
S3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177752 2013-10-01] (Symantec Corporation)
S1 SymIRON; C:\Windows\system32\drivers\NISx64\1501000.012\Ironx64.SYS [264280 2013-07-31] (Symantec Corporation)
S1 SymNetS; C:\Windows\System32\Drivers\NISx64\1501000.012\SYMNETS.SYS [590936 2013-09-26] (Symantec Corporation)
S3 EraserUtilDrv11312; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilDrv11312.sys [x]
S3 MSICDSetup; \??\D:\CDriver64.sys [x]
 
==================== NetSvcs (Whitelisted) ===================
 
 
==================== One Month Created Files and Folders ========
 
2013-11-21 11:54 - 2013-11-21 11:54 - 00000000 ____D C:\FRST
2013-11-21 09:18 - 2013-11-21 11:35 - 95025368 ____T C:\ProgramData\f2vvfrrj.bxx
2013-11-21 09:18 - 2013-11-21 11:35 - 00000000 _____ C:\ProgramData\f2vvfrrj.fvv
2013-11-21 09:18 - 2013-11-21 09:18 - 00221184 _____ (Корпорация Майкрософт) C:\ProgramData\jrrfvv2f.dss
2013-11-21 09:18 - 2013-11-21 09:18 - 00061540 ____T (Microsoft Corporation) C:\ProgramData\f2vvfrrj.pss
2013-11-20 11:14 - 2013-11-20 11:14 - 00000000 ____D C:\Users\Hirth\AppData\Local\NPE
2013-11-18 20:37 - 2013-11-18 20:37 - 00001513 _____ C:\Users\Hirth\Desktop\Internet Explorer.lnk
2013-11-18 19:48 - 2013-11-18 19:48 - 51415040 _____ (Microsoft Corporation) C:\Users\Hirth\Downloads\IE10-Windows6.1-x64-de-de.exe
2013-11-18 11:11 - 2013-11-18 15:39 - 00000000 ____D C:\Users\Hirth\AppData\Local\CrashDumps
2013-11-18 10:54 - 2013-11-18 19:23 - 95025368 ____T C:\ProgramData\fodh3ow.bxx
2013-11-18 10:54 - 2013-11-18 15:38 - 00000000 _____ C:\ProgramData\fodh3ow.fvv
2013-11-18 10:54 - 2013-11-18 10:54 - 00061024 ____T (Microsoft Corporation) C:\ProgramData\fodh3ow.pss
2013-11-18 10:54 - 2013-11-18 10:54 - 00000279 _____ C:\ProgramData\fodh3ow.reg
2013-11-14 20:54 - 2013-10-12 09:45 - 01364992 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-11-14 20:54 - 2013-10-12 09:45 - 00051712 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-11-14 20:54 - 2013-10-12 09:43 - 03959808 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-11-14 20:54 - 2013-10-12 09:43 - 02648576 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-11-14 20:54 - 2013-10-12 09:43 - 00855552 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-11-14 20:54 - 2013-10-12 09:43 - 00603136 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-11-14 20:54 - 2013-10-12 09:43 - 00526336 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-11-14 20:54 - 2013-10-12 09:43 - 00136704 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-11-14 20:54 - 2013-10-12 09:43 - 00067072 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-11-14 20:54 - 2013-10-12 09:43 - 00053248 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-11-14 20:54 - 2013-10-12 09:43 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-11-14 20:54 - 2013-10-12 08:03 - 01138176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-11-14 20:54 - 2013-10-12 08:02 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-14 20:54 - 2013-10-12 08:02 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-14 20:54 - 2013-10-12 08:02 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-11-14 20:54 - 2013-10-12 08:02 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-11-14 20:54 - 2013-10-12 08:02 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-11-14 20:54 - 2013-10-12 08:02 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-11-14 20:54 - 2013-10-12 08:02 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-11-14 20:54 - 2013-10-12 08:02 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-11-14 20:54 - 2013-10-12 08:02 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-11-14 20:54 - 2013-10-12 07:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-11-14 20:54 - 2013-10-12 07:08 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-11-14 20:54 - 2013-10-12 06:44 - 00089600 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-11-14 20:54 - 2013-10-12 06:15 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-11-14 20:53 - 2013-10-12 09:45 - 02241536 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-11-14 20:53 - 2013-10-12 09:43 - 19269632 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-11-14 20:53 - 2013-10-12 09:43 - 15404544 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-11-14 20:53 - 2013-10-12 08:03 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-14 20:53 - 2013-10-12 08:02 - 14355968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-14 20:53 - 2013-10-12 08:02 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-14 16:51 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-11-14 16:51 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-11-14 16:51 - 2013-10-04 03:28 - 00190464 _____ (Microsoft Corporation) C:\Windows\System32\SmartcardCredentialProvider.dll
2013-11-14 16:51 - 2013-10-04 03:25 - 00197120 _____ (Microsoft Corporation) C:\Windows\System32\credui.dll
2013-11-14 16:51 - 2013-10-04 03:24 - 01930752 _____ (Microsoft Corporation) C:\Windows\System32\authui.dll
2013-11-14 16:51 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SmartcardCredentialProvider.dll
2013-11-14 16:51 - 2013-10-04 02:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2013-11-14 16:51 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credui.dll
2013-11-14 16:51 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\afd.sys
2013-11-14 16:50 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\System32\nshwfp.dll
2013-11-14 16:50 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\System32\IKEEXT.DLL
2013-11-14 16:50 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\System32\FWPUCLNT.DLL
2013-11-14 16:50 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2013-11-14 16:50 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2013-11-14 16:50 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\System32\gdi32.dll
2013-11-14 16:50 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2013-11-14 16:50 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys
2013-11-14 16:50 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys
2013-11-14 16:50 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\System32\sspicli.dll
2013-11-14 16:50 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\System32\sspisrv.dll
2013-11-14 16:50 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\System32\secur32.dll
2013-11-14 16:50 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\System32\schannel.dll
2013-11-14 16:50 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\System32\lsasrv.dll
2013-11-14 16:50 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\System32\ncrypt.dll
2013-11-14 16:50 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2013-11-14 16:50 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-11-14 16:50 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2013-11-14 16:50 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2013-11-14 16:50 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\System32\lsass.exe
2013-11-14 16:50 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\cng.sys
2013-11-09 10:37 - 2013-11-09 10:37 - 00000000 ____D C:\Program Files\WEB.DE MailCheck
2013-11-09 10:37 - 2013-11-09 10:37 - 00000000 ____D C:\Program Files (x86)\WEB.DE MailCheck
2013-11-08 17:37 - 2013-11-08 17:37 - 00000000 ____D C:\ProgramData\UUdb
2013-11-05 14:16 - 2013-11-05 14:18 - 00000000 _____ C:\ctapi_out_gr.txt
 
