Trojaner-Board - Windows 8, Infektion mit Win32/Fynloski.A?

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Windows 8, Infektion mit Win32/Fynloski.A? (https://www.trojaner-board.de/142271-windows-8-infektion-win32-fynloski-a.html)

Rupsi

29.09.2013 16:02

Windows 8, Infektion mit Win32/Fynloski.A?

Guten Tag,
seit einigen Tagen meldet Windows Defender bei mir eine Infektion mit Win32/Fynloski.A. MBAM meldet weitere Infektionen aber kein Fynloski.
An Symptomen habe ich selbst bislang wenig erkennen können, außer dass häufiger wenn ich in Firefox auf einen link klicke, dieses erst nach mehreren Malen funktioniert. Sonst kommt in etwa eine Meldung wie"Server nicht gefunden".
Da es anscheinend mit dem Defender nicht möglich ist, den Urheber zu eliminieren nun hier die Frage an jemanden, der mehr davon versteht als ich. Wie werde ich diesen Schädling wieder los?
Gmer-log:

Code:

GMER 2.1.19163 - hxxp://www.gmer.net

Rootkit scan 2013-09-29 16:29:20

Windows 6.2.9200  x64 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP1T1L0-3 WDC_WD3200AAJS-22RYA0 rev.12.01B01 298,09GB

Running: gmer_2.1.19163.exe; Driver: C:\Users\TOM_AD~1\AppData\Local\Temp\kwrcyuog.sys
 
 

---- User code sections - GMER 2.1 ----
 

.text   C:\WINDOWS\system32\dwm.exe[984] C:\WINDOWS\system32\PSAPI.DLL!GetProcessImageFileNameA + 306                                       000007ff5781177a 4 bytes [81, 57, FF, 07]

.text   C:\WINDOWS\system32\dwm.exe[984] C:\WINDOWS\system32\PSAPI.DLL!GetProcessImageFileNameA + 314                                       000007ff57811782 4 bytes [81, 57, FF, 07]

.text   C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[864] C:\WINDOWS\SYSTEM32\MSIMG32.dll!GradientFill + 690                    000007ff53a11532 4 bytes [A1, 53, FF, 07]

.text   C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[864] C:\WINDOWS\SYSTEM32\MSIMG32.dll!GradientFill + 698                    000007ff53a1153a 4 bytes [A1, 53, FF, 07]

.text   C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[864] C:\WINDOWS\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                  000007ff53a1165a 4 bytes [A1, 53, FF, 07]

.text   C:\WINDOWS\system32\nvvsvc.exe[912] C:\WINDOWS\system32\MSIMG32.dll!GradientFill + 690                                              000007ff53a11532 4 bytes [A1, 53, FF, 07]

.text   C:\WINDOWS\system32\nvvsvc.exe[912] C:\WINDOWS\system32\MSIMG32.dll!GradientFill + 698                                              000007ff53a1153a 4 bytes [A1, 53, FF, 07]

.text   C:\WINDOWS\system32\nvvsvc.exe[912] C:\WINDOWS\system32\MSIMG32.dll!TransparentBlt + 246                                            000007ff53a1165a 4 bytes [A1, 53, FF, 07]

.text   C:\WINDOWS\system32\nvvsvc.exe[912] C:\WINDOWS\system32\PSAPI.DLL!GetProcessImageFileNameA + 306                                    000007ff5781177a 4 bytes [81, 57, FF, 07]

.text   C:\WINDOWS\system32\nvvsvc.exe[912] C:\WINDOWS\system32\PSAPI.DLL!GetProcessImageFileNameA + 314                                    000007ff57811782 4 bytes [81, 57, FF, 07]

.text   C:\WINDOWS\system32\mqsvc.exe[252] C:\WINDOWS\system32\WSOCK32.dll!recvfrom + 742                                                   000007ff50211b32 4 bytes [21, 50, FF, 07]

.text   C:\WINDOWS\system32\mqsvc.exe[252] C:\WINDOWS\system32\WSOCK32.dll!recvfrom + 750                                                   000007ff50211b3a 4 bytes [21, 50, FF, 07]

.text   C:\WINDOWS\System32\svchost.exe[1992] c:\windows\system32\WSOCK32.dll!recvfrom + 742                                                000007ff50211b32 4 bytes [21, 50, FF, 07]

.text   C:\WINDOWS\System32\svchost.exe[1992] c:\windows\system32\WSOCK32.dll!recvfrom + 750                                                000007ff50211b3a 4 bytes [21, 50, FF, 07]

.text   C:\WINDOWS\System32\svchost.exe[2248] c:\windows\system32\WSOCK32.dll!recvfrom + 742                                                000007ff50211b32 4 bytes [21, 50, FF, 07]

.text   C:\WINDOWS\System32\svchost.exe[2248] c:\windows\system32\WSOCK32.dll!recvfrom + 750                                                000007ff50211b3a 4 bytes [21, 50, FF, 07]

.text   C:\Program Files\Windows Defender\MsMpEng.exe[2544] C:\WINDOWS\system32\psapi.dll!GetProcessImageFileNameA + 306                    000007ff5781177a 4 bytes [81, 57, FF, 07]

.text   C:\Program Files\Windows Defender\MsMpEng.exe[2544] C:\WINDOWS\system32\psapi.dll!GetProcessImageFileNameA + 314                    000007ff57811782 4 bytes [81, 57, FF, 07]

.text   C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1164] C:\WINDOWS\SYSTEM32\MSIMG32.dll!GradientFill + 690                     000007ff53a11532 4 bytes [A1, 53, FF, 07]

.text   C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1164] C:\WINDOWS\SYSTEM32\MSIMG32.dll!GradientFill + 698                     000007ff53a1153a 4 bytes [A1, 53, FF, 07]

.text   C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1164] C:\WINDOWS\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                   000007ff53a1165a 4 bytes [A1, 53, FF, 07]
 

---- Threads - GMER 2.1 ----
 

Thread  C:\WINDOWS\system32\csrss.exe [572:596]                                                                                             fffff960008a85e8

Thread  C:\WINDOWS\SysWOW64\notepad.exe [4144:4152]                                                                                         0000000000470000
 

---- Registry - GMER 2.1 ----
 

Reg     HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel\RNG@RNGAuxiliarySeed                                                   -1267476665

Reg     HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch@Epoch                                                                     101329

Reg     HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules@{6CC20B6F-BCB9-4388-AF99-08346840D374}  v2.20|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Windows\System32\spoolsv.exe|Name=HP Networked Printer Installer|

Reg     HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules@{529126C3-73FC-4287-ACAF-A02B973D223B}  v2.20|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Windows\System32\spoolsv.exe|Name=HP Networked Printer Installer|
 

---- EOF - GMER 2.1 ----

First-Log

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-09-2013 02

Ran by Tom (ATTENTION: The logged in user is not administrator) on TOM_ADMIN-PC on 29-09-2013 14:01:47

Running from L:\Download

Windows 8 Pro (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) =================
 

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe

(Hewlett-Packard Company) C:\Program Files (x86)\HP\HP Color LaserJet CM2320 MFP Series\hppfaxprintersrv.exe

(Samsung) C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe

(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe

(InstallShield Software Corporation) C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe

() C:\Users\Tom\AppData\Local\Temp\cvtres.exe

(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe

(Microsoft Corporation) C:\WINDOWS\SysWOW64\notepad.exe

(Mozilla Corporation) C:\Program Files (x86)\Firefox\firefox.exe

(Mozilla Corporation) C:\Program Files (x86)\Firefox\plugin-container.exe

(Adobe Systems, Inc.) C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe

(Adobe Systems, Inc.) C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13196432 2012-09-25] (Realtek Semiconductor)

HKLM\...\Run: [HP Color LaserJet CM2320 MFP Series Fax] - C:\Program Files (x86)\HP\HP Color LaserJet CM2320 MFP Series\hppfaxprintersrv.exe [3700736 2009-09-22] (Hewlett-Packard Company)

HKLM\...\RunOnce: [*WerKernelReporting] - %SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq [439488 2013-07-09] (Microsoft Corporation)

HKLM\...\Winlogon: [Userinit] C:\Windows\SysWOW64\userinit.exe,

HKCU\...\Run: [Java Updater] - C:\Users\Tom\AppData\lsass.exe [274944 2013-09-13] ()

HKCU\...\Run: [] - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844656 2013-09-04] (Samsung)

HKLM-x32\...\Run: [BCSSync] - C:\Program Files (x86)\Microsoft Office2010\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)

HKLM-x32\...\Run: [EaseUS EPM tray] - C:\Program Files (x86)\EaseUS\EaseUS Partition Master 9.2.1 Home Edition\bin\EpmNews.exe [2086984 2012-11-29] (CHENGDU YIWO Tech Development Co., Ltd)

HKLM-x32\...\Run: [ISUSScheduler] - C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe [81920 2005-02-16] (InstallShield Software Corporation)

HKLM-x32\...\Run: [JMB36X IDE Setup] - C:\Windows\RaidTool\xInsIDE.exe [36864 2007-03-20] ()

HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [163000 2012-12-12] (Geek Software GmbH)

HKLM-x32\...\Run: [] - [x]

HKLM-x32\...\Run: [HPUsageTracking] - C:\Program Files (x86)\HP\HP UT\bin\hppusg.exe [24576 2009-05-11] (Hewlett-Packard Company)

HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)

HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)

HKLM-x32\...\Run: [Live Update 5] - C:\Program Files (x86)\MSI\Live Update 5\BootStartLiveupdate.exe [315392 2012-01-30] ()

HKLM-x32\...\Run: [KiesTrayAgent] - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311152 2013-09-04] (Samsung Electronics Co., Ltd.)

AppInit_DLLs:         [0 ] ()

AppInit_DLLs-x32:   [ ] ()

Startup: C:\Users\Tom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk

ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office2010\Office14\ONENOTEM.EXE (Microsoft Corporation)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.metager.de/

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x6EEDBAB406CCCD01

SearchScopes: HKLM-x32 - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snap.do/?publisher=SnapdoEMon&dpid=SnapdoEMon&co=DE&userid=dc45f073-fe67-455e-a3b8-5331ef50cad9&searchtype=ds&q={searchTerms}

SearchScopes: HKLM-x32 - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snap.do/?publisher=SnapdoEMon&dpid=SnapdoEMon&co=DE&userid=dc45f073-fe67-455e-a3b8-5331ef50cad9&searchtype=ds&q={searchTerms}

SearchScopes: HKCU - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snap.do/?publisher=SnapdoEMon&dpid=SnapdoEMon&co=DE&userid=dc45f073-fe67-455e-a3b8-5331ef50cad9&searchtype=ds&q={searchTerms}

SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snap.do/?publisher=SnapdoEMon&dpid=SnapdoEMon&co=DE&userid=dc45f073-fe67-455e-a3b8-5331ef50cad9&searchtype=ds&q={searchTerms}

SearchScopes: HKCU - {3BD44F0E-0596-4008-AEE0-45D47E3A8F0E} URL = 

BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office2010\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office2010\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: No Name - {DBC80044-A445-435b-BC74-9C25C1C588A9} -  No File

Toolbar: HKLM -  No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} -  No File

Toolbar: HKLM-x32 -  No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} -  No File

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 0.0.0.0
 

FireFox:

========

FF ProfilePath: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default

FF DefaultSearchEngine: Ixquick HTTP - Deutsch

FF SelectedSearchEngine: Ixquick HTTP - Deutsch

FF Homepage: hxxp://meta.rrzn.uni-hannover.de/meta/cgi-bin/mg-perein.pl?mg_version=10&mm=and&lr=all&maxtreffer=200&time=2&hitsPerServer=2&textmenge=2&wissRank=on&sprueche=on&wikiboost=on&QuickTips=beschleuniger&synonyme=on&linkTest=no&check_time=3&dmoz=on&exalead=on&fastbot=on&wikipedia=on&yacy=on&witch=on&overture=on&nebel=on&metarss=on&Nachrichten=on&atsearch=on&suchticker=on&amidalla=on&BASE=on&portalu=on&fportal=on&clewwa=on&qsensei=on&harvest=on&premiumpresse=on&yandex=on&dest=bookmark

FF NetworkProxy: "http", "211.76.97.150"

FF NetworkProxy: "http_port", 80

FF NetworkProxy: "share_proxy_settings", true

FF NetworkProxy: "type", 0

FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()

FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()

FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\WINDOWS\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf - f:\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)

FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf - f:\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)

FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - e:\Picasa3\npPicasa3.dll No File

FF Plugin-x32: @java.com/DTPlugin,version=1.6.0_35 - C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MI4066~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MI4066~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin-x32: @real.com/nppl3260;version=15.0.4.53 - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprjplug;version=15.0.4.53 - c:\program files (x86)\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprpchromebrowserrecordext;version=15.0.4.53 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprphtml5videoshim;version=15.0.4.53 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprpplugin;version=15.0.4.53 - c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Tom\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()

FF SearchPlugin: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\betabinariesnl.xml

FF SearchPlugin: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\eurobuchcom.xml

FF SearchPlugin: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\icqplugin-1.xml

FF SearchPlugin: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\icqplugin-2.xml

FF SearchPlugin: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\icqplugin-3.xml

FF SearchPlugin: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\icqplugin.xml

FF SearchPlugin: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\ixquick-http---deutsch.xml

FF SearchPlugin: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\mein-metager.xml

FF SearchPlugin: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\searchplugins-backup

FF SearchPlugin: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\startpage-https---deutsch.xml

FF Extension: Deutsches Wörterbuch - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\de-DE@dictionaries.addons.mozilla.org

FF Extension: Garmin Communicator - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}

FF Extension: Microsoft .NET Framework Assistant - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b}

FF Extension: EPUBReader - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\{5384767E-00D9-40E9-B72F-9CC39D655D6F}

FF Extension: No Name - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\{c36177c0-224a-11da-8cd6-0800200c9a66}

FF Extension: Bitdefender QuickScan - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\{e001c731-5e37-4538-a5cb-8168736a2360}

FF Extension: admin - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\admin@proxy-listen.de.xpi

FF Extension: No Name - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\Extensions.rdf

FF Extension: No Name - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\installed-extensions.txt

FF Extension: optout - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\optout@google.com.xpi

FF Extension: youtubeunblocker - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\youtubeunblocker@unblocker.yt.xpi

FF HKLM-x32\...\Firefox\Extensions: [{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext

FF Extension: RealPlayer Browser Record Plugin - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext

FF HKLM-x32\...\Firefox\Extensions: [{ACAA314B-EEBA-48e4-AD47-84E31C44796C}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\

FF StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Firefox\firefox.exe
 

Chrome: 

=======

CHR HomePage: hxxp://www.google.com/

CHR DefaultSearchURL: (Google) - {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}

CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}

CHR Plugin: (Chrome PDF Viewer) - C:\Users\Tom\AppData\Local\Google\Chrome\Application\10.0.648.204\pdf.dll No File

CHR Plugin: (Google Gears 0.5.33.0) - C:\Users\Tom\AppData\Local\Google\Chrome\Application\10.0.648.204\gears.dll No File

CHR Plugin: (Shockwave Flash) - C:\Users\Tom\AppData\Local\Google\Chrome\Application\10.0.648.204\gcswf32.dll No File

CHR Plugin: (Foxit Reader Plugin for Mozilla) - C:\Program Files (x86)\Firefox\plugins\npFoxitReaderPlugin.dll (Foxit Software Company)

CHR Plugin: (2007 Microsoft Office system) - C:\Program Files (x86)\Firefox\plugins\NPOFF12.DLL (Microsoft Corporation)

CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

CHR Plugin: (Google Update) - C:\Users\Tom\AppData\Local\Google\Update\1.2.183.39\npGoogleOneClick8.dll No File

CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File

CHR Plugin: (Default Plug-in) - default_plugin No File

CHR HKLM-x32\...\Chrome\Extension: [abfmigjiaapipflmopkaaooigcjjdojh] - C:\Program Files (x86)\LyricsContainer\120.crx

CHR HKLM-x32\...\Chrome\Extension: [fjoijdanhaiflhibkljeklcghcmmfffh] - C:\Program Files (x86)\WebCake\WebCakeLayers.crx

CHR HKLM-x32\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Ext\rphtml5video.crx

CHR HKLM-x32\...\Chrome\Extension: [ofnnlhbgdcabppjmlijllkhekcglbjlg] - C:\Program Files (x86)\Lyrics_Monkey\128.crx
 

==================== Services (Whitelisted) =================
 

R2 BackupStack; C:\Program Files (x86)\MyPC Backup\BackupStack.exe [32808 2013-07-01] (Just Develop It)

R2 Garmin Core Update Service; C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [185688 2013-03-27] (Garmin Ltd or its subsidiaries)

R2 HPSLPSVC; C:\Users\Tom\AppData\Local\Temp\7zS3579\hpslpsvc64.dll [1039360 2012-11-14] (Hewlett-Packard Co.)

R2 lmhosts; C:\Windows\system32\svchost.exe [29696 2012-09-20] (Microsoft Corporation)

S3 Microsoft SharePoint Workspace Audit Service; C:\Program Files (x86)\Microsoft Office2010\Office14\GROOVE.EXE [30785672 2012-09-20] (Microsoft Corporation)

R2 MSMQ; C:\Windows\system32\mqsvc.exe [25088 2012-07-26] (Microsoft Corporation)

R2 NlaSvc; C:\Windows\System32\svchost.exe [29696 2012-09-20] (Microsoft Corporation)

R2 nsi; C:\Windows\system32\svchost.exe [29696 2012-09-20] (Microsoft Corporation)

R2 PMBDeviceInfoProvider; C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe [474168 2012-04-22] (Sony Corporation)

S2 SynoDrService; C:\Program Files (x86)\Synology Data Replicator  3\SynoDrServicex64.exe [380928 2010-06-02] ()

R2 TVGOnlineUpdateSvc; C:\Program Files (x86)\TVG\OnlineUpdate\OnlineUpdateSvc.exe [398128 2010-12-14] ()

R2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [471552 2012-07-26] (Microsoft Corporation)

R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)

R2 WsysSvc; C:\ProgramData\eSafe\eGdpSvc.exe [301120 2013-08-25] (Wsys Co., Ltd.)
 

==================== Drivers (Whitelisted) ====================
 

S3 androidusb; C:\Windows\System32\Drivers\androidusb.sys [32768 2010-04-29] (Google Inc)

S3 DigiartyVirtualCDBus; C:\Windows\System32\drivers\DigiartyVirtualCDBus.sys [276256 2013-08-28] (Digiarty Software, Inc.)

R2 easycvfs; C:\WINDOWS\system32\drivers\easycvfs.sys [109960 2009-11-09] ()

S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [17480 2012-12-21] ()

S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [17480 2012-12-21] ()

S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9800 2012-12-21] ()

S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9800 2012-12-21] ()

R1 HWiNFO32; C:\Program Files (x86)\HWiNFO32\HWiNFO64A.SYS [29288 2009-05-21] (REALiX(tm))

R1 HWiNFO32; C:\Program Files (x86)\HWiNFO32\HWiNFO64A.SYS [29288 2009-05-21] (REALiX(tm))

R3 MQAC; C:\Windows\System32\drivers\mqac.sys [185856 2012-07-26] (Microsoft Corporation)

S1 NNSNAHSL; C:\Windows\System32\DRIVERS\NNSNAHSL.sys [33320 2012-10-22] (Panda Security, S.L.)

S3 NTIOLib_1_0_4; C:\Program Files (x86)\MSI\Live Update 5\NTIOLib_X64.sys [14136 2010-10-22] (MSI)

S3 NTIOLib_1_0_4; C:\Program Files (x86)\MSI\Live Update 5\NTIOLib_X64.sys [14136 2010-10-22] (MSI)

S3 NTIOLib_1_0_6; C:\Program Files (x86)\Setup Files\Ms7586v1B0\NTIOLib_X64.sys [11888 2011-01-06] (MSI)

S3 NTIOLib_1_0_6; C:\Program Files (x86)\Setup Files\Ms7586v1B0\NTIOLib_X64.sys [11888 2011-01-06] (MSI)

R3 seehcri; C:\Windows\System32\drivers\seehcri.sys [34032 2008-01-09] (Sony Ericsson Mobile Communications)

R3 SKYNET; C:\Windows\system32\DRIVERS\SkyNET_AMD64.SYS [615440 2009-09-11] (TechniSat Digital, S.A.)

S4 sptd; C:\Windows\System32\Drivers\sptd.sys [828912 2011-08-16] (Duplex Secure Ltd.)

S3 vvftav; C:\Windows\System32\drivers\vvftav.sys [300800 2007-02-02] (Vimicro Corporation)

S3 ZSMC0305; C:\Windows\System32\Drivers\usbVM305.sys [1541120 2007-03-08] (Vimicro Corporation)

U3 idsvc; 

S3 MSI_MSIBIOS_010507; \??\C:\Program Files (x86)\MSI\Live Update 5\msibios64_100507.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-09-29 14:01 - 2013-09-29 14:01 - 00000000 ____D C:\FRST

2013-09-27 14:21 - 2013-09-27 14:21 - 00000000 ____D C:\Users\Tom\Documents\SelfMV

2013-09-27 14:10 - 2013-09-27 14:10 - 00002018 _____ C:\Users\Public\Desktop\Samsung Kies (Lite).lnk

2013-09-27 14:10 - 2013-09-27 14:10 - 00002008 _____ C:\Users\Public\Desktop\Samsung Kies.lnk

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\WINDOWS\LastGood.Tmp

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Tom\Documents\samsung

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Tom\AppData\Roaming\Samsung

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Tom\AppData\Local\Samsung

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Public\Documents\NativeFus_Log

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Public\Documents\CrashDump

2013-09-27 14:08 - 2013-09-27 14:08 - 00000000 ____D C:\Program Files (x86)\MyFree Codec

2013-09-27 14:05 - 2013-09-27 14:09 - 00000000 ____D C:\ProgramData\Samsung

2013-09-27 14:05 - 2013-09-27 14:09 - 00000000 ____D C:\Program Files (x86)\Samsung

2013-09-27 14:05 - 2013-07-18 14:33 - 04659712 _____ (Dmitry Streblechenko) C:\WINDOWS\SysWOW64\Redemption.dll

2013-09-27 14:05 - 2013-07-18 14:32 - 00821824 _____ (Devguru Co., Ltd.) C:\WINDOWS\SysWOW64\dgderapi.dll

2013-09-27 13:59 - 2013-09-27 13:59 - 00001059 _____ C:\Users\Public\Desktop\DriverTuner.lnk

2013-09-27 13:59 - 2013-09-27 13:59 - 00000000 ____D C:\Program Files (x86)\DriverTuner

2013-09-27 13:54 - 2013-09-27 13:54 - 00000000 ____D C:\Users\Tom\.android

2013-09-26 10:35 - 2013-09-26 10:35 - 00000103 _____ C:\WINDOWS\ParrotFlashWiz.INI

2013-09-26 10:33 - 2013-09-26 10:33 - 00000000 ____D C:\Program Files (x86)\Parrot Software Update Tool

2013-09-23 11:12 - 2013-09-23 11:12 - 1285878931 _____ C:\WINDOWS\MEMORY.DMP

2013-09-16 20:47 - 2013-08-07 07:15 - 00144896 _____ (Microsoft Corporation) C:\WINDOWS\system32\tssdisai.dll

2013-09-15 13:06 - 2013-09-15 13:07 - 00531240 _____ C:\WINDOWS\system32\FNTCACHE.DAT

2013-09-15 10:43 - 2013-09-15 10:43 - 00005630 _____ C:\WINDOWS\PFRO.log

2013-09-14 17:15 - 2013-09-29 12:54 - 00108555 _____ C:\WINDOWS\setupact.log

2013-09-14 17:15 - 2013-09-14 17:15 - 00000000 _____ C:\WINDOWS\setuperr.log

2013-09-13 10:57 - 2013-09-29 12:22 - 01964153 _____ C:\WINDOWS\WindowsUpdate.log

2013-09-13 09:28 - 2013-09-13 09:28 - 00274944 _____ C:\Users\Tom\AppData\lsass.exe

2013-09-13 09:24 - 2013-08-16 07:41 - 00058200 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dam.sys

2013-09-13 09:24 - 2013-08-16 07:39 - 02371728 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSService.dll

2013-09-13 09:24 - 2013-08-16 07:39 - 00059416 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe

2013-09-13 09:24 - 2013-08-16 07:32 - 00209200 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationUI.exe

2013-09-13 09:24 - 2013-08-16 07:22 - 04917760 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppsvc.exe

2013-09-13 09:24 - 2013-08-16 07:22 - 00040448 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe

2013-09-13 09:24 - 2013-08-16 07:21 - 03275776 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 01621504 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 01164288 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00773120 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00688640 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00368640 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppwinob.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00252416 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00204800 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSClient.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00183808 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSSync.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00174592 _____ (Microsoft Corporation) C:\WINDOWS\system32\storewuauth.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00163840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00142848 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00120320 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppc.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00099328 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00081408 _____ (Microsoft Corporation) C:\WINDOWS\system32\setupcln.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00049664 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00049152 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups2.dll

2013-09-13 09:24 - 2013-08-16 07:20 - 00105984 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinSetupUI.dll

2013-09-13 09:24 - 2013-08-16 00:43 - 00628736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll

2013-09-13 09:24 - 2013-08-16 00:43 - 00562688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll

2013-09-13 09:24 - 2013-08-16 00:43 - 00167424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSClient.dll

2013-09-13 09:24 - 2013-08-16 00:43 - 00159232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSSync.dll

2013-09-13 09:24 - 2013-08-16 00:43 - 00143872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.dll

2013-09-13 09:24 - 2013-08-16 00:43 - 00126976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll

2013-09-13 09:24 - 2013-08-16 00:43 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll

2013-09-13 09:24 - 2013-08-16 00:43 - 00084992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll

2013-09-13 09:24 - 2013-08-16 00:43 - 00083968 _____ C:\WINDOWS\SysWOW64\OEMLicense.dll

2013-09-13 09:24 - 2013-08-16 00:43 - 00035328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe

2013-09-13 09:24 - 2013-08-16 00:43 - 00020992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wups.dll

2013-09-13 09:24 - 2013-08-16 00:42 - 00091648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sppc.dll

2013-09-13 09:24 - 2013-08-16 00:42 - 00076800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\setupcln.dll

2013-09-13 09:23 - 2013-08-21 06:12 - 02241024 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll

2013-09-13 09:23 - 2013-08-21 06:12 - 00051712 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe

2013-09-13 09:23 - 2013-08-21 06:11 - 19246592 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 15404544 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 03959296 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 02647040 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 01365504 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 00915968 _____ (Microsoft Corporation) C:\WINDOWS\system32\uxtheme.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 00855552 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 00603136 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 00136704 _____ (Microsoft Corporation) C:\WINDOWS\system32\iesysprep.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 00067072 _____ (Microsoft Corporation) C:\WINDOWS\system32\iesetup.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 00053760 _____ (Microsoft Corporation) C:\WINDOWS\system32\UXInit.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 00053760 _____ (Microsoft Corporation) C:\WINDOWS\system32\jsproxy.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 00039936 _____ (Microsoft Corporation) C:\WINDOWS\system32\iernonce.dll

2013-09-13 09:23 - 2013-08-21 04:34 - 02706432 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.tlb

2013-09-13 09:23 - 2013-08-21 04:06 - 01767936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll

2013-09-13 09:23 - 2013-08-21 04:06 - 01141248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll

2013-09-13 09:23 - 2013-08-21 04:06 - 00044032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UXInit.dll

2013-09-13 09:23 - 2013-08-21 04:05 - 14332928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll

2013-09-13 09:23 - 2013-08-21 04:05 - 13761024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll

2013-09-13 09:23 - 2013-08-21 04:05 - 02876928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll

2013-09-13 09:23 - 2013-08-21 04:05 - 02048000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll

2013-09-13 09:23 - 2013-08-21 04:05 - 00690688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll

2013-09-13 09:23 - 2013-08-21 04:05 - 00493056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll

2013-09-13 09:23 - 2013-08-21 04:05 - 00109056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iesysprep.dll

2013-09-13 09:23 - 2013-08-21 04:05 - 00061440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iesetup.dll

2013-09-13 09:23 - 2013-08-21 04:05 - 00039936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jsproxy.dll

2013-09-13 09:23 - 2013-08-21 04:05 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iernonce.dll

2013-09-13 09:23 - 2013-08-21 03:43 - 02706432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.tlb

2013-09-13 09:23 - 2013-08-21 01:52 - 00534528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\uxtheme.dll

2013-09-13 09:23 - 2013-08-03 06:30 - 04038144 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys

2013-09-12 22:38 - 2013-09-12 22:38 - 00001604 _____ C:\Users\Public\Desktop\Angry Birds Star Wars.lnk

2013-09-11 21:10 - 2013-07-09 10:04 - 00120144 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\msgpioclx.sys

2013-09-11 21:10 - 2013-07-09 08:18 - 00439488 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe

2013-09-11 21:10 - 2013-07-09 06:25 - 00385768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe

2013-09-11 21:10 - 2013-07-09 00:46 - 00414208 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanconn.dll

2013-09-11 21:10 - 2013-07-09 00:46 - 00370688 _____ (Microsoft Corporation) C:\WINDOWS\system32\Wwanadvui.dll

2013-09-11 21:10 - 2013-07-06 02:16 - 01025024 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll

2013-09-11 21:10 - 2013-07-03 02:23 - 00778752 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleaut32.dll

2013-09-11 21:10 - 2013-07-03 02:22 - 02839552 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll

2013-09-11 21:10 - 2013-07-03 02:22 - 01300480 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32.dll

2013-09-11 21:10 - 2013-07-03 02:11 - 00551424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleaut32.dll

2013-09-11 21:10 - 2013-07-03 02:11 - 00268800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.BackgroundTransfer.dll

2013-09-11 21:10 - 2013-07-03 02:10 - 02273792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll

2013-09-11 21:10 - 2013-06-29 08:15 - 00195416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys

2013-09-11 21:10 - 2013-06-29 08:15 - 00125784 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpsd.sys

2013-09-11 21:10 - 2013-06-29 07:43 - 00327512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Classpnp.sys

2013-09-11 21:10 - 2013-06-25 00:54 - 00447488 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll

