FRST Logfile:
FRST Logfile:
FRST Logfile:
FRST Logfile:
FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-01-2014 03
Ran by Habibti (administrator) on HABIBTI-VAIO on 18-01-2014 15:12:18
Running from C:\Users\Habibti\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: Downloading Farbar Recovery Scan Tool
Download link for 64-Bit Version: Downloading Farbar Recovery Scan Tool
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: FRST Tutorial - How to use Farbar Recovery Scan Tool - Geeks to Go Forums
==================== Processes (Whitelisted) =================
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nitro PDF Software) C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe
(Sony Corporation) C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe
(ArcSoft, Inc.) C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNService.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\Apoint.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe
() C:\Program Files (x86)\RocketDock\RocketDock.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 6700\Bin\ScanToPCActivationApp.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 6700\Bin\HPNetworkCommunicatorCom.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\ApMsgFwd.exe
(ALPS) C:\Program Files\Apoint\Apvfb.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\ApntEx.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMService.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\SeaPort.EXE
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Apoint] - C:\Program Files\Apoint\Apoint.exe [212480 2010-05-31] (Alps Electric Co., Ltd.)
HKLM\...\Run: [Windows Mobile Device Center] - C:\Windows\WindowsMobile\wmdc.exe [660360 2007-05-31] (Microsoft Corporation)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-17] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKCU\...\Run: [RocketDock] - C:\Program Files (x86)\RocketDock\RocketDock.exe [495616 2007-09-02] ()
HKCU\...\Run: [MobileDocuments] - C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe
HKCU\...\Run: [ApplePhotoStreams] - C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-11-20] (Apple Inc.)
HKCU\...\Run: [com.apple.dav.bookmarks.daemon] - C:\Program Files (x86)\Common Files\Apple\Internet Services\BookmarkDAV_client.exe
HKCU\...\Run: [HP Officejet 6700 (NET)] - C:\Program Files\HP\HP Officejet 6700\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
AppInit_DLLs: C:\PROGRA~2\Amazon\AMAZON~1\AMAZON~2.DLL [ ] ()
AppInit_DLLs-x32: c:\progra~2\amazon\amazon~1\\amazon~3.dll [ ] ()
Startup: C:\Users\Habibti\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Officejet 6700 (Netzwerk).lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Officejet 6700 (Netzwerk).lnk -> C:\Program Files\HP\HP Officejet 6700\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Sign In
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = 1&1 - Telefon-Internet-Flatrates und mobiles Internet
HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = 1&1 - Telefon-Internet-Flatrates und mobiles Internet
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {19228C4F-8923-4501-92BF-230D1FDFDAE4} URL = hxxp://go.1und1.de/br/ie8_search_amazon/?keywords={searchTerms}
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
SearchScopes: HKCU - {72FF0D37-4A18-46B1-88D7-63805E972492} URL = hxxp://go.1und1.de/br/ie8_search_ebay/?q={searchTerms}
SearchScopes: HKCU - {A7C82C73-F48C-4B93-B0AB-650D96591730} URL = hxxp://wa.ui-portal.de/1und1/1und1/s?produkte.browser.link.ebaysuche&s_brand=1und1&t_link=ebaysuche&ns_type=clickin&ns_url=hxxp://rover.ebay.com/rover/1/707-52222-30040-8/4?mpre=hxxp://shop.ebay.de/?_sacat=See-All-Categories&_nkw={searchTerms}
SearchScopes: HKCU - {D3463596-0886-4809-8560-0C4AAAB5B03F} URL = hxxp://go.1und1.de/br/ie8_search_web/?su={searchTerms}
SearchScopes: HKCU - {DF5C78F6-0A83-4483-B59E-7809C12D7F64} URL = hxxp://go.1und1.de/suchbox/ie_amazon/?keywords={searchTerms}
BHO: Bing Bar Helper - {1dad3af3-ef2f-4f64-ac4b-11789189fcb6} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\amd64\BingExt.dll (Microsoft Corporation.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Bing Bar Helper - {1dad3af3-ef2f-4f64-ac4b-11789189fcb6} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\BingExt.dll (Microsoft Corporation.)