==================== One Month Modified Files and Folders =======
 
2013-11-21 11:54 - 2013-11-21 11:54 - 00000000 ____D C:\FRST
2013-11-21 11:42 - 2009-07-14 05:45 - 00014928 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-21 11:42 - 2009-07-14 05:45 - 00014928 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-21 11:35 - 2013-11-21 09:18 - 95025368 ____T C:\ProgramData\f2vvfrrj.bxx
2013-11-21 11:35 - 2013-11-21 09:18 - 00000000 _____ C:\ProgramData\f2vvfrrj.fvv
2013-11-21 11:35 - 2012-09-26 09:23 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-21 11:34 - 2010-12-21 15:28 - 00084791 _____ C:\Windows\setupact.log
2013-11-21 11:34 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-21 11:27 - 2010-08-20 22:48 - 01960136 _____ C:\Windows\WindowsUpdate.log
2013-11-21 09:18 - 2013-11-21 09:18 - 00221184 _____ (Корпорация Майкрософт) C:\ProgramData\jrrfvv2f.dss
2013-11-21 09:18 - 2013-11-21 09:18 - 00061540 ____T (Microsoft Corporation) C:\ProgramData\f2vvfrrj.pss
2013-11-21 08:55 - 2013-01-18 10:05 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-21 08:54 - 2012-09-26 09:23 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-20 11:14 - 2013-11-20 11:14 - 00000000 ____D C:\Users\Hirth\AppData\Local\NPE
2013-11-18 20:37 - 2013-11-18 20:37 - 00001513 _____ C:\Users\Hirth\Desktop\Internet Explorer.lnk
2013-11-18 20:32 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\System32\NDF
2013-11-18 19:50 - 2013-05-07 19:33 - 00011008 _____ C:\Windows\IE10_main.log
2013-11-18 19:48 - 2013-11-18 19:48 - 51415040 _____ (Microsoft Corporation) C:\Users\Hirth\Downloads\IE10-Windows6.1-x64-de-de.exe
2013-11-18 19:23 - 2013-11-18 10:54 - 95025368 ____T C:\ProgramData\fodh3ow.bxx
2013-11-18 15:46 - 2011-02-06 20:19 - 00000000 ____D C:\Users\Eigene Dateien\Norbert
2013-11-18 15:39 - 2013-11-18 11:11 - 00000000 ____D C:\Users\Hirth\AppData\Local\CrashDumps
2013-11-18 15:38 - 2013-11-18 10:54 - 00000000 _____ C:\ProgramData\fodh3ow.fvv
2013-11-18 15:38 - 2009-07-14 06:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-11-18 10:54 - 2013-11-18 10:54 - 00061024 ____T (Microsoft Corporation) C:\ProgramData\fodh3ow.pss
2013-11-18 10:54 - 2013-11-18 10:54 - 00000279 _____ C:\ProgramData\fodh3ow.reg
2013-11-16 15:54 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-11-16 13:57 - 2012-09-26 09:23 - 00002181 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-11-16 13:07 - 2011-05-03 10:22 - 00030126 _____ C:\Windows\PFRO.log
2013-11-14 20:52 - 2013-08-15 21:36 - 00000000 ____D C:\Windows\System32\MRT
2013-11-14 20:52 - 2010-08-20 17:35 - 82896128 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-11-09 10:37 - 2013-11-09 10:37 - 00000000 ____D C:\Program Files\WEB.DE MailCheck
2013-11-09 10:37 - 2013-11-09 10:37 - 00000000 ____D C:\Program Files (x86)\WEB.DE MailCheck
2013-11-08 17:37 - 2013-11-08 17:37 - 00000000 ____D C:\ProgramData\UUdb
2013-11-08 17:37 - 2012-10-14 15:27 - 00002008 _____ C:\Users\Hirth\Desktop\Amazon.lnk
2013-11-08 17:37 - 2012-10-14 15:27 - 00002006 _____ C:\Users\Hirth\Desktop\WEB.DE.lnk
2013-11-08 17:37 - 2012-10-14 15:27 - 00002000 _____ C:\Users\Hirth\Desktop\eBay.lnk
2013-11-08 17:37 - 2012-10-14 15:27 - 00000000 ____D C:\ProgramData\DesktopIcons
2013-11-08 17:37 - 2012-05-26 12:40 - 00003872 _____ C:\Windows\System32\Tasks\Registration 1und1 Task
2013-11-08 17:37 - 2012-05-26 12:40 - 00000000 ____D C:\Program Files (x86)\1und1Softwareaktualisierung
2013-11-05 14:18 - 2013-11-05 14:16 - 00000000 _____ C:\ctapi_out_gr.txt
2013-10-29 20:02 - 2009-07-14 18:58 - 00657660 _____ C:\Windows\System32\perfh007.dat
2013-10-29 20:02 - 2009-07-14 18:58 - 00131032 _____ C:\Windows\System32\perfc007.dat
2013-10-29 20:02 - 2009-07-14 06:13 - 01507342 _____ C:\Windows\System32\PerfStringBackup.INI
 
Files to move or delete:
====================
C:\ProgramData\f2vvfrrj.bxx
C:\ProgramData\f2vvfrrj.fvv
C:\ProgramData\f2vvfrrj.pss
C:\ProgramData\fodh3ow.bxx
C:\ProgramData\fodh3ow.fvv
C:\ProgramData\fodh3ow.pss
C:\ProgramData\fodh3ow.reg
C:\ProgramData\jrrfvv2f.dss
 