2013-09-11 21:10 - 2013-06-25 00:54 - 00263680 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmsvc.dll

2013-09-11 21:10 - 2013-06-25 00:54 - 00074240 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmcsp.dll

2013-09-11 21:10 - 2013-06-19 07:36 - 00183808 _____ (Microsoft Corporation) C:\WINDOWS\system32\winmmbase.dll

2013-09-11 21:10 - 2013-06-19 07:36 - 00115712 _____ (Microsoft Corporation) C:\WINDOWS\system32\winmm.dll

2013-09-11 21:10 - 2013-06-19 00:38 - 00160256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmmbase.dll

2013-09-11 21:10 - 2013-06-19 00:38 - 00125440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmm.dll

2013-09-11 21:10 - 2013-06-12 01:26 - 00230912 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinSCard.dll

2013-09-11 21:10 - 2013-06-10 23:17 - 00096512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wfplwfs.sys

2013-09-11 21:10 - 2013-06-10 21:15 - 01156096 _____ (Microsoft Corporation) C:\WINDOWS\system32\IKEEXT.DLL

2013-09-11 21:10 - 2013-06-10 21:15 - 00723968 _____ (Microsoft Corporation) C:\WINDOWS\system32\BFE.DLL

2013-09-11 21:10 - 2013-06-10 21:15 - 00381952 _____ (Microsoft Corporation) C:\WINDOWS\system32\FWPUCLNT.DLL

2013-09-11 21:10 - 2013-06-06 10:03 - 00119040 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBSTOR.SYS

2013-09-11 21:09 - 2013-07-09 05:57 - 00245760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LocationApi.dll

2013-09-11 21:09 - 2013-07-09 00:46 - 00543744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanmm.dll

2013-09-11 21:09 - 2013-07-09 00:45 - 00312832 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationApi.dll

2013-09-11 21:09 - 2013-07-03 02:23 - 00391168 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.BackgroundTransfer.dll

2013-09-11 21:09 - 2013-07-02 00:08 - 00387583 _____ C:\WINDOWS\system32\ApnDatabase.xml

2013-09-11 21:09 - 2013-07-01 00:30 - 00067072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\openfiles.exe

2013-09-11 21:09 - 2013-07-01 00:29 - 00077312 _____ (Microsoft Corporation) C:\WINDOWS\system32\openfiles.exe

2013-09-11 21:09 - 2013-06-29 03:12 - 01022464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32.dll

2013-09-11 21:09 - 2013-06-26 05:01 - 00321536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\udfs.sys

2013-09-11 21:09 - 2013-06-12 01:43 - 00154112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinSCard.dll

2013-09-11 21:09 - 2013-06-10 21:16 - 00888832 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshwfp.dll

2013-09-11 21:09 - 2013-06-10 21:10 - 00702464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nshwfp.dll

2013-09-11 21:09 - 2013-06-10 21:10 - 00245248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FWPUCLNT.DLL

2013-09-11 21:09 - 2013-04-03 01:37 - 00025088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cryptdlg.dll

2013-09-11 21:09 - 2013-04-03 01:12 - 00030720 _____ (Microsoft Corporation) C:\WINDOWS\system32\cryptdlg.dll

2013-09-11 21:09 - 2013-03-22 05:49 - 02382336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\esent.dll

2013-09-11 21:09 - 2013-03-22 00:47 - 02851840 _____ (Microsoft Corporation) C:\WINDOWS\system32\esent.dll

2013-09-11 21:09 - 2013-03-02 10:23 - 00375808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ReAgent.dll

2013-09-11 21:09 - 2013-03-02 04:44 - 01011200 _____ (Microsoft Corporation) C:\WINDOWS\system32\reseteng.dll

2013-09-11 21:09 - 2012-12-15 06:55 - 00443392 _____ (Microsoft Corporation) C:\WINDOWS\system32\ReAgent.dll

2013-09-11 21:09 - 2012-11-03 07:26 - 00132096 _____ (Microsoft Corporation) C:\WINDOWS\system32\sysreset.exe

2013-09-11 21:09 - 2012-11-03 07:25 - 00945152 _____ (Microsoft Corporation) C:\WINDOWS\system32\resetengmig.dll

2013-09-11 21:09 - 2012-10-24 05:25 - 00026624 _____ (Microsoft Corporation) C:\WINDOWS\system32\ReAgentc.exe

2013-09-11 21:09 - 2012-10-24 05:25 - 00013312 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcalua.exe

2013-09-11 21:09 - 2012-10-24 05:24 - 00405504 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcasvc.dll

2013-09-11 21:09 - 2012-10-24 05:24 - 00031232 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcadm.dll

2013-09-11 21:09 - 2012-10-24 05:05 - 00011776 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcaevts.dll

2013-09-11 21:09 - 2012-10-24 04:48 - 00024064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ReAgentc.exe

2013-09-09 10:23 - 2013-06-09 21:59 - 00216064 _____ C:\WINDOWS\SysWOW64\gcapi_dll.dll

2013-09-01 16:29 - 2013-09-01 16:29 - 00000000 ____D C:\WINDOWS\SysWOW64\fstrainer2011

2013-09-01 16:29 - 2008-01-03 19:19 - 00581632 _____ (Adobe Systems, Inc.) C:\WINDOWS\SysWOW64\Control.dll

2013-09-01 16:29 - 2004-12-07 10:09 - 00347136 _____ C:\WINDOWS\SysWOW64\unicows.pdb

2013-09-01 16:29 - 2004-08-04 07:21 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msado27.tlb

2013-09-01 16:29 - 2004-03-08 21:00 - 00152848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comdlg32.ocx

2013-09-01 14:49 - 2013-09-09 10:36 - 00000942 _____ C:\Users\Public\Desktop\calibre 64bit - E-book management.lnk

2013-09-01 14:49 - 2013-09-09 10:36 - 00000000 ____D C:\Program Files\Calibre2

2013-09-01 14:49 - 2013-09-01 18:42 - 00000000 ____D C:\Users\Tom\AppData\Local\calibre-cache

2013-08-30 16:11 - 2013-08-30 16:11 - 00000000 ____D C:\Users\TomAdminPW_Ur\AppData\Roaming\Apple Computer
 

==================== One Month Modified Files and Folders =======
 

2013-09-29 14:02 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\system32\sru

2013-09-29 14:01 - 2013-09-29 14:01 - 00000000 ____D C:\FRST

2013-09-29 13:21 - 2012-08-15 10:55 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job

2013-09-29 13:01 - 2012-07-26 12:27 - 00863478 _____ C:\WINDOWS\system32\perfh007.dat

2013-09-29 13:01 - 2012-07-26 12:27 - 00197036 _____ C:\WINDOWS\system32\perfc007.dat

2013-09-29 13:01 - 2012-07-26 09:28 - 02029610 _____ C:\WINDOWS\system32\PerfStringBackup.INI

2013-09-29 13:00 - 2013-08-25 14:40 - 00000000 ____D C:\ProgramData\eSafe

2013-09-29 12:57 - 2009-07-14 04:34 - 00001106 _____ C:\WINDOWS\win.ini

2013-09-29 12:54 - 2013-09-14 17:15 - 00108555 _____ C:\WINDOWS\setupact.log

2013-09-29 12:54 - 2013-01-02 02:50 - 00000000 ____D C:\ProgramData\NVIDIA

2013-09-29 12:54 - 2012-07-26 09:22 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT

2013-09-29 12:22 - 2013-09-13 10:57 - 01964153 _____ C:\WINDOWS\WindowsUpdate.log

2013-09-27 17:54 - 2013-02-26 22:16 - 00000000 ____D C:\Users\Tom\AppData\Roaming\Simple Sudoku

2013-09-27 17:20 - 2013-03-18 16:32 - 00013213 _____ C:\Users\Tom\Desktop\Wasserverbrauch.xlsx

2013-09-27 17:10 - 2013-03-18 16:19 - 00015297 _____ C:\Users\Tom\Desktop\Stromverbrauch.xlsx

2013-09-27 14:41 - 2012-12-02 22:30 - 00000000 ____D C:\Users\Tom\AppData\Roaming\MyPhoneExplorer

2013-09-27 14:21 - 2013-09-27 14:21 - 00000000 ____D C:\Users\Tom\Documents\SelfMV

2013-09-27 14:10 - 2013-09-27 14:10 - 00002018 _____ C:\Users\Public\Desktop\Samsung Kies (Lite).lnk

2013-09-27 14:10 - 2013-09-27 14:10 - 00002008 _____ C:\Users\Public\Desktop\Samsung Kies.lnk

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\WINDOWS\LastGood.Tmp

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Tom\Documents\samsung

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Tom\AppData\Roaming\Samsung

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Tom\AppData\Local\Samsung

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Public\Documents\NativeFus_Log

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Public\Documents\CrashDump

2013-09-27 14:09 - 2013-09-27 14:05 - 00000000 ____D C:\ProgramData\Samsung

2013-09-27 14:09 - 2013-09-27 14:05 - 00000000 ____D C:\Program Files (x86)\Samsung

2013-09-27 14:08 - 2013-09-27 14:08 - 00000000 ____D C:\Program Files (x86)\MyFree Codec

2013-09-27 14:05 - 2010-01-24 03:50 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information

2013-09-27 13:59 - 2013-09-27 13:59 - 00001059 _____ C:\Users\Public\Desktop\DriverTuner.lnk

2013-09-27 13:59 - 2013-09-27 13:59 - 00000000 ____D C:\Program Files (x86)\DriverTuner

2013-09-27 13:54 - 2013-09-27 13:54 - 00000000 ____D C:\Users\Tom\.android

2013-09-27 13:54 - 2013-01-02 02:54 - 00000000 ____D C:\Users\Tom

2013-09-27 13:54 - 2012-12-02 22:30 - 00002073 _____ C:\Users\Public\Desktop\MyPhoneExplorer.lnk

2013-09-27 13:54 - 2012-12-02 22:30 - 00000000 ____D C:\Program Files (x86)\MyPhoneExplorer

2013-09-26 11:27 - 2013-06-01 13:54 - 00000000 ____D C:\Users\Tom\Desktop\Calibre

2013-09-26 10:45 - 2012-09-09 20:42 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-09-26 10:35 - 2013-09-26 10:35 - 00000103 _____ C:\WINDOWS\ParrotFlashWiz.INI

2013-09-26 10:33 - 2013-09-26 10:33 - 00000000 ____D C:\Program Files (x86)\Parrot Software Update Tool

2013-09-25 17:58 - 2011-03-22 23:38 - 00000000 ____D C:\Users\Tom\AppData\Roaming\Foxit Software

2013-09-23 11:12 - 2013-09-23 11:12 - 1285878931 _____ C:\WINDOWS\MEMORY.DMP

2013-09-23 11:12 - 2013-01-12 07:48 - 00000000 ____D C:\WINDOWS\Minidump

2013-09-23 09:50 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\AUInstallAgent

2013-09-19 01:26 - 2013-01-10 23:02 - 00694232 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe

2013-09-19 01:26 - 2013-01-10 23:02 - 00078296 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl

2013-09-18 16:22 - 2013-06-05 11:18 - 00322048 ___SH C:\Users\Tom\Desktop\Thumbs.db

2013-09-18 16:22 - 2013-02-06 22:20 - 00000000 ____D C:\Users\Tom\Desktop\KabelBW

2013-09-15 15:57 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\rescache

2013-09-15 15:38 - 2013-02-23 11:24 - 00000586 _____ C:\Users\Public\Desktop\mkvmerge GUI.lnk

2013-09-15 13:07 - 2013-09-15 13:06 - 00531240 _____ C:\WINDOWS\system32\FNTCACHE.DAT

2013-09-15 10:43 - 2013-09-15 10:43 - 00005630 _____ C:\WINDOWS\PFRO.log

2013-09-15 01:14 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\WinStore

2013-09-15 01:14 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\PolicyDefinitions

2013-09-15 00:05 - 2010-06-01 00:58 - 00000000 ____D C:\Users\Tom\AppData\Local\QuickPar

2013-09-14 17:15 - 2013-09-14 17:15 - 00000000 _____ C:\WINDOWS\setuperr.log

2013-09-14 11:57 - 2010-06-01 01:01 - 00018944 _____ C:\Users\Tom\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2013-09-14 03:02 - 2010-05-09 20:21 - 00000000 ____D C:\ProgramData\Microsoft Help

2013-09-13 11:06 - 2013-08-19 11:05 - 00000000 ____D C:\WINDOWS\system32\MRT

2013-09-13 11:03 - 2009-10-14 07:12 - 79143768 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe

2013-09-13 09:58 - 2013-08-25 14:42 - 00000834 _____ C:\Users\Public\Desktop\CCleaner.lnk

2013-09-13 09:58 - 2013-08-25 14:42 - 00000000 ____D C:\Program Files\CCleaner

2013-09-13 09:28 - 2013-09-13 09:28 - 00274944 _____ C:\Users\Tom\AppData\lsass.exe

2013-09-13 09:05 - 2012-07-26 07:38 - 00000000 ____D C:\WINDOWS\system32\oobe

2013-09-12 22:38 - 2013-09-12 22:38 - 00001604 _____ C:\Users\Public\Desktop\Angry Birds Star Wars.lnk

2013-09-12 22:38 - 2013-07-05 12:47 - 00000000 ____D C:\Users\Tom\AppData\Roaming\Rovio Entertainment Ltd

2013-09-10 15:45 - 2013-05-04 21:34 - 00000000 ____D C:\Users\Tom\Documents\Settlers7

2013-09-09 10:36 - 2013-09-01 14:49 - 00000942 _____ C:\Users\Public\Desktop\calibre 64bit - E-book management.lnk

2013-09-09 10:36 - 2013-09-01 14:49 - 00000000 ____D C:\Program Files\Calibre2

2013-09-08 14:07 - 2013-08-25 14:40 - 00000000 ____D C:\Program Files (x86)\MyPC Backup

2013-09-02 16:17 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\system32\NDF

2013-09-01 18:42 - 2013-09-01 14:49 - 00000000 ____D C:\Users\Tom\AppData\Local\calibre-cache

2013-09-01 16:29 - 2013-09-01 16:29 - 00000000 ____D C:\WINDOWS\SysWOW64\fstrainer2011

2013-09-01 16:29 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\SysWOW64\Macromed

2013-09-01 16:29 - 2012-07-10 13:44 - 00000000 ____D C:\WINDOWS\SysWOW64\Adobe

2013-09-01 14:41 - 2013-02-17 20:48 - 00000000 ____D C:\Users\TomAdminPW_Ur\AppData\Roaming\SpeedProject

2013-08-30 16:11 - 2013-08-30 16:11 - 00000000 ____D C:\Users\TomAdminPW_Ur\AppData\Roaming\Apple Computer
 

Files to move or delete:

====================

C:\ProgramData\hpe5F3.dll
 
 

Some content of TEMP:

====================

C:\Users\Tom\AppData\Local\Temp\Checkupdate.exe

C:\Users\Tom\AppData\Local\Temp\cvtres.exe

C:\Users\Tom\AppData\Local\Temp\Foxit Reader Updater.exe

C:\Users\Tom\AppData\Local\Temp\gcapi_dll.dll

C:\Users\Tom\AppData\Local\Temp\gtapi_signed.dll
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 

==================== End Of Log ============================

Addition-file

Code:

Malwarebytes Anti-Malware 1.75.0.1300

www.malwarebytes.org
 

Datenbank Version: v2013.09.29.05
 

Windows 8 x64 NTFS

Internet Explorer 10.0.9200.16688

Tom_Admin :: TOM_ADMIN-PC [Administrator]
 

29.09.2013 16:50:10

MBAM-log-2013-09-29 (16-56-22).txt
 

Art des Suchlaufs: Quick-Scan

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: Heuristiks/Extra | P2P

Durchsuchte Objekte: 38762

Laufzeit: 5 Minute(n), 11 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 2

HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C} (PUP.Optional.OptimzerPro.A) -> Keine Aktion durchgeführt.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WsysControl (Trojan.Staser) -> Keine Aktion durchgeführt.
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 4

C:\ProgramData\eSafe\eGdpSvc.exe (Trojan.Staser) -> Keine Aktion durchgeführt.

C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.exe (PUP.Optional.Tarma.A) -> Keine Aktion durchgeführt.

C:\ProgramData\Tarma Installer\{C4ED781C-7394-4906-AAFF-D6AB64FF7C38}\Setup.exe (PUP.Optional.Tarma.A) -> Keine Aktion durchgeführt.

C:\Users\Tom\AppData\Local\Temp\cvtres.exe (Riskware.Exit) -> Keine Aktion durchgeführt.
 

(Ende)

MBAM-Log:

Code:

Malwarebytes Anti-Malware 1.75.0.1300

www.malwarebytes.org
 

Datenbank Version: v2013.09.29.05
 

Windows 8 x64 NTFS

Internet Explorer 10.0.9200.16688

Tom_Admin :: TOM_ADMIN-PC [Administrator]
 

29.09.2013 16:50:10

MBAM-log-2013-09-29 (16-56-22).txt
 

Art des Suchlaufs: Quick-Scan

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: Heuristiks/Extra | P2P

Durchsuchte Objekte: 38762

Laufzeit: 5 Minute(n), 11 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 2

HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C} (PUP.Optional.OptimzerPro.A) -> Keine Aktion durchgeführt.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WsysControl (Trojan.Staser) -> Keine Aktion durchgeführt.
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 4

C:\ProgramData\eSafe\eGdpSvc.exe (Trojan.Staser) -> Keine Aktion durchgeführt.

C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.exe (PUP.Optional.Tarma.A) -> Keine Aktion durchgeführt.

C:\ProgramData\Tarma Installer\{C4ED781C-7394-4906-AAFF-D6AB64FF7C38}\Setup.exe (PUP.Optional.Tarma.A) -> Keine Aktion durchgeführt.

C:\Users\Tom\AppData\Local\Temp\cvtres.exe (Riskware.Exit) -> Keine Aktion durchgeführt.
 

(Ende)

aharonov

29.09.2013 16:25

Hallo,

schauen wir mal:

Schritt 1

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Schritt 2

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Schritt 3

Starte noch einmal FRST.

Ändere keine der Voreinstellungen und drücke auf Scan.
Wenn der Scan abgeschlossen ist, werden ein neues Logfile FRST.txt erstellt und auf dem Desktop gespeichert.
Poste den Inhalt dieses Logfiles bitte hier in deinen Thread.

Bitte poste in deiner nächsten Antwort:

Log von Adwcleaner
Log von Combofix
Log von FRST

Rupsi

29.09.2013 17:41

So. Hier sind die Ergebnisse bislang:

AdwCleanerR0.txt:

Code:

# AdwCleaner v3.005 - Bericht erstellt am 29/09/2013 um 17:36:22

# Updated 22/09/2013 von Xplode

# Betriebssystem : Windows 8 Pro  (64 bits)

# Benutzername : Tom_Admin - TOM_ADMIN-PC

# Gestartet von : L:\Download\adwcleaner.exe

# Option : Suchen
 

***** [ Dienste ] *****
 

Dienst Gefunden : BackupStack
 

***** [ Dateien / Ordner ] *****
 

Datei Gefunden : C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\icqplugin.xml

Datei Gefunden : C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\icqplugin-1.xml

Datei Gefunden : C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\icqplugin-2.xml

Datei Gefunden : C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\icqplugin-3.xml

Datei Gefunden : C:\Users\Tom_Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk

Datei Gefunden : C:\Users\Tom_Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m5mhonw7.default\user.js

Datei Gefunden : C:\Users\Tom_Admin\Desktop\MyPC Backup.lnk

Ordner Gefunden C:\Program Files (x86)\Common Files\337

Ordner Gefunden C:\Program Files (x86)\MyPC Backup

Ordner Gefunden C:\Program Files (x86)\MyPC Backup 

Ordner Gefunden C:\ProgramData\eSafe

Ordner Gefunden C:\ProgramData\Tarma Installer

Ordner Gefunden C:\Users\Tom\AppData\Local\PackageAware

Ordner Gefunden C:\Users\Tom_Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPC Backup

Ordner Gefunden C:\Users\Tom_Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPC Backup 

Ordner Gefunden C:\Users\TomAdminPW_Ur\AppData\Roaming\dvdvideosoftiehelpers

Ordner Gefunden C:\Users\TomAdminPW_Ur\AppData\Roaming\WebCake
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 

Schlüssel Gefunden : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}

Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\Lyrics_Monkey

Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}

Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}

Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}

Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}

Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}

Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}

Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\secman.DLL

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{A0B10EBE-4E51-4CAE-949B-E6B9E7D68CEA}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{F511AFDB-726E-4458-90E7-1ECB97406544}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{FB684D26-01F4-4D9D-87CB-F486BEBA56DC}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}

Schlüssel Gefunden : HKLM\Software\Conduit

Schlüssel Gefunden : HKLM\Software\Desksvc

Schlüssel Gefunden : HKLM\Software\eSafeSecControl

Schlüssel Gefunden : HKLM\SOFTWARE\Google\Chrome\Extensions\abfmigjiaapipflmopkaaooigcjjdojh

Schlüssel Gefunden : HKLM\SOFTWARE\Google\Chrome\Extensions\fjoijdanhaiflhibkljeklcghcmmfffh

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASAPI32

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASMANCS

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WSysControl

Schlüssel Gefunden : HKLM\Software\PIP

Schlüssel Gefunden : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\DeskSvc

Schlüssel Gefunden : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WsysSvc

Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Schlüssel Gefunden : [x64] HKLM\SOFTWARE\DomaIQ

Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C4ED781C-7394-4906-AAFF-D6AB64FF7C38}

Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyPC Backup

Wert Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]

Wert Gefunden : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{ACAA314B-EEBA-48E4-AD47-84E31C44796C}]

Wert Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
 

***** [ Browser ] *****
 

-\\ Internet Explorer v10.0.9200.16688

AdwCleanerS0.txt

Code:

# AdwCleaner v3.005 - Bericht erstellt am 29/09/2013 um 17:43:01

# Updated 22/09/2013 von Xplode

# Betriebssystem : Windows 8 Pro  (64 bits)

# Benutzername : Tom_Admin - TOM_ADMIN-PC

# Gestartet von : L:\Download\adwcleaner.exe

# Option : Löschen
 

***** [ Dienste ] *****
 

Dienst Gelöscht : BackupStack
 

***** [ Dateien / Ordner ] *****
 

Ordner Gelöscht : C:\ProgramData\eSafe

Ordner Gelöscht : C:\ProgramData\Tarma Installer

[!] Ordner Gelöscht : C:\Program Files (x86)\MyPC Backup 

[!] Ordner Gelöscht : C:\Program Files (x86)\MyPC Backup

Ordner Gelöscht : C:\Program Files (x86)\Common Files\337

Ordner Gelöscht : C:\Users\Tom_Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPC Backup 

Ordner Gelöscht : C:\Users\Tom\AppData\Local\PackageAware

Ordner Gelöscht : C:\Users\TomAdminPW_Ur\AppData\Roaming\dvdvideosoftiehelpers

Ordner Gelöscht : C:\Users\TomAdminPW_Ur\AppData\Roaming\WebCake

Datei Gelöscht : C:\Users\Tom_Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk

Datei Gelöscht : C:\Users\Tom_Admin\Desktop\MyPC Backup.lnk

Datei Gelöscht : C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\icqplugin.xml

Datei Gelöscht : C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\icqplugin-1.xml

Datei Gelöscht : C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\icqplugin-2.xml

Datei Gelöscht : C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\icqplugin-3.xml

Datei Gelöscht : C:\Users\Tom_Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m5mhonw7.default\user.js
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 

Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{ACAA314B-EEBA-48E4-AD47-84E31C44796C}]

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\abfmigjiaapipflmopkaaooigcjjdojh

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\fjoijdanhaiflhibkljeklcghcmmfffh

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\secman.DLL

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASMANCS

Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\DeskSvc

Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WsysSvc

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A0B10EBE-4E51-4CAE-949B-E6B9E7D68CEA}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F511AFDB-726E-4458-90E7-1ECB97406544}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FB684D26-01F4-4D9D-87CB-F486BEBA56DC}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}

Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Wert Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]

Schlüssel Gelöscht : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Lyrics_Monkey

Schlüssel Gelöscht : HKLM\Software\Conduit

Schlüssel Gelöscht : HKLM\Software\Desksvc

Schlüssel Gelöscht : HKLM\Software\eSafeSecControl

Schlüssel Gelöscht : HKLM\Software\PIP

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WSysControl

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\DomaIQ

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C4ED781C-7394-4906-AAFF-D6AB64FF7C38}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyPC Backup
 

***** [ Browser ] *****
 

-\\ Internet Explorer v10.0.9200.16688
 

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Search [Default_Search_URL]

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Search [SearchAssistant]

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\SearchUrl [Default]
 

-\\ Mozilla Firefox v23.0.1 (de)
 

[ Datei : C:\Users\Tom_Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m5mhonw7.default\prefs.js ]
 
 

[ Datei : C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\prefs.js ]
 

Zeile gelöscht : user_pref("icqtoolbar.allowSendURL", false);

Zeile gelöscht : user_pref("icqtoolbar.engineVerified", false);

Zeile gelöscht : user_pref("icqtoolbar.hiddenElements", "itb_options");

Zeile gelöscht : user_pref("icqtoolbar.history", "dofus%20kimbo||gamescon||dofus%20minotoror||falk||dofus%20%22hysterical%20judge%22||dofus%20%22hysterischer%20Richter%22||%22Navigon%208110%22||test%20navigationsger%C[...]

Zeile gelöscht : user_pref("icqtoolbar.numberOfSearches", 0);

Zeile gelöscht : user_pref("icqtoolbar.previousFFVersion", "3.0.11");

Zeile gelöscht : user_pref("icqtoolbar.skip_default_search", "no");

Zeile gelöscht : user_pref("icqtoolbar.suggestions", false);

Zeile gelöscht : user_pref("icqtoolbar.uninstStatSent", true);

Zeile gelöscht : user_pref("icqtoolbar.uniqueID", "123645397012364545701236477613276");

Zeile gelöscht : user_pref("icqtoolbar.usageStatstTimestamp", 1247346703);

Zeile gelöscht : user_pref("icqtoolbar.xmlEnableSuggestions", false);

Zeile gelöscht : user_pref("icqtoolbar.xmlLanguage", "de");
 

[ Datei : C:\Users\Max\AppData\Roaming\Mozilla\Firefox\Profiles\7v8f41d4.default\prefs.js ]
 
 

*************************
 

AdwCleaner[R0].txt - [7838 octets] - [29/09/2013 17:36:22]

AdwCleaner[S0].txt - [7028 octets] - [29/09/2013 17:43:01]
 

########## EOF - \AdwCleaner\AdwCleaner[S0].txt - [7088 octets] ##########

FRST.txt

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-09-2013 02

Ran by Tom (ATTENTION: The logged in user is not administrator) on TOM_ADMIN-PC on 29-09-2013 18:35:18

Running from C:\Users\Tom\Desktop\Trojan

Windows 8 Pro (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) =================
 

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Hewlett-Packard Company) C:\Program Files (x86)\HP\HP Color LaserJet CM2320 MFP Series\hppfaxprintersrv.exe

(Samsung) C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe

(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe

(InstallShield Software Corporation) C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe

(Hewlett-Packard Company) C:\Program Files (x86)\HP\HP UT\bin\hppusg.exe

(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe

(Microsoft Corporation) C:\WINDOWS\SysWOW64\notepad.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13196432 2012-09-25] (Realtek Semiconductor)

HKLM\...\Run: [HP Color LaserJet CM2320 MFP Series Fax] - C:\Program Files (x86)\HP\HP Color LaserJet CM2320 MFP Series\hppfaxprintersrv.exe [3700736 2009-09-22] (Hewlett-Packard Company)

HKLM\...\Run: [combofix] - C:\ComboFix\CF31833.3XE /c C:\ComboFix\Combobatch.bat

HKLM\...\RunOnce: [*WerKernelReporting] - %SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq [439488 2013-07-09] (Microsoft Corporation)

HKLM\...\Runonce: [combofix] - C:\ComboFix\CF31833.3XE /c C:\ComboFixCombobatch.bat

HKLM\...\runonceex: [flags] - 8

HKLM-x32\...\RunOnce: [Malwarebytes Anti-Malware] - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation)

HKCU\...\Run: [Java Updater] - C:\Users\Tom\AppData\lsass.exe [274944 2013-09-13] ()

HKCU\...\Run: [] - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844656 2013-09-04] (Samsung)

HKLM-x32\...\Run: [BCSSync] - C:\Program Files (x86)\Microsoft Office2010\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)

HKLM-x32\...\Run: [EaseUS EPM tray] - C:\Program Files (x86)\EaseUS\EaseUS Partition Master 9.2.1 Home Edition\bin\EpmNews.exe [2086984 2012-11-29] (CHENGDU YIWO Tech Development Co., Ltd)

HKLM-x32\...\Run: [ISUSScheduler] - C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe [81920 2005-02-16] (InstallShield Software Corporation)

HKLM-x32\...\Run: [JMB36X IDE Setup] - C:\Windows\RaidTool\xInsIDE.exe [36864 2007-03-20] ()

HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [163000 2012-12-12] (Geek Software GmbH)

HKLM-x32\...\Run: [] - [x]

HKLM-x32\...\Run: [HPUsageTracking] - C:\Program Files (x86)\HP\HP UT\bin\hppusg.exe [24576 2009-05-11] (Hewlett-Packard Company)

HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)

HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)

HKLM-x32\...\Run: [Live Update 5] - C:\Program Files (x86)\MSI\Live Update 5\BootStartLiveupdate.exe [315392 2012-01-30] ()

HKLM-x32\...\Run: [KiesTrayAgent] - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311152 2013-09-04] (Samsung Electronics Co., Ltd.)