BHO-x32: No Name - {26B19FA4-E8A1-4A1B-A163-1A1E46F830DD} - No File
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Bing Bar - {eec0f710-38b5-4aba-99bf-ec87564a4e13} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\amd64\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM-x32 - Bing Bar - {eec0f710-38b5-4aba-99bf-ec87564a4e13} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\BingExt.dll (Microsoft Corporation.)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Habibti\AppData\Roaming\Mozilla\Firefox\Profiles\x89xwakz.default
FF DefaultSearchEngine: Amazon
FF Homepage: hxxp://www.google.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nitropdf.com/NitroPDF - C:\Program Files (x86)\Nitro\Reader 3\npnitromozilla.dll (Nitro PDF)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Разпознаване на устройство Logitech - C:\Users\Habibti\AppData\Roaming\Mozilla\Firefox\Profiles\x89xwakz.default\Extensions\DeviceDetection@logitech.com [2011-08-21]
FF Extension: Virtus Search Opt-in - C:\Users\Habibti\AppData\Roaming\Mozilla\Firefox\Profiles\x89xwakz.default\Extensions\extension@virtusdesigns.com [2011-03-11]
FF Extension: Aero Fox Silver XL - C:\Users\Habibti\AppData\Roaming\Mozilla\Firefox\Profiles\x89xwakz.default\Extensions\{5c876f30-10ce-11dd-bd0b-0800200c9a66} [2011-03-11]
FF Extension: GutscheinRausch.de - C:\Users\Habibti\AppData\Roaming\Mozilla\Firefox\Profiles\x89xwakz.default\Extensions\jl@leimbach-it.de.xpi [2011-10-21]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2013-12-20]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2013-12-20]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} [2013-12-20]
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-17] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-19] (Avira Operations GmbH & Co. KG)
R2 NitroReaderDriverReadSpool3; C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe [230416 2013-03-26] (Nitro PDF Software)
R2 uCamMonitor; C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [104960 2008-09-18] (ArcSoft, Inc.)
S3 VCFw; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [864000 2010-09-27] (Sony Corporation)
S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [x]
==================== Drivers (Whitelisted) ====================
R3 ArcSoftKsUFilter; C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys [19968 2009-05-26] (ArcSoft, Inc.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-01] (Avira Operations GmbH & Co. KG)
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [304784 2010-03-23] ()
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-01-18 15:10 - 2014-01-18 15:02 - 00000967 _____ C:\Users\Habibti\Downloads\txt.txt
2014-01-18 14:56 - 2014-01-18 15:02 - 00000967 _____ C:\Users\Habibti\Desktop\txt.txt
2014-01-18 14:34 - 2014-01-18 14:38 - 00000000 ____D C:\AdwCleaner
2014-01-18 14:34 - 2014-01-18 14:34 - 01236282 _____ C:\Users\Habibti\Downloads\adwcleaner.exe
2014-01-18 08:45 - 2014-01-18 08:45 - 00028470 _____ C:\Users\Habibti\Downloads\Addition.txt
2014-01-18 08:43 - 2014-01-18 15:12 - 00014760 _____ C:\Users\Habibti\Downloads\FRST.txt
2014-01-18 08:43 - 2014-01-18 08:43 - 00000000 ____D C:\FRST
2014-01-18 08:42 - 2014-01-18 08:42 - 02076160 _____ (Farbar) C:\Users\Habibti\Downloads\FRST64.exe