 
Some content of TEMP:
====================
C:\Users\Hirth\AppData\Local\Temp\0946.dll
C:\Users\Hirth\AppData\Local\Temp\setup.exe
C:\Users\Hirth\AppData\Local\Temp\tmp10C2.exe
C:\Users\Hirth\AppData\Local\Temp\tmp1C20.exe
C:\Users\Hirth\AppData\Local\Temp\tmp26E0.exe
C:\Users\Hirth\AppData\Local\Temp\tmp6F78.exe
C:\Users\Hirth\AppData\Local\Temp\tmpB03D.exe
C:\Users\Hirth\AppData\Local\Temp\tmpE465.exe
C:\Users\Hirth\AppData\Local\Temp\tmpF640.exe
C:\Users\Hirth\AppData\Local\Temp\tmpF862.exe
C:\Users\Hirth\AppData\Local\Temp\tmpF99.exe
C:\Users\Hirth\AppData\Local\Temp\WEB.DE_Softwareaktualisierung_Setup.exe
C:\Users\Hirth\AppData\Local\Temp\WEB.DE_Toolbar_IE_Setup.exe
C:\Users\Hirth\AppData\Local\Temp\WEB.DE_Toolbar_IE_Setup_quiet.exe
 
 
==================== Known DLLs (Whitelisted) ================
 
 
==================== Bamital & volsnap Check =================
 
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
==================== EXE ASSOCIATION =====================
 
HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK
 
==================== Restore Points =========================
 
12
Restore point made on: 2013-09-17 11:32:03
Restore point made on: 2013-09-20 13:01:28
Restore point made on: 2013-09-24 11:44:37
Restore point made on: 2013-10-01 12:00:58
Restore point made on: 2013-10-10 19:01:51
Restore point made on: 2013-10-11 18:10:51
Restore point made on: 2013-10-12 19:13:47
Restore point made on: 2013-10-20 15:45:25
Restore point made on: 2013-10-28 14:43:19
Restore point made on: 2013-11-05 15:22:28
Restore point made on: 2013-11-13 16:06:16
Restore point made on: 2013-11-14 20:51:24
 
==================== Memory info ===========================
 
Percentage of memory in use: 15%
Total physical RAM: 3838.18 MB
Available physical RAM: 3224.19 MB
Total Pagefile: 3836.33 MB
Available Pagefile: 3215.63 MB
Total Virtual: 8192 MB
Available Virtual: 8191.87 MB
 
==================== Drives ================================
 
Drive c: (System) (Fixed) (Total:931.41 GB) (Free:867.83 GB) NTFS
Drive f: () (Removable) (Total:0.98 GB) (Free:0.85 GB) FAT
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: E7A3CBC2)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931 GB) - (Type=07 NTFS)
 
========================================================
Disk: 1 (Size: 1006 MB) (Disk ID: 6E652072)
No partition Table on disk 1.
 
 
LastRegBack: 2013-11-20 12:25
 
==================== End Of Log ============================
--- --- ---

schrauber 21.11.2013 12:22
HI,

Drücke bitte die + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
Startup: C:\Users\Hirth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f2vvfrrj.lnk
ShortcutTarget: f2vvfrrj.lnk -> C:\PROGRA~3\jrrfvv2f.dss (Корпорация Майкрософт)
S2 Winmgmt; C:\ProgramData\fodh3ow.pss [61024 2013-11-18] (Microsoft Corporation)
2013-11-21 09:18 - 2013-11-21 11:35 - 95025368 ____T C:\ProgramData\f2vvfrrj.bxx
2013-11-21 09:18 - 2013-11-21 11:35 - 00000000 _____ C:\ProgramData\f2vvfrrj.fvv
2013-11-21 09:18 - 2013-11-21 09:18 - 00221184 _____ (Корпорация Майкрософт) C:\ProgramData\jrrfvv2f.dss
2013-11-21 09:18 - 2013-11-21 09:18 - 00061540 ____T (Microsoft Corporation) C:\ProgramData\f2vvfrrj.pss
2013-11-18 10:54 - 2013-11-18 19:23 - 95025368 ____T C:\ProgramData\fodh3ow.bxx
2013-11-18 10:54 - 2013-11-18 15:38 - 00000000 _____ C:\ProgramData\fodh3ow.fvv
2013-11-18 10:54 - 2013-11-18 10:54 - 00061024 ____T (Microsoft Corporation) C:\ProgramData\fodh3ow.pss
2013-11-18 10:54 - 2013-11-18 10:54 - 00000279 _____ C:\ProgramData\fodh3ow.reg
C:\ProgramData\f2vvfrrj.bxx
C:\ProgramData\f2vvfrrj.fvv
C:\ProgramData\f2vvfrrj.pss
C:\ProgramData\fodh3ow.bxx
C:\ProgramData\fodh3ow.fvv
C:\ProgramData\fodh3ow.pss
C:\ProgramData\fodh3ow.reg
C:\ProgramData\jrrfvv2f.dss
Speichere diese bitte als Fixlist.txt auf deinem USB Stick.
  • Starte deinen Rechner erneut in die Reparaturoptionen
  • Starte nun die FRST.exe erneut und klicke den Entfernen Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.


rechner normal starten.

ADiehm 21.11.2013 12:35
Vielen Dank erst einmal für die schnelle Reaktion. Bin begeistert :-).

Rechner startet komplett normal.

Hier das Ergebnis des Fixlogs:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 18-11-2013
Ran by SYSTEM at 2013-11-21 12:31:15 Run:1
Running from F:\
Boot Mode: Recovery
==============================================

Content of fixlist:
*****************
Startup: C:\Users\Hirth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f2vvfrrj.lnk
ShortcutTarget: f2vvfrrj.lnk -> C:\PROGRA~3\jrrfvv2f.dss (?????????? ??????????)
S2 Winmgmt; C:\ProgramData\fodh3ow.pss [61024 2013-11-18] (Microsoft Corporation)
2013-11-21 09:18 - 2013-11-21 11:35 - 95025368 ____T C:\ProgramData\f2vvfrrj.bxx
2013-11-21 09:18 - 2013-11-21 11:35 - 00000000 _____ C:\ProgramData\f2vvfrrj.fvv
2013-11-21 09:18 - 2013-11-21 09:18 - 00221184 _____ (?????????? ??????????) C:\ProgramData\jrrfvv2f.dss
2013-11-21 09:18 - 2013-11-21 09:18 - 00061540 ____T (Microsoft Corporation) C:\ProgramData\f2vvfrrj.pss
2013-11-18 10:54 - 2013-11-18 19:23 - 95025368 ____T C:\ProgramData\fodh3ow.bxx
2013-11-18 10:54 - 2013-11-18 15:38 - 00000000 _____ C:\ProgramData\fodh3ow.fvv
2013-11-18 10:54 - 2013-11-18 10:54 - 00061024 ____T (Microsoft Corporation) C:\ProgramData\fodh3ow.pss
2013-11-18 10:54 - 2013-11-18 10:54 - 00000279 _____ C:\ProgramData\fodh3ow.reg
C:\ProgramData\f2vvfrrj.bxx
C:\ProgramData\f2vvfrrj.fvv
C:\ProgramData\f2vvfrrj.pss
C:\ProgramData\fodh3ow.bxx
C:\ProgramData\fodh3ow.fvv
C:\ProgramData\fodh3ow.pss
C:\ProgramData\fodh3ow.reg
C:\ProgramData\jrrfvv2f.dss
*****************