AppInit_DLLs:         [0 ] ()

Startup: C:\Users\Tom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk

ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office2010\Office14\ONENOTEM.EXE (Microsoft Corporation)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.metager.de/

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x6EEDBAB406CCCD01

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snap.do/?publisher=SnapdoEMon&dpid=SnapdoEMon&co=DE&userid=dc45f073-fe67-455e-a3b8-5331ef50cad9&searchtype=ds&q={searchTerms}

SearchScopes: HKCU - {3BD44F0E-0596-4008-AEE0-45D47E3A8F0E} URL = 

BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office2010\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office2010\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: No Name - {DBC80044-A445-435b-BC74-9C25C1C588A9} -  No File

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 0.0.0.0
 

FireFox:

========

FF ProfilePath: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default

FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()

FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()

FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\WINDOWS\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf - f:\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)

FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf - f:\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)

FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - e:\Picasa3\npPicasa3.dll No File

FF Plugin-x32: @java.com/DTPlugin,version=1.6.0_35 - C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MI4066~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MI4066~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin-x32: @real.com/nppl3260;version=15.0.4.53 - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprjplug;version=15.0.4.53 - c:\program files (x86)\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprpchromebrowserrecordext;version=15.0.4.53 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprphtml5videoshim;version=15.0.4.53 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprpplugin;version=15.0.4.53 - c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Tom\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()

FF SearchPlugin: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\betabinariesnl.xml

FF SearchPlugin: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\eurobuchcom.xml

FF SearchPlugin: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\ixquick-http---deutsch.xml

FF SearchPlugin: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\mein-metager.xml

FF SearchPlugin: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\searchplugins-backup

FF SearchPlugin: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\startpage-https---deutsch.xml

FF Extension: Deutsches Wörterbuch - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\de-DE@dictionaries.addons.mozilla.org

FF Extension: Garmin Communicator - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}

FF Extension: Microsoft .NET Framework Assistant - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b}

FF Extension: EPUBReader - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\{5384767E-00D9-40E9-B72F-9CC39D655D6F}

FF Extension: No Name - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\{c36177c0-224a-11da-8cd6-0800200c9a66}

FF Extension: Bitdefender QuickScan - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\{e001c731-5e37-4538-a5cb-8168736a2360}

FF Extension: admin - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\admin@proxy-listen.de.xpi

FF Extension: No Name - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\Extensions.rdf

FF Extension: No Name - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\installed-extensions.txt

FF Extension: optout - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\optout@google.com.xpi

FF Extension: youtubeunblocker - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\youtubeunblocker@unblocker.yt.xpi

FF HKLM-x32\...\Firefox\Extensions: [{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext

FF Extension: RealPlayer Browser Record Plugin - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext

FF StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Firefox\firefox.exe
 

Chrome: 

=======

CHR HomePage: hxxp://www.google.com/

CHR DefaultSearchURL: (Google) - {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}

CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}

CHR Plugin: (Chrome PDF Viewer) - C:\Users\Tom\AppData\Local\Google\Chrome\Application\10.0.648.204\pdf.dll No File

CHR Plugin: (Google Gears 0.5.33.0) - C:\Users\Tom\AppData\Local\Google\Chrome\Application\10.0.648.204\gears.dll No File

CHR Plugin: (Shockwave Flash) - C:\Users\Tom\AppData\Local\Google\Chrome\Application\10.0.648.204\gcswf32.dll No File

CHR Plugin: (Foxit Reader Plugin for Mozilla) - C:\Program Files (x86)\Firefox\plugins\npFoxitReaderPlugin.dll (Foxit Software Company)

CHR Plugin: (2007 Microsoft Office system) - C:\Program Files (x86)\Firefox\plugins\NPOFF12.DLL (Microsoft Corporation)

CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

CHR Plugin: (Google Update) - C:\Users\Tom\AppData\Local\Google\Update\1.2.183.39\npGoogleOneClick8.dll No File

CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File

CHR Plugin: (Default Plug-in) - default_plugin No File

CHR HKLM-x32\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Ext\rphtml5video.crx

CHR HKLM-x32\...\Chrome\Extension: [ofnnlhbgdcabppjmlijllkhekcglbjlg] - C:\Program Files (x86)\Lyrics_Monkey\128.crx
 

==================== Services (Whitelisted) =================
 

R2 Garmin Core Update Service; C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [185688 2013-03-27] (Garmin Ltd or its subsidiaries)

R2 HPSLPSVC; C:\Users\Tom\AppData\Local\Temp\7zS3579\hpslpsvc64.dll [1039360 2012-11-14] (Hewlett-Packard Co.)

R2 lmhosts; C:\Windows\system32\svchost.exe [29696 2012-09-20] (Microsoft Corporation)

S3 Microsoft SharePoint Workspace Audit Service; C:\Program Files (x86)\Microsoft Office2010\Office14\GROOVE.EXE [30785672 2012-09-20] (Microsoft Corporation)

R2 MSMQ; C:\Windows\system32\mqsvc.exe [25088 2012-07-26] (Microsoft Corporation)

R2 NlaSvc; C:\Windows\System32\svchost.exe [29696 2012-09-20] (Microsoft Corporation)

R2 nsi; C:\Windows\system32\svchost.exe [29696 2012-09-20] (Microsoft Corporation)

R2 PMBDeviceInfoProvider; C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe [474168 2012-04-22] (Sony Corporation)

S2 SynoDrService; C:\Program Files (x86)\Synology Data Replicator  3\SynoDrServicex64.exe [380928 2010-06-02] ()

R2 TVGOnlineUpdateSvc; C:\Program Files (x86)\TVG\OnlineUpdate\OnlineUpdateSvc.exe [398128 2010-12-14] ()

R2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [471552 2012-07-26] (Microsoft Corporation)

R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)
 

==================== Drivers (Whitelisted) ====================
 

S3 androidusb; C:\Windows\System32\Drivers\androidusb.sys [32768 2010-04-29] (Google Inc)

S3 DigiartyVirtualCDBus; C:\Windows\System32\drivers\DigiartyVirtualCDBus.sys [276256 2013-08-28] (Digiarty Software, Inc.)

R2 easycvfs; C:\WINDOWS\system32\drivers\easycvfs.sys [109960 2009-11-09] ()

S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [17480 2012-12-21] ()

S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [17480 2012-12-21] ()

S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9800 2012-12-21] ()

S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9800 2012-12-21] ()

R1 HWiNFO32; C:\Program Files (x86)\HWiNFO32\HWiNFO64A.SYS [29288 2009-05-21] (REALiX(tm))

R1 HWiNFO32; C:\Program Files (x86)\HWiNFO32\HWiNFO64A.SYS [29288 2009-05-21] (REALiX(tm))

R3 MQAC; C:\Windows\System32\drivers\mqac.sys [185856 2012-07-26] (Microsoft Corporation)

S1 NNSNAHSL; C:\Windows\System32\DRIVERS\NNSNAHSL.sys [33320 2012-10-22] (Panda Security, S.L.)

S3 NTIOLib_1_0_4; C:\Program Files (x86)\MSI\Live Update 5\NTIOLib_X64.sys [14136 2010-10-22] (MSI)

S3 NTIOLib_1_0_4; C:\Program Files (x86)\MSI\Live Update 5\NTIOLib_X64.sys [14136 2010-10-22] (MSI)

S3 NTIOLib_1_0_6; C:\Program Files (x86)\Setup Files\Ms7586v1B0\NTIOLib_X64.sys [11888 2011-01-06] (MSI)

S3 NTIOLib_1_0_6; C:\Program Files (x86)\Setup Files\Ms7586v1B0\NTIOLib_X64.sys [11888 2011-01-06] (MSI)

R3 seehcri; C:\Windows\System32\drivers\seehcri.sys [34032 2008-01-09] (Sony Ericsson Mobile Communications)

R3 SKYNET; C:\Windows\system32\DRIVERS\SkyNET_AMD64.SYS [615440 2009-09-11] (TechniSat Digital, S.A.)

S4 sptd; C:\Windows\System32\Drivers\sptd.sys [828912 2011-08-16] (Duplex Secure Ltd.)

S3 vvftav; C:\Windows\System32\drivers\vvftav.sys [300800 2007-02-02] (Vimicro Corporation)

S3 ZSMC0305; C:\Windows\System32\Drivers\usbVM305.sys [1541120 2007-03-08] (Vimicro Corporation)

S3 catchme; \??\C:\ComboFix\catchme.sys [x]

U3 idsvc; 

S3 MSI_MSIBIOS_010507; \??\C:\Program Files (x86)\MSI\Live Update 5\msibios64_100507.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-09-29 17:53 - 2013-09-29 18:01 - 00000000 ___SD C:\ComboFix

2013-09-29 17:49 - 2013-09-29 17:49 - 00000000 ____D C:\Users\Tom\Desktop\Trojan

2013-09-29 16:47 - 2013-09-29 16:47 - 00001125 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-09-29 16:47 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys

2013-09-29 14:13 - 2013-09-29 14:47 - 00000000 ____D C:\WINDOWS\erdnt

2013-09-29 14:13 - 2013-09-29 14:13 - 00000000 ____D C:\Qoobox

2013-09-29 14:13 - 2011-06-26 08:45 - 00256000 _____ C:\WINDOWS\PEV.exe

2013-09-29 14:13 - 2010-11-07 19:20 - 00208896 _____ C:\WINDOWS\MBR.exe

2013-09-29 14:13 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\WINDOWS\NIRCMD.exe

2013-09-29 14:13 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\WINDOWS\SWREG.exe

2013-09-29 14:13 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\WINDOWS\SWSC.exe

2013-09-29 14:13 - 2000-08-31 02:00 - 00212480 _____ (SteelWerX) C:\WINDOWS\SWXCACLS.exe

2013-09-29 14:13 - 2000-08-31 02:00 - 00098816 _____ C:\WINDOWS\sed.exe

2013-09-29 14:13 - 2000-08-31 02:00 - 00080412 _____ C:\WINDOWS\grep.exe

2013-09-29 14:13 - 2000-08-31 02:00 - 00068096 _____ C:\WINDOWS\zip.exe

2013-09-29 14:07 - 2013-09-29 14:07 - 05130789 ____R (Swearware) C:\Users\Tom\Desktop\ComboFix.exe

2013-09-29 14:01 - 2013-09-29 14:01 - 00000000 ____D C:\FRST

2013-09-27 14:21 - 2013-09-27 14:21 - 00000000 ____D C:\Users\Tom\Documents\SelfMV

2013-09-27 14:10 - 2013-09-27 14:10 - 00002018 _____ C:\Users\Public\Desktop\Samsung Kies (Lite).lnk

2013-09-27 14:10 - 2013-09-27 14:10 - 00002008 _____ C:\Users\Public\Desktop\Samsung Kies.lnk

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\WINDOWS\LastGood.Tmp

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Tom\Documents\samsung

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Tom\AppData\Roaming\Samsung

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Tom\AppData\Local\Samsung

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Public\Documents\NativeFus_Log

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Public\Documents\CrashDump

2013-09-27 14:08 - 2013-09-27 14:08 - 00000000 ____D C:\Program Files (x86)\MyFree Codec

2013-09-27 14:05 - 2013-09-27 14:09 - 00000000 ____D C:\ProgramData\Samsung

2013-09-27 14:05 - 2013-09-27 14:09 - 00000000 ____D C:\Program Files (x86)\Samsung

2013-09-27 14:05 - 2013-07-18 14:33 - 04659712 _____ (Dmitry Streblechenko) C:\WINDOWS\SysWOW64\Redemption.dll

2013-09-27 14:05 - 2013-07-18 14:32 - 00821824 _____ (Devguru Co., Ltd.) C:\WINDOWS\SysWOW64\dgderapi.dll

2013-09-27 13:59 - 2013-09-27 13:59 - 00001059 _____ C:\Users\Public\Desktop\DriverTuner.lnk

2013-09-27 13:59 - 2013-09-27 13:59 - 00000000 ____D C:\Program Files (x86)\DriverTuner

2013-09-27 13:54 - 2013-09-27 13:54 - 00000000 ____D C:\Users\Tom\.android

2013-09-26 10:35 - 2013-09-26 10:35 - 00000103 _____ C:\WINDOWS\ParrotFlashWiz.INI

2013-09-26 10:33 - 2013-09-26 10:33 - 00000000 ____D C:\Program Files (x86)\Parrot Software Update Tool

2013-09-23 11:12 - 2013-09-23 11:12 - 1285878931 _____ C:\WINDOWS\MEMORY.DMP

2013-09-16 20:47 - 2013-08-07 07:15 - 00144896 _____ (Microsoft Corporation) C:\WINDOWS\system32\tssdisai.dll

2013-09-15 13:06 - 2013-09-15 13:07 - 00531240 _____ C:\WINDOWS\system32\FNTCACHE.DAT

2013-09-15 10:43 - 2013-09-29 18:30 - 00008026 _____ C:\WINDOWS\PFRO.log

2013-09-14 17:15 - 2013-09-29 18:30 - 00213135 _____ C:\WINDOWS\setupact.log

2013-09-14 17:15 - 2013-09-14 17:15 - 00000000 _____ C:\WINDOWS\setuperr.log

2013-09-13 10:57 - 2013-09-29 15:30 - 01972589 _____ C:\WINDOWS\WindowsUpdate.log

2013-09-13 09:28 - 2013-09-13 09:28 - 00274944 _____ C:\Users\Tom\AppData\lsass.exe

2013-09-13 09:24 - 2013-08-16 07:41 - 00058200 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dam.sys

2013-09-13 09:24 - 2013-08-16 07:39 - 02371728 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSService.dll

2013-09-13 09:24 - 2013-08-16 07:39 - 00059416 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe

2013-09-13 09:24 - 2013-08-16 07:32 - 00209200 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationUI.exe

2013-09-13 09:24 - 2013-08-16 07:22 - 04917760 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppsvc.exe

2013-09-13 09:24 - 2013-08-16 07:22 - 00040448 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe

2013-09-13 09:24 - 2013-08-16 07:21 - 03275776 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 01621504 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 01164288 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00773120 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00688640 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00368640 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppwinob.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00252416 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00204800 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSClient.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00183808 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSSync.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00174592 _____ (Microsoft Corporation) C:\WINDOWS\system32\storewuauth.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00163840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00142848 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00120320 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppc.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00099328 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00081408 _____ (Microsoft Corporation) C:\WINDOWS\system32\setupcln.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00049664 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00049152 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups2.dll

2013-09-13 09:24 - 2013-08-16 07:20 - 00105984 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinSetupUI.dll

2013-09-13 09:24 - 2013-08-16 00:43 - 00628736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll

2013-09-13 09:24 - 2013-08-16 00:43 - 00562688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll

2013-09-13 09:24 - 2013-08-16 00:43 - 00167424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSClient.dll

2013-09-13 09:24 - 2013-08-16 00:43 - 00159232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSSync.dll

2013-09-13 09:24 - 2013-08-16 00:43 - 00143872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.dll

2013-09-13 09:24 - 2013-08-16 00:43 - 00126976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll

2013-09-13 09:24 - 2013-08-16 00:43 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll

2013-09-13 09:24 - 2013-08-16 00:43 - 00084992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll

2013-09-13 09:24 - 2013-08-16 00:43 - 00083968 _____ C:\WINDOWS\SysWOW64\OEMLicense.dll

2013-09-13 09:24 - 2013-08-16 00:43 - 00035328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe

2013-09-13 09:24 - 2013-08-16 00:43 - 00020992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wups.dll

2013-09-13 09:24 - 2013-08-16 00:42 - 00091648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sppc.dll

2013-09-13 09:24 - 2013-08-16 00:42 - 00076800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\setupcln.dll

2013-09-13 09:23 - 2013-08-21 06:12 - 02241024 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll

2013-09-13 09:23 - 2013-08-21 06:12 - 00051712 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe

2013-09-13 09:23 - 2013-08-21 06:11 - 19246592 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 15404544 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 03959296 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 02647040 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 01365504 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 00915968 _____ (Microsoft Corporation) C:\WINDOWS\system32\uxtheme.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 00855552 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 00603136 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 00136704 _____ (Microsoft Corporation) C:\WINDOWS\system32\iesysprep.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 00067072 _____ (Microsoft Corporation) C:\WINDOWS\system32\iesetup.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 00053760 _____ (Microsoft Corporation) C:\WINDOWS\system32\UXInit.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 00053760 _____ (Microsoft Corporation) C:\WINDOWS\system32\jsproxy.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 00039936 _____ (Microsoft Corporation) C:\WINDOWS\system32\iernonce.dll

2013-09-13 09:23 - 2013-08-21 04:34 - 02706432 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.tlb

2013-09-13 09:23 - 2013-08-21 04:06 - 01767936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll

2013-09-13 09:23 - 2013-08-21 04:06 - 01141248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll

2013-09-13 09:23 - 2013-08-21 04:06 - 00044032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UXInit.dll

2013-09-13 09:23 - 2013-08-21 04:05 - 14332928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll

2013-09-13 09:23 - 2013-08-21 04:05 - 13761024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll

2013-09-13 09:23 - 2013-08-21 04:05 - 02876928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll

2013-09-13 09:23 - 2013-08-21 04:05 - 02048000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll

2013-09-13 09:23 - 2013-08-21 04:05 - 00690688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll

2013-09-13 09:23 - 2013-08-21 04:05 - 00493056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll

2013-09-13 09:23 - 2013-08-21 04:05 - 00109056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iesysprep.dll

2013-09-13 09:23 - 2013-08-21 04:05 - 00061440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iesetup.dll

2013-09-13 09:23 - 2013-08-21 04:05 - 00039936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jsproxy.dll

2013-09-13 09:23 - 2013-08-21 04:05 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iernonce.dll

2013-09-13 09:23 - 2013-08-21 03:43 - 02706432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.tlb

2013-09-13 09:23 - 2013-08-21 01:52 - 00534528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\uxtheme.dll

2013-09-13 09:23 - 2013-08-03 06:30 - 04038144 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys

2013-09-12 22:38 - 2013-09-12 22:38 - 00001604 _____ C:\Users\Public\Desktop\Angry Birds Star Wars.lnk

2013-09-11 21:10 - 2013-07-09 10:04 - 00120144 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\msgpioclx.sys

2013-09-11 21:10 - 2013-07-09 08:18 - 00439488 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe

2013-09-11 21:10 - 2013-07-09 06:25 - 00385768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe

2013-09-11 21:10 - 2013-07-09 00:46 - 00414208 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanconn.dll

2013-09-11 21:10 - 2013-07-09 00:46 - 00370688 _____ (Microsoft Corporation) C:\WINDOWS\system32\Wwanadvui.dll

2013-09-11 21:10 - 2013-07-06 02:16 - 01025024 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll

2013-09-11 21:10 - 2013-07-03 02:23 - 00778752 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleaut32.dll

2013-09-11 21:10 - 2013-07-03 02:22 - 02839552 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll

2013-09-11 21:10 - 2013-07-03 02:22 - 01300480 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32.dll

2013-09-11 21:10 - 2013-07-03 02:11 - 00551424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleaut32.dll

2013-09-11 21:10 - 2013-07-03 02:11 - 00268800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.BackgroundTransfer.dll

2013-09-11 21:10 - 2013-07-03 02:10 - 02273792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll

2013-09-11 21:10 - 2013-06-29 08:15 - 00195416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys

2013-09-11 21:10 - 2013-06-29 08:15 - 00125784 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpsd.sys

2013-09-11 21:10 - 2013-06-29 07:43 - 00327512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Classpnp.sys

2013-09-11 21:10 - 2013-06-25 00:54 - 00447488 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll

2013-09-11 21:10 - 2013-06-25 00:54 - 00263680 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmsvc.dll

2013-09-11 21:10 - 2013-06-25 00:54 - 00074240 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmcsp.dll

2013-09-11 21:10 - 2013-06-19 07:36 - 00183808 _____ (Microsoft Corporation) C:\WINDOWS\system32\winmmbase.dll

2013-09-11 21:10 - 2013-06-19 07:36 - 00115712 _____ (Microsoft Corporation) C:\WINDOWS\system32\winmm.dll

2013-09-11 21:10 - 2013-06-19 00:38 - 00160256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmmbase.dll

2013-09-11 21:10 - 2013-06-19 00:38 - 00125440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmm.dll

2013-09-11 21:10 - 2013-06-12 01:26 - 00230912 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinSCard.dll

2013-09-11 21:10 - 2013-06-10 23:17 - 00096512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wfplwfs.sys

2013-09-11 21:10 - 2013-06-10 21:15 - 01156096 _____ (Microsoft Corporation) C:\WINDOWS\system32\IKEEXT.DLL

2013-09-11 21:10 - 2013-06-10 21:15 - 00723968 _____ (Microsoft Corporation) C:\WINDOWS\system32\BFE.DLL

2013-09-11 21:10 - 2013-06-10 21:15 - 00381952 _____ (Microsoft Corporation) C:\WINDOWS\system32\FWPUCLNT.DLL

2013-09-11 21:10 - 2013-06-06 10:03 - 00119040 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBSTOR.SYS

2013-09-11 21:09 - 2013-07-09 05:57 - 00245760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LocationApi.dll

2013-09-11 21:09 - 2013-07-09 00:46 - 00543744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanmm.dll

2013-09-11 21:09 - 2013-07-09 00:45 - 00312832 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationApi.dll

2013-09-11 21:09 - 2013-07-03 02:23 - 00391168 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.BackgroundTransfer.dll

2013-09-11 21:09 - 2013-07-02 00:08 - 00387583 _____ C:\WINDOWS\system32\ApnDatabase.xml

2013-09-11 21:09 - 2013-07-01 00:30 - 00067072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\openfiles.exe

2013-09-11 21:09 - 2013-07-01 00:29 - 00077312 _____ (Microsoft Corporation) C:\WINDOWS\system32\openfiles.exe

2013-09-11 21:09 - 2013-06-29 03:12 - 01022464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32.dll

2013-09-11 21:09 - 2013-06-26 05:01 - 00321536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\udfs.sys

2013-09-11 21:09 - 2013-06-12 01:43 - 00154112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinSCard.dll

2013-09-11 21:09 - 2013-06-10 21:16 - 00888832 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshwfp.dll

2013-09-11 21:09 - 2013-06-10 21:10 - 00702464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nshwfp.dll

2013-09-11 21:09 - 2013-06-10 21:10 - 00245248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FWPUCLNT.DLL

2013-09-11 21:09 - 2013-04-03 01:37 - 00025088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cryptdlg.dll

2013-09-11 21:09 - 2013-04-03 01:12 - 00030720 _____ (Microsoft Corporation) C:\WINDOWS\system32\cryptdlg.dll

2013-09-11 21:09 - 2013-03-22 05:49 - 02382336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\esent.dll

2013-09-11 21:09 - 2013-03-22 00:47 - 02851840 _____ (Microsoft Corporation) C:\WINDOWS\system32\esent.dll

2013-09-11 21:09 - 2013-03-02 10:23 - 00375808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ReAgent.dll

2013-09-11 21:09 - 2013-03-02 04:44 - 01011200 _____ (Microsoft Corporation) C:\WINDOWS\system32\reseteng.dll

2013-09-11 21:09 - 2012-12-15 06:55 - 00443392 _____ (Microsoft Corporation) C:\WINDOWS\system32\ReAgent.dll

2013-09-11 21:09 - 2012-11-03 07:26 - 00132096 _____ (Microsoft Corporation) C:\WINDOWS\system32\sysreset.exe

2013-09-11 21:09 - 2012-11-03 07:25 - 00945152 _____ (Microsoft Corporation) C:\WINDOWS\system32\resetengmig.dll

2013-09-11 21:09 - 2012-10-24 05:25 - 00026624 _____ (Microsoft Corporation) C:\WINDOWS\system32\ReAgentc.exe

2013-09-11 21:09 - 2012-10-24 05:25 - 00013312 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcalua.exe

2013-09-11 21:09 - 2012-10-24 05:24 - 00405504 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcasvc.dll

2013-09-11 21:09 - 2012-10-24 05:24 - 00031232 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcadm.dll

2013-09-11 21:09 - 2012-10-24 05:05 - 00011776 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcaevts.dll

2013-09-11 21:09 - 2012-10-24 04:48 - 00024064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ReAgentc.exe

2013-09-09 10:23 - 2013-06-09 21:59 - 00216064 _____ C:\WINDOWS\SysWOW64\gcapi_dll.dll

2013-09-01 16:29 - 2013-09-01 16:29 - 00000000 ____D C:\WINDOWS\SysWOW64\fstrainer2011

2013-09-01 16:29 - 2008-01-03 19:19 - 00581632 _____ (Adobe Systems, Inc.) C:\WINDOWS\SysWOW64\Control.dll

2013-09-01 16:29 - 2004-12-07 10:09 - 00347136 _____ C:\WINDOWS\SysWOW64\unicows.pdb

2013-09-01 16:29 - 2004-08-04 07:21 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msado27.tlb

2013-09-01 16:29 - 2004-03-08 21:00 - 00152848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comdlg32.ocx

2013-09-01 14:49 - 2013-09-09 10:36 - 00000942 _____ C:\Users\Public\Desktop\calibre 64bit - E-book management.lnk

2013-09-01 14:49 - 2013-09-09 10:36 - 00000000 ____D C:\Program Files\Calibre2

2013-09-01 14:49 - 2013-09-01 18:42 - 00000000 ____D C:\Users\Tom\AppData\Local\calibre-cache

2013-08-30 16:11 - 2013-08-30 16:11 - 00000000 ____D C:\Users\TomAdminPW_Ur\AppData\Roaming\Apple Computer
 

==================== One Month Modified Files and Folders =======
 

2013-09-29 18:33 - 2009-07-14 04:34 - 00001106 _____ C:\WINDOWS\win.ini

2013-09-29 18:30 - 2013-09-15 10:43 - 00008026 _____ C:\WINDOWS\PFRO.log

2013-09-29 18:30 - 2013-09-14 17:15 - 00213135 _____ C:\WINDOWS\setupact.log

2013-09-29 18:30 - 2013-01-02 02:50 - 00000000 ____D C:\ProgramData\NVIDIA

2013-09-29 18:30 - 2012-07-26 09:22 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT

2013-09-29 18:23 - 2012-08-15 10:55 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job

2013-09-29 18:01 - 2013-09-29 17:53 - 00000000 ___SD C:\ComboFix

2013-09-29 18:00 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\system32\sru

2013-09-29 17:50 - 2012-07-26 12:27 - 00863478 _____ C:\WINDOWS\system32\perfh007.dat

2013-09-29 17:50 - 2012-07-26 12:27 - 00197036 _____ C:\WINDOWS\system32\perfc007.dat

2013-09-29 17:50 - 2012-07-26 09:28 - 02029610 _____ C:\WINDOWS\system32\PerfStringBackup.INI

2013-09-29 17:49 - 2013-09-29 17:49 - 00000000 ____D C:\Users\Tom\Desktop\Trojan

2013-09-29 17:44 - 2013-08-25 14:40 - 00000000 ____D C:\Program Files (x86)\MyPC Backup

2013-09-29 17:35 - 2013-06-01 13:54 - 00000000 ____D C:\Users\Tom\Desktop\Calibre

2013-09-29 16:47 - 2013-09-29 16:47 - 00001125 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-09-29 16:47 - 2012-09-09 20:42 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-09-29 16:16 - 2013-01-02 02:54 - 00000000 ____D C:\Users\Tom_Admin

2013-09-29 15:30 - 2013-09-13 10:57 - 01972589 _____ C:\WINDOWS\WindowsUpdate.log

2013-09-29 14:47 - 2013-09-29 14:13 - 00000000 ____D C:\WINDOWS\erdnt

2013-09-29 14:13 - 2013-09-29 14:13 - 00000000 ____D C:\Qoobox

2013-09-29 14:07 - 2013-09-29 14:07 - 05130789 ____R (Swearware) C:\Users\Tom\Desktop\ComboFix.exe

2013-09-29 14:01 - 2013-09-29 14:01 - 00000000 ____D C:\FRST

2013-09-27 17:54 - 2013-02-26 22:16 - 00000000 ____D C:\Users\Tom\AppData\Roaming\Simple Sudoku

2013-09-27 17:20 - 2013-03-18 16:32 - 00013213 _____ C:\Users\Tom\Desktop\Wasserverbrauch.xlsx

2013-09-27 17:10 - 2013-03-18 16:19 - 00015297 _____ C:\Users\Tom\Desktop\Stromverbrauch.xlsx

2013-09-27 14:41 - 2012-12-02 22:30 - 00000000 ____D C:\Users\Tom\AppData\Roaming\MyPhoneExplorer

2013-09-27 14:21 - 2013-09-27 14:21 - 00000000 ____D C:\Users\Tom\Documents\SelfMV

2013-09-27 14:10 - 2013-09-27 14:10 - 00002018 _____ C:\Users\Public\Desktop\Samsung Kies (Lite).lnk

2013-09-27 14:10 - 2013-09-27 14:10 - 00002008 _____ C:\Users\Public\Desktop\Samsung Kies.lnk

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\WINDOWS\LastGood.Tmp

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Tom\Documents\samsung

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Tom\AppData\Roaming\Samsung

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Tom\AppData\Local\Samsung

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Public\Documents\NativeFus_Log

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Public\Documents\CrashDump

2013-09-27 14:09 - 2013-09-27 14:05 - 00000000 ____D C:\ProgramData\Samsung

2013-09-27 14:09 - 2013-09-27 14:05 - 00000000 ____D C:\Program Files (x86)\Samsung

2013-09-27 14:08 - 2013-09-27 14:08 - 00000000 ____D C:\Program Files (x86)\MyFree Codec

2013-09-27 14:05 - 2010-01-24 03:50 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information

2013-09-27 13:59 - 2013-09-27 13:59 - 00001059 _____ C:\Users\Public\Desktop\DriverTuner.lnk

2013-09-27 13:59 - 2013-09-27 13:59 - 00000000 ____D C:\Program Files (x86)\DriverTuner

2013-09-27 13:54 - 2013-09-27 13:54 - 00000000 ____D C:\Users\Tom\.android

2013-09-27 13:54 - 2013-01-02 02:54 - 00000000 ____D C:\Users\Tom

2013-09-27 13:54 - 2012-12-02 22:30 - 00002073 _____ C:\Users\Public\Desktop\MyPhoneExplorer.lnk

2013-09-27 13:54 - 2012-12-02 22:30 - 00000000 ____D C:\Program Files (x86)\MyPhoneExplorer

2013-09-26 11:47 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\AUInstallAgent

2013-09-26 10:35 - 2013-09-26 10:35 - 00000103 _____ C:\WINDOWS\ParrotFlashWiz.INI

2013-09-26 10:33 - 2013-09-26 10:33 - 00000000 ____D C:\Program Files (x86)\Parrot Software Update Tool

2013-09-25 17:58 - 2011-03-22 23:38 - 00000000 ____D C:\Users\Tom\AppData\Roaming\Foxit Software

2013-09-23 11:12 - 2013-09-23 11:12 - 1285878931 _____ C:\WINDOWS\MEMORY.DMP

2013-09-23 11:12 - 2013-01-12 07:48 - 00000000 ____D C:\WINDOWS\Minidump

2013-09-19 01:26 - 2013-01-10 23:02 - 00694232 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe

2013-09-19 01:26 - 2013-01-10 23:02 - 00078296 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl

2013-09-18 16:22 - 2013-06-05 11:18 - 00322048 ___SH C:\Users\Tom\Desktop\Thumbs.db

2013-09-18 16:22 - 2013-02-06 22:20 - 00000000 ____D C:\Users\Tom\Desktop\KabelBW

2013-09-15 15:57 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\rescache

2013-09-15 15:38 - 2013-02-23 11:24 - 00000586 _____ C:\Users\Public\Desktop\mkvmerge GUI.lnk

2013-09-15 13:07 - 2013-09-15 13:06 - 00531240 _____ C:\WINDOWS\system32\FNTCACHE.DAT

2013-09-15 01:14 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\WinStore

2013-09-15 01:14 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\PolicyDefinitions

2013-09-15 00:05 - 2010-06-01 00:58 - 00000000 ____D C:\Users\Tom\AppData\Local\QuickPar

2013-09-14 17:15 - 2013-09-14 17:15 - 00000000 _____ C:\WINDOWS\setuperr.log

2013-09-14 11:57 - 2010-06-01 01:01 - 00018944 _____ C:\Users\Tom\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2013-09-14 03:02 - 2010-05-09 20:21 - 00000000 ____D C:\ProgramData\Microsoft Help

2013-09-13 11:06 - 2013-08-19 11:05 - 00000000 ____D C:\WINDOWS\system32\MRT

2013-09-13 11:03 - 2009-10-14 07:12 - 79143768 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe

2013-09-13 09:58 - 2013-08-25 14:42 - 00000834 _____ C:\Users\Public\Desktop\CCleaner.lnk

2013-09-13 09:58 - 2013-08-25 14:42 - 00000000 ____D C:\Program Files\CCleaner

2013-09-13 09:28 - 2013-09-13 09:28 - 00274944 _____ C:\Users\Tom\AppData\lsass.exe

2013-09-13 09:05 - 2012-07-26 07:38 - 00000000 ____D C:\WINDOWS\system32\oobe

2013-09-12 22:38 - 2013-09-12 22:38 - 00001604 _____ C:\Users\Public\Desktop\Angry Birds Star Wars.lnk

2013-09-12 22:38 - 2013-07-05 12:47 - 00000000 ____D C:\Users\Tom\AppData\Roaming\Rovio Entertainment Ltd

2013-09-10 15:45 - 2013-05-04 21:34 - 00000000 ____D C:\Users\Tom\Documents\Settlers7

2013-09-09 10:36 - 2013-09-01 14:49 - 00000942 _____ C:\Users\Public\Desktop\calibre 64bit - E-book management.lnk

2013-09-09 10:36 - 2013-09-01 14:49 - 00000000 ____D C:\Program Files\Calibre2

2013-09-02 16:17 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\system32\NDF

2013-09-01 18:42 - 2013-09-01 14:49 - 00000000 ____D C:\Users\Tom\AppData\Local\calibre-cache

2013-09-01 16:29 - 2013-09-01 16:29 - 00000000 ____D C:\WINDOWS\SysWOW64\fstrainer2011

2013-09-01 16:29 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\SysWOW64\Macromed

2013-09-01 16:29 - 2012-07-10 13:44 - 00000000 ____D C:\WINDOWS\SysWOW64\Adobe

2013-09-01 14:41 - 2013-02-17 20:48 - 00000000 ____D C:\Users\TomAdminPW_Ur\AppData\Roaming\SpeedProject

2013-08-30 16:11 - 2013-08-30 16:11 - 00000000 ____D C:\Users\TomAdminPW_Ur\AppData\Roaming\Apple Computer
 

Some content of TEMP:

====================

C:\Users\Tom\AppData\Local\Temp\cvtres.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Frage: existiert hier auf dem Board ein Donate-Button?

aharonov

29.09.2013 19:00

Hallo,

hast du auch noch das Log von Combofix? (Bisher ist nur AdwCleaner und FRST vorhanden.)