2014-01-18 08:19 - 2014-01-18 08:19 - 00003152 _____ C:\Windows\System32\Tasks\{4F95111C-F878-4940-9DAD-1DF6E385D18E}
2014-01-18 08:18 - 2014-01-18 08:18 - 00009758 _____ C:\Windows\DPINST.LOG
2014-01-18 08:07 - 2014-01-18 08:20 - 00000000 ____D C:\Program Files (x86)\Plus-HD-5.0
2014-01-18 07:55 - 2014-01-18 08:24 - 00000000 ____D C:\Program Files (x86)\Jump Flip
2014-01-18 07:55 - 2014-01-18 08:13 - 00000000 ____D C:\Users\Habibti\AppData\Local\cache
2014-01-18 07:55 - 2014-01-18 07:55 - 00000000 ____D C:\Users\Habibti\.android
2014-01-18 07:55 - 2014-01-18 07:55 - 00000000 _____ C:\Users\Habibti\daemonprocess.txt
2014-01-18 07:53 - 2014-01-18 08:08 - 00003252 _____ C:\Windows\System32\Tasks\Digital Sites
2014-01-18 07:53 - 2014-01-18 08:08 - 00000300 _____ C:\Windows\Tasks\Digital Sites.job
2014-01-18 07:53 - 2014-01-18 07:53 - 00000110 _____ C:\Users\Habibti\AppData\Roaming\WB.CFG
2014-01-18 07:53 - 2014-01-18 07:53 - 00000005 _____ C:\Users\Habibti\AppData\Roaming\WBPU-TTL.DAT
2014-01-18 07:53 - 2014-01-18 07:53 - 00000000 ____D C:\Users\Habibti\AppData\Roaming\DigitalSites
2014-01-18 07:52 - 2014-01-18 07:52 - 00680328 _____ ( ) C:\Users\Habibti\Downloads\ZipOpenerSetup.exe
2014-01-17 22:03 - 2014-01-17 22:07 - 00027136 ___SH C:\Users\Habibti\AppData\Roaming\Thumbs.db
2014-01-17 13:46 - 2014-01-17 13:46 - 00002039 _____ C:\Users\Habibti\Desktop\Entfernen des Avira EU-Cleaners.lnk
2014-01-17 13:46 - 2014-01-17 13:46 - 00001983 _____ C:\Users\Habibti\Desktop\Avira EU-Cleaner.lnk
2014-01-17 13:45 - 2014-01-17 13:46 - 02209056 _____ C:\Users\Habibti\Downloads\avira-eu-cleaner_de.exe
2014-01-16 08:01 - 2014-01-16 08:00 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-01-16 08:00 - 2014-01-16 08:00 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-01-16 08:00 - 2014-01-16 08:00 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-01-16 07:39 - 2014-01-16 08:00 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-01-16 07:38 - 2014-01-16 07:39 - 00005373 _____ C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-01-15 12:32 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 12:32 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 12:32 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 12:32 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 12:32 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 12:32 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 12:32 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 12:32 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-15 12:32 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-14 19:37 - 2014-01-14 19:27 - 29040552 _____ (Oracle Corporation) C:\Users\Habibti\Documents\jre-7u45-windows-i586.exe
2014-01-14 19:26 - 2014-01-14 19:27 - 29040552 _____ (Oracle Corporation) C:\Users\Habibti\Downloads\jre-7u45-windows-i586.exe
2014-01-13 11:16 - 2014-01-13 13:21 - 00020941 _____ C:\Users\Habibti\Desktop\Behinderten Antrag Prozess.odt
2014-01-12 22:00 - 2014-01-16 10:11 - 00026847 _____ C:\Users\Habibti\Desktop\Questico scheißendreck..odt
2014-01-09 09:35 - 2014-01-09 09:35 - 00915368 _____ (Oracle Corporation) C:\Users\Habibti\Downloads\jxpiinstall(3).exe