C:\Users\Hirth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f2vvfrrj.lnk => Moved successfully.
C:\PROGRA~3\jrrfvv2f.dss => Moved successfully.
Winmgmt => Service restored successfully.
C:\ProgramData\f2vvfrrj.bxx => Moved successfully.
C:\ProgramData\f2vvfrrj.fvv => Moved successfully.
"C:\ProgramData\jrrfvv2f.dss" => File/Directory not found.
C:\ProgramData\f2vvfrrj.pss => Moved successfully.
C:\ProgramData\fodh3ow.bxx => Moved successfully.
C:\ProgramData\fodh3ow.fvv => Moved successfully.
C:\ProgramData\fodh3ow.pss => Moved successfully.
C:\ProgramData\fodh3ow.reg => Moved successfully.
"C:\ProgramData\f2vvfrrj.bxx" => File/Directory not found.
"C:\ProgramData\f2vvfrrj.fvv" => File/Directory not found.
"C:\ProgramData\f2vvfrrj.pss" => File/Directory not found.
"C:\ProgramData\fodh3ow.bxx" => File/Directory not found.
"C:\ProgramData\fodh3ow.fvv" => File/Directory not found.
"C:\ProgramData\fodh3ow.pss" => File/Directory not found.
"C:\ProgramData\fodh3ow.reg" => File/Directory not found.
"C:\ProgramData\jrrfvv2f.dss" => File/Directory not found.

==== End of Fixlog ====

schrauber 22.11.2013 10:37
Kontrollscans im normalen Modus :)

Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)




So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
http://www.trojaner-board.de/picture...&pictureid=307

ADiehm 22.11.2013 14:11
Malwarebytes Anti-Malware-Scan:

Habe alle infizierten Daten hier entfernen lassen!
Code:
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.11.22.05

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16736
Hirth :: HIRTH-PC [Administrator]

22.11.2013 12:16:24
mbam-log-2013-11-22 (12-16-24).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 344104
Laufzeit: 52 Minute(n), 25 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 6
C:\FRST\Quarantine\f2vvfrrj.pss (Trojan.FakeMS) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\FRST\Quarantine\fodh3ow.pss (Trojan.FakeMS) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\FRST\Quarantine\jrrfvv2f.dss (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Eigene Dateien\Norbert\KNT\2009-12-30\index_b5[1].jpg (Extension.Mismatch) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Hirth\AppData\Local\Temp\0946.dll (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Hirth\AppData\Local\Temp\jrrfvv2f.dss (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
Nun das Ergebnis von AdwCleaner:

AdwCleaner Logfile:
Code:
# AdwCleaner v3.012 - Bericht erstellt am 22/11/2013 um 13:45:32
# Updated 11/11/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Hirth - HIRTH-PC
# Gestartet von : C:\Users\Hirth\Downloads\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Datei Gelöscht : C:\Users\Hirth\Desktop\eBay.lnk

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{C424171E-592A-415A-9EB1-DFD6D95D3530}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{C424171E-592A-415A-9EB1-DFD6D95D3530}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{C424171E-592A-415A-9EB1-DFD6D95D3530}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{C424171E-592A-415A-9EB1-DFD6D95D3530}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{C424171E-592A-415A-9EB1-DFD6D95D3530}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{C424171E-592A-415A-9EB1-DFD6D95D3530}
Wert Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{C424171E-592A-415A-9EB1-DFD6D95D3530}]

***** [ Browser ] *****

-\\ Internet Explorer v10.0.9200.16736


-\\ Google Chrome v31.0.1650.57

[ Datei : C:\Users\Hirth\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [2579 octets] - [22/11/2013 13:44:14]
AdwCleaner[S0].txt - [2370 octets] - [22/11/2013 13:45:32]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2430 octets] ##########
--- --- ---

Hier Junkware Removal Tool (JRT):

Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.8 (11.05.2013:1)
OS: Windows 7 Home Premium x64
Ran by Hirth on 22.11.2013 at 13:54:47,06
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{E41B1DCC-8877-4FAA-85D3-D5F4A27B2E77}



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 22.11.2013 at 13:59:34,44
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Scan - FRST.txt:


FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-11-2013
Ran by Hirth (administrator) on HIRTH-PC on 22-11-2013 14:08:24
Running from D:\
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\NIS.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
(1und1 Mail und Media GmbH) C:\Program Files (x86)\WEB.DE MailCheck\IE\WEB.DE_MailCheck_Broker.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\NIS.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ==================

HKCU\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2012-09-26] (Google Inc.)
HKCU\...\Run: [GarminExpressTrayApp] - C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [1093464 2013-07-09] (Garmin Ltd or its subsidiaries)
MountPoints2: D - D:\LaunchU3.exe -a
MountPoints2: {49b80a60-aca4-11df-bf55-806e6f6e6963} - D:\DVDSetup.exe
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-07-06] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [ATICustomerCare] - C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe [311296 2010-03-04] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [MailCheck IE Broker] - C:\Program Files (x86)\WEB.DE MailCheck\IE\WEB.DE_MailCheck_Broker.exe [1766464 2013-10-16] (1und1 Mail und Media GmbH)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/?rlz=1w4chbb_dede563
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xE4C0B0878240CB01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
SearchScopes: HKCU - {0ACD7A75-EC5E-441C-B3EC-5DF7FC97F269} URL = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
SearchScopes: HKCU - {761D9547-DBC1-4BAE-86C2-965CA03CE8AE} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {CE639E9A-F3AA-43BF-8938-D32BCE0D7A6F} URL = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {E2722C2B-E6FA-49E1-9DDC-D2026DE1BE80} URL = hxxp://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}
BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine64\21.1.0.18\coieplg.dll (Symantec Corporation)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: WEB.DE MailCheck BHO - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\office15\OCHelper.dll (Microsoft Corporation)
BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\coieplg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\ips\ipsbho.dll (Symantec Corporation)
BHO-x32: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\office15\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: WEB.DE MailCheck BHO - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Program Files (x86)\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
BHO-x32: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Bing Bar BHO - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2291.0\npwinext.dll (Microsoft Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine64\21.1.0.18\coieplg.dll (Symantec Corporation)
Toolbar: HKLM-x32 - @C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2291.0\npwinext.dll,-100 - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2291.0\npwinext.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\coieplg.dll (Symantec Corporation)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKCU - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine64\21.1.0.18\coieplg.dll (Symantec Corporation)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: webde - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\office15\MSOSB.DLL (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler-x32: webde - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files (x86)\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
Tcpip\Parameters: [DhcpNameServer] 192.168.128.2

Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR RestoreOnStartup: "hxxp://www.google.com/"
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.89\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.57\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.57\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.57\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Garmin Communicator Plug-In) - C:\Program Files (x86)\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll ( Microsoft Corporation)
CHR Extension: (Norton Identity Protection) - C:\Users\Hirth\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk\2014.6.0.27_0
CHR Extension: (Google Wallet) - C:\Users\Hirth\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0
CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\Exts\Chrome.crx

==================== Services (Whitelisted) =================

S2 Garmin Core Update Service; C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [219480 2013-07-09] (Garmin Ltd or its subsidiaries)
R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\NIS.exe [275696 2013-10-08] (Symantec Corporation)
R2 OfficeSvc; C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe [1907896 2013-09-17] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

R1 BHDrvx64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.0.0.100\Definitions\BASHDefs\20131114.001\BHDrvx64.sys [1524824 2013-10-23] (Symantec Corporation)
R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1501000.012\ccSetx64.sys [162392 2013-09-26] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-11-21] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [137648 2013-11-21] (Symantec Corporation)
R1 IDSVia64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.0.0.100\Definitions\IPSDefs\20131121.001\IDSvia64.sys [521816 2013-10-29] (Symantec Corporation)
S3 MHIKEY10; C:\Windows\System32\Drivers\MHIKEY10x64.sys [60288 2010-09-15] (Generic USB smartcard reader)
R3 NAVENG; C:\Program Files (x86)\Norton Internet Security\NortonData\21.0.0.100\Definitions\VirusDefs\20131121.023\ENG64.SYS [126040 2013-10-01] (Symantec Corporation)
R3 NAVEX15; C:\Program Files (x86)\Norton Internet Security\NortonData\21.0.0.100\Definitions\VirusDefs\20131121.023\EX64.SYS [2099288 2013-10-01] (Symantec Corporation)
R3 SRTSP; C:\Windows\System32\Drivers\NISx64\1501000.012\SRTSP64.SYS [858200 2013-09-27] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1501000.012\SRTSPX64.SYS [36952 2013-07-31] (Symantec Corporation)
S3 StarOpen; No ImagePath
R0 SymDS; C:\Windows\System32\drivers\NISx64\1501000.012\SYMDS64.SYS [493656 2013-08-01] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NISx64\1501000.012\SYMEFA64.SYS [1147480 2013-09-27] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177752 2013-10-01] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NISx64\1501000.012\Ironx64.SYS [264280 2013-07-31] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1501000.012\SYMNETS.SYS [590936 2013-09-26] (Symantec Corporation)
S3 EraserUtilDrv11312; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilDrv11312.sys [x]
S3 MSICDSetup; \??\D:\CDriver64.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-11-22 13:59 - 2013-11-22 13:59 - 00000772 _____ C:\Users\Hirth\Downloads\JRT.txt
2013-11-22 13:54 - 2013-11-22 13:54 - 00000000 ____D C:\Windows\ERUNT
2013-11-22 13:53 - 2013-11-22 13:53 - 01034531 _____ (Thisisu) C:\Users\Hirth\Downloads\JRT.exe
2013-11-22 13:33 - 2013-11-22 13:45 - 00000000 ____D C:\AdwCleaner
2013-11-22 13:32 - 2013-11-22 13:32 - 01085542 _____ C:\Users\Hirth\Downloads\adwcleaner.exe
2013-11-22 13:22 - 2013-11-22 13:22 - 00004746 _____ C:\Windows\PFRO.log
2013-11-22 12:13 - 2013-11-22 12:13 - 00000000 ____D C:\Users\Hirth\AppData\Roaming\Malwarebytes
2013-11-22 12:12 - 2013-11-22 12:13 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-11-22 12:12 - 2013-11-22 12:12 - 00001115 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-11-22 12:12 - 2013-11-22 12:12 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-22 12:12 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-11-22 12:11 - 2013-11-22 12:11 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Hirth\Downloads\mbam-setup-1.75.0.1300.exe
2013-11-22 09:37 - 2013-11-22 09:37 - 00000000 ____D C:\Windows\System32\Tasks\OfficeSoftwareProtectionPlatform
2013-11-22 09:27 - 2013-11-22 09:28 - 00000000 ____D C:\Program Files\Microsoft Office 15
2013-11-22 09:26 - 2013-11-21 10:11 - 00575168 _____ (Microsoft Corporation) C:\Users\Hirth\Downloads\setupproplusretail.x86.de-de_act_1_.exe
2013-11-22 09:23 - 2013-11-22 14:08 - 00001762 _____ C:\Windows\setupact.log
2013-11-22 09:23 - 2013-11-22 09:23 - 00000000 _____ C:\Windows\setuperr.log
2013-11-21 15:40 - 2013-11-21 15:40 - 00016342 _____ C:\Users\Hirth\Documents\cc_20131121_154046.reg
2013-11-21 11:54 - 2013-11-21 11:54 - 00000000 ____D C:\FRST
2013-11-20 11:14 - 2013-11-20 11:14 - 00000000 ____D C:\Users\Hirth\AppData\Local\NPE
2013-11-18 20:37 - 2013-11-18 20:37 - 00001513 _____ C:\Users\Hirth\Desktop\Internet Explorer.lnk
2013-11-18 19:48 - 2013-11-18 19:48 - 51415040 _____ (Microsoft Corporation) C:\Users\Hirth\Downloads\IE10-Windows6.1-x64-de-de.exe
2013-11-18 11:11 - 2013-11-18 15:39 - 00000000 ____D C:\Users\Hirth\AppData\Local\CrashDumps
2013-11-14 20:54 - 2013-10-12 09:45 - 01364992 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-14 20:54 - 2013-10-12 09:45 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-14 20:54 - 2013-10-12 09:43 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-14 20:54 - 2013-10-12 09:43 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-14 20:54 - 2013-10-12 09:43 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-14 20:54 - 2013-10-12 09:43 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-14 20:54 - 2013-10-12 09:43 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-14 20:54 - 2013-10-12 09:43 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-14 20:54 - 2013-10-12 09:43 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-14 20:54 - 2013-10-12 09:43 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-14 20:54 - 2013-10-12 09:43 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-14 20:54 - 2013-10-12 08:03 - 01138176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-11-14 20:54 - 2013-10-12 08:02 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-14 20:54 - 2013-10-12 08:02 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-14 20:54 - 2013-10-12 08:02 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-11-14 20:54 - 2013-10-12 08:02 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-11-14 20:54 - 2013-10-12 08:02 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-11-14 20:54 - 2013-10-12 08:02 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-11-14 20:54 - 2013-10-12 08:02 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-11-14 20:54 - 2013-10-12 08:02 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-11-14 20:54 - 2013-10-12 08:02 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-11-14 20:54 - 2013-10-12 07:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-14 20:54 - 2013-10-12 07:08 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-11-14 20:54 - 2013-10-12 06:44 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-14 20:54 - 2013-10-12 06:15 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-11-14 20:53 - 2013-10-12 09:45 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-14 20:53 - 2013-10-12 09:43 - 19269632 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-14 20:53 - 2013-10-12 09:43 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-14 20:53 - 2013-10-12 08:03 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-14 20:53 - 2013-10-12 08:02 - 14355968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-14 20:53 - 2013-10-12 08:02 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-14 16:51 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-11-14 16:51 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-11-14 16:51 - 2013-10-04 03:28 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll
2013-11-14 16:51 - 2013-10-04 03:25 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll
2013-11-14 16:51 - 2013-10-04 03:24 - 01930752 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2013-11-14 16:51 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SmartcardCredentialProvider.dll
2013-11-14 16:51 - 2013-10-04 02:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2013-11-14 16:51 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credui.dll
2013-11-14 16:51 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-11-14 16:50 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2013-11-14 16:50 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2013-11-14 16:50 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2013-11-14 16:50 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2013-11-14 16:50 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2013-11-14 16:50 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2013-11-14 16:50 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2013-11-14 16:50 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-11-14 16:50 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2013-11-14 16:50 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2013-11-14 16:50 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2013-11-14 16:50 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2013-11-14 16:50 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-11-14 16:50 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-11-14 16:50 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2013-11-14 16:50 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2013-11-14 16:50 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-11-14 16:50 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2013-11-14 16:50 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2013-11-14 16:50 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2013-11-14 16:50 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-11-09 10:37 - 2013-11-09 10:37 - 00000000 ____D C:\Program Files\WEB.DE MailCheck
2013-11-09 10:37 - 2013-11-09 10:37 - 00000000 ____D C:\Program Files (x86)\WEB.DE MailCheck
2013-11-08 17:37 - 2013-11-08 17:37 - 00000000 ____D C:\ProgramData\UUdb
2013-11-05 14:16 - 2013-11-05 14:18 - 00000000 _____ C:\ctapi_out_gr.txt