Zitat:

Frage: existiert hier auf dem Board ein Donate-Button?

Ja, das existiert: http://www.trojaner-board.de/79994-s...ndenkonto.html

Rupsi

29.09.2013 19:04

Ups..

Hier das Log von Combofix:

Code:

ComboFix 13-09-28.02 - Tom_Admin 29.09.2013  17:55:20.2.4 - x64

Microsoft Windows 8 Pro  6.2.9200.0.1252.49.1031.18.8183.6498 [GMT 2:00]

ausgeführt von:: C:\Users\Tom\Desktop\Trojan\ComboFix.exe

AV: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

aharonov

29.09.2013 19:08

Das sind nur die ersten paar Zeilen davon und somit sehr unvollständig. :)
Sieht das Log tatsächlich so aus?
Andernfalls poste es bitte nochmals komplett. :)

Rupsi

29.09.2013 19:10

Das log sieht tatsächlich so aus :-(

aharonov

29.09.2013 19:19

Kannst du Combofix nochmals nach der Anleitung ausführen? (Zuvor die bestehende combofix.exe löschen und neu herunterladen.)

Rupsi

29.09.2013 19:58

Sir, Yes Sir ;-)

So. Nun ist sie da.
Zuvor lief wohl ComboFix gar nicht zuende. Der Rechner hatte wohl einen Neustart gemacht. Ich hatte es nicht gesehen, da ich den Lauf nicht vor dem Bildschirm verfolgt habe.

Code:

ComboFix 13-09-28.02 - Tom_Admin 29.09.2013  20:25:23.3.4 - x64

Microsoft Windows 8 Pro  6.2.9200.0.1252.49.1031.18.8183.6587 [GMT 2:00]

ausgeführt von:: c:\users\Tom\Desktop\Trojan\ComboFix.exe

AV: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\program files (x86)\FireFox\plugin-container.exe

c:\program files (x86)\FireFox\uninstall\helper.exe

c:\program files (x86)\FireFox\updater.exe

c:\users\Tom\AppData\Roaming\chrtmp

c:\users\Tom\AppData\Roaming\dclogs

c:\users\Tom\AppData\Roaming\dclogs\2013-09-29-1.dc

c:\users\Tom\AppData\Roaming\inst.exe

.

.

(((((((((((((((((((((((   Dateien erstellt von 2013-08-28 bis 2013-09-29  ))))))))))))))))))))))))))))))

.

.

2013-09-29 18:32 . 2013-09-29 18:32        --------        d-----w-        c:\users\UpdatusUser\AppData\Local\temp

2013-09-29 18:32 . 2013-09-29 18:32        --------        d-----w-        c:\users\TomAdminPW_Ur\AppData\Local\temp

2013-09-29 18:32 . 2013-09-29 18:32        --------        d-----w-        c:\users\Tom_Admin\AppData\Local\temp

2013-09-29 18:32 . 2013-09-29 18:32        --------        d-----w-        c:\users\Max\AppData\Local\temp

2013-09-29 18:32 . 2013-09-29 18:32        --------        d-----w-        c:\users\DefaultAppPool\AppData\Local\temp

2013-09-29 18:32 . 2013-09-29 18:32        --------        d-----w-        c:\users\Default\AppData\Local\temp

2013-09-29 16:33 . 2013-09-29 16:33        76232        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{4990ED62-4329-48A1-B089-52FD3C187F84}\offreg.dll

2013-09-29 14:47 . 2013-09-29 14:47        --------        d-----w-        c:\users\Tom_Admin\AppData\Roaming\Malwarebytes

2013-09-29 14:47 . 2013-04-04 12:50        25928        ----a-w-        c:\windows\system32\drivers\mbam.sys

2013-09-29 12:01 . 2013-09-29 12:01        --------        d-----w-        C:\FRST

2013-09-29 10:22 . 2013-09-05 05:32        9694160        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{4990ED62-4329-48A1-B089-52FD3C187F84}\mpengine.dll

2013-09-27 12:10 . 2013-09-27 12:10        --------        d-----w-        c:\users\Tom\AppData\Local\Samsung

2013-09-27 12:10 . 2013-09-27 12:10        --------        d-----w-        c:\users\Tom\AppData\Roaming\Samsung

2013-09-27 12:10 . 2013-09-27 12:10        --------        d-----w-        c:\windows\LastGood.Tmp

2013-09-27 12:08 . 2013-09-27 12:08        --------        d-----w-        c:\program files (x86)\MyFree Codec

2013-09-27 12:05 . 2013-07-18 12:33        4659712        ----a-w-        c:\windows\SysWow64\Redemption.dll

2013-09-27 12:05 . 2013-07-18 12:32        821824        ----a-w-        c:\windows\SysWow64\dgderapi.dll

2013-09-27 12:05 . 2013-09-27 12:09        --------        d-----w-        c:\program files (x86)\Samsung

2013-09-27 12:05 . 2013-09-27 12:09        --------        d-----w-        c:\programdata\Samsung

2013-09-27 12:03 . 2013-09-27 12:03        --------        d-----w-        c:\users\Tom_Admin\AppData\Local\Downloaded Installations

2013-09-27 11:59 . 2013-09-27 11:59        --------        d-----w-        c:\users\Tom_Admin\AppData\Local\DriverTuner

2013-09-27 11:59 . 2013-09-27 11:59        --------        d-----w-        c:\program files (x86)\DriverTuner

2013-09-27 11:54 . 2013-09-27 11:54        --------        d-----w-        c:\users\Tom\.android

2013-09-26 08:33 . 2013-09-26 08:33        --------        d-----w-        c:\program files (x86)\Parrot Software Update Tool

2013-09-16 18:47 . 2013-08-07 05:15        144896        ----a-w-        c:\windows\system32\tssdisai.dll

2013-09-13 07:23 . 2013-08-21 04:11        19246592        ----a-w-        c:\windows\system32\mshtml.dll

2013-09-11 19:09 . 2013-07-09 03:57        245760        ----a-w-        c:\windows\SysWow64\LocationApi.dll

2013-09-09 08:23 . 2013-06-09 19:59        216064        ----a-w-        c:\windows\SysWow64\gcapi_dll.dll

2013-09-09 08:23 . 2013-09-09 08:23        --------        d-----w-        c:\users\Tom_Admin\AppData\Roaming\Foxit Software

2013-09-01 14:29 . 2013-09-01 14:29        --------        d-----w-        c:\windows\SysWow64\fstrainer2011

2013-09-01 14:29 . 2008-01-03 17:19        581632        ----a-w-        c:\windows\SysWow64\Control.dll

2013-09-01 14:29 . 2004-03-08 19:00        152848        ----a-w-        c:\windows\SysWow64\comdlg32.ocx

2013-09-01 14:29 . 2004-08-04 05:21        81920        ----a-w-        c:\windows\SysWow64\msado27.tlb

2013-09-01 12:49 . 2013-09-01 16:42        --------        d-----w-        c:\users\Tom\AppData\Local\calibre-cache

2013-09-01 12:49 . 2013-09-09 08:36        --------        d-----w-        c:\program files\Calibre2

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-09-29 16:30 . 2013-01-02 00:53        4194304        ----a-w-        c:\windows\ServiceProfiles\NetworkService\msmqlog.bin

2013-09-18 23:26 . 2013-01-10 21:02        78296        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2013-09-18 23:26 . 2013-01-10 21:02        694232        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2013-09-13 09:03 . 2009-10-14 05:12        79143768        ----a-w-        c:\windows\system32\MRT.exe

2013-09-05 17:00 . 2013-03-09 09:10        17536        ----a-w-        c:\programdata\Microsoft\windowssampling\Sqm\Manifest\Sqm3.bin

2013-08-28 19:13 . 2013-08-28 19:13        276256        ----a-w-        c:\windows\system32\drivers\DigiartyVirtualCDBus.sys

2013-08-20 05:02 . 2013-08-20 05:02        204568        ----a-w-        c:\windows\system32\drivers\ssudmdm.sys

2013-08-20 05:02 . 2013-08-20 05:02        103576        ----a-w-        c:\windows\system32\drivers\ssudbus.sys

2013-07-18 12:32 . 2013-07-18 12:32        90112        ----a-w-        c:\windows\MAMCityDownload.ocx

2013-07-18 12:32 . 2013-07-18 12:32        330240        ----a-w-        c:\windows\MASetupCaller.dll

2013-07-18 12:32 . 2013-07-18 12:32        30568        ----a-w-        c:\windows\MusiccityDownload.exe

2013-07-18 12:32 . 2013-07-18 12:32        974848        ----a-w-        c:\windows\SysWow64\cis-2.4.dll

2013-07-18 12:32 . 2013-07-18 12:32        81920        ----a-w-        c:\windows\SysWow64\issacapi_bs-2.3.dll

2013-07-18 12:32 . 2013-07-18 12:32        65536        ----a-w-        c:\windows\SysWow64\issacapi_pe-2.3.dll

2013-07-18 12:32 . 2013-07-18 12:32        57344        ----a-w-        c:\windows\SysWow64\MTXSYNCICON.dll

2013-07-18 12:32 . 2013-07-18 12:32        57344        ----a-w-        c:\windows\SysWow64\MK_Lyric.dll

2013-07-18 12:32 . 2013-07-18 12:32        57344        ----a-w-        c:\windows\SysWow64\issacapi_se-2.3.dll

2013-07-18 12:32 . 2013-07-18 12:32        569344        ----a-w-        c:\windows\SysWow64\muzdecode.ax

2013-07-18 12:32 . 2013-07-18 12:32        491520        ----a-w-        c:\windows\SysWow64\muzapp.dll

2013-07-18 12:32 . 2013-07-18 12:32        49152        ----a-w-        c:\windows\SysWow64\MaJGUILib.dll

2013-07-18 12:32 . 2013-07-18 12:32        45320        ----a-w-        c:\windows\SysWow64\MAMACExtract.dll

2013-07-18 12:32 . 2013-07-18 12:32        45056        ----a-w-        c:\windows\SysWow64\MaXMLProto.dll

2013-07-18 12:32 . 2013-07-18 12:32        45056        ----a-w-        c:\windows\SysWow64\MACXMLProto.dll

2013-07-18 12:32 . 2013-07-18 12:32        40960        ----a-w-        c:\windows\SysWow64\MTTELECHIP.dll

2013-07-18 12:32 . 2013-07-18 12:32        352256        ----a-w-        c:\windows\SysWow64\MSLUR71.dll

2013-07-18 12:32 . 2013-07-18 12:32        258048        ----a-w-        c:\windows\SysWow64\muzoggsp.ax

2013-07-18 12:32 . 2013-07-18 12:32        245760        ----a-w-        c:\windows\SysWow64\MSCLib.dll

2013-07-18 12:32 . 2013-07-18 12:32        24576        ----a-w-        c:\windows\SysWow64\MASetupCleaner.exe

2013-07-18 12:32 . 2013-07-18 12:32        200704        ----a-w-        c:\windows\SysWow64\muzwmts.dll

2013-07-18 12:32 . 2013-07-18 12:32        172032        ----a-w-        c:\windows\SysWow64\muzapp.exe

2013-07-18 12:32 . 2013-07-18 12:32        155648        ----a-w-        c:\windows\SysWow64\MSFLib.dll

2013-07-18 12:32 . 2013-07-18 12:32        143360        ----a-w-        c:\windows\SysWow64\3DAudio.ax

2013-07-18 12:32 . 2013-07-18 12:32        135168        ----a-w-        c:\windows\SysWow64\muzaf1.dll

2013-07-18 12:32 . 2013-07-18 12:32        131072        ----a-w-        c:\windows\SysWow64\muzmpgsp.ax

2013-07-18 12:32 . 2013-07-18 12:32        122880        ----a-w-        c:\windows\SysWow64\muzeffect.ax

2013-07-18 12:32 . 2013-07-18 12:32        118784        ----a-w-        c:\windows\SysWow64\MaDRM.dll

2013-07-18 12:32 . 2013-07-18 12:32        110592        ----a-w-        c:\windows\SysWow64\muzmp4sp.ax

2013-07-13 06:18 . 2013-08-16 21:22        337408        ----a-w-        c:\windows\system32\wintrust.dll

2013-07-13 06:16 . 2013-08-16 21:22        1889280        ----a-w-        c:\windows\system32\crypt32.dll

2013-07-13 06:16 . 2013-08-16 21:22        68096        ----a-w-        c:\windows\system32\cryptsvc.dll

2013-07-13 06:15 . 2013-08-16 21:22        98304        ----a-w-        c:\windows\system32\apprepsync.dll

2013-07-13 06:15 . 2013-08-16 21:22        124416        ----a-w-        c:\windows\system32\apprepapi.dll

2013-07-13 04:24 . 2013-08-16 21:22        261120        ----a-w-        c:\windows\SysWow64\wintrust.dll

2013-07-13 04:23 . 2013-08-16 21:22        1568256        ----a-w-        c:\windows\SysWow64\crypt32.dll

2013-07-13 04:23 . 2013-08-16 21:22        87040        ----a-w-        c:\windows\SysWow64\apprepapi.dll

2013-07-13 04:23 . 2013-08-16 21:22        74240        ----a-w-        c:\windows\SysWow64\apprepsync.dll

2013-07-09 06:07 . 2013-08-16 21:22        2233168        ----a-w-        c:\windows\system32\drivers\tcpip.sys

2013-07-02 00:44 . 2013-08-16 21:22        36288        ----a-w-        c:\windows\system32\drivers\WdBoot.sys

2013-07-01 22:08 . 2013-08-16 21:22        247216        ----a-w-        c:\windows\system32\drivers\WdFilter.sys

2012-05-11 12:16 . 2012-05-11 12:16        171520        ----a-w-        c:\program files (x86)\Common Files\dsfOggDemux2.dll

2011-04-18 20:51 . 2011-04-18 20:51        653136        ----a-w-        c:\program files (x86)\Common Files\MSVCR90.dll

2011-04-18 20:51 . 2011-04-18 20:51        569680        ----a-w-        c:\program files (x86)\Common Files\MSVCP90.dll

2011-01-12 00:00 . 2011-01-12 00:00        30208        ----a-w-        c:\program files (x86)\Common Files\wmpinfo.dll

2011-01-12 00:00 . 2011-01-12 00:00        240128        ----a-w-        c:\program files (x86)\Common Files\dsfVorbisDecoder.dll

2011-01-12 00:00 . 2011-01-12 00:00        146944        ----a-w-        c:\program files (x86)\Common Files\dsfFLACDecoder.dll

2011-01-12 00:00 . 2011-01-12 00:00        221184        ----a-w-        c:\program files (x86)\Common Files\dsfFLACEncoder.dll

2011-01-12 00:00 . 2011-01-12 00:00        204800        ----a-w-        c:\program files (x86)\Common Files\dsfNativeFLACSource.dll

2010-12-16 19:39 . 2010-12-16 19:39        302592        ----a-w-        c:\program files (x86)\Common Files\webmmux.dll

2010-12-16 19:39 . 2010-12-16 19:39        701440        ----a-w-        c:\program files (x86)\Common Files\vp8encoder.dll

2010-12-16 19:39 . 2010-12-16 19:39        412672        ----a-w-        c:\program files (x86)\Common Files\vp8decoder.dll

2010-12-16 19:39 . 2010-12-16 19:39        292352        ----a-w-        c:\program files (x86)\Common Files\webmsplit.dll

2006-05-03 10:06        163328        --sha-r-        c:\windows\SysWOW64\flvDX.dll

2007-02-21 11:47        31232        --sha-r-        c:\windows\SysWOW64\msfDX.dll

2008-03-16 13:30        216064        --sha-r-        c:\windows\SysWOW64\nbDX.dll

2010-01-06 22:00        107520        --sha-r-        c:\windows\SysWOW64\TAKDSDecoder.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"KiesPreload"="c:\program files (x86)\Samsung\Kies\Kies.exe" [2013-09-04 1564528]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"BCSSync"="c:\program files (x86)\Microsoft Office2010\Office14\BCSSync.exe" [2010-03-13 91520]

"EaseUS EPM tray"="c:\program files (x86)\EaseUS\EaseUS Partition Master 9.2.1 Home Edition\bin\EpmNews.exe" [2012-11-29 2086984]

"ISUSScheduler"="c:\program files (x86)\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 81920]

"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2007-03-20 36864]

"PDFPrint"="c:\program files (x86)\PDF24\pdf24.exe" [2012-12-12 163000]

"HPUsageTracking"="c:\program files (x86)\HP\HP UT\bin\hppusg.exe" [2009-05-11 24576]

"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]

"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888]

"Live Update 5"="c:\program files (x86)\MSI\Live Update 5\BootStartLiveupdate.exe" [2012-01-30 315392]

"KiesTrayAgent"="c:\program files (x86)\Samsung\Kies\KiesTrayAgent.exe" [2013-09-04 311152]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]

"Malwarebytes Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2013-04-04 532040]

.

c:\users\Tom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files (x86)\Microsoft Office2010\Office14\ONENOTEM.EXE /tsr [2013-6-25 228552]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\StartUp\

HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"EnableUIADesktopToggle"= 0 (0x0)

"EnableCursorSuppression"= 1 (0x1)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLinkedConnections"= 1 (0x1)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=1 (0x1)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

.

R1 NNSNAHSL;Network Activity Hook Server LightWeight Filter Driver;c:\windows\system32\DRIVERS\NNSNAHSL.sys;c:\windows\SYSNATIVE\DRIVERS\NNSNAHSL.sys [x]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]

R2 SynoDrService;SynoDrService;c:\program files (x86)\Synology Data Replicator  3\SynoDrServicex64.exe;c:\program files (x86)\Synology Data Replicator  3\SynoDrServicex64.exe [x]

R3 androidusb;ADB Interface Driver;c:\windows\System32\Drivers\androidusb.sys;c:\windows\SYSNATIVE\Drivers\androidusb.sys [x]

R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]

R3 DigiartyVirtualCDBus;Digiarty Virtual Driver;c:\windows\system32\drivers\DigiartyVirtualCDBus.sys;c:\windows\SYSNATIVE\drivers\DigiartyVirtualCDBus.sys [x]

R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys;c:\windows\SYSNATIVE\epmntdrv.sys [x]

R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys;c:\windows\SYSNATIVE\EuGdiDrv.sys [x]

R3 HPFXFAX;HPFXFAX;c:\windows\system32\drivers\hpfx64fax.sys;c:\windows\SYSNATIVE\drivers\hpfx64fax.sys [x]

R3 MSI_MSIBIOS_010507;MSI_MSIBIOS_010507;c:\program files (x86)\MSI\Live Update 5\msibios64_100507.sys;c:\program files (x86)\MSI\Live Update 5\msibios64_100507.sys [x]

R3 NTIOLib_1_0_4;NTIOLib_1_0_4;c:\program files (x86)\MSI\Live Update 5\NTIOLib_X64.sys;c:\program files (x86)\MSI\Live Update 5\NTIOLib_X64.sys [x]

R3 NTIOLib_1_0_6;NTIOLib_1_0_6;c:\program files (x86)\Setup Files\Ms7586v1B0\NTIOLib_X64.sys;c:\program files (x86)\Setup Files\Ms7586v1B0\NTIOLib_X64.sys [x]

R3 Olympus DVR Service;Olympus DVR Service;c:\program files (x86)\Common Files\Olympus Shared\DeviceManager\olydvrsv.exe;c:\program files (x86)\Common Files\Olympus Shared\DeviceManager\olydvrsv.exe [x]

R3 pcouffin;VSO Software pcouffin;c:\windows\system32\Drivers\pcouffin.sys;c:\windows\SYSNATIVE\Drivers\pcouffin.sys [x]

R3 Sony PC Companion;Sony PC Companion;c:\program files (x86)\Sony\Sony PC Companion\PCCService.exe;c:\program files (x86)\Sony\Sony PC Companion\PCCService.exe [x]

R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]

R3 vvftav;vvftav;c:\windows\system32\drivers\vvftav.sys;c:\windows\SYSNATIVE\drivers\vvftav.sys [x]

R3 WUDFWpdMtp;WUDFWpdMtp;c:\windows\system32\DRIVERS\WUDFRd.sys;c:\windows\SYSNATIVE\DRIVERS\WUDFRd.sys [x]

R3 ZSMC0305;USB PC Camera VC305;c:\windows\system32\Drivers\usbVM305.sys;c:\windows\SYSNATIVE\Drivers\usbVM305.sys [x]

R4 sptd;sptd;c:\windows\System32\Drivers\sptd.sys;c:\windows\SYSNATIVE\Drivers\sptd.sys [x]

S1 HWiNFO32;HWiNFO32 Kernel Driver;c:\program files (x86)\HWiNFO32\HWiNFO64A.SYS;c:\program files (x86)\HWiNFO32\HWiNFO64A.SYS [x]

S2 acedrv11;acedrv11;c:\windows\system32\drivers\acedrv11.sys;c:\windows\SYSNATIVE\drivers\acedrv11.sys [x]

S2 easycvfs;easyClient DriveOnWeb File System;c:\windows\system32\drivers\easycvfs.sys;c:\windows\SYSNATIVE\drivers\easycvfs.sys [x]

S2 Garmin Core Update Service;Garmin Core Update Service;c:\program files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe;c:\program files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [x]

S2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe;c:\program files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe [x]

S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]

S2 TVGOnlineUpdateSvc;TVG OnlineUpdate-Service;c:\program files (x86)\TVG\OnlineUpdate\OnlineUpdateSvc.exe;c:\program files (x86)\TVG\OnlineUpdate\OnlineUpdateSvc.exe [x]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]

S3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\System32\drivers\seehcri.sys;c:\windows\SYSNATIVE\drivers\seehcri.sys [x]

S3 SKYNET;TechniSat DVB-PC TV Star PCI;c:\windows\system32\DRIVERS\SkyNET_AMD64.SYS;c:\windows\SYSNATIVE\DRIVERS\SkyNET_AMD64.SYS [x]

.

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]

apphost        REG_MULTI_SZ           apphostsvc

iissvcs        REG_MULTI_SZ           w3svc was

hpdevmgmt        REG_MULTI_SZ           hpqcxs08 hpqddsvc

.

Inhalt des "geplante Tasks" Ordners

.

2013-09-29 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-09 16:21]

.

2013-07-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-06-15 23:04]

.

2013-07-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-06-15 23:04]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2012-09-25 13196432]

"HP Color LaserJet CM2320 MFP Series Fax"="c:\program files (x86)\HP\HP Color LaserJet CM2320 MFP Series\hppfaxprintersrv.exe" [2009-09-22 3700736]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"*WerKernelReporting"="c:\windows\SYSTEM32\WerFault.exe" [2013-07-09 439488]

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

mLocal Page = c:\windows\SysWOW64\blank.htm

uSearchAssistant = hxxp://www.google.com

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: An OneNote s&enden - c:\progra~2\MI4066~1\Office14\ONBttnIE.dll/105

IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MI4066~1\Office14\EXCEL.EXE/3000

IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000

Trusted Zone: paypal.com

TCP: DhcpNameServer = 192.168.0.1

FF - ProfilePath - c:\users\Tom_Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m5mhonw7.default\

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

Wow6432Node-HKCU-Run-KiesAirMessage - c:\program files (x86)\Samsung\Kies\KiesAirMessage.exe

Wow6432Node-HKLM-Run-<NO NAME> - (no file)

AddRemove-AquaSoft DiaShow 7 Ultimate - c:\programdata\{C408D0B2-D2DE-46C9-9628-D4E335EC4EB6}\Setup.exe

AddRemove-Mozilla Firefox 23.0.1 (x86 de) - c:\program files (x86)\Firefox\uninstall\helper.exe

AddRemove-Picasa 3 - e:\picasa3\Uninstall.exe

AddRemove-{2FAA2415-618E-4EC0-8253-3CDA076C84D6} - c:\programdata\{C408D0B2-D2DE-46C9-9628-D4E335EC4EB6}\Setup.exe

AddRemove-TeamSpeak 3 Client - c:\users\Tom\AppData\Local\TeamSpeak 3 Client\uninstall.exe

AddRemove-UnityWebPlayer - c:\users\Tom_Admin\AppData\Local\Unity\WebPlayer\Uninstall.exe

AddRemove-{8DC910CD-8EE3-4ffc-A4EB-9B02701059C4} - c:\users\Tom_Admin\Music\uninstaller.exe

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]

@Denied: (A) (Everyone)

"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]

@Denied: (A) (Everyone)

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]

"Key"="ActionsPane3"

"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e96d-e325-11ce-bfc1-08002be10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

@SACL=(02 0000)

.

Zeit der Fertigstellung: 2013-09-29  20:41:29

ComboFix-quarantined-files.txt  2013-09-29 18:41

.

Vor Suchlauf: 24 Verzeichnis(se), 23.432.044.544 Bytes frei

Nach Suchlauf: 32 Verzeichnis(se), 23.027.625.984 Bytes frei

.

- - End Of File - - 02AC84A423A6A769912F17BEF88F90BA

A36C5E4F47E84449FF07ED3517B43A31

Firefox stürzt inzwischen übreigens immer wieder ab

aharonov

29.09.2013 20:13

Ok, und jetzt nochmals frische FRST-Logs:
(Deinstalliere den Firefox mal und installiere ihn dann neu.)

Starte noch einmal FRST.

Setze bei Optional Scan den Haken bei Addition.txt und drücke Scan.
Wenn der Scan abgeschlossen ist, werden zwei neue Logfiles FRST.txt und Addition.txt erstellt und auf dem Desktop gespeichert.
Poste den Inhalt dieser beiden Logfiles bitte hier in deinen Thread.

Rupsi

29.09.2013 20:21

Ich wollte Firefox deinstallieren, doch er weigert sich deinstalliert zu werden :-(

aharonov

29.09.2013 20:24

Klappt es nach dem hier?

Combofix-Skript

WARNUNG für die MITLESER:
Folgendes ComboFix Skript ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!

Lösche die vorhandene Combofix.exe von deinem Desktop und lade das Programm von folgenden Download-Spiegel neu herunter: Link

Speichere es erneut auf dem Desktop (nicht woanders hin, das ist wichtig)!

Drücke die Windows + R Taste --> notepad (hinein schreiben) --> OK

Kopiere nun den Text aus der folgenden Codebox komplett in das leere Textdokument.