2014-01-08 20:53 - 2014-01-14 20:15 - 00000000 ____D C:\Users\Habibti\Desktop\Elohim Lichtsprache
2014-01-05 20:33 - 2014-01-05 20:42 - 00022628 _____ C:\Users\Habibti\Desktop\Ablehnung des Mieterhöhungsbegehren 2014.odt
2014-01-04 19:34 - 2014-01-04 19:34 - 00013798 _____ C:\Users\Habibti\Desktop\Gut zu wissen!.odt
2013-12-22 09:27 - 2013-12-22 09:27 - 00002090 _____ C:\Users\Public\Desktop\Mozilla Thunderbird.lnk
2013-12-22 09:26 - 2013-12-22 09:27 - 21981704 _____ (Mozilla) C:\Users\Habibti\Downloads\Thunderbird Setup 24.2.0.exe
2013-12-20 18:08 - 2013-12-20 18:08 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-19 18:27 - 2013-12-24 21:20 - 00017803 _____ C:\Users\Habibti\Desktop\Jendrny Klage 2013.odt
==================== One Month Modified Files and Folders =======
2014-01-18 15:12 - 2014-01-18 08:43 - 00014760 _____ C:\Users\Habibti\Downloads\FRST.txt
2014-01-18 15:02 - 2014-01-18 15:10 - 00000967 _____ C:\Users\Habibti\Downloads\txt.txt
2014-01-18 15:02 - 2014-01-18 14:56 - 00000967 _____ C:\Users\Habibti\Desktop\txt.txt
2014-01-18 14:49 - 2012-10-12 18:33 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-18 14:47 - 2009-07-14 05:45 - 00013664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-18 14:47 - 2009-07-14 05:45 - 00013664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-18 14:43 - 2010-11-23 18:50 - 00654400 _____ C:\Windows\system32\perfh007.dat
2014-01-18 14:43 - 2010-11-23 18:50 - 00130240 _____ C:\Windows\system32\perfc007.dat
2014-01-18 14:43 - 2009-07-14 06:13 - 01498742 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-18 14:39 - 2013-12-18 09:08 - 00002296 _____ C:\Windows\setupact.log
2014-01-18 14:39 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-18 14:38 - 2014-01-18 14:34 - 00000000 ____D C:\AdwCleaner
2014-01-18 14:38 - 2013-07-13 21:16 - 01280406 _____ C:\Windows\WindowsUpdate.log
2014-01-18 14:34 - 2014-01-18 14:34 - 01236282 _____ C:\Users\Habibti\Downloads\adwcleaner.exe
2014-01-18 11:12 - 2011-03-08 19:45 - 00003954 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{8A5569B6-0925-4D15-81B8-3E6C7BB54F5A}
2014-01-18 08:45 - 2014-01-18 08:45 - 00028470 _____ C:\Users\Habibti\Downloads\Addition.txt
2014-01-18 08:43 - 2014-01-18 08:43 - 00000000 ____D C:\FRST
2014-01-18 08:42 - 2014-01-18 08:42 - 02076160 _____ (Farbar) C:\Users\Habibti\Downloads\FRST64.exe
2014-01-18 08:26 - 2013-12-18 09:08 - 00003810 _____ C:\Windows\PFRO.log
2014-01-18 08:24 - 2014-01-18 07:55 - 00000000 ____D C:\Program Files (x86)\Jump Flip
2014-01-18 08:20 - 2014-01-18 08:07 - 00000000 ____D C:\Program Files (x86)\Plus-HD-5.0
2014-01-18 08:19 - 2014-01-18 08:19 - 00003152 _____ C:\Windows\System32\Tasks\{4F95111C-F878-4940-9DAD-1DF6E385D18E}
2014-01-18 08:18 - 2014-01-18 08:18 - 00009758 _____ C:\Windows\DPINST.LOG
2014-01-18 08:13 - 2014-01-18 07:55 - 00000000 ____D C:\Users\Habibti\AppData\Local\cache
2014-01-18 08:08 - 2014-01-18 07:53 - 00003252 _____ C:\Windows\System32\Tasks\Digital Sites
2014-01-18 08:08 - 2014-01-18 07:53 - 00000300 _____ C:\Windows\Tasks\Digital Sites.job
2014-01-18 07:55 - 2014-01-18 07:55 - 00000000 ____D C:\Users\Habibti\.android
2014-01-18 07:55 - 2014-01-18 07:55 - 00000000 _____ C:\Users\Habibti\daemonprocess.txt