==================== One Month Modified Files and Folders =======

2013-11-22 14:08 - 2013-11-22 09:23 - 00001762 _____ C:\Windows\setupact.log
2013-11-22 13:59 - 2013-11-22 13:59 - 00000772 _____ C:\Users\Hirth\Downloads\JRT.txt
2013-11-22 13:57 - 2009-07-14 05:45 - 00014928 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-22 13:57 - 2009-07-14 05:45 - 00014928 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-22 13:55 - 2013-01-18 10:05 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-22 13:54 - 2013-11-22 13:54 - 00000000 ____D C:\Windows\ERUNT
2013-11-22 13:54 - 2012-09-26 09:23 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-22 13:54 - 2010-08-20 22:48 - 02047029 _____ C:\Windows\WindowsUpdate.log
2013-11-22 13:53 - 2013-11-22 13:53 - 01034531 _____ (Thisisu) C:\Users\Hirth\Downloads\JRT.exe
2013-11-22 13:51 - 2010-08-20 17:23 - 00109504 _____ C:\Users\Hirth\AppData\Local\GDIPFONTCACHEV1.DAT
2013-11-22 13:49 - 2012-09-26 09:23 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-22 13:49 - 2009-07-14 05:45 - 00435928 _____ C:\Windows\system32\FNTCACHE.DAT
2013-11-22 13:48 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-22 13:45 - 2013-11-22 13:33 - 00000000 ____D C:\AdwCleaner
2013-11-22 13:35 - 2010-09-19 21:27 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-11-22 13:35 - 2010-09-19 21:27 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2013-11-22 13:35 - 2009-07-14 19:18 - 00000000 ____D C:\Windows\ShellNew
2013-11-22 13:34 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\MSBuild
2013-11-22 13:32 - 2013-11-22 13:32 - 01085542 _____ C:\Users\Hirth\Downloads\adwcleaner.exe
2013-11-22 13:29 - 2009-07-14 04:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2013-11-22 13:22 - 2013-11-22 13:22 - 00004746 _____ C:\Windows\PFRO.log
2013-11-22 12:13 - 2013-11-22 12:13 - 00000000 ____D C:\Users\Hirth\AppData\Roaming\Malwarebytes
2013-11-22 12:13 - 2013-11-22 12:12 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-11-22 12:12 - 2013-11-22 12:12 - 00001115 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-11-22 12:12 - 2013-11-22 12:12 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-22 12:11 - 2013-11-22 12:11 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Hirth\Downloads\mbam-setup-1.75.0.1300.exe
2013-11-22 09:37 - 2013-11-22 09:37 - 00000000 ____D C:\Windows\System32\Tasks\OfficeSoftwareProtectionPlatform
2013-11-22 09:29 - 2009-07-14 18:58 - 00657660 _____ C:\Windows\system32\perfh007.dat
2013-11-22 09:29 - 2009-07-14 18:58 - 00131032 _____ C:\Windows\system32\perfc007.dat
2013-11-22 09:29 - 2009-07-14 06:13 - 01507342 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-22 09:28 - 2013-11-22 09:27 - 00000000 ____D C:\Program Files\Microsoft Office 15
2013-11-22 09:23 - 2013-11-22 09:23 - 00000000 _____ C:\Windows\setuperr.log
2013-11-21 15:40 - 2013-11-21 15:40 - 00016342 _____ C:\Users\Hirth\Documents\cc_20131121_154046.reg
2013-11-21 15:39 - 2010-08-29 14:53 - 00000000 ____D C:\Windows\Minidump
2013-11-21 12:31 - 2010-08-20 22:58 - 00000000 ___RD C:\Users\Hirth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-11-21 11:54 - 2013-11-21 11:54 - 00000000 ____D C:\FRST
2013-11-21 10:11 - 2013-11-22 09:26 - 00575168 _____ (Microsoft Corporation) C:\Users\Hirth\Downloads\setupproplusretail.x86.de-de_act_1_.exe
2013-11-20 11:14 - 2013-11-20 11:14 - 00000000 ____D C:\Users\Hirth\AppData\Local\NPE
2013-11-18 20:37 - 2013-11-18 20:37 - 00001513 _____ C:\Users\Hirth\Desktop\Internet Explorer.lnk
2013-11-18 20:32 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\NDF
2013-11-18 19:48 - 2013-11-18 19:48 - 51415040 _____ (Microsoft Corporation) C:\Users\Hirth\Downloads\IE10-Windows6.1-x64-de-de.exe
2013-11-18 15:46 - 2011-02-06 20:19 - 00000000 ____D C:\Users\Eigene Dateien\Norbert
2013-11-18 15:39 - 2013-11-18 11:11 - 00000000 ____D C:\Users\Hirth\AppData\Local\CrashDumps
2013-11-18 15:38 - 2009-07-14 06:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-11-16 15:54 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-11-16 13:57 - 2012-09-26 09:23 - 00002181 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-11-14 20:53 - 2013-08-15 21:36 - 00000000 ____D C:\Windows\system32\MRT
2013-11-14 20:52 - 2010-08-20 17:35 - 82896128 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-11-09 10:37 - 2013-11-09 10:37 - 00000000 ____D C:\Program Files\WEB.DE MailCheck
2013-11-09 10:37 - 2013-11-09 10:37 - 00000000 ____D C:\Program Files (x86)\WEB.DE MailCheck
2013-11-08 17:37 - 2013-11-08 17:37 - 00000000 ____D C:\ProgramData\UUdb
2013-11-08 17:37 - 2012-10-14 15:27 - 00002008 _____ C:\Users\Hirth\Desktop\Amazon.lnk
2013-11-08 17:37 - 2012-10-14 15:27 - 00002006 _____ C:\Users\Hirth\Desktop\WEB.DE.lnk
2013-11-08 17:37 - 2012-10-14 15:27 - 00000000 ____D C:\ProgramData\DesktopIcons
2013-11-08 17:37 - 2012-05-26 12:40 - 00003872 _____ C:\Windows\System32\Tasks\Registration 1und1 Task
2013-11-08 17:37 - 2012-05-26 12:40 - 00000000 ____D C:\Program Files (x86)\1und1Softwareaktualisierung
2013-11-05 14:18 - 2013-11-05 14:16 - 00000000 _____ C:\ctapi_out_gr.txt