Code:

DeQuarantine:: C:\Qoobox\Quarantine\C\program files (x86)\FireFox Quit::

Speichere dies als CFScript.txt auf deinem Desktop.

Wichtig: Stelle deine Anti Viren Software temporär ab. Dies kann ComboFix nämlich bei der Arbeit behindern.
Danach wieder anstellen nicht vergessen!

Schließe alle laufenden Programme damit ComboFix ungehindert arbeiten kann.

Ziehe CFScript.txt in die ComboFix.exe wie in diesem Bild:

Mache nichts am Computer, bewege nicht die Maus über das ComboFix-Fenster oder klicke in dieses hinein. Dies kann dazu führen, dass ComboFix sich aufhängt.

Wenn ComboFix fertig ist wird es ein Log erstellen: C:\ComboFix.txt
Bitte füge es hier als Antwort (in CODE-Tags mit dem #-Button des Editors) ein.

Hinweis:
Suspect:: und Collect::
Falls im Skript diese Anweisungen enthalten sind, sollen Dateien zur Analyse eingeschickt werden. Es erscheint eine Message-Box, nachdem Combofix fertig ist. Klicke OK und folge den Aufforderungen/Anweisungen, um die Dateien hochzuladen. Teile mir unbedingt mit, ob der Upload geklappt hat!

Rupsi

29.09.2013 20:37

Firfox geht inzwischen gar nicht mehr aber hier das log von FRST:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-09-2013 02

Ran by Tom_Admin (administrator) on TOM_ADMIN-PC on 29-09-2013 21:27:36

Running from C:\Users\Tom\Desktop\Trojan

Windows 8 Pro (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) =================
 

(NVIDIA Corporation) C:\WINDOWS\system32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\WINDOWS\system32\nvvsvc.exe

(Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe

(Microsoft Corporation) C:\WINDOWS\system32\dashost.exe

(Microsoft Corporation) C:\WINDOWS\SysWOW64\svchost.exe

(Microsoft Corporation) C:\WINDOWS\system32\mqsvc.exe

(Sony Corporation) C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe

() C:\Program Files (x86)\TVG\OnlineUpdate\OnlineUpdateSvc.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe

(Microsoft Corporation) C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

(Microsoft Corporation) C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Hewlett-Packard Company) C:\Program Files (x86)\HP\HP Color LaserJet CM2320 MFP Series\hppfaxprintersrv.exe

(Samsung) C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe

(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe

(InstallShield Software Corporation) C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe

(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe

() C:\Users\Tom\AppData\Local\Temp\cvtres.exe

(Microsoft Corporation) C:\WINDOWS\SysWOW64\notepad.exe

(SWE Sven Ritter) C:\Program Files\SpeedProject\SpeedCommander 14\SpeedCommander.exe

(SWE Sven Ritter) C:\Program Files\SpeedProject\SpeedCommander 14\LuaHelper.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13196432 2012-09-25] (Realtek Semiconductor)

HKLM\...\Run: [HP Color LaserJet CM2320 MFP Series Fax] - C:\Program Files (x86)\HP\HP Color LaserJet CM2320 MFP Series\hppfaxprintersrv.exe [3700736 2009-09-22] (Hewlett-Packard Company)

HKLM\...\RunOnce: [*WerKernelReporting] - %SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq [439488 2013-07-09] (Microsoft Corporation)

HKLM-x32\...\RunOnce: [Malwarebytes Anti-Malware] - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation)

HKCU\...\Run: [KiesPreload] - C:\Program Files (x86)\Samsung\Kies\Kies.exe [1564528 2013-09-04] (Samsung)

HKLM-x32\...\Run: [BCSSync] - C:\Program Files (x86)\Microsoft Office2010\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)

HKLM-x32\...\Run: [EaseUS EPM tray] - C:\Program Files (x86)\EaseUS\EaseUS Partition Master 9.2.1 Home Edition\bin\EpmNews.exe [2086984 2012-11-29] (CHENGDU YIWO Tech Development Co., Ltd)

HKLM-x32\...\Run: [ISUSScheduler] - C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe [81920 2005-02-16] (InstallShield Software Corporation)

HKLM-x32\...\Run: [JMB36X IDE Setup] - C:\Windows\RaidTool\xInsIDE.exe [36864 2007-03-20] ()

HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [163000 2012-12-12] (Geek Software GmbH)

HKLM-x32\...\Run: [] - [x]

HKLM-x32\...\Run: [HPUsageTracking] - C:\Program Files (x86)\HP\HP UT\bin\hppusg.exe [24576 2009-05-11] (Hewlett-Packard Company)

HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)

HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)

HKLM-x32\...\Run: [Live Update 5] - C:\Program Files (x86)\MSI\Live Update 5\BootStartLiveupdate.exe [315392 2012-01-30] ()

HKLM-x32\...\Run: [KiesTrayAgent] - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311152 2013-09-04] (Samsung Electronics Co., Ltd.)

HKU\TomAdminPW_Ur\...\Run: [GarminExpressTrayApp] - C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [1098072 2013-03-27] (Garmin Ltd or its subsidiaries)

HKU\UpdatusUser\...\RunOnce: [WAB Migrate] - C:\Program Files\Windows Mail\wab.exe [516096 2012-07-26] (Microsoft Corporation)

Startup: C:\Users\Tom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk

ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office2010\Office14\ONENOTEM.EXE (Microsoft Corporation)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xBC7CC5332A8FCD01

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office2010\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office2010\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: No Name - {DBC80044-A445-435b-BC74-9C25C1C588A9} -  No File

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 0.0.0.0
 

FireFox:

========

FF ProfilePath: C:\Users\Tom_Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m5mhonw7.default

FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()

FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()

FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\WINDOWS\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf - f:\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)

FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf - f:\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)

FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - e:\Picasa3\npPicasa3.dll No File

FF Plugin-x32: @java.com/DTPlugin,version=1.6.0_35 - C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MI4066~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MI4066~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin-x32: @real.com/nppl3260;version=15.0.4.53 - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprjplug;version=15.0.4.53 - c:\program files (x86)\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprpchromebrowserrecordext;version=15.0.4.53 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprphtml5videoshim;version=15.0.4.53 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprpplugin;version=15.0.4.53 - c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Extension: Battlefield Heroes Updater - C:\Users\Tom_Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m5mhonw7.default\Extensions\battlefieldheroespatcher@ea.com

FF HKLM-x32\...\Firefox\Extensions: [{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext

FF Extension: RealPlayer Browser Record Plugin - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext

FF HKCU\...\Firefox\Extensions: [lrcsmonkey@lrcsmonkey.net] - C:\Program Files (x86)\Lyrics_Monkey\128.xpi

FF StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Firefox\firefox.exe
 

==================== Services (Whitelisted) =================
 

R2 Garmin Core Update Service; C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [185688 2013-03-27] (Garmin Ltd or its subsidiaries)

R2 HPSLPSVC; C:\Users\Tom\AppData\Local\Temp\7zS3579\hpslpsvc64.dll [1039360 2012-11-14] (Hewlett-Packard Co.)

S3 Microsoft SharePoint Workspace Audit Service; C:\Program Files (x86)\Microsoft Office2010\Office14\GROOVE.EXE [30785672 2012-09-20] (Microsoft Corporation)

R2 MSMQ; C:\Windows\system32\mqsvc.exe [25088 2012-07-26] (Microsoft Corporation)

R2 PMBDeviceInfoProvider; C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe [474168 2012-04-22] (Sony Corporation)

S2 SynoDrService; C:\Program Files (x86)\Synology Data Replicator  3\SynoDrServicex64.exe [380928 2010-06-02] ()

R2 TVGOnlineUpdateSvc; C:\Program Files (x86)\TVG\OnlineUpdate\OnlineUpdateSvc.exe [398128 2010-12-14] ()

R2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [471552 2012-07-26] (Microsoft Corporation)

R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)
 

==================== Drivers (Whitelisted) ====================
 

S3 androidusb; C:\Windows\System32\Drivers\androidusb.sys [32768 2010-04-29] (Google Inc)

S3 DigiartyVirtualCDBus; C:\Windows\System32\drivers\DigiartyVirtualCDBus.sys [276256 2013-08-28] (Digiarty Software, Inc.)

R2 easycvfs; C:\WINDOWS\system32\drivers\easycvfs.sys [109960 2009-11-09] ()

S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [17480 2012-12-21] ()

S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [17480 2012-12-21] ()

S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9800 2012-12-21] ()

S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9800 2012-12-21] ()

R1 HWiNFO32; C:\Program Files (x86)\HWiNFO32\HWiNFO64A.SYS [29288 2009-05-21] (REALiX(tm))

R1 HWiNFO32; C:\Program Files (x86)\HWiNFO32\HWiNFO64A.SYS [29288 2009-05-21] (REALiX(tm))

R3 MQAC; C:\Windows\System32\drivers\mqac.sys [185856 2012-07-26] (Microsoft Corporation)

S1 NNSNAHSL; C:\Windows\System32\DRIVERS\NNSNAHSL.sys [33320 2012-10-22] (Panda Security, S.L.)

S3 NTIOLib_1_0_4; C:\Program Files (x86)\MSI\Live Update 5\NTIOLib_X64.sys [14136 2010-10-22] (MSI)

S3 NTIOLib_1_0_4; C:\Program Files (x86)\MSI\Live Update 5\NTIOLib_X64.sys [14136 2010-10-22] (MSI)

S3 NTIOLib_1_0_6; C:\Program Files (x86)\Setup Files\Ms7586v1B0\NTIOLib_X64.sys [11888 2011-01-06] (MSI)

S3 NTIOLib_1_0_6; C:\Program Files (x86)\Setup Files\Ms7586v1B0\NTIOLib_X64.sys [11888 2011-01-06] (MSI)

R3 seehcri; C:\Windows\System32\drivers\seehcri.sys [34032 2008-01-09] (Sony Ericsson Mobile Communications)

R3 SKYNET; C:\Windows\system32\DRIVERS\SkyNET_AMD64.SYS [615440 2009-09-11] (TechniSat Digital, S.A.)

S4 sptd; C:\Windows\System32\Drivers\sptd.sys [828912 2011-08-16] (Duplex Secure Ltd.)

S3 vvftav; C:\Windows\System32\drivers\vvftav.sys [300800 2007-02-02] (Vimicro Corporation)

S3 ZSMC0305; C:\Windows\System32\Drivers\usbVM305.sys [1541120 2007-03-08] (Vimicro Corporation)

S3 catchme; \??\C:\ComboFix\catchme.sys [x]

U3 idsvc; 

S3 MSI_MSIBIOS_010507; \??\C:\Program Files (x86)\MSI\Live Update 5\msibios64_100507.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-09-29 21:13 - 2013-09-29 21:13 - 22537616 _____ (Mozilla) C:\Users\Tom\Downloads\Firefox Setup 24.0.exe

2013-09-29 20:41 - 2013-09-29 20:41 - 00020983 _____ C:\ComboFix.txt

2013-09-29 20:41 - 2013-09-29 20:41 - 00001454 _____ C:\Users\Tom_Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2013-09-29 20:41 - 2013-09-29 20:41 - 00000000 ____D C:\Users\Tom_Admin\AppData\Local\Packages

2013-09-29 20:22 - 2013-09-29 20:22 - 05130789 _____ (Swearware) C:\Users\Tom\Downloads\ComboFix.exe

2013-09-29 17:49 - 2013-09-29 21:27 - 00000000 ____D C:\Users\Tom\Desktop\Trojan

2013-09-29 16:47 - 2013-09-29 16:47 - 00001125 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-09-29 16:47 - 2013-09-29 16:47 - 00000000 ____D C:\Users\Tom_Admin\AppData\Roaming\Malwarebytes

2013-09-29 16:47 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys

2013-09-29 16:16 - 2013-09-29 16:16 - 00000000 _____ C:\Users\Tom_Admin\defogger_reenable

2013-09-29 14:13 - 2013-09-29 20:41 - 00000000 ____D C:\Qoobox

2013-09-29 14:13 - 2013-09-29 20:38 - 00000000 ____D C:\WINDOWS\erdnt

2013-09-29 14:13 - 2011-06-26 08:45 - 00256000 _____ C:\WINDOWS\PEV.exe

2013-09-29 14:13 - 2010-11-07 19:20 - 00208896 _____ C:\WINDOWS\MBR.exe

2013-09-29 14:13 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\WINDOWS\NIRCMD.exe

2013-09-29 14:13 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\WINDOWS\SWREG.exe

2013-09-29 14:13 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\WINDOWS\SWSC.exe

2013-09-29 14:13 - 2000-08-31 02:00 - 00212480 _____ (SteelWerX) C:\WINDOWS\SWXCACLS.exe

2013-09-29 14:13 - 2000-08-31 02:00 - 00098816 _____ C:\WINDOWS\sed.exe

2013-09-29 14:13 - 2000-08-31 02:00 - 00080412 _____ C:\WINDOWS\grep.exe

2013-09-29 14:13 - 2000-08-31 02:00 - 00068096 _____ C:\WINDOWS\zip.exe

2013-09-29 14:07 - 2013-09-29 14:07 - 05130789 ____R (Swearware) C:\Users\Tom\Desktop\ComboFix.exe

2013-09-29 14:01 - 2013-09-29 14:01 - 00000000 ____D C:\FRST

2013-09-27 14:21 - 2013-09-27 14:21 - 00000000 ____D C:\Users\Tom\Documents\SelfMV

2013-09-27 14:10 - 2013-09-27 14:10 - 00002018 _____ C:\Users\Public\Desktop\Samsung Kies (Lite).lnk

2013-09-27 14:10 - 2013-09-27 14:10 - 00002008 _____ C:\Users\Public\Desktop\Samsung Kies.lnk

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\WINDOWS\LastGood.Tmp

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Tom\Documents\samsung

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Tom\AppData\Roaming\Samsung

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Tom\AppData\Local\Samsung

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Public\Documents\NativeFus_Log

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Public\Documents\CrashDump

2013-09-27 14:08 - 2013-09-27 14:08 - 00000000 ____D C:\Program Files (x86)\MyFree Codec

2013-09-27 14:05 - 2013-09-27 14:09 - 00000000 ____D C:\ProgramData\Samsung

2013-09-27 14:05 - 2013-09-27 14:09 - 00000000 ____D C:\Program Files (x86)\Samsung

2013-09-27 14:05 - 2013-07-18 14:33 - 04659712 _____ (Dmitry Streblechenko) C:\WINDOWS\SysWOW64\Redemption.dll

2013-09-27 14:05 - 2013-07-18 14:32 - 00821824 _____ (Devguru Co., Ltd.) C:\WINDOWS\SysWOW64\dgderapi.dll

2013-09-27 14:03 - 2013-09-27 14:03 - 00000000 ____D C:\Users\Tom_Admin\AppData\Local\Downloaded Installations

2013-09-27 13:59 - 2013-09-27 13:59 - 00003328 _____ C:\WINDOWS\System32\Tasks\DriverTuner Startup

2013-09-27 13:59 - 2013-09-27 13:59 - 00001059 _____ C:\Users\Public\Desktop\DriverTuner.lnk

2013-09-27 13:59 - 2013-09-27 13:59 - 00000000 ____D C:\Users\Tom_Admin\AppData\Local\DriverTuner

2013-09-27 13:59 - 2013-09-27 13:59 - 00000000 ____D C:\Program Files (x86)\DriverTuner

2013-09-27 13:54 - 2013-09-27 13:54 - 00000000 ____D C:\Users\Tom\.android

2013-09-26 10:35 - 2013-09-26 10:35 - 00000103 _____ C:\WINDOWS\ParrotFlashWiz.INI

2013-09-26 10:33 - 2013-09-26 10:33 - 00000000 ____D C:\Program Files (x86)\Parrot Software Update Tool

2013-09-23 11:12 - 2013-09-23 11:12 - 1285878931 _____ C:\WINDOWS\MEMORY.DMP

2013-09-23 11:12 - 2013-09-23 11:12 - 00296000 _____ C:\WINDOWS\Minidump\092313-40466-01.dmp

2013-09-23 09:48 - 2013-09-23 09:48 - 00000426 _____ C:\Users\Tom_Admin\Desktop\Range Extender Settings.txt

2013-09-16 20:47 - 2013-08-07 07:15 - 00144896 _____ (Microsoft Corporation) C:\WINDOWS\system32\tssdisai.dll

2013-09-15 13:06 - 2013-09-15 13:07 - 00531240 _____ C:\WINDOWS\system32\FNTCACHE.DAT

2013-09-15 10:43 - 2013-09-29 20:44 - 00008578 _____ C:\WINDOWS\PFRO.log

2013-09-14 17:15 - 2013-09-29 20:44 - 00234051 _____ C:\WINDOWS\setupact.log

2013-09-14 17:15 - 2013-09-14 17:15 - 00000000 _____ C:\WINDOWS\setuperr.log

2013-09-13 10:57 - 2013-09-29 21:02 - 01994993 _____ C:\WINDOWS\WindowsUpdate.log

2013-09-13 10:07 - 2013-09-13 10:07 - 00080878 _____ C:\Users\Tom_Admin\Documents\cc_20130913_100737.reg

2013-09-13 09:54 - 2013-09-13 09:55 - 04454952 _____ (Piriform Ltd) C:\Users\Tom_Admin\Downloads\ccsetup405.exe

2013-09-13 09:28 - 2013-09-13 09:28 - 00274944 _____ C:\Users\Tom\AppData\lsass.exe

2013-09-13 09:24 - 2013-08-16 07:41 - 00058200 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dam.sys

2013-09-13 09:24 - 2013-08-16 07:39 - 02371728 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSService.dll

2013-09-13 09:24 - 2013-08-16 07:39 - 00059416 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe

2013-09-13 09:24 - 2013-08-16 07:32 - 00209200 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationUI.exe

2013-09-13 09:24 - 2013-08-16 07:22 - 04917760 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppsvc.exe

2013-09-13 09:24 - 2013-08-16 07:22 - 00040448 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe

2013-09-13 09:24 - 2013-08-16 07:21 - 03275776 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 01621504 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 01164288 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00773120 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00688640 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00368640 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppwinob.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00252416 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00204800 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSClient.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00183808 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSSync.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00174592 _____ (Microsoft Corporation) C:\WINDOWS\system32\storewuauth.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00163840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00142848 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00120320 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppc.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00099328 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00081408 _____ (Microsoft Corporation) C:\WINDOWS\system32\setupcln.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00049664 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00049152 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups2.dll

2013-09-13 09:24 - 2013-08-16 07:20 - 00105984 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinSetupUI.dll

2013-09-13 09:24 - 2013-08-16 00:43 - 00628736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll

2013-09-13 09:24 - 2013-08-16 00:43 - 00562688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll

2013-09-13 09:24 - 2013-08-16 00:43 - 00167424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSClient.dll

2013-09-13 09:24 - 2013-08-16 00:43 - 00159232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSSync.dll

2013-09-13 09:24 - 2013-08-16 00:43 - 00143872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.dll

2013-09-13 09:24 - 2013-08-16 00:43 - 00126976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll

2013-09-13 09:24 - 2013-08-16 00:43 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll

2013-09-13 09:24 - 2013-08-16 00:43 - 00084992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll

2013-09-13 09:24 - 2013-08-16 00:43 - 00083968 _____ C:\WINDOWS\SysWOW64\OEMLicense.dll

2013-09-13 09:24 - 2013-08-16 00:43 - 00035328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe

2013-09-13 09:24 - 2013-08-16 00:43 - 00020992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wups.dll

2013-09-13 09:24 - 2013-08-16 00:42 - 00091648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sppc.dll

2013-09-13 09:24 - 2013-08-16 00:42 - 00076800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\setupcln.dll

2013-09-13 09:23 - 2013-08-21 06:12 - 02241024 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll

2013-09-13 09:23 - 2013-08-21 06:12 - 00051712 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe

2013-09-13 09:23 - 2013-08-21 06:11 - 19246592 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 15404544 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 03959296 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 02647040 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 01365504 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 00915968 _____ (Microsoft Corporation) C:\WINDOWS\system32\uxtheme.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 00855552 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 00603136 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 00136704 _____ (Microsoft Corporation) C:\WINDOWS\system32\iesysprep.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 00067072 _____ (Microsoft Corporation) C:\WINDOWS\system32\iesetup.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 00053760 _____ (Microsoft Corporation) C:\WINDOWS\system32\UXInit.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 00053760 _____ (Microsoft Corporation) C:\WINDOWS\system32\jsproxy.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 00039936 _____ (Microsoft Corporation) C:\WINDOWS\system32\iernonce.dll

2013-09-13 09:23 - 2013-08-21 04:34 - 02706432 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.tlb

2013-09-13 09:23 - 2013-08-21 04:06 - 01767936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll

2013-09-13 09:23 - 2013-08-21 04:06 - 01141248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll

2013-09-13 09:23 - 2013-08-21 04:06 - 00044032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UXInit.dll

2013-09-13 09:23 - 2013-08-21 04:05 - 14332928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll

2013-09-13 09:23 - 2013-08-21 04:05 - 13761024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll

2013-09-13 09:23 - 2013-08-21 04:05 - 02876928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll

2013-09-13 09:23 - 2013-08-21 04:05 - 02048000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll

2013-09-13 09:23 - 2013-08-21 04:05 - 00690688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll

2013-09-13 09:23 - 2013-08-21 04:05 - 00493056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll

2013-09-13 09:23 - 2013-08-21 04:05 - 00109056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iesysprep.dll

2013-09-13 09:23 - 2013-08-21 04:05 - 00061440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iesetup.dll

2013-09-13 09:23 - 2013-08-21 04:05 - 00039936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jsproxy.dll

2013-09-13 09:23 - 2013-08-21 04:05 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iernonce.dll

2013-09-13 09:23 - 2013-08-21 03:43 - 02706432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.tlb

2013-09-13 09:23 - 2013-08-21 01:52 - 00534528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\uxtheme.dll

2013-09-13 09:23 - 2013-08-03 06:30 - 04038144 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys

2013-09-12 22:38 - 2013-09-12 22:38 - 00001604 _____ C:\Users\Public\Desktop\Angry Birds Star Wars.lnk

2013-09-11 21:10 - 2013-07-09 10:04 - 00120144 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\msgpioclx.sys

2013-09-11 21:10 - 2013-07-09 08:18 - 00439488 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe

2013-09-11 21:10 - 2013-07-09 06:25 - 00385768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe

2013-09-11 21:10 - 2013-07-09 00:46 - 00414208 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanconn.dll

2013-09-11 21:10 - 2013-07-09 00:46 - 00370688 _____ (Microsoft Corporation) C:\WINDOWS\system32\Wwanadvui.dll

2013-09-11 21:10 - 2013-07-06 02:16 - 01025024 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll

2013-09-11 21:10 - 2013-07-03 02:23 - 00778752 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleaut32.dll

2013-09-11 21:10 - 2013-07-03 02:22 - 02839552 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll

2013-09-11 21:10 - 2013-07-03 02:22 - 01300480 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32.dll

2013-09-11 21:10 - 2013-07-03 02:11 - 00551424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleaut32.dll

2013-09-11 21:10 - 2013-07-03 02:11 - 00268800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.BackgroundTransfer.dll

2013-09-11 21:10 - 2013-07-03 02:10 - 02273792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll

2013-09-11 21:10 - 2013-06-29 08:15 - 00195416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys

2013-09-11 21:10 - 2013-06-29 08:15 - 00125784 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpsd.sys

2013-09-11 21:10 - 2013-06-29 07:43 - 00327512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Classpnp.sys

2013-09-11 21:10 - 2013-06-25 00:54 - 00447488 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll

2013-09-11 21:10 - 2013-06-25 00:54 - 00263680 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmsvc.dll

2013-09-11 21:10 - 2013-06-25 00:54 - 00074240 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmcsp.dll

2013-09-11 21:10 - 2013-06-19 07:36 - 00183808 _____ (Microsoft Corporation) C:\WINDOWS\system32\winmmbase.dll

2013-09-11 21:10 - 2013-06-19 07:36 - 00115712 _____ (Microsoft Corporation) C:\WINDOWS\system32\winmm.dll

2013-09-11 21:10 - 2013-06-19 00:38 - 00160256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmmbase.dll

2013-09-11 21:10 - 2013-06-19 00:38 - 00125440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmm.dll

2013-09-11 21:10 - 2013-06-12 01:26 - 00230912 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinSCard.dll

2013-09-11 21:10 - 2013-06-10 23:17 - 00096512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wfplwfs.sys

2013-09-11 21:10 - 2013-06-10 21:15 - 01156096 _____ (Microsoft Corporation) C:\WINDOWS\system32\IKEEXT.DLL

2013-09-11 21:10 - 2013-06-10 21:15 - 00723968 _____ (Microsoft Corporation) C:\WINDOWS\system32\BFE.DLL

2013-09-11 21:10 - 2013-06-10 21:15 - 00381952 _____ (Microsoft Corporation) C:\WINDOWS\system32\FWPUCLNT.DLL

2013-09-11 21:10 - 2013-06-06 10:03 - 00119040 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBSTOR.SYS

2013-09-11 21:09 - 2013-07-09 05:57 - 00245760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LocationApi.dll

2013-09-11 21:09 - 2013-07-09 00:46 - 00543744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanmm.dll

2013-09-11 21:09 - 2013-07-09 00:45 - 00312832 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationApi.dll

2013-09-11 21:09 - 2013-07-03 02:23 - 00391168 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.BackgroundTransfer.dll

2013-09-11 21:09 - 2013-07-02 00:08 - 00387583 _____ C:\WINDOWS\system32\ApnDatabase.xml

2013-09-11 21:09 - 2013-07-01 00:30 - 00067072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\openfiles.exe

2013-09-11 21:09 - 2013-07-01 00:29 - 00077312 _____ (Microsoft Corporation) C:\WINDOWS\system32\openfiles.exe

2013-09-11 21:09 - 2013-06-29 03:12 - 01022464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32.dll

2013-09-11 21:09 - 2013-06-26 05:01 - 00321536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\udfs.sys

2013-09-11 21:09 - 2013-06-12 01:43 - 00154112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinSCard.dll

2013-09-11 21:09 - 2013-06-10 21:16 - 00888832 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshwfp.dll

2013-09-11 21:09 - 2013-06-10 21:10 - 00702464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nshwfp.dll

2013-09-11 21:09 - 2013-06-10 21:10 - 00245248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FWPUCLNT.DLL

2013-09-11 21:09 - 2013-04-03 01:37 - 00025088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cryptdlg.dll

2013-09-11 21:09 - 2013-04-03 01:12 - 00030720 _____ (Microsoft Corporation) C:\WINDOWS\system32\cryptdlg.dll

2013-09-11 21:09 - 2013-03-22 05:49 - 02382336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\esent.dll

2013-09-11 21:09 - 2013-03-22 00:47 - 02851840 _____ (Microsoft Corporation) C:\WINDOWS\system32\esent.dll

2013-09-11 21:09 - 2013-03-02 10:23 - 00375808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ReAgent.dll

2013-09-11 21:09 - 2013-03-02 04:44 - 01011200 _____ (Microsoft Corporation) C:\WINDOWS\system32\reseteng.dll

2013-09-11 21:09 - 2012-12-15 06:55 - 00443392 _____ (Microsoft Corporation) C:\WINDOWS\system32\ReAgent.dll

2013-09-11 21:09 - 2012-11-03 07:26 - 00132096 _____ (Microsoft Corporation) C:\WINDOWS\system32\sysreset.exe

2013-09-11 21:09 - 2012-11-03 07:25 - 00945152 _____ (Microsoft Corporation) C:\WINDOWS\system32\resetengmig.dll

2013-09-11 21:09 - 2012-10-24 05:25 - 00026624 _____ (Microsoft Corporation) C:\WINDOWS\system32\ReAgentc.exe

2013-09-11 21:09 - 2012-10-24 05:25 - 00013312 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcalua.exe

2013-09-11 21:09 - 2012-10-24 05:24 - 00405504 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcasvc.dll

2013-09-11 21:09 - 2012-10-24 05:24 - 00031232 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcadm.dll

2013-09-11 21:09 - 2012-10-24 05:05 - 00011776 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcaevts.dll

2013-09-11 21:09 - 2012-10-24 04:48 - 00024064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ReAgentc.exe

2013-09-09 10:23 - 2013-09-09 10:23 - 00000000 ____D C:\Users\Tom_Admin\AppData\Roaming\Foxit Software

2013-09-09 10:23 - 2013-06-09 21:59 - 00216064 _____ C:\WINDOWS\SysWOW64\gcapi_dll.dll

2013-09-01 16:29 - 2013-09-01 16:29 - 00000650 _____ C:\Users\Tom_Admin\Desktop\Führerschein Trainer 2012.lnk

2013-09-01 16:29 - 2013-09-01 16:29 - 00000000 ____D C:\WINDOWS\SysWOW64\fstrainer2011

2013-09-01 16:29 - 2008-01-03 19:19 - 00581632 _____ (Adobe Systems, Inc.) C:\WINDOWS\SysWOW64\Control.dll

2013-09-01 16:29 - 2004-12-07 10:09 - 00347136 _____ C:\WINDOWS\SysWOW64\unicows.pdb

2013-09-01 16:29 - 2004-08-04 07:21 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msado27.tlb

2013-09-01 16:29 - 2004-03-08 21:00 - 00152848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comdlg32.ocx

2013-09-01 14:49 - 2013-09-09 10:36 - 00000942 _____ C:\Users\Public\Desktop\calibre 64bit - E-book management.lnk

2013-09-01 14:49 - 2013-09-09 10:36 - 00000000 ____D C:\Program Files\Calibre2

2013-09-01 14:49 - 2013-09-01 18:42 - 00000000 ____D C:\Users\Tom\AppData\Local\calibre-cache

2013-09-01 14:42 - 2013-09-01 14:42 - 00036256 _____ C:\Users\TomAdminPW_Ur\Documents\cc_20130901_144221.reg

2013-09-01 14:37 - 2013-09-01 14:37 - 00001848 _____ C:\Users\TomAdminPW_Ur\Desktop\SpeedCommanderPortable.lnk

2013-09-01 14:34 - 2013-09-01 14:34 - 00292514 _____ C:\Users\TomAdminPW_Ur\Documents\cc_20130901_143447.reg

2013-08-30 16:11 - 2013-08-30 16:11 - 00000000 ____D C:\Users\TomAdminPW_Ur\AppData\Roaming\Apple Computer
 

==================== One Month Modified Files and Folders =======
 

2013-09-29 21:27 - 2013-09-29 17:49 - 00000000 ____D C:\Users\Tom\Desktop\Trojan

2013-09-29 21:22 - 2009-07-14 04:34 - 00001106 _____ C:\WINDOWS\win.ini

2013-09-29 21:21 - 2012-08-15 10:55 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job

2013-09-29 21:13 - 2013-09-29 21:13 - 22537616 _____ (Mozilla) C:\Users\Tom\Downloads\Firefox Setup 24.0.exe

2013-09-29 21:02 - 2013-09-13 10:57 - 01994993 _____ C:\WINDOWS\WindowsUpdate.log

2013-09-29 21:00 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\system32\sru

2013-09-29 20:51 - 2013-01-02 10:05 - 00003598 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1318767841-1341867437-3819663778-1003

2013-09-29 20:44 - 2013-09-15 10:43 - 00008578 _____ C:\WINDOWS\PFRO.log

2013-09-29 20:44 - 2013-09-14 17:15 - 00234051 _____ C:\WINDOWS\setupact.log

2013-09-29 20:44 - 2013-01-02 02:50 - 00000000 ____D C:\ProgramData\NVIDIA

2013-09-29 20:44 - 2012-07-26 09:22 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT

2013-09-29 20:42 - 2010-01-24 03:21 - 00000000 ___RD C:\Users\Tom_Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

2013-09-29 20:42 - 2010-01-24 03:21 - 00000000 ___RD C:\Users\Tom_Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools

2013-09-29 20:41 - 2013-09-29 20:41 - 00020983 _____ C:\ComboFix.txt

2013-09-29 20:41 - 2013-09-29 20:41 - 00001454 _____ C:\Users\Tom_Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2013-09-29 20:41 - 2013-09-29 20:41 - 00000000 ____D C:\Users\Tom_Admin\AppData\Local\Packages

2013-09-29 20:41 - 2013-09-29 14:13 - 00000000 ____D C:\Qoobox

2013-09-29 20:38 - 2013-09-29 14:13 - 00000000 ____D C:\WINDOWS\erdnt

2013-09-29 20:32 - 2012-07-26 07:26 - 00000215 _____ C:\WINDOWS\system.ini

2013-09-29 20:30 - 2013-08-17 10:39 - 00000000 ____D C:\Program Files (x86)\Firefox!