2014-01-18 07:55 - 2011-03-08 19:42 - 00000000 ____D C:\Users\Habibti
2014-01-18 07:53 - 2014-01-18 07:53 - 00000110 _____ C:\Users\Habibti\AppData\Roaming\WB.CFG
2014-01-18 07:53 - 2014-01-18 07:53 - 00000005 _____ C:\Users\Habibti\AppData\Roaming\WBPU-TTL.DAT
2014-01-18 07:53 - 2014-01-18 07:53 - 00000000 ____D C:\Users\Habibti\AppData\Roaming\DigitalSites
2014-01-18 07:52 - 2014-01-18 07:52 - 00680328 _____ ( ) C:\Users\Habibti\Downloads\ZipOpenerSetup.exe
2014-01-17 22:07 - 2014-01-17 22:03 - 00027136 ___SH C:\Users\Habibti\AppData\Roaming\Thumbs.db
2014-01-17 19:00 - 2011-03-08 20:45 - 00000000 ____D C:\Users\Habibti\AppData\Roaming\Mozilla
2014-01-17 13:46 - 2014-01-17 13:46 - 00002039 _____ C:\Users\Habibti\Desktop\Entfernen des Avira EU-Cleaners.lnk
2014-01-17 13:46 - 2014-01-17 13:46 - 00001983 _____ C:\Users\Habibti\Desktop\Avira EU-Cleaner.lnk
2014-01-17 13:46 - 2014-01-17 13:45 - 02209056 _____ C:\Users\Habibti\Downloads\avira-eu-cleaner_de.exe
2014-01-17 13:06 - 2011-03-10 23:27 - 00000000 ____D C:\Users\Habibti\AppData\Roaming\Nitro PDF
2014-01-16 10:11 - 2014-01-12 22:00 - 00026847 _____ C:\Users\Habibti\Desktop\Questico scheißendreck..odt
2014-01-16 08:01 - 2013-10-17 14:21 - 00000000 ____D C:\ProgramData\Oracle
2014-01-16 08:00 - 2014-01-16 08:01 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-01-16 08:00 - 2014-01-16 08:00 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-01-16 08:00 - 2014-01-16 08:00 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-01-16 08:00 - 2014-01-16 07:39 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-01-16 07:39 - 2014-01-16 07:38 - 00005373 _____ C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-01-16 07:39 - 2011-03-08 22:22 - 00000000 ____D C:\Program Files (x86)\Java
2014-01-16 07:29 - 2009-07-14 06:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2014-01-16 07:29 - 2009-07-14 05:45 - 00350248 _____ C:\Windows\system32\FNTCACHE.DAT
2014-01-15 21:03 - 2013-07-15 13:10 - 00000000 ____D C:\Windows\system32\MRT
2014-01-15 21:00 - 2011-03-09 16:02 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-15 20:55 - 2012-06-21 09:23 - 00000000 ____D C:\Users\Habibti\Desktop\fb.Foto´s
2014-01-15 19:21 - 2009-11-29 12:35 - 00000000 ____D C:\Users\Habibti\Desktop\Tattoos
2014-01-14 20:15 - 2014-01-08 20:53 - 00000000 ____D C:\Users\Habibti\Desktop\Elohim Lichtsprache
2014-01-14 19:27 - 2014-01-14 19:37 - 29040552 _____ (Oracle Corporation) C:\Users\Habibti\Documents\jre-7u45-windows-i586.exe
2014-01-14 19:27 - 2014-01-14 19:26 - 29040552 _____ (Oracle Corporation) C:\Users\Habibti\Downloads\jre-7u45-windows-i586.exe
2014-01-14 10:35 - 2012-03-25 20:31 - 00000000 ____D C:\Users\Habibti\Desktop\Esoterisches
2014-01-14 10:34 - 2011-03-12 22:17 - 00000000 ___RD C:\Users\Habibti\Persönliche Dokumente
2014-01-14 10:08 - 2013-06-17 10:01 - 00000000 ____D C:\Users\Habibti\Desktop\CrewPortal-Dateien
2014-01-14 10:08 - 2013-01-03 22:51 - 00000000 ____D C:\Users\Habibti\Desktop\CRA Rechnungen 12
2014-01-13 13:21 - 2014-01-13 11:16 - 00020941 _____ C:\Users\Habibti\Desktop\Behinderten Antrag Prozess.odt
2014-01-11 17:23 - 2012-10-31 18:43 - 00000000 ____D C:\Users\Habibti\Desktop\Wohnungs-Bewerbung