Some content of TEMP:
====================
C:\Users\Hirth\AppData\Local\Temp\OfficeSetup.exe
C:\Users\Hirth\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-11-20 12:25

==================== End Of Log ============================
--- --- ---

--- --- ---


und Addition.txt:

Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 18-11-2013
Ran by Hirth at 2013-11-22 14:08:53
Running from D:\
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Norton Internet Security (Disabled - Up to date) {63DF5164-9100-186D-2187-8DC619EFD8BF}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Norton Internet Security (Enabled - Up to date) {D8BEB080-B73A-17E3-1B37-B6B462689202}
FW: Norton Internet Security (Disabled) {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

==================== Installed Programs ======================

Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.117)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.117)
Adobe Reader X (10.1.8) - Deutsch (x32 Version: 10.1.8)
Advertising Center (x32 Version: 0.0.0.2)
AMD Drag and Drop Transcoding (Version: 2.00.0000)
ATI Catalyst Install Manager (Version: 3.0.782.0)
ATI Catalyst Registration (x32 Version: 3.00.0000)
Bing Bar (x32 Version: 6.3.2291.0)
Bing Bar Platform (x32 Version: 6.3.2291.0)
BurnInTest v6.0 Pro (x32 Version: 6.0)
Catalyst Control Center - Branding (x32 Version: 1.00.0000)
Catalyst Control Center Graphics Previews Common (x32 Version: 2010.0706.2128.36662)
Catalyst Control Center Graphics Previews Vista (x32 Version: 2010.0706.2128.36662)
Catalyst Control Center InstallProxy (x32 Version: 2010.0706.2128.36662)
CCC Help English (x32 Version: 2010.0706.2127.36662)
ccc-core-static (x32 Version: 2010.0706.2128.36662)
ccc-utility64 (Version: 2010.0706.2128.36662)
CCleaner (Version: 3.01)
DolbyFiles (x32 Version: 2.0)
Elevated Installer (x32 Version: 2.2.16)
Garmin City Navigator Europe NT 2013.10 Update (x32 Version: 16.10.0.0)
Garmin City Navigator Europe NT v9 (x32 Version: 9.0.0.0)
Garmin Communicator Plugin (x32 Version: 4.0.1)
Garmin Communicator Plugin x64 (Version: 4.0.1)
Garmin Express (x32 Version: 2.2.16)
Garmin Express Tray (x32 Version: 2.2.16)
Garmin MapSource (x32 Version: 6.15.11)
Garmin Update Service (x32 Version: 2.2.16)
Garmin USB Drivers (x32 Version: 2.3.0.0)
Garmin WebUpdater (x32 Version: 2.5.5)
Google Chrome (x32 Version: 31.0.1650.57)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0)
Google Toolbar for Internet Explorer (x32 Version: 7.5.4601.54)
Google Update Helper (x32 Version: 1.3.21.165)
HP Officejet 6500 E710n-z - Grundlegende Software für das Gerät (Version: 22.50.231.0)
HP Officejet 6500 E710n-z Hilfe (x32 Version: 140.0.2.2)
HP Photo Creations (x32 Version: 1.0.0.9572)
HP Update (x32 Version: 5.005.000.001)
HPDiagnosticAlert (x32 Version: 1.00.0000)
I.R.I.S. OCR (x32 Version: 12.3.4.0)
ImagXpress (x32 Version: 7.0.74.0)
Java(TM) 6 Update 20 (64-bit) (Version: 6.0.200)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
Marketsplash Schnellzugriffe (x32 Version: 1.0.1.7)
Menu Templates - Starter Kit (x32 Version: 9.4.6.0)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Default Manager (x32 Version: 2.2.114.0)
Microsoft Office Professional Plus 2013 - de-de (Version: 15.0.4551.1005)
Microsoft Search Enhancement Pack (x32 Version: 3.0.131.0)
Microsoft Silverlight (x32 Version: 4.0.50401.0)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Nero 9 (x32)
Nero ControlCenter (x32 Version: 9.0.0.1)
Nero Installer (x32 Version: 4.4.9.0)
NeroBurningROM (x32 Version: 9.4.26.100)
Norton Internet Security (x32 Version: 21.1.0.18)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4551.1005)
Office 15 Click-to-Run Licensing Component (Version: 15.0.4551.1005)
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4551.1005)
Skype™ 6.0 (x32 Version: 6.0.126)
Studie zur Verbesserung von HP Officejet 6500 E710n-z Produkten (Version: 22.50.231.0)
The Lord of the Rings FREE Trial  (x32 Version: 1.00.0000)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3)
VLC media player 1.1.0 (x32 Version: 1.1.0)
WEB.DE Desktop Icons (x32 Version: 3.0.3.0)
WEB.DE MailCheck für Internet Explorer (x32 Version: 2.4.0.0)
WEB.DE Softwareaktualisierung (x32 Version: 3.0.0.55)
Windows Driver Package - Garmin (grmnusb) GARMIN Devices  (06/03/2009 2.3.0.0) (Version: 06/03/2009 2.3.0.0)