2013-09-29 20:22 - 2013-09-29 20:22 - 05130789 _____ (Swearware) C:\Users\Tom\Downloads\ComboFix.exe

2013-09-29 17:50 - 2012-07-26 12:27 - 00863478 _____ C:\WINDOWS\system32\perfh007.dat

2013-09-29 17:50 - 2012-07-26 12:27 - 00197036 _____ C:\WINDOWS\system32\perfc007.dat

2013-09-29 17:50 - 2012-07-26 09:28 - 02029610 _____ C:\WINDOWS\system32\PerfStringBackup.INI

2013-09-29 17:44 - 2013-08-25 14:40 - 00000000 ____D C:\Program Files (x86)\MyPC Backup

2013-09-29 17:35 - 2013-06-01 13:54 - 00000000 ____D C:\Users\Tom\Desktop\Calibre

2013-09-29 16:47 - 2013-09-29 16:47 - 00001125 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-09-29 16:47 - 2013-09-29 16:47 - 00000000 ____D C:\Users\Tom_Admin\AppData\Roaming\Malwarebytes

2013-09-29 16:47 - 2012-09-09 20:42 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-09-29 16:16 - 2013-09-29 16:16 - 00000000 _____ C:\Users\Tom_Admin\defogger_reenable

2013-09-29 16:16 - 2013-01-02 02:54 - 00000000 ____D C:\Users\Tom_Admin

2013-09-29 14:47 - 2012-07-26 07:26 - 93847552 _____ C:\WINDOWS\system32\config\SOFTWARE.bak

2013-09-29 14:47 - 2012-07-26 07:26 - 14680064 _____ C:\WINDOWS\system32\config\SYSTEM.bak

2013-09-29 14:47 - 2012-07-26 07:26 - 00786432 _____ C:\WINDOWS\system32\config\DEFAULT.bak

2013-09-29 14:47 - 2012-07-26 07:26 - 00262144 _____ C:\WINDOWS\system32\config\SECURITY.bak

2013-09-29 14:47 - 2012-07-26 07:26 - 00262144 _____ C:\WINDOWS\system32\config\SAM.bak

2013-09-29 14:07 - 2013-09-29 14:07 - 05130789 ____R (Swearware) C:\Users\Tom\Desktop\ComboFix.exe

2013-09-29 14:01 - 2013-09-29 14:01 - 00000000 ____D C:\FRST

2013-09-29 12:59 - 2012-07-26 10:08 - 05734400 _____ C:\WINDOWS\system32\config\DRIVERS.bak

2013-09-27 17:54 - 2013-02-26 22:16 - 00000000 ____D C:\Users\Tom\AppData\Roaming\Simple Sudoku

2013-09-27 17:20 - 2013-03-18 16:32 - 00013213 _____ C:\Users\Tom\Desktop\Wasserverbrauch.xlsx

2013-09-27 17:10 - 2013-03-18 16:19 - 00015297 _____ C:\Users\Tom\Desktop\Stromverbrauch.xlsx

2013-09-27 14:41 - 2012-12-02 22:30 - 00000000 ____D C:\Users\Tom\AppData\Roaming\MyPhoneExplorer

2013-09-27 14:21 - 2013-09-27 14:21 - 00000000 ____D C:\Users\Tom\Documents\SelfMV

2013-09-27 14:10 - 2013-09-27 14:10 - 00002018 _____ C:\Users\Public\Desktop\Samsung Kies (Lite).lnk

2013-09-27 14:10 - 2013-09-27 14:10 - 00002008 _____ C:\Users\Public\Desktop\Samsung Kies.lnk

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\WINDOWS\LastGood.Tmp

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Tom\Documents\samsung

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Tom\AppData\Roaming\Samsung

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Tom\AppData\Local\Samsung

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Public\Documents\NativeFus_Log

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Public\Documents\CrashDump

2013-09-27 14:09 - 2013-09-27 14:05 - 00000000 ____D C:\ProgramData\Samsung

2013-09-27 14:09 - 2013-09-27 14:05 - 00000000 ____D C:\Program Files (x86)\Samsung

2013-09-27 14:08 - 2013-09-27 14:08 - 00000000 ____D C:\Program Files (x86)\MyFree Codec

2013-09-27 14:05 - 2010-01-24 03:50 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information

2013-09-27 14:03 - 2013-09-27 14:03 - 00000000 ____D C:\Users\Tom_Admin\AppData\Local\Downloaded Installations

2013-09-27 13:59 - 2013-09-27 13:59 - 00003328 _____ C:\WINDOWS\System32\Tasks\DriverTuner Startup

2013-09-27 13:59 - 2013-09-27 13:59 - 00001059 _____ C:\Users\Public\Desktop\DriverTuner.lnk

2013-09-27 13:59 - 2013-09-27 13:59 - 00000000 ____D C:\Users\Tom_Admin\AppData\Local\DriverTuner

2013-09-27 13:59 - 2013-09-27 13:59 - 00000000 ____D C:\Program Files (x86)\DriverTuner

2013-09-27 13:54 - 2013-09-27 13:54 - 00000000 ____D C:\Users\Tom\.android

2013-09-27 13:54 - 2013-01-02 02:54 - 00000000 ____D C:\Users\Tom

2013-09-27 13:54 - 2012-12-02 22:30 - 00002073 _____ C:\Users\Public\Desktop\MyPhoneExplorer.lnk

2013-09-27 13:54 - 2012-12-02 22:30 - 00000000 ____D C:\Program Files (x86)\MyPhoneExplorer

2013-09-26 11:47 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\AUInstallAgent

2013-09-26 10:35 - 2013-09-26 10:35 - 00000103 _____ C:\WINDOWS\ParrotFlashWiz.INI

2013-09-26 10:33 - 2013-09-26 10:33 - 00000000 ____D C:\Program Files (x86)\Parrot Software Update Tool

2013-09-25 17:58 - 2011-03-22 23:38 - 00000000 ____D C:\Users\Tom\AppData\Roaming\Foxit Software

2013-09-23 11:12 - 2013-09-23 11:12 - 1285878931 _____ C:\WINDOWS\MEMORY.DMP

2013-09-23 11:12 - 2013-09-23 11:12 - 00296000 _____ C:\WINDOWS\Minidump\092313-40466-01.dmp

2013-09-23 11:12 - 2013-01-12 07:48 - 00000000 ____D C:\WINDOWS\Minidump

2013-09-23 09:48 - 2013-09-23 09:48 - 00000426 _____ C:\Users\Tom_Admin\Desktop\Range Extender Settings.txt

2013-09-19 01:26 - 2013-01-10 23:02 - 00694232 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe

2013-09-19 01:26 - 2013-01-10 23:02 - 00078296 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl

2013-09-18 16:22 - 2013-06-05 11:18 - 00322048 ___SH C:\Users\Tom\Desktop\Thumbs.db

2013-09-18 16:22 - 2013-02-06 22:20 - 00000000 ____D C:\Users\Tom\Desktop\KabelBW

2013-09-15 15:57 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\rescache

2013-09-15 15:38 - 2013-02-23 11:24 - 00000586 _____ C:\Users\Public\Desktop\mkvmerge GUI.lnk

2013-09-15 13:07 - 2013-09-15 13:06 - 00531240 _____ C:\WINDOWS\system32\FNTCACHE.DAT

2013-09-15 01:14 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\WinStore

2013-09-15 01:14 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\PolicyDefinitions

2013-09-15 00:05 - 2010-06-01 00:58 - 00000000 ____D C:\Users\Tom\AppData\Local\QuickPar

2013-09-14 17:15 - 2013-09-14 17:15 - 00000000 _____ C:\WINDOWS\setuperr.log

2013-09-14 11:57 - 2010-06-01 01:01 - 00018944 _____ C:\Users\Tom\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2013-09-14 03:02 - 2010-05-09 20:21 - 00000000 ____D C:\ProgramData\Microsoft Help

2013-09-13 11:06 - 2013-08-19 11:05 - 00000000 ____D C:\WINDOWS\system32\MRT

2013-09-13 11:03 - 2009-10-14 07:12 - 79143768 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe

2013-09-13 10:07 - 2013-09-13 10:07 - 00080878 _____ C:\Users\Tom_Admin\Documents\cc_20130913_100737.reg

2013-09-13 09:58 - 2013-08-25 14:42 - 00000834 _____ C:\Users\Public\Desktop\CCleaner.lnk

2013-09-13 09:58 - 2013-08-25 14:42 - 00000000 ____D C:\Program Files\CCleaner

2013-09-13 09:55 - 2013-09-13 09:54 - 04454952 _____ (Piriform Ltd) C:\Users\Tom_Admin\Downloads\ccsetup405.exe

2013-09-13 09:28 - 2013-09-13 09:28 - 00274944 _____ C:\Users\Tom\AppData\lsass.exe

2013-09-13 09:06 - 2012-07-26 07:26 - 00524288 ___SH C:\WINDOWS\system32\config\BBI

2013-09-13 09:05 - 2012-07-26 07:38 - 00000000 ____D C:\WINDOWS\system32\oobe

2013-09-12 22:38 - 2013-09-12 22:38 - 00001604 _____ C:\Users\Public\Desktop\Angry Birds Star Wars.lnk

2013-09-12 22:38 - 2013-07-05 12:47 - 00000000 ____D C:\Users\Tom\AppData\Roaming\Rovio Entertainment Ltd

2013-09-10 18:21 - 2013-01-31 10:20 - 00003772 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater

2013-09-10 15:45 - 2013-05-04 21:34 - 00000000 ____D C:\Users\Tom\Documents\Settlers7

2013-09-09 10:36 - 2013-09-01 14:49 - 00000942 _____ C:\Users\Public\Desktop\calibre 64bit - E-book management.lnk

2013-09-09 10:36 - 2013-09-01 14:49 - 00000000 ____D C:\Program Files\Calibre2

2013-09-09 10:23 - 2013-09-09 10:23 - 00000000 ____D C:\Users\Tom_Admin\AppData\Roaming\Foxit Software

2013-09-02 16:17 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\system32\NDF

2013-09-01 18:42 - 2013-09-01 14:49 - 00000000 ____D C:\Users\Tom\AppData\Local\calibre-cache

2013-09-01 16:29 - 2013-09-01 16:29 - 00000650 _____ C:\Users\Tom_Admin\Desktop\Führerschein Trainer 2012.lnk

2013-09-01 16:29 - 2013-09-01 16:29 - 00000000 ____D C:\WINDOWS\SysWOW64\fstrainer2011

2013-09-01 16:29 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\SysWOW64\Macromed

2013-09-01 16:29 - 2012-07-10 13:44 - 00000000 ____D C:\WINDOWS\SysWOW64\Adobe

2013-09-01 16:29 - 2010-12-03 17:21 - 00000000 ____D C:\Users\Tom_Admin\AppData\Roaming\Macromedia

2013-09-01 16:29 - 2010-12-03 17:21 - 00000000 ____D C:\Users\Tom_Admin\AppData\Roaming\Adobe

2013-09-01 14:42 - 2013-09-01 14:42 - 00036256 _____ C:\Users\TomAdminPW_Ur\Documents\cc_20130901_144221.reg

2013-09-01 14:41 - 2013-02-17 20:48 - 00000000 ____D C:\Users\TomAdminPW_Ur\AppData\Roaming\SpeedProject

2013-09-01 14:37 - 2013-09-01 14:37 - 00001848 _____ C:\Users\TomAdminPW_Ur\Desktop\SpeedCommanderPortable.lnk

2013-09-01 14:34 - 2013-09-01 14:34 - 00292514 _____ C:\Users\TomAdminPW_Ur\Documents\cc_20130901_143447.reg

2013-09-01 14:29 - 2013-02-17 20:51 - 00003600 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1318767841-1341867437-3819663778-1004

2013-08-30 16:11 - 2013-08-30 16:11 - 00000000 ____D C:\Users\TomAdminPW_Ur\AppData\Roaming\Apple Computer

2013-08-30 16:11 - 2011-03-30 11:05 - 00000000 ___RD C:\Users\TomAdminPW_Ur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

2013-08-30 16:11 - 2011-03-30 11:05 - 00000000 ___RD C:\Users\TomAdminPW_Ur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
 

Some content of TEMP:

====================

C:\Users\Tom\AppData\Local\temp\cvtres.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-09-29 18:50
 

==================== End Of Log ============================

--- --- ---

aharonov

29.09.2013 20:46

Mit dem Firefox klappt auch nach dem CFScript aus obigem Post nichts mehr?

Rupsi

29.09.2013 21:07

Firefox scheint wieder zu gehen.

Hier log con ComboFix

Code:

ComboFix 13-09-28.02 - Tom_Admin 29.09.2013  21:42:50.4.4 - x64

Microsoft Windows 8 Pro  6.2.9200.0.1252.49.1031.18.8183.6480 [GMT 2:00]

ausgeführt von:: c:\users\Tom\Desktop\ComboFix.exe

AV: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\users\Tom\AppData\Roaming\dclogs

c:\users\Tom\AppData\Roaming\dclogs\2013-09-29-1.dc

.

.

(((((((((((((((((((((((   Dateien erstellt von 2013-08-28 bis 2013-09-29  ))))))))))))))))))))))))))))))

.

.

2013-09-29 19:47 . 2013-09-29 19:47        --------        d-----w-        c:\users\UpdatusUser\AppData\Local\temp

2013-09-29 19:47 . 2013-09-29 19:47        --------        d-----w-        c:\users\TomAdminPW_Ur\AppData\Local\temp

2013-09-29 19:47 . 2013-09-29 19:47        --------        d-----w-        c:\users\Tom_Admin\AppData\Local\temp

2013-09-29 19:47 . 2013-09-29 19:47        --------        d-----w-        c:\users\Max\AppData\Local\temp

2013-09-29 19:47 . 2013-09-29 19:47        --------        d-----w-        c:\users\eingeschränkt\AppData\Local\temp

2013-09-29 19:47 . 2013-09-29 19:47        --------        d-----w-        c:\users\DefaultAppPool\AppData\Local\temp

2013-09-29 19:47 . 2013-09-29 19:47        --------        d-----w-        c:\users\Default\AppData\Local\temp

2013-09-29 19:47 . 2013-09-29 19:47        --------        d-----w-        c:\users\Default.migrated\AppData\Local\temp

2013-09-29 18:41 . 2013-09-29 18:41        --------        d-----w-        c:\users\Tom_Admin\AppData\Local\Packages

2013-09-29 16:33 . 2013-09-29 16:33        76232        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{4990ED62-4329-48A1-B089-52FD3C187F84}\offreg.dll

2013-09-29 14:47 . 2013-09-29 14:47        --------        d-----w-        c:\users\Tom_Admin\AppData\Roaming\Malwarebytes

2013-09-29 14:47 . 2013-04-04 12:50        25928        ----a-w-        c:\windows\system32\drivers\mbam.sys

2013-09-29 12:01 . 2013-09-29 12:01        --------        d-----w-        C:\FRST

2013-09-29 10:22 . 2013-09-05 05:32        9694160        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{4990ED62-4329-48A1-B089-52FD3C187F84}\mpengine.dll

2013-09-27 12:10 . 2013-09-27 12:10        --------        d-----w-        c:\users\Tom\AppData\Local\Samsung

2013-09-27 12:10 . 2013-09-27 12:10        --------        d-----w-        c:\users\Tom\AppData\Roaming\Samsung

2013-09-27 12:10 . 2013-09-27 12:10        --------        d-----w-        c:\windows\LastGood.Tmp

2013-09-27 12:08 . 2013-09-27 12:08        --------        d-----w-        c:\program files (x86)\MyFree Codec

2013-09-27 12:05 . 2013-07-18 12:33        4659712        ----a-w-        c:\windows\SysWow64\Redemption.dll

2013-09-27 12:05 . 2013-07-18 12:32        821824        ----a-w-        c:\windows\SysWow64\dgderapi.dll

2013-09-27 12:05 . 2013-09-27 12:09        --------        d-----w-        c:\program files (x86)\Samsung

2013-09-27 12:05 . 2013-09-27 12:09        --------        d-----w-        c:\programdata\Samsung

2013-09-27 12:03 . 2013-09-27 12:03        --------        d-----w-        c:\users\Tom_Admin\AppData\Local\Downloaded Installations

2013-09-27 11:59 . 2013-09-27 11:59        --------        d-----w-        c:\users\Tom_Admin\AppData\Local\DriverTuner

2013-09-27 11:59 . 2013-09-27 11:59        --------        d-----w-        c:\program files (x86)\DriverTuner

2013-09-27 11:54 . 2013-09-27 11:54        --------        d-----w-        c:\users\Tom\.android

2013-09-26 08:33 . 2013-09-26 08:33        --------        d-----w-        c:\program files (x86)\Parrot Software Update Tool

2013-09-16 18:47 . 2013-08-07 05:15        144896        ----a-w-        c:\windows\system32\tssdisai.dll

2013-09-13 07:23 . 2013-08-21 04:11        19246592        ----a-w-        c:\windows\system32\mshtml.dll

2013-09-11 19:09 . 2013-07-09 03:57        245760        ----a-w-        c:\windows\SysWow64\LocationApi.dll

2013-09-09 08:23 . 2013-06-09 19:59        216064        ----a-w-        c:\windows\SysWow64\gcapi_dll.dll

2013-09-09 08:23 . 2013-09-09 08:23        --------        d-----w-        c:\users\Tom_Admin\AppData\Roaming\Foxit Software

2013-09-01 14:29 . 2013-09-01 14:29        --------        d-----w-        c:\windows\SysWow64\fstrainer2011

2013-09-01 14:29 . 2008-01-03 17:19        581632        ----a-w-        c:\windows\SysWow64\Control.dll

2013-09-01 14:29 . 2004-03-08 19:00        152848        ----a-w-        c:\windows\SysWow64\comdlg32.ocx

2013-09-01 14:29 . 2004-08-04 05:21        81920        ----a-w-        c:\windows\SysWow64\msado27.tlb

2013-09-01 12:49 . 2013-09-01 16:42        --------        d-----w-        c:\users\Tom\AppData\Local\calibre-cache

2013-09-01 12:49 . 2013-09-09 08:36        --------        d-----w-        c:\program files\Calibre2

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-09-29 18:44 . 2013-01-02 00:53        4194304        ----a-w-        c:\windows\ServiceProfiles\NetworkService\msmqlog.bin

2013-09-18 23:26 . 2013-01-10 21:02        78296        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2013-09-18 23:26 . 2013-01-10 21:02        694232        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2013-09-13 09:03 . 2009-10-14 05:12        79143768        ----a-w-        c:\windows\system32\MRT.exe

2013-09-05 17:00 . 2013-03-09 09:10        17536        ----a-w-        c:\programdata\Microsoft\windowssampling\Sqm\Manifest\Sqm3.bin

2013-08-28 19:13 . 2013-08-28 19:13        276256        ----a-w-        c:\windows\system32\drivers\DigiartyVirtualCDBus.sys

2013-08-20 05:02 . 2013-08-20 05:02        204568        ----a-w-        c:\windows\system32\drivers\ssudmdm.sys

2013-08-20 05:02 . 2013-08-20 05:02        103576        ----a-w-        c:\windows\system32\drivers\ssudbus.sys

2013-07-18 12:32 . 2013-07-18 12:32        90112        ----a-w-        c:\windows\MAMCityDownload.ocx

2013-07-18 12:32 . 2013-07-18 12:32        330240        ----a-w-        c:\windows\MASetupCaller.dll

2013-07-18 12:32 . 2013-07-18 12:32        30568        ----a-w-        c:\windows\MusiccityDownload.exe

2013-07-18 12:32 . 2013-07-18 12:32        974848        ----a-w-        c:\windows\SysWow64\cis-2.4.dll

2013-07-18 12:32 . 2013-07-18 12:32        81920        ----a-w-        c:\windows\SysWow64\issacapi_bs-2.3.dll

2013-07-18 12:32 . 2013-07-18 12:32        65536        ----a-w-        c:\windows\SysWow64\issacapi_pe-2.3.dll

2013-07-18 12:32 . 2013-07-18 12:32        57344        ----a-w-        c:\windows\SysWow64\MTXSYNCICON.dll

2013-07-18 12:32 . 2013-07-18 12:32        57344        ----a-w-        c:\windows\SysWow64\MK_Lyric.dll

2013-07-18 12:32 . 2013-07-18 12:32        57344        ----a-w-        c:\windows\SysWow64\issacapi_se-2.3.dll

2013-07-18 12:32 . 2013-07-18 12:32        569344        ----a-w-        c:\windows\SysWow64\muzdecode.ax

2013-07-18 12:32 . 2013-07-18 12:32        491520        ----a-w-        c:\windows\SysWow64\muzapp.dll

2013-07-18 12:32 . 2013-07-18 12:32        49152        ----a-w-        c:\windows\SysWow64\MaJGUILib.dll

2013-07-18 12:32 . 2013-07-18 12:32        45320        ----a-w-        c:\windows\SysWow64\MAMACExtract.dll

2013-07-18 12:32 . 2013-07-18 12:32        45056        ----a-w-        c:\windows\SysWow64\MaXMLProto.dll

2013-07-18 12:32 . 2013-07-18 12:32        45056        ----a-w-        c:\windows\SysWow64\MACXMLProto.dll

2013-07-18 12:32 . 2013-07-18 12:32        40960        ----a-w-        c:\windows\SysWow64\MTTELECHIP.dll

2013-07-18 12:32 . 2013-07-18 12:32        352256        ----a-w-        c:\windows\SysWow64\MSLUR71.dll

2013-07-18 12:32 . 2013-07-18 12:32        258048        ----a-w-        c:\windows\SysWow64\muzoggsp.ax

2013-07-18 12:32 . 2013-07-18 12:32        245760        ----a-w-        c:\windows\SysWow64\MSCLib.dll

2013-07-18 12:32 . 2013-07-18 12:32        24576        ----a-w-        c:\windows\SysWow64\MASetupCleaner.exe

2013-07-18 12:32 . 2013-07-18 12:32        200704        ----a-w-        c:\windows\SysWow64\muzwmts.dll

2013-07-18 12:32 . 2013-07-18 12:32        172032        ----a-w-        c:\windows\SysWow64\muzapp.exe

2013-07-18 12:32 . 2013-07-18 12:32        155648        ----a-w-        c:\windows\SysWow64\MSFLib.dll

2013-07-18 12:32 . 2013-07-18 12:32        143360        ----a-w-        c:\windows\SysWow64\3DAudio.ax

2013-07-18 12:32 . 2013-07-18 12:32        135168        ----a-w-        c:\windows\SysWow64\muzaf1.dll

2013-07-18 12:32 . 2013-07-18 12:32        131072        ----a-w-        c:\windows\SysWow64\muzmpgsp.ax

2013-07-18 12:32 . 2013-07-18 12:32        122880        ----a-w-        c:\windows\SysWow64\muzeffect.ax

2013-07-18 12:32 . 2013-07-18 12:32        118784        ----a-w-        c:\windows\SysWow64\MaDRM.dll

2013-07-18 12:32 . 2013-07-18 12:32        110592        ----a-w-        c:\windows\SysWow64\muzmp4sp.ax

2013-07-13 06:18 . 2013-08-16 21:22        337408        ----a-w-        c:\windows\system32\wintrust.dll

2013-07-13 06:16 . 2013-08-16 21:22        1889280        ----a-w-        c:\windows\system32\crypt32.dll

2013-07-13 06:16 . 2013-08-16 21:22        68096        ----a-w-        c:\windows\system32\cryptsvc.dll

2013-07-13 06:15 . 2013-08-16 21:22        98304        ----a-w-        c:\windows\system32\apprepsync.dll

2013-07-13 06:15 . 2013-08-16 21:22        124416        ----a-w-        c:\windows\system32\apprepapi.dll

2013-07-13 04:24 . 2013-08-16 21:22        261120        ----a-w-        c:\windows\SysWow64\wintrust.dll

2013-07-13 04:23 . 2013-08-16 21:22        1568256        ----a-w-        c:\windows\SysWow64\crypt32.dll

2013-07-13 04:23 . 2013-08-16 21:22        87040        ----a-w-        c:\windows\SysWow64\apprepapi.dll

2013-07-13 04:23 . 2013-08-16 21:22        74240        ----a-w-        c:\windows\SysWow64\apprepsync.dll

2013-07-09 06:07 . 2013-08-16 21:22        2233168        ----a-w-        c:\windows\system32\drivers\tcpip.sys

2013-07-02 00:44 . 2013-08-16 21:22        36288        ----a-w-        c:\windows\system32\drivers\WdBoot.sys

2013-07-01 22:08 . 2013-08-16 21:22        247216        ----a-w-        c:\windows\system32\drivers\WdFilter.sys

2012-05-11 12:16 . 2012-05-11 12:16        171520        ----a-w-        c:\program files (x86)\Common Files\dsfOggDemux2.dll

2011-04-18 20:51 . 2011-04-18 20:51        653136        ----a-w-        c:\program files (x86)\Common Files\MSVCR90.dll

2011-04-18 20:51 . 2011-04-18 20:51        569680        ----a-w-        c:\program files (x86)\Common Files\MSVCP90.dll

2011-01-12 00:00 . 2011-01-12 00:00        30208        ----a-w-        c:\program files (x86)\Common Files\wmpinfo.dll

2011-01-12 00:00 . 2011-01-12 00:00        240128        ----a-w-        c:\program files (x86)\Common Files\dsfVorbisDecoder.dll

2011-01-12 00:00 . 2011-01-12 00:00        146944        ----a-w-        c:\program files (x86)\Common Files\dsfFLACDecoder.dll

2011-01-12 00:00 . 2011-01-12 00:00        221184        ----a-w-        c:\program files (x86)\Common Files\dsfFLACEncoder.dll

2011-01-12 00:00 . 2011-01-12 00:00        204800        ----a-w-        c:\program files (x86)\Common Files\dsfNativeFLACSource.dll

2010-12-16 19:39 . 2010-12-16 19:39        302592        ----a-w-        c:\program files (x86)\Common Files\webmmux.dll

2010-12-16 19:39 . 2010-12-16 19:39        701440        ----a-w-        c:\program files (x86)\Common Files\vp8encoder.dll

2010-12-16 19:39 . 2010-12-16 19:39        412672        ----a-w-        c:\program files (x86)\Common Files\vp8decoder.dll

2010-12-16 19:39 . 2010-12-16 19:39        292352        ----a-w-        c:\program files (x86)\Common Files\webmsplit.dll

2006-05-03 10:06        163328        --sha-r-        c:\windows\SysWOW64\flvDX.dll

2007-02-21 11:47        31232        --sha-r-        c:\windows\SysWOW64\msfDX.dll

2008-03-16 13:30        216064        --sha-r-        c:\windows\SysWOW64\nbDX.dll

2010-01-06 22:00        107520        --sha-r-        c:\windows\SysWOW64\TAKDSDecoder.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"KiesPreload"="c:\program files (x86)\Samsung\Kies\Kies.exe" [2013-09-04 1564528]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"BCSSync"="c:\program files (x86)\Microsoft Office2010\Office14\BCSSync.exe" [2010-03-13 91520]

"EaseUS EPM tray"="c:\program files (x86)\EaseUS\EaseUS Partition Master 9.2.1 Home Edition\bin\EpmNews.exe" [2012-11-29 2086984]

"ISUSScheduler"="c:\program files (x86)\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 81920]

"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2007-03-20 36864]

"PDFPrint"="c:\program files (x86)\PDF24\pdf24.exe" [2012-12-12 163000]

"HPUsageTracking"="c:\program files (x86)\HP\HP UT\bin\hppusg.exe" [2009-05-11 24576]

"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]

"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888]

"Live Update 5"="c:\program files (x86)\MSI\Live Update 5\BootStartLiveupdate.exe" [2012-01-30 315392]

"KiesTrayAgent"="c:\program files (x86)\Samsung\Kies\KiesTrayAgent.exe" [2013-09-04 311152]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]

"Malwarebytes Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2013-04-04 532040]

.

c:\users\Tom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files (x86)\Microsoft Office2010\Office14\ONENOTEM.EXE /tsr [2013-6-25 228552]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\StartUp\

HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"EnableUIADesktopToggle"= 0 (0x0)

"EnableCursorSuppression"= 1 (0x1)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLinkedConnections"= 1 (0x1)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=1 (0x1)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

.