2014-01-09 09:35 - 2014-01-09 09:35 - 00915368 _____ (Oracle Corporation) C:\Users\Habibti\Downloads\jxpiinstall(3).exe
2014-01-08 13:09 - 2011-03-08 19:43 - 00081824 _____ C:\Users\Habibti\AppData\Local\GDIPFONTCACHEV1.DAT
2014-01-05 20:42 - 2014-01-05 20:33 - 00022628 _____ C:\Users\Habibti\Desktop\Ablehnung des Mieterhöhungsbegehren 2014.odt
2014-01-04 19:34 - 2014-01-04 19:34 - 00013798 _____ C:\Users\Habibti\Desktop\Gut zu wissen!.odt
2013-12-24 21:20 - 2013-12-19 18:27 - 00017803 _____ C:\Users\Habibti\Desktop\Jendrny Klage 2013.odt
2013-12-24 20:48 - 2013-12-17 15:21 - 00000000 ____D C:\Users\Habibti\AppData\Roaming\HpUpdate
2013-12-23 09:26 - 2012-04-26 09:12 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-12-22 09:27 - 2013-12-22 09:27 - 00002090 _____ C:\Users\Public\Desktop\Mozilla Thunderbird.lnk
2013-12-22 09:27 - 2013-12-22 09:26 - 21981704 _____ (Mozilla) C:\Users\Habibti\Downloads\Thunderbird Setup 24.2.0.exe
2013-12-22 09:27 - 2011-03-08 22:30 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-12-20 18:08 - 2013-12-20 18:08 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
Some content of TEMP:
====================
C:\Users\Habibti\AppData\Local\Temp\7187uninstall.exe
C:\Users\Habibti\AppData\Local\Temp\avgnt.exe
C:\Users\Habibti\AppData\Local\Temp\ICReinstall_ZipOpenerSetup.exe
C:\Users\Habibti\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe
C:\Users\Habibti\AppData\Local\Temp\Quarantine.exe
C:\Users\Habibti\AppData\Local\Temp\Sqlite3.dll
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-01-09 11:26
==================== End Of Log ============================
--- --- ---
--- --- ---
--- --- ---
--- --- ---
--- --- ---
Malwarebytes Anti-Malware 1.75.0.1300
Malwarebytes : Free Anti-Malware
Datenbank Version: v2014.01.18.03
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16476
Habibti :: HABIBTI-VAIO [Administrator]
18.01.2014 15:21:17
mbam-log-2014-01-18 (15-21-17).txt
Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 213478
Laufzeit: 8 Minute(n), 55 Sekunde(n)
Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse: 2
C:\Users\Habibti\AppData\Roaming\DigitalSites\UpdateProc (PUP.Optional.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Plus-HD-5.0 (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
Infizierte Dateien: 7
C:\Users\Habibti\AppData\Local\Temp\is357113909\32985368_stp\JumpFlipSetup.exe (PUP.Optional.JumpFlip.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Habibti\AppData\Local\Temp\is357113909\33802557_stp\OptimizerPro.exe (PUP.Optional.OptimizerPro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Habibti\AppData\Roaming\DigitalSites\UpdateProc\UpdateTask.exe (PUP.Optional.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Habibti\AppData\Roaming\DigitalSites\UpdateProc\config.dat (PUP.Optional.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Habibti\AppData\Roaming\DigitalSites\UpdateProc\prod.dat (PUP.Optional.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Habibti\AppData\Roaming\DigitalSites\UpdateProc\STTL.DAT (PUP.Optional.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Habibti\AppData\Roaming\DigitalSites\UpdateProc\TTL.DAT (PUP.Optional.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt.