==================== Restore Points  =========================

11-10-2013 17:10:39 Windows Update
12-10-2013 18:13:10 Windows Update
20-10-2013 14:45:06 Geplanter Prüfpunkt
28-10-2013 13:43:04 Geplanter Prüfpunkt
05-11-2013 14:22:13 Geplanter Prüfpunkt
13-11-2013 15:06:01 Geplanter Prüfpunkt
14-11-2013 19:51:12 Windows Update
22-11-2013 09:05:29 Configured Microsoft Office Enterprise 2007
22-11-2013 12:27:29 Removed Microsoft Office Enterprise 2007

==================== Hosts content: ==========================

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {13CB4B37-D4DC-4044-A488-3D9A774DCB2E} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe [2013-09-17] (Microsoft Corporation)
Task: {165A1055-49C6-4C2D-B67C-4A6FA12A0D98} - System32\Tasks\HpWebReg.exe => C:\Program Files\HP\HP Officejet 6500 E710n-z\Bin\hpwebreg.exe [2010-11-16] (Hewlett-Packard Co.)
Task: {2E5A6B39-291E-42DE-924F-740D030FF081} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-09-26] (Google Inc.)
Task: {7B953B3B-21EB-47A3-B652-ABA881B422CE} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-23] (Microsoft Corporation)
Task: {849F90C7-572F-4F82-BBE9-6D2D572C789D} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\symerr.exe [2013-08-01] (Symantec Corporation)
Task: {A02ACAEB-2935-406A-AD1D-BD7DF8402365} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\symerr.exe [2013-08-01] (Symantec Corporation)
Task: {C11BCDE1-46EA-43B0-9D71-2727DD500BCF} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office 15\root\office15\msoia.exe [2013-11-22] (Microsoft Corporation)
Task: {C413A7AC-77C3-4533-9D7F-A6A88BA8C57D} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {C5C64EEA-C265-4179-8BE1-5D194BF73E6B} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-09-26] (Google Inc.)
Task: {C64ADBA4-84B5-4805-972A-C3B640683600} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-10] (Adobe Systems Incorporated)
Task: {E2DD87E7-043C-4DBA-95BD-8B161A92325E} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office 15\root\office15\msoia.exe [2013-11-22] (Microsoft Corporation)
Task: {E7F43259-729B-4FED-A64B-17BEC4A197AB} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\wscstub.exe [2013-10-08] (Symantec Corporation)
Task: {F147E58B-D024-4CEE-BA7C-E1487B3D7E0C} - System32\Tasks\Registration 1und1 Task => C:\Program Files (x86)\1und1Softwareaktualisierung\cdsupdclient.exe [2013-06-18] (1&1 Mail & Media GmbH)
Task: {FD75DF02-0C7E-4569-8438-48E2A7F36A4F} - System32\Tasks\HPCustParticipation HP Officejet 6500 E710n-z => C:\Program Files\HP\HP Officejet 6500 E710n-z\Bin\HPCustPartic.exe [2010-11-16] (Hewlett-Packard Co.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2010-04-16 13:20 - 2010-04-16 13:20 - 00016384 ____R () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2010-07-06 20:26 - 2010-07-06 20:26 - 00270336 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2013-11-16 13:56 - 2013-11-14 12:28 - 00702416 _____ () C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.57\libglesv2.dll
2013-11-16 13:56 - 2013-11-14 12:28 - 00099792 _____ () C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.57\libegl.dll
2013-11-16 13:56 - 2013-11-14 12:29 - 04055504 _____ () C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.57\pdf.dll
2013-11-16 13:56 - 2013-11-14 12:29 - 00399312 _____ () C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.57\ppGoogleNaClPluginChrome.dll
2013-11-16 13:56 - 2013-11-14 12:28 - 01619408 _____ () C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.57\ffmpegsumo.dll
2013-11-16 13:56 - 2013-11-14 12:29 - 13582800 _____ () C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.57\PepperFlash\pepflashplayer.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============

Microsoft Office Sessions:
=========================

==================== Memory info ===========================

Percentage of memory in use: 36%
Total physical RAM: 3838.18 MB
Available physical RAM: 2420.13 MB
Total Pagefile: 7674.54 MB
Available Pagefile: 6037.44 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB

==================== Drives ================================

Drive c: (System) (Fixed) (Total:931.41 GB) (Free:869.54 GB) NTFS
Drive d: () (Removable) (Total:0.98 GB) (Free:0.34 GB) FAT

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: E7A3CBC2)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 1006 MB) (Disk ID: 6E652072)
No partition Table on disk 1.

==================== End Of Log ============================
Denke das wars, oder, PC scheint sauber zu sein. Herzlichen Dank noch einmal.

schrauber 23.11.2013 07:34

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)


Alle Zeitangaben in WEZ +1. Es ist jetzt 07:02 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20