R1 NNSNAHSL;Network Activity Hook Server LightWeight Filter Driver;c:\windows\system32\DRIVERS\NNSNAHSL.sys;c:\windows\SYSNATIVE\DRIVERS\NNSNAHSL.sys [x]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]

R2 SynoDrService;SynoDrService;c:\program files (x86)\Synology Data Replicator  3\SynoDrServicex64.exe;c:\program files (x86)\Synology Data Replicator  3\SynoDrServicex64.exe [x]

R3 androidusb;ADB Interface Driver;c:\windows\System32\Drivers\androidusb.sys;c:\windows\SYSNATIVE\Drivers\androidusb.sys [x]

R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]

R3 DigiartyVirtualCDBus;Digiarty Virtual Driver;c:\windows\system32\drivers\DigiartyVirtualCDBus.sys;c:\windows\SYSNATIVE\drivers\DigiartyVirtualCDBus.sys [x]

R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys;c:\windows\SYSNATIVE\epmntdrv.sys [x]

R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys;c:\windows\SYSNATIVE\EuGdiDrv.sys [x]

R3 HPFXFAX;HPFXFAX;c:\windows\system32\drivers\hpfx64fax.sys;c:\windows\SYSNATIVE\drivers\hpfx64fax.sys [x]

R3 MSI_MSIBIOS_010507;MSI_MSIBIOS_010507;c:\program files (x86)\MSI\Live Update 5\msibios64_100507.sys;c:\program files (x86)\MSI\Live Update 5\msibios64_100507.sys [x]

R3 NTIOLib_1_0_4;NTIOLib_1_0_4;c:\program files (x86)\MSI\Live Update 5\NTIOLib_X64.sys;c:\program files (x86)\MSI\Live Update 5\NTIOLib_X64.sys [x]

R3 NTIOLib_1_0_6;NTIOLib_1_0_6;c:\program files (x86)\Setup Files\Ms7586v1B0\NTIOLib_X64.sys;c:\program files (x86)\Setup Files\Ms7586v1B0\NTIOLib_X64.sys [x]

R3 Olympus DVR Service;Olympus DVR Service;c:\program files (x86)\Common Files\Olympus Shared\DeviceManager\olydvrsv.exe;c:\program files (x86)\Common Files\Olympus Shared\DeviceManager\olydvrsv.exe [x]

R3 pcouffin;VSO Software pcouffin;c:\windows\system32\Drivers\pcouffin.sys;c:\windows\SYSNATIVE\Drivers\pcouffin.sys [x]

R3 Sony PC Companion;Sony PC Companion;c:\program files (x86)\Sony\Sony PC Companion\PCCService.exe;c:\program files (x86)\Sony\Sony PC Companion\PCCService.exe [x]

R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]

R3 vvftav;vvftav;c:\windows\system32\drivers\vvftav.sys;c:\windows\SYSNATIVE\drivers\vvftav.sys [x]

R3 WUDFWpdMtp;WUDFWpdMtp;c:\windows\system32\DRIVERS\WUDFRd.sys;c:\windows\SYSNATIVE\DRIVERS\WUDFRd.sys [x]

R3 ZSMC0305;USB PC Camera VC305;c:\windows\system32\Drivers\usbVM305.sys;c:\windows\SYSNATIVE\Drivers\usbVM305.sys [x]

R4 sptd;sptd;c:\windows\System32\Drivers\sptd.sys;c:\windows\SYSNATIVE\Drivers\sptd.sys [x]

S1 HWiNFO32;HWiNFO32 Kernel Driver;c:\program files (x86)\HWiNFO32\HWiNFO64A.SYS;c:\program files (x86)\HWiNFO32\HWiNFO64A.SYS [x]

S2 acedrv11;acedrv11;c:\windows\system32\drivers\acedrv11.sys;c:\windows\SYSNATIVE\drivers\acedrv11.sys [x]

S2 easycvfs;easyClient DriveOnWeb File System;c:\windows\system32\drivers\easycvfs.sys;c:\windows\SYSNATIVE\drivers\easycvfs.sys [x]

S2 Garmin Core Update Service;Garmin Core Update Service;c:\program files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe;c:\program files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [x]

S2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe;c:\program files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe [x]

S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]

S2 TVGOnlineUpdateSvc;TVG OnlineUpdate-Service;c:\program files (x86)\TVG\OnlineUpdate\OnlineUpdateSvc.exe;c:\program files (x86)\TVG\OnlineUpdate\OnlineUpdateSvc.exe [x]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]

S3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\System32\drivers\seehcri.sys;c:\windows\SYSNATIVE\drivers\seehcri.sys [x]

S3 SKYNET;TechniSat DVB-PC TV Star PCI;c:\windows\system32\DRIVERS\SkyNET_AMD64.SYS;c:\windows\SYSNATIVE\DRIVERS\SkyNET_AMD64.SYS [x]

.

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]

apphost        REG_MULTI_SZ           apphostsvc

iissvcs        REG_MULTI_SZ           w3svc was

hpdevmgmt        REG_MULTI_SZ           hpqcxs08 hpqddsvc

.

Inhalt des "geplante Tasks" Ordners

.

2013-09-29 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-09 16:21]

.

2013-07-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-06-15 23:04]

.

2013-07-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-06-15 23:04]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2012-09-25 13196432]

"HP Color LaserJet CM2320 MFP Series Fax"="c:\program files (x86)\HP\HP Color LaserJet CM2320 MFP Series\hppfaxprintersrv.exe" [2009-09-22 3700736]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"*WerKernelReporting"="c:\windows\SYSTEM32\WerFault.exe" [2013-07-09 439488]

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

mLocal Page = c:\windows\SysWOW64\blank.htm

uSearchAssistant = hxxp://www.google.com

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: An OneNote s&enden - c:\progra~2\MI4066~1\Office14\ONBttnIE.dll/105

IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MI4066~1\Office14\EXCEL.EXE/3000

IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000

Trusted Zone: paypal.com

TCP: DhcpNameServer = 192.168.0.1

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

Wow6432Node-HKLM-Run-<NO NAME> - (no file)

AddRemove-AquaSoft DiaShow 7 Ultimate - c:\programdata\{C408D0B2-D2DE-46C9-9628-D4E335EC4EB6}\Setup.exe

AddRemove-Picasa 3 - e:\picasa3\Uninstall.exe

AddRemove-{2FAA2415-618E-4EC0-8253-3CDA076C84D6} - c:\programdata\{C408D0B2-D2DE-46C9-9628-D4E335EC4EB6}\Setup.exe

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]

@Denied: (A) (Everyone)

"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]

@Denied: (A) (Everyone)

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]

"Key"="ActionsPane3"

"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e96d-e325-11ce-bfc1-08002be10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

@SACL=(02 0000)

.

Zeit der Fertigstellung: 2013-09-29  21:50:12

ComboFix-quarantined-files.txt  2013-09-29 19:50

ComboFix2.txt  2013-09-29 18:41

.

Vor Suchlauf: 31 Verzeichnis(se), 22.968.066.048 Bytes frei

Nach Suchlauf: 32 Verzeichnis(se), 22.873.264.128 Bytes frei

.

- - End Of File - - 39B8FC94CD9BD9234DD355D57364A3EB

A36C5E4F47E84449FF07ED3517B43A31

Nein. Firefox kackt noch immer ab, wenn ich länger was daran mache bzw. bei mehreren Tabs.
Außerdem habe ich Mist gemacht. Als das Deinstallieren über die Systemsteuerung nicht ging hab ich aus Versehen Firefox aus der Liste der installierten Programme entfernt.

aharonov

29.09.2013 21:10

Gehen wir zuerst die Malware an.

Schritt 1

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

C:\Users\Tom\AppData\Local\temp\cvtres.exe

2013-09-13 09:28 - 2013-09-13 09:28 - 00274944 _____ C:\Users\Tom\AppData\lsass.exe

FF HKCU\...\Firefox\Extensions: [lrcsmonkey@lrcsmonkey.net] - C:\Program Files (x86)\Lyrics_Monkey\128.xpi

c:\users\Tom\AppData\Roaming\dclogs

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Dann den Rechner neu starten und ein frischen FRST-Log machen:

Schritt 2

Starte noch einmal FRST.

Ändere keine der Voreinstellungen und drücke auf Scan.
Wenn der Scan abgeschlossen ist, werden ein neues Logfile FRST.txt erstellt und auf dem Desktop gespeichert.
Poste den Inhalt dieses Logfiles bitte hier in deinen Thread.

Rupsi

29.09.2013 21:40

Hier Ergebnis Schritt 1:

Code:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 27-09-2013 02

Ran by Tom at 2013-09-29 22:15:42 Run:1

Running from C:\Users\Tom\Desktop\Trojan

Boot Mode: Normal

==============================================
 

Content of fixlist:

*****************

C:\Users\Tom\AppData\Local\temp\cvtres.exe

2013-09-13 09:28 - 2013-09-13 09:28 - 00274944 _____ C:\Users\Tom\AppData\lsass.exe

FF HKCU\...\Firefox\Extensions: [lrcsmonkey@lrcsmonkey.net] - C:\Program Files (x86)\Lyrics_Monkey\128.xpi

c:\users\Tom\AppData\Roaming\dclogs

         

*****************
 

C:\Users\Tom\AppData\Local\temp\cvtres.exe => Moved successfully.

C:\Users\Tom\AppData\lsass.exe => Moved successfully.

HKCU\Software\Mozilla\Firefox\Extensions\\lrcsmonkey@lrcsmonkey.net => Value not found.

c:\users\Tom\AppData\Roaming\dclogs => Moved successfully.
 
 

The system needs a manual reboot. 
 

==== End of Fixlog ====

Hier nun die Log-Datei:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-09-2013 02

Ran by Tom (ATTENTION: The logged in user is not administrator) on TOM_ADMIN-PC on 29-09-2013 22:36:59

Running from C:\Users\Tom\Desktop\Trojan

Windows 8 Pro (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) =================
 

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Mozilla Corporation) C:\Program Files (x86)\Firefox\firefox.exe

(Hewlett-Packard Company) C:\Program Files (x86)\HP\HP Color LaserJet CM2320 MFP Series\hppfaxprintersrv.exe

(Samsung) C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe

(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe

(InstallShield Software Corporation) C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe

(Hewlett-Packard Company) C:\Program Files (x86)\HP\HP UT\bin\hppusg.exe

(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13196432 2012-09-25] (Realtek Semiconductor)

HKLM\...\Run: [HP Color LaserJet CM2320 MFP Series Fax] - C:\Program Files (x86)\HP\HP Color LaserJet CM2320 MFP Series\hppfaxprintersrv.exe [3700736 2009-09-22] (Hewlett-Packard Company)

HKLM\...\RunOnce: [*WerKernelReporting] - %SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq [439488 2013-07-09] (Microsoft Corporation)

HKLM-x32\...\RunOnce: [Malwarebytes Anti-Malware] - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation)

HKCU\...\Run: [Java Updater] - C:\Users\Tom\AppData\lsass.exe

HKCU\...\Run: [] - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844656 2013-09-04] (Samsung)

HKLM-x32\...\Run: [BCSSync] - C:\Program Files (x86)\Microsoft Office2010\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)

HKLM-x32\...\Run: [EaseUS EPM tray] - C:\Program Files (x86)\EaseUS\EaseUS Partition Master 9.2.1 Home Edition\bin\EpmNews.exe [2086984 2012-11-29] (CHENGDU YIWO Tech Development Co., Ltd)

HKLM-x32\...\Run: [ISUSScheduler] - C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe [81920 2005-02-16] (InstallShield Software Corporation)

HKLM-x32\...\Run: [JMB36X IDE Setup] - C:\Windows\RaidTool\xInsIDE.exe [36864 2007-03-20] ()

HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [163000 2012-12-12] (Geek Software GmbH)

HKLM-x32\...\Run: [] - [x]

HKLM-x32\...\Run: [HPUsageTracking] - C:\Program Files (x86)\HP\HP UT\bin\hppusg.exe [24576 2009-05-11] (Hewlett-Packard Company)

HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)

HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)

HKLM-x32\...\Run: [Live Update 5] - C:\Program Files (x86)\MSI\Live Update 5\BootStartLiveupdate.exe [315392 2012-01-30] ()

HKLM-x32\...\Run: [KiesTrayAgent] - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311152 2013-09-04] (Samsung Electronics Co., Ltd.)

Startup: C:\Users\Tom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk

ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office2010\Office14\ONENOTEM.EXE (Microsoft Corporation)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.metager.de/

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x6EEDBAB406CCCD01

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snap.do/?publisher=SnapdoEMon&dpid=SnapdoEMon&co=DE&userid=dc45f073-fe67-455e-a3b8-5331ef50cad9&searchtype=ds&q={searchTerms}

SearchScopes: HKCU - {3BD44F0E-0596-4008-AEE0-45D47E3A8F0E} URL = 

BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office2010\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office2010\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: No Name - {DBC80044-A445-435b-BC74-9C25C1C588A9} -  No File

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 0.0.0.0
 

FireFox:

========

FF ProfilePath: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default

FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()

FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()

FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\WINDOWS\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf - f:\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)

FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf - f:\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)

FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - e:\Picasa3\npPicasa3.dll No File

FF Plugin-x32: @java.com/DTPlugin,version=1.6.0_35 - C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MI4066~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MI4066~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin-x32: @real.com/nppl3260;version=15.0.4.53 - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprjplug;version=15.0.4.53 - c:\program files (x86)\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprpchromebrowserrecordext;version=15.0.4.53 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprphtml5videoshim;version=15.0.4.53 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprpplugin;version=15.0.4.53 - c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Tom\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()

FF SearchPlugin: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\betabinariesnl.xml

FF SearchPlugin: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\eurobuchcom.xml

FF SearchPlugin: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\ixquick-http---deutsch.xml

FF SearchPlugin: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\mein-metager.xml

FF SearchPlugin: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\searchplugins-backup

FF SearchPlugin: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\startpage-https---deutsch.xml

FF Extension: Deutsches Wörterbuch - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\de-DE@dictionaries.addons.mozilla.org

FF Extension: Garmin Communicator - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}

FF Extension: EPUBReader - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\{5384767E-00D9-40E9-B72F-9CC39D655D6F}

FF Extension: Bitdefender QuickScan - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\{e001c731-5e37-4538-a5cb-8168736a2360}

FF Extension: No Name - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\Extensions.rdf

FF Extension: No Name - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\installed-extensions.txt

FF Extension: optout - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\optout@google.com.xpi

FF Extension: youtubeunblocker - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\youtubeunblocker@unblocker.yt.xpi

FF HKLM-x32\...\Firefox\Extensions: [{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext

FF Extension: RealPlayer Browser Record Plugin - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext

FF StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Firefox\firefox.exe
 

Chrome: 

=======

CHR HomePage: hxxp://www.google.com/

CHR DefaultSearchURL: (Google) - {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}

CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}

CHR Plugin: (Chrome PDF Viewer) - C:\Users\Tom\AppData\Local\Google\Chrome\Application\10.0.648.204\pdf.dll No File

CHR Plugin: (Google Gears 0.5.33.0) - C:\Users\Tom\AppData\Local\Google\Chrome\Application\10.0.648.204\gears.dll No File

CHR Plugin: (Shockwave Flash) - C:\Users\Tom\AppData\Local\Google\Chrome\Application\10.0.648.204\gcswf32.dll No File

CHR Plugin: (Foxit Reader Plugin for Mozilla) - C:\Program Files (x86)\Firefox\plugins\npFoxitReaderPlugin.dll (Foxit Software Company)

CHR Plugin: (2007 Microsoft Office system) - C:\Program Files (x86)\Firefox\plugins\NPOFF12.DLL (Microsoft Corporation)

CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

CHR Plugin: (Google Update) - C:\Users\Tom\AppData\Local\Google\Update\1.2.183.39\npGoogleOneClick8.dll No File

CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File

CHR Plugin: (Default Plug-in) - default_plugin No File

CHR HKLM-x32\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Ext\rphtml5video.crx

CHR HKLM-x32\...\Chrome\Extension: [ofnnlhbgdcabppjmlijllkhekcglbjlg] - C:\Program Files (x86)\Lyrics_Monkey\128.crx
 

==================== Services (Whitelisted) =================
 

R2 Garmin Core Update Service; C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [185688 2013-03-27] (Garmin Ltd or its subsidiaries)

R2 HPSLPSVC; C:\Users\Tom\AppData\Local\Temp\7zS3579\hpslpsvc64.dll [1039360 2012-11-14] (Hewlett-Packard Co.)

R2 lmhosts; C:\Windows\system32\svchost.exe [29696 2012-09-20] (Microsoft Corporation)

S3 Microsoft SharePoint Workspace Audit Service; C:\Program Files (x86)\Microsoft Office2010\Office14\GROOVE.EXE [30785672 2012-09-20] (Microsoft Corporation)

R2 MSMQ; C:\Windows\system32\mqsvc.exe [25088 2012-07-26] (Microsoft Corporation)

R2 NlaSvc; C:\Windows\System32\svchost.exe [29696 2012-09-20] (Microsoft Corporation)

R2 nsi; C:\Windows\system32\svchost.exe [29696 2012-09-20] (Microsoft Corporation)

R2 PMBDeviceInfoProvider; C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe [474168 2012-04-22] (Sony Corporation)

S2 SynoDrService; C:\Program Files (x86)\Synology Data Replicator  3\SynoDrServicex64.exe [380928 2010-06-02] ()

R2 TVGOnlineUpdateSvc; C:\Program Files (x86)\TVG\OnlineUpdate\OnlineUpdateSvc.exe [398128 2010-12-14] ()

R2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [471552 2012-07-26] (Microsoft Corporation)

R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)
 

==================== Drivers (Whitelisted) ====================
 

S3 androidusb; C:\Windows\System32\Drivers\androidusb.sys [32768 2010-04-29] (Google Inc)

S3 DigiartyVirtualCDBus; C:\Windows\System32\drivers\DigiartyVirtualCDBus.sys [276256 2013-08-28] (Digiarty Software, Inc.)

R2 easycvfs; C:\WINDOWS\system32\drivers\easycvfs.sys [109960 2009-11-09] ()

S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [17480 2012-12-21] ()

S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [17480 2012-12-21] ()

S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9800 2012-12-21] ()

S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9800 2012-12-21] ()

R1 HWiNFO32; C:\Program Files (x86)\HWiNFO32\HWiNFO64A.SYS [29288 2009-05-21] (REALiX(tm))

R1 HWiNFO32; C:\Program Files (x86)\HWiNFO32\HWiNFO64A.SYS [29288 2009-05-21] (REALiX(tm))

R3 MQAC; C:\Windows\System32\drivers\mqac.sys [185856 2012-07-26] (Microsoft Corporation)

S1 NNSNAHSL; C:\Windows\System32\DRIVERS\NNSNAHSL.sys [33320 2012-10-22] (Panda Security, S.L.)

S3 NTIOLib_1_0_4; C:\Program Files (x86)\MSI\Live Update 5\NTIOLib_X64.sys [14136 2010-10-22] (MSI)

S3 NTIOLib_1_0_4; C:\Program Files (x86)\MSI\Live Update 5\NTIOLib_X64.sys [14136 2010-10-22] (MSI)

S3 NTIOLib_1_0_6; C:\Program Files (x86)\Setup Files\Ms7586v1B0\NTIOLib_X64.sys [11888 2011-01-06] (MSI)

S3 NTIOLib_1_0_6; C:\Program Files (x86)\Setup Files\Ms7586v1B0\NTIOLib_X64.sys [11888 2011-01-06] (MSI)

R3 seehcri; C:\Windows\System32\drivers\seehcri.sys [34032 2008-01-09] (Sony Ericsson Mobile Communications)

R3 SKYNET; C:\Windows\system32\DRIVERS\SkyNET_AMD64.SYS [615440 2009-09-11] (TechniSat Digital, S.A.)

S4 sptd; C:\Windows\System32\Drivers\sptd.sys [828912 2011-08-16] (Duplex Secure Ltd.)

S3 vvftav; C:\Windows\System32\drivers\vvftav.sys [300800 2007-02-02] (Vimicro Corporation)

S3 ZSMC0305; C:\Windows\System32\Drivers\usbVM305.sys [1541120 2007-03-08] (Vimicro Corporation)

S3 catchme; \??\C:\ComboFix\catchme.sys [x]

U3 idsvc; 

S3 MSI_MSIBIOS_010507; \??\C:\Program Files (x86)\MSI\Live Update 5\msibios64_100507.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-09-29 22:31 - 2013-09-29 22:33 - 00000387 _____ C:\DeQuarantine.txt

2013-09-29 22:30 - 2013-09-29 22:31 - 00000000 ___SD C:\ComboFix

2013-09-29 21:13 - 2013-09-29 21:13 - 22537616 _____ (Mozilla) C:\Users\Tom\Downloads\Firefox Setup 24.0.exe

2013-09-29 20:22 - 2013-09-29 20:22 - 05130789 _____ (Swearware) C:\Users\Tom\Downloads\ComboFix.exe

2013-09-29 17:49 - 2013-09-29 22:36 - 00000000 ____D C:\Users\Tom\Desktop\Trojan

2013-09-29 16:47 - 2013-09-29 16:47 - 00001125 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-09-29 16:47 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys

2013-09-29 14:13 - 2013-09-29 22:31 - 00000000 ____D C:\Qoobox

2013-09-29 14:13 - 2013-09-29 20:38 - 00000000 ____D C:\WINDOWS\erdnt

2013-09-29 14:13 - 2011-06-26 08:45 - 00256000 _____ C:\WINDOWS\PEV.exe

2013-09-29 14:13 - 2010-11-07 19:20 - 00208896 _____ C:\WINDOWS\MBR.exe

2013-09-29 14:13 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\WINDOWS\SWREG.exe

2013-09-29 14:13 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\WINDOWS\SWSC.exe

2013-09-29 14:13 - 2000-08-31 02:00 - 00212480 _____ (SteelWerX) C:\WINDOWS\SWXCACLS.exe

2013-09-29 14:13 - 2000-08-31 02:00 - 00098816 _____ C:\WINDOWS\sed.exe

2013-09-29 14:13 - 2000-08-31 02:00 - 00080412 _____ C:\WINDOWS\grep.exe

2013-09-29 14:13 - 2000-08-31 02:00 - 00068096 _____ C:\WINDOWS\zip.exe

2013-09-29 14:07 - 2013-09-29 21:41 - 05130789 ____R (Swearware) C:\Users\Tom\Desktop\ComboFix.exe

2013-09-29 14:01 - 2013-09-29 22:15 - 00000000 ____D C:\FRST

2013-09-27 14:21 - 2013-09-27 14:21 - 00000000 ____D C:\Users\Tom\Documents\SelfMV

2013-09-27 14:10 - 2013-09-27 14:10 - 00002018 _____ C:\Users\Public\Desktop\Samsung Kies (Lite).lnk

2013-09-27 14:10 - 2013-09-27 14:10 - 00002008 _____ C:\Users\Public\Desktop\Samsung Kies.lnk

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\WINDOWS\LastGood.Tmp

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Tom\Documents\samsung

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Tom\AppData\Roaming\Samsung

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Tom\AppData\Local\Samsung

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Public\Documents\NativeFus_Log

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Public\Documents\CrashDump

2013-09-27 14:08 - 2013-09-27 14:08 - 00000000 ____D C:\Program Files (x86)\MyFree Codec

2013-09-27 14:05 - 2013-09-27 14:09 - 00000000 ____D C:\ProgramData\Samsung

2013-09-27 14:05 - 2013-09-27 14:09 - 00000000 ____D C:\Program Files (x86)\Samsung

2013-09-27 14:05 - 2013-07-18 14:33 - 04659712 _____ (Dmitry Streblechenko) C:\WINDOWS\SysWOW64\Redemption.dll

2013-09-27 14:05 - 2013-07-18 14:32 - 00821824 _____ (Devguru Co., Ltd.) C:\WINDOWS\SysWOW64\dgderapi.dll

2013-09-27 13:59 - 2013-09-27 13:59 - 00001059 _____ C:\Users\Public\Desktop\DriverTuner.lnk

2013-09-27 13:59 - 2013-09-27 13:59 - 00000000 ____D C:\Program Files (x86)\DriverTuner

2013-09-27 13:54 - 2013-09-27 13:54 - 00000000 ____D C:\Users\Tom\.android

2013-09-26 10:35 - 2013-09-26 10:35 - 00000103 _____ C:\WINDOWS\ParrotFlashWiz.INI

2013-09-26 10:33 - 2013-09-26 10:33 - 00000000 ____D C:\Program Files (x86)\Parrot Software Update Tool

2013-09-23 11:12 - 2013-09-23 11:12 - 1285878931 _____ C:\WINDOWS\MEMORY.DMP

2013-09-16 20:47 - 2013-08-07 07:15 - 00144896 _____ (Microsoft Corporation) C:\WINDOWS\system32\tssdisai.dll

2013-09-15 13:06 - 2013-09-15 13:07 - 00531240 _____ C:\WINDOWS\system32\FNTCACHE.DAT

2013-09-15 10:43 - 2013-09-29 22:34 - 00009676 _____ C:\WINDOWS\PFRO.log

2013-09-14 17:15 - 2013-09-29 22:34 - 00296799 _____ C:\WINDOWS\setupact.log

2013-09-14 17:15 - 2013-09-14 17:15 - 00000000 _____ C:\WINDOWS\setuperr.log

2013-09-13 10:57 - 2013-09-29 22:31 - 02001767 _____ C:\WINDOWS\WindowsUpdate.log

2013-09-13 09:24 - 2013-08-16 07:41 - 00058200 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dam.sys

2013-09-13 09:24 - 2013-08-16 07:39 - 02371728 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSService.dll

2013-09-13 09:24 - 2013-08-16 07:39 - 00059416 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe

2013-09-13 09:24 - 2013-08-16 07:32 - 00209200 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationUI.exe

2013-09-13 09:24 - 2013-08-16 07:22 - 04917760 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppsvc.exe

2013-09-13 09:24 - 2013-08-16 07:22 - 00040448 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe

2013-09-13 09:24 - 2013-08-16 07:21 - 03275776 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 01621504 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 01164288 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00773120 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00688640 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00368640 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppwinob.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00252416 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00204800 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSClient.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00183808 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSSync.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00174592 _____ (Microsoft Corporation) C:\WINDOWS\system32\storewuauth.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00163840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00142848 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00120320 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppc.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00099328 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00081408 _____ (Microsoft Corporation) C:\WINDOWS\system32\setupcln.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00049664 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00049152 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups2.dll

2013-09-13 09:24 - 2013-08-16 07:20 - 00105984 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinSetupUI.dll

2013-09-13 09:24 - 2013-08-16 00:43 - 00628736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll

2013-09-13 09:24 - 2013-08-16 00:43 - 00562688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll

2013-09-13 09:24 - 2013-08-16 00:43 - 00167424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSClient.dll

2013-09-13 09:24 - 2013-08-16 00:43 - 00159232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSSync.dll

2013-09-13 09:24 - 2013-08-16 00:43 - 00143872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.dll

2013-09-13 09:24 - 2013-08-16 00:43 - 00126976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll

2013-09-13 09:24 - 2013-08-16 00:43 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll

2013-09-13 09:24 - 2013-08-16 00:43 - 00084992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll

2013-09-13 09:24 - 2013-08-16 00:43 - 00083968 _____ C:\WINDOWS\SysWOW64\OEMLicense.dll

2013-09-13 09:24 - 2013-08-16 00:43 - 00035328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe

2013-09-13 09:24 - 2013-08-16 00:43 - 00020992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wups.dll

2013-09-13 09:24 - 2013-08-16 00:42 - 00091648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sppc.dll

2013-09-13 09:24 - 2013-08-16 00:42 - 00076800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\setupcln.dll

2013-09-13 09:23 - 2013-08-21 06:12 - 02241024 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll

2013-09-13 09:23 - 2013-08-21 06:12 - 00051712 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe

2013-09-13 09:23 - 2013-08-21 06:11 - 19246592 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 15404544 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 03959296 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 02647040 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 01365504 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 00915968 _____ (Microsoft Corporation) C:\WINDOWS\system32\uxtheme.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 00855552 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 00603136 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 00136704 _____ (Microsoft Corporation) C:\WINDOWS\system32\iesysprep.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 00067072 _____ (Microsoft Corporation) C:\WINDOWS\system32\iesetup.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 00053760 _____ (Microsoft Corporation) C:\WINDOWS\system32\UXInit.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 00053760 _____ (Microsoft Corporation) C:\WINDOWS\system32\jsproxy.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 00039936 _____ (Microsoft Corporation) C:\WINDOWS\system32\iernonce.dll

2013-09-13 09:23 - 2013-08-21 04:34 - 02706432 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.tlb

2013-09-13 09:23 - 2013-08-21 04:06 - 01767936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll

2013-09-13 09:23 - 2013-08-21 04:06 - 01141248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll

2013-09-13 09:23 - 2013-08-21 04:06 - 00044032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UXInit.dll

2013-09-13 09:23 - 2013-08-21 04:05 - 14332928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll

2013-09-13 09:23 - 2013-08-21 04:05 - 13761024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll

2013-09-13 09:23 - 2013-08-21 04:05 - 02876928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll

2013-09-13 09:23 - 2013-08-21 04:05 - 02048000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll

2013-09-13 09:23 - 2013-08-21 04:05 - 00690688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll

2013-09-13 09:23 - 2013-08-21 04:05 - 00493056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll

2013-09-13 09:23 - 2013-08-21 04:05 - 00109056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iesysprep.dll

2013-09-13 09:23 - 2013-08-21 04:05 - 00061440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iesetup.dll

2013-09-13 09:23 - 2013-08-21 04:05 - 00039936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jsproxy.dll

2013-09-13 09:23 - 2013-08-21 04:05 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iernonce.dll

2013-09-13 09:23 - 2013-08-21 03:43 - 02706432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.tlb