(Ende)
ich habe den Maleware nochmals durchlaufen lassen, nachdem ich die Objekte entfernt habe. ... das ist nun das Ergebnis...schaut gut aus oder???
Malwarebytes Anti-Malware 1.75.0.1300
Malwarebytes : Free Anti-Malware
Datenbank Version: v2014.01.18.03
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16476
Habibti :: HABIBTI-VAIO [Administrator]
18.01.2014 15:35:41
mbam-log-2014-01-18 (15-35-41).txt
Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 213184
Laufzeit: 10 Minute(n), 46 Sekunde(n)
Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)
Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)
(Ende)
so leo, ich habe das mit dem FRST auch geschafft,hier das Ergebnis.
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 17-01-2014 03
Ran by Habibti at 2014-01-18 16:01:55 Run:1
Running from C:\Users\Habibti\Desktop
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
AppInit_DLLs: C:\PROGRA~2\Amazon\AMAZON~1\AMAZON~2.DLL [ ] ()
AppInit_DLLs-x32: c:\progra~2\amazon\amazon~1\\amazon~3.dll [ ] ()
2014-01-18 08:07 - 2014-01-18 08:20 - 00000000 ____D C:\Program Files (x86)\Plus-HD-5.0
2014-01-18 07:55 - 2014-01-18 08:24 - 00000000 ____D C:\Program Files (x86)\Jump Flip
2014-01-18 07:55 - 2014-01-18 08:13 - 00000000 ____D C:\Users\Habibti\AppData\Local\cache
2014-01-18 07:55 - 2014-01-18 07:55 - 00000000 ____D C:\Users\Habibti\.android
2014-01-18 07:55 - 2014-01-18 07:55 - 00000000 _____ C:\Users\Habibti\daemonprocess.txt
2014-01-18 07:53 - 2014-01-18 08:08 - 00003252 _____ C:\Windows\System32\Tasks\Digital Sites
2014-01-18 07:53 - 2014-01-18 08:08 - 00000300 _____ C:\Windows\Tasks\Digital Sites.job
C:\Users\Habibti\AppData\Local\Temp\*.exe
2014-01-18 07:52 - 2014-01-18 07:52 - 00680328 _____ ( ) C:\Users\Habibti\Downloads\ZipOpenerSetup.exe
*****************
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs => Value was restored successfully.
HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs => Value was restored successfully.
"C:\Program Files (x86)\Plus-HD-5.0" => File/Directory not found.
C:\Program Files (x86)\Jump Flip => Moved successfully.
C:\Users\Habibti\AppData\Local\cache => Moved successfully.
C:\Users\Habibti\.android => Moved successfully.
C:\Users\Habibti\daemonprocess.txt => Moved successfully.
C:\Windows\System32\Tasks\Digital Sites => Moved successfully.
C:\Windows\Tasks\Digital Sites.job => Moved successfully.
C:\Users\Habibti\AppData\Local\Temp\*.exe => Moved successfully.
C:\Users\Habibti\Downloads\ZipOpenerSetup.exe => Moved successfully.
==== End of Fixlog ====