2013-09-13 09:23 - 2013-08-21 01:52 - 00534528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\uxtheme.dll

2013-09-13 09:23 - 2013-08-03 06:30 - 04038144 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys

2013-09-12 22:38 - 2013-09-12 22:38 - 00001604 _____ C:\Users\Public\Desktop\Angry Birds Star Wars.lnk

2013-09-11 21:10 - 2013-07-09 10:04 - 00120144 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\msgpioclx.sys

2013-09-11 21:10 - 2013-07-09 08:18 - 00439488 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe

2013-09-11 21:10 - 2013-07-09 06:25 - 00385768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe

2013-09-11 21:10 - 2013-07-09 00:46 - 00414208 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanconn.dll

2013-09-11 21:10 - 2013-07-09 00:46 - 00370688 _____ (Microsoft Corporation) C:\WINDOWS\system32\Wwanadvui.dll

2013-09-11 21:10 - 2013-07-06 02:16 - 01025024 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll

2013-09-11 21:10 - 2013-07-03 02:23 - 00778752 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleaut32.dll

2013-09-11 21:10 - 2013-07-03 02:22 - 02839552 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll

2013-09-11 21:10 - 2013-07-03 02:22 - 01300480 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32.dll

2013-09-11 21:10 - 2013-07-03 02:11 - 00551424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleaut32.dll

2013-09-11 21:10 - 2013-07-03 02:11 - 00268800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.BackgroundTransfer.dll

2013-09-11 21:10 - 2013-07-03 02:10 - 02273792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll

2013-09-11 21:10 - 2013-06-29 08:15 - 00195416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys

2013-09-11 21:10 - 2013-06-29 08:15 - 00125784 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpsd.sys

2013-09-11 21:10 - 2013-06-29 07:43 - 00327512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Classpnp.sys

2013-09-11 21:10 - 2013-06-25 00:54 - 00447488 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll

2013-09-11 21:10 - 2013-06-25 00:54 - 00263680 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmsvc.dll

2013-09-11 21:10 - 2013-06-25 00:54 - 00074240 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmcsp.dll

2013-09-11 21:10 - 2013-06-19 07:36 - 00183808 _____ (Microsoft Corporation) C:\WINDOWS\system32\winmmbase.dll

2013-09-11 21:10 - 2013-06-19 07:36 - 00115712 _____ (Microsoft Corporation) C:\WINDOWS\system32\winmm.dll

2013-09-11 21:10 - 2013-06-19 00:38 - 00160256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmmbase.dll

2013-09-11 21:10 - 2013-06-19 00:38 - 00125440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmm.dll

2013-09-11 21:10 - 2013-06-12 01:26 - 00230912 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinSCard.dll

2013-09-11 21:10 - 2013-06-10 23:17 - 00096512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wfplwfs.sys

2013-09-11 21:10 - 2013-06-10 21:15 - 01156096 _____ (Microsoft Corporation) C:\WINDOWS\system32\IKEEXT.DLL

2013-09-11 21:10 - 2013-06-10 21:15 - 00723968 _____ (Microsoft Corporation) C:\WINDOWS\system32\BFE.DLL

2013-09-11 21:10 - 2013-06-10 21:15 - 00381952 _____ (Microsoft Corporation) C:\WINDOWS\system32\FWPUCLNT.DLL

2013-09-11 21:10 - 2013-06-06 10:03 - 00119040 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBSTOR.SYS

2013-09-11 21:09 - 2013-07-09 05:57 - 00245760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LocationApi.dll

2013-09-11 21:09 - 2013-07-09 00:46 - 00543744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanmm.dll

2013-09-11 21:09 - 2013-07-09 00:45 - 00312832 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationApi.dll

2013-09-11 21:09 - 2013-07-03 02:23 - 00391168 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.BackgroundTransfer.dll

2013-09-11 21:09 - 2013-07-02 00:08 - 00387583 _____ C:\WINDOWS\system32\ApnDatabase.xml

2013-09-11 21:09 - 2013-07-01 00:30 - 00067072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\openfiles.exe

2013-09-11 21:09 - 2013-07-01 00:29 - 00077312 _____ (Microsoft Corporation) C:\WINDOWS\system32\openfiles.exe

2013-09-11 21:09 - 2013-06-29 03:12 - 01022464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32.dll

2013-09-11 21:09 - 2013-06-26 05:01 - 00321536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\udfs.sys

2013-09-11 21:09 - 2013-06-12 01:43 - 00154112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinSCard.dll

2013-09-11 21:09 - 2013-06-10 21:16 - 00888832 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshwfp.dll

2013-09-11 21:09 - 2013-06-10 21:10 - 00702464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nshwfp.dll

2013-09-11 21:09 - 2013-06-10 21:10 - 00245248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FWPUCLNT.DLL

2013-09-11 21:09 - 2013-04-03 01:37 - 00025088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cryptdlg.dll

2013-09-11 21:09 - 2013-04-03 01:12 - 00030720 _____ (Microsoft Corporation) C:\WINDOWS\system32\cryptdlg.dll

2013-09-11 21:09 - 2013-03-22 05:49 - 02382336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\esent.dll

2013-09-11 21:09 - 2013-03-22 00:47 - 02851840 _____ (Microsoft Corporation) C:\WINDOWS\system32\esent.dll

2013-09-11 21:09 - 2013-03-02 10:23 - 00375808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ReAgent.dll

2013-09-11 21:09 - 2013-03-02 04:44 - 01011200 _____ (Microsoft Corporation) C:\WINDOWS\system32\reseteng.dll

2013-09-11 21:09 - 2012-12-15 06:55 - 00443392 _____ (Microsoft Corporation) C:\WINDOWS\system32\ReAgent.dll

2013-09-11 21:09 - 2012-11-03 07:26 - 00132096 _____ (Microsoft Corporation) C:\WINDOWS\system32\sysreset.exe

2013-09-11 21:09 - 2012-11-03 07:25 - 00945152 _____ (Microsoft Corporation) C:\WINDOWS\system32\resetengmig.dll

2013-09-11 21:09 - 2012-10-24 05:25 - 00026624 _____ (Microsoft Corporation) C:\WINDOWS\system32\ReAgentc.exe

2013-09-11 21:09 - 2012-10-24 05:25 - 00013312 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcalua.exe

2013-09-11 21:09 - 2012-10-24 05:24 - 00405504 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcasvc.dll

2013-09-11 21:09 - 2012-10-24 05:24 - 00031232 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcadm.dll

2013-09-11 21:09 - 2012-10-24 05:05 - 00011776 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcaevts.dll

2013-09-11 21:09 - 2012-10-24 04:48 - 00024064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ReAgentc.exe

2013-09-09 10:23 - 2013-06-09 21:59 - 00216064 _____ C:\WINDOWS\SysWOW64\gcapi_dll.dll

2013-09-01 16:29 - 2013-09-01 16:29 - 00000000 ____D C:\WINDOWS\SysWOW64\fstrainer2011

2013-09-01 16:29 - 2008-01-03 19:19 - 00581632 _____ (Adobe Systems, Inc.) C:\WINDOWS\SysWOW64\Control.dll

2013-09-01 16:29 - 2004-12-07 10:09 - 00347136 _____ C:\WINDOWS\SysWOW64\unicows.pdb

2013-09-01 16:29 - 2004-08-04 07:21 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msado27.tlb

2013-09-01 16:29 - 2004-03-08 21:00 - 00152848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comdlg32.ocx

2013-09-01 14:49 - 2013-09-09 10:36 - 00000942 _____ C:\Users\Public\Desktop\calibre 64bit - E-book management.lnk

2013-09-01 14:49 - 2013-09-09 10:36 - 00000000 ____D C:\Program Files\Calibre2

2013-09-01 14:49 - 2013-09-01 18:42 - 00000000 ____D C:\Users\Tom\AppData\Local\calibre-cache

2013-08-30 16:11 - 2013-08-30 16:11 - 00000000 ____D C:\Users\TomAdminPW_Ur\AppData\Roaming\Apple Computer
 

==================== One Month Modified Files and Folders =======
 

2013-09-29 22:36 - 2013-09-29 17:49 - 00000000 ____D C:\Users\Tom\Desktop\Trojan

2013-09-29 22:36 - 2009-07-14 04:34 - 00001106 _____ C:\WINDOWS\win.ini

2013-09-29 22:34 - 2013-09-15 10:43 - 00009676 _____ C:\WINDOWS\PFRO.log

2013-09-29 22:34 - 2013-09-14 17:15 - 00296799 _____ C:\WINDOWS\setupact.log

2013-09-29 22:34 - 2013-01-02 02:50 - 00000000 ____D C:\ProgramData\NVIDIA

2013-09-29 22:34 - 2012-07-26 09:22 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT

2013-09-29 22:33 - 2013-09-29 22:31 - 00000387 _____ C:\DeQuarantine.txt

2013-09-29 22:31 - 2013-09-29 22:30 - 00000000 ___SD C:\ComboFix

2013-09-29 22:31 - 2013-09-29 14:13 - 00000000 ____D C:\Qoobox

2013-09-29 22:31 - 2013-09-13 10:57 - 02001767 _____ C:\WINDOWS\WindowsUpdate.log

2013-09-29 22:31 - 2013-08-17 10:39 - 00000000 ____D C:\Program Files (x86)\Firefox

2013-09-29 22:21 - 2012-08-15 10:55 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job

2013-09-29 22:15 - 2013-09-29 14:01 - 00000000 ____D C:\FRST

2013-09-29 21:47 - 2012-07-26 07:26 - 00000215 _____ C:\WINDOWS\system.ini

2013-09-29 21:41 - 2013-09-29 14:07 - 05130789 ____R (Swearware) C:\Users\Tom\Desktop\ComboFix.exe

2013-09-29 21:13 - 2013-09-29 21:13 - 22537616 _____ (Mozilla) C:\Users\Tom\Downloads\Firefox Setup 24.0.exe

2013-09-29 21:00 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\system32\sru

2013-09-29 20:38 - 2013-09-29 14:13 - 00000000 ____D C:\WINDOWS\erdnt

2013-09-29 20:22 - 2013-09-29 20:22 - 05130789 _____ (Swearware) C:\Users\Tom\Downloads\ComboFix.exe

2013-09-29 17:50 - 2012-07-26 12:27 - 00863478 _____ C:\WINDOWS\system32\perfh007.dat

2013-09-29 17:50 - 2012-07-26 12:27 - 00197036 _____ C:\WINDOWS\system32\perfc007.dat

2013-09-29 17:50 - 2012-07-26 09:28 - 02029610 _____ C:\WINDOWS\system32\PerfStringBackup.INI

2013-09-29 17:44 - 2013-08-25 14:40 - 00000000 ____D C:\Program Files (x86)\MyPC Backup

2013-09-29 17:35 - 2013-06-01 13:54 - 00000000 ____D C:\Users\Tom\Desktop\Calibre

2013-09-29 16:47 - 2013-09-29 16:47 - 00001125 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-09-29 16:47 - 2012-09-09 20:42 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-09-29 16:16 - 2013-01-02 02:54 - 00000000 ____D C:\Users\Tom_Admin

2013-09-27 17:54 - 2013-02-26 22:16 - 00000000 ____D C:\Users\Tom\AppData\Roaming\Simple Sudoku

2013-09-27 17:20 - 2013-03-18 16:32 - 00013213 _____ C:\Users\Tom\Desktop\Wasserverbrauch.xlsx

2013-09-27 17:10 - 2013-03-18 16:19 - 00015297 _____ C:\Users\Tom\Desktop\Stromverbrauch.xlsx

2013-09-27 14:41 - 2012-12-02 22:30 - 00000000 ____D C:\Users\Tom\AppData\Roaming\MyPhoneExplorer

2013-09-27 14:21 - 2013-09-27 14:21 - 00000000 ____D C:\Users\Tom\Documents\SelfMV

2013-09-27 14:10 - 2013-09-27 14:10 - 00002018 _____ C:\Users\Public\Desktop\Samsung Kies (Lite).lnk

2013-09-27 14:10 - 2013-09-27 14:10 - 00002008 _____ C:\Users\Public\Desktop\Samsung Kies.lnk

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\WINDOWS\LastGood.Tmp

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Tom\Documents\samsung

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Tom\AppData\Roaming\Samsung

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Tom\AppData\Local\Samsung

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Public\Documents\NativeFus_Log

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Public\Documents\CrashDump

2013-09-27 14:09 - 2013-09-27 14:05 - 00000000 ____D C:\ProgramData\Samsung

2013-09-27 14:09 - 2013-09-27 14:05 - 00000000 ____D C:\Program Files (x86)\Samsung

2013-09-27 14:08 - 2013-09-27 14:08 - 00000000 ____D C:\Program Files (x86)\MyFree Codec

2013-09-27 14:05 - 2010-01-24 03:50 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information

2013-09-27 13:59 - 2013-09-27 13:59 - 00001059 _____ C:\Users\Public\Desktop\DriverTuner.lnk

2013-09-27 13:59 - 2013-09-27 13:59 - 00000000 ____D C:\Program Files (x86)\DriverTuner

2013-09-27 13:54 - 2013-09-27 13:54 - 00000000 ____D C:\Users\Tom\.android

2013-09-27 13:54 - 2013-01-02 02:54 - 00000000 ____D C:\Users\Tom

2013-09-27 13:54 - 2012-12-02 22:30 - 00002073 _____ C:\Users\Public\Desktop\MyPhoneExplorer.lnk

2013-09-27 13:54 - 2012-12-02 22:30 - 00000000 ____D C:\Program Files (x86)\MyPhoneExplorer

2013-09-26 11:47 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\AUInstallAgent

2013-09-26 10:35 - 2013-09-26 10:35 - 00000103 _____ C:\WINDOWS\ParrotFlashWiz.INI

2013-09-26 10:33 - 2013-09-26 10:33 - 00000000 ____D C:\Program Files (x86)\Parrot Software Update Tool

2013-09-25 17:58 - 2011-03-22 23:38 - 00000000 ____D C:\Users\Tom\AppData\Roaming\Foxit Software

2013-09-23 11:12 - 2013-09-23 11:12 - 1285878931 _____ C:\WINDOWS\MEMORY.DMP

2013-09-23 11:12 - 2013-01-12 07:48 - 00000000 ____D C:\WINDOWS\Minidump

2013-09-19 01:26 - 2013-01-10 23:02 - 00694232 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe

2013-09-19 01:26 - 2013-01-10 23:02 - 00078296 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl

2013-09-18 16:22 - 2013-06-05 11:18 - 00322048 ___SH C:\Users\Tom\Desktop\Thumbs.db

2013-09-18 16:22 - 2013-02-06 22:20 - 00000000 ____D C:\Users\Tom\Desktop\KabelBW

2013-09-15 15:57 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\rescache

2013-09-15 15:38 - 2013-02-23 11:24 - 00000586 _____ C:\Users\Public\Desktop\mkvmerge GUI.lnk

2013-09-15 13:07 - 2013-09-15 13:06 - 00531240 _____ C:\WINDOWS\system32\FNTCACHE.DAT

2013-09-15 01:14 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\WinStore

2013-09-15 01:14 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\PolicyDefinitions

2013-09-15 00:05 - 2010-06-01 00:58 - 00000000 ____D C:\Users\Tom\AppData\Local\QuickPar

2013-09-14 17:15 - 2013-09-14 17:15 - 00000000 _____ C:\WINDOWS\setuperr.log

2013-09-14 11:57 - 2010-06-01 01:01 - 00018944 _____ C:\Users\Tom\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2013-09-14 03:02 - 2010-05-09 20:21 - 00000000 ____D C:\ProgramData\Microsoft Help

2013-09-13 11:06 - 2013-08-19 11:05 - 00000000 ____D C:\WINDOWS\system32\MRT

2013-09-13 11:03 - 2009-10-14 07:12 - 79143768 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe

2013-09-13 09:58 - 2013-08-25 14:42 - 00000834 _____ C:\Users\Public\Desktop\CCleaner.lnk

2013-09-13 09:58 - 2013-08-25 14:42 - 00000000 ____D C:\Program Files\CCleaner

2013-09-13 09:05 - 2012-07-26 07:38 - 00000000 ____D C:\WINDOWS\system32\oobe

2013-09-12 22:38 - 2013-09-12 22:38 - 00001604 _____ C:\Users\Public\Desktop\Angry Birds Star Wars.lnk

2013-09-12 22:38 - 2013-07-05 12:47 - 00000000 ____D C:\Users\Tom\AppData\Roaming\Rovio Entertainment Ltd

2013-09-10 15:45 - 2013-05-04 21:34 - 00000000 ____D C:\Users\Tom\Documents\Settlers7

2013-09-09 10:36 - 2013-09-01 14:49 - 00000942 _____ C:\Users\Public\Desktop\calibre 64bit - E-book management.lnk

2013-09-09 10:36 - 2013-09-01 14:49 - 00000000 ____D C:\Program Files\Calibre2

2013-09-02 16:17 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\system32\NDF

2013-09-01 18:42 - 2013-09-01 14:49 - 00000000 ____D C:\Users\Tom\AppData\Local\calibre-cache

2013-09-01 16:29 - 2013-09-01 16:29 - 00000000 ____D C:\WINDOWS\SysWOW64\fstrainer2011

2013-09-01 16:29 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\SysWOW64\Macromed

2013-09-01 16:29 - 2012-07-10 13:44 - 00000000 ____D C:\WINDOWS\SysWOW64\Adobe

2013-09-01 14:41 - 2013-02-17 20:48 - 00000000 ____D C:\Users\TomAdminPW_Ur\AppData\Roaming\SpeedProject

2013-08-30 16:11 - 2013-08-30 16:11 - 00000000 ____D C:\Users\TomAdminPW_Ur\AppData\Roaming\Apple Computer
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

diese Datei hatte ich vorhin nicht gepostet:
DeQuarantine.txt

Code:

C:\Qoobox\Quarantine\C\program files (x86)\FireFox\plugin-container.exe -> C:\program files (x86)\FireFox\plugin-container.exe

C:\Qoobox\Quarantine\C\program files (x86)\FireFox\updater.exe -> C:\program files (x86)\FireFox\updater.exe

C:\Qoobox\Quarantine\C\program files (x86)\FireFox\uninstall\helper.exe -> C:\program files (x86)\FireFox\uninstall\helper.exe

3 Datei(en) kopiert

So. Nu erst mit dem Hund raus und Nikotin auftanken

aharonov

29.09.2013 22:18

Ok, dann weiter:

Schritt 1

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snap.do/?publisher=SnapdoEMon&dpid=SnapdoEMon&co=DE&userid=dc45f073-fe67-455e-a3b8-5331ef50cad9&searchtype=ds&q={searchTerms}

HKCU\...\Run: [Java Updater] - C:\Users\Tom\AppData\lsass.exe

C:\Users\Tom\AppData\Local\temp\cvtres.exe

C:\Users\Tom\AppData\lsass.exe

c:\users\Tom\AppData\Roaming\dclogs

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Schritt 2

Öffne das Programm Malwarebytes Anti-Malware.
Vista und Win7 User mit Rechtsklick "als Administrator starten".
Klicke auf Aktualisierung --> Suche nach Aktualisierung.
Wenn das Update beendet wurde, aktiviere im Reiter Suchlauf die Option Quick-Scan durchführen und drücke auf Scannen.
Wenn der Scan fertig ist, klicke auf Ergebnisse anzeigen.
Versichere dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
Poste das Logfile, welches sich in Notepad öffnet, hier in den Thread.
Nachträglich kannst du den Bericht unter dem Reiter Logdateien finden.

Schritt 3

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Schritt 4

Starte noch einmal FRST.

Ändere keine der Voreinstellungen und drücke auf Scan.
Wenn der Scan abgeschlossen ist, werden ein neues Logfile FRST.txt erstellt und auf dem Desktop gespeichert.
Poste den Inhalt dieses Logfiles bitte hier in deinen Thread.

Rupsi

30.09.2013 19:27

Schritt 1:

Code:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 27-09-2013 02

Ran by Tom at 2013-09-29 23:23:39 Run:2

Running from C:\Users\Tom\Desktop\Trojan

Boot Mode: Normal

==============================================
 

Content of fixlist:

*****************

SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snap.do/?publisher=SnapdoEMon&dpid=SnapdoEMon&co=DE&userid=dc45f073-fe67-455e-a3b8-5331ef50cad9&searchtype=ds&q={searchTerms}

HKCU\...\Run: [Java Updater] - C:\Users\Tom\AppData\lsass.exe

C:\Users\Tom\AppData\Local\temp\cvtres.exe

C:\Users\Tom\AppData\lsass.exe

c:\users\Tom\AppData\Roaming\dclogs

*****************
 

HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5} => Key deleted successfully.

HKCR\CLSID\{006ee092-9658-4fd6-bd8e-a21a348e59f5} => Key not found.

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\Java Updater => Value deleted successfully.

"C:\Users\Tom\AppData\Local\temp\cvtres.exe" => File/Directory not found.

"C:\Users\Tom\AppData\lsass.exe" => File/Directory not found.

"c:\users\Tom\AppData\Roaming\dclogs" => File/Directory not found.
 

==== End of Fixlog ====

mbam:

Code:

Malwarebytes Anti-Malware 1.75.0.1300

www.malwarebytes.org
 

Datenbank Version: v2013.09.29.05
 

Windows 8 x64 NTFS

Internet Explorer 10.0.9200.16688

Tom :: TOM_ADMIN-PC [limitiert]
 

29.09.2013 23:25:37

mbam-log-2013-09-29 (23-25-37).txt
 

Art des Suchlaufs: Quick-Scan

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 221351

Laufzeit: 3 Minute(n), 30 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 2

HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C} (PUP.Optional.OptimzerPro.A) -> Löschen bei Neustart.

HKCU\Software\DC3_FEXEC (Malware.Trace) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

Da erst nach einem Neustart alles gelöscht wird erfolgt nun erst ein Neustart.

Zu 3.
Der Scan läuft nun wohl noch 1-1,5 Std. Ich lass den PC alleine ackern und hau mich auf`s Ohr (4:45 h Nacht zuende).

Bis hier her erst einmal ganz lieben, herzlichen Dank!!

Schritt 3: ESET-Log

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6920

# api_version=3.0.2

# EOSSerial=59c1ace9a4d19d449514a5fd8c2cb5e1

# engine=15302

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=false

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2013-09-29 11:57:29

# local_time=2013-09-30 01:57:29 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.2.9200 NT 

# compatibility_mode=3074 16777214 16 15 23417772 70631321 0 0

# compatibility_mode=5893 16776573 100 94 26658 7782524 0 0

# scanned=351837

# found=10

# cleaned=0

# scan_time=8426

sh=CD8B4796CA9DFA8926CB9A8AB5A1A1E4F944AB70 ft=1 fh=27ebe4af9c61e471 vn="a variant of MSIL/Kryptik.KQ trojan" ac=I fn="C:\FRST\Quarantine\lsass.exe"

sh=034BE991CB00B240F574CF8B7F0B1F407B1FD9B8 ft=1 fh=d540e00c2c6e80d8 vn="probably a variant of Win32/Adware.Yontoo.B application" ac=I fn="L:\AdwCleaner\Quarantine\C\ProgramData\Tarma Installer\{C4ED781C-7394-4906-AAFF-D6AB64FF7C38}\_Setupx.dll.vir"

sh=6E917FE022664F855BAF1E83136A6F5F6B3A1315 ft=0 fh=0000000000000000 vn="a variant of Android/Adware.AirPush.G application" ac=I fn="L:\Download\Android\3DSoundsAndRingtones-v1.0.apk"

sh=F6F1D90F4DF26923C66F70FF38AF3796E6119D53 ft=0 fh=0000000000000000 vn="a variant of Android/Plankton.I trojan" ac=I fn="L:\Download\Android\Alkometer.apk"

sh=CF25B631DCB1DC6B424577470802A2D05CC77F81 ft=0 fh=0000000000000000 vn="a variant of Android/Adware.AirPush.G application" ac=I fn="L:\Download\Android\OldPhoneRingtones1.0.apk"

sh=DDF970CA8A6BF1A33508CEEEE223D6A2C688B853 ft=0 fh=0000000000000000 vn="a variant of Android/Plankton.I trojan" ac=I fn="L:\Download\Android\pandas-vs-ninjas-v1.25.apk"

sh=A4856CAE33FA7A377AAAA01C7649CDB8B34DF42E ft=0 fh=0000000000000000 vn="a variant of Android/Adware.AirPush.G application" ac=I fn="L:\Download\Android\Popular Ringtones.apk"

sh=9855E1E4EE485DE6EDA443CA1837C9ECFE1AD08D ft=0 fh=0000000000000000 vn="a variant of Android/Plankton.I trojan" ac=I fn="L:\Download\Android\screenshot.apk"

sh=E8C7568806FA5B5BCF2B758A03B54C12459381EA ft=1 fh=05ba21cf0817a83b vn="a variant of Win32/Kryptik.AWYM trojan" ac=I fn="L:\Download\donnelly-2012-kooba.exe"

sh=8512692839F62F17679C4E828D61D0E9D6EBBE60 ft=1 fh=c71c00114b34ff12 vn="a variant of Win32/Injector.YYX trojan" ac=I fn="L:\Download\kokosnuss-2012-kooba.exe"

Die 3 *.exe Dateien am Ende habe ich bereits komplett vom Rechner gelöscht.

Schritt 4: FRST

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-09-2013 02

Ran by Tom (ATTENTION: The logged in user is not administrator) on TOM_ADMIN-PC on 30-09-2013 20:24:59

Running from C:\Users\Tom\Desktop\Trojan

Windows 8 Pro (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) =================
 

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Mozilla Corporation) C:\Program Files (x86)\Firefox\firefox.exe

(Hewlett-Packard Company) C:\Program Files (x86)\HP\HP Color LaserJet CM2320 MFP Series\hppfaxprintersrv.exe

(Samsung) C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe

(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe

(InstallShield Software Corporation) C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe

(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13196432 2012-09-25] (Realtek Semiconductor)

HKLM\...\Run: [HP Color LaserJet CM2320 MFP Series Fax] - C:\Program Files (x86)\HP\HP Color LaserJet CM2320 MFP Series\hppfaxprintersrv.exe [3700736 2009-09-22] (Hewlett-Packard Company)

HKLM\...\RunOnce: [*WerKernelReporting] - %SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq [439488 2013-07-09] (Microsoft Corporation)

HKLM-x32\...\RunOnce: [Malwarebytes Anti-Malware] - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation)

HKCU\...\Run: [] - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844656 2013-09-04] (Samsung)

HKLM-x32\...\Run: [BCSSync] - C:\Program Files (x86)\Microsoft Office2010\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)

HKLM-x32\...\Run: [EaseUS EPM tray] - C:\Program Files (x86)\EaseUS\EaseUS Partition Master 9.2.1 Home Edition\bin\EpmNews.exe [2086984 2012-11-29] (CHENGDU YIWO Tech Development Co., Ltd)

HKLM-x32\...\Run: [ISUSScheduler] - C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe [81920 2005-02-16] (InstallShield Software Corporation)

HKLM-x32\...\Run: [JMB36X IDE Setup] - C:\Windows\RaidTool\xInsIDE.exe [36864 2007-03-20] ()

HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [163000 2012-12-12] (Geek Software GmbH)

HKLM-x32\...\Run: [] - [x]

HKLM-x32\...\Run: [HPUsageTracking] - C:\Program Files (x86)\HP\HP UT\bin\hppusg.exe [24576 2009-05-11] (Hewlett-Packard Company)

HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)

HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)

HKLM-x32\...\Run: [Live Update 5] - C:\Program Files (x86)\MSI\Live Update 5\BootStartLiveupdate.exe [315392 2012-01-30] ()

HKLM-x32\...\Run: [KiesTrayAgent] - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311152 2013-09-04] (Samsung Electronics Co., Ltd.)

Startup: C:\Users\Tom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk

ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office2010\Office14\ONENOTEM.EXE (Microsoft Corporation)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.metager.de/

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x6EEDBAB406CCCD01

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKCU - {3BD44F0E-0596-4008-AEE0-45D47E3A8F0E} URL = 

BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office2010\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office2010\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: No Name - {DBC80044-A445-435b-BC74-9C25C1C588A9} -  No File

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 0.0.0.0
 

FireFox:

========

FF ProfilePath: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default

FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()

FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()

FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\WINDOWS\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf - f:\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)

FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf - f:\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)

FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - e:\Picasa3\npPicasa3.dll No File

FF Plugin-x32: @java.com/DTPlugin,version=1.6.0_35 - C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MI4066~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MI4066~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin-x32: @real.com/nppl3260;version=15.0.4.53 - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprjplug;version=15.0.4.53 - c:\program files (x86)\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprpchromebrowserrecordext;version=15.0.4.53 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprphtml5videoshim;version=15.0.4.53 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprpplugin;version=15.0.4.53 - c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Tom\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()

FF SearchPlugin: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\betabinariesnl.xml

FF SearchPlugin: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\eurobuchcom.xml

FF SearchPlugin: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\ixquick-http---deutsch.xml

FF SearchPlugin: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\mein-metager.xml

FF SearchPlugin: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\searchplugins-backup

FF SearchPlugin: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\searchplugins\startpage-https---deutsch.xml

FF Extension: Deutsches Wörterbuch - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\de-DE@dictionaries.addons.mozilla.org

FF Extension: Garmin Communicator - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}

FF Extension: EPUBReader - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\{5384767E-00D9-40E9-B72F-9CC39D655D6F}

FF Extension: Bitdefender QuickScan - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\{e001c731-5e37-4538-a5cb-8168736a2360}

FF Extension: No Name - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\Extensions.rdf

FF Extension: No Name - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\installed-extensions.txt

FF Extension: optout - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\optout@google.com.xpi

FF Extension: youtubeunblocker - C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\o39skso7.default\Extensions\youtubeunblocker@unblocker.yt.xpi

FF HKLM-x32\...\Firefox\Extensions: [{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext

FF Extension: RealPlayer Browser Record Plugin - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext

FF StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Firefox\firefox.exe
 

Chrome: 

=======

CHR HomePage: hxxp://www.google.com/

CHR DefaultSearchURL: (Google) - {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}

CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}

CHR Plugin: (Chrome PDF Viewer) - C:\Users\Tom\AppData\Local\Google\Chrome\Application\10.0.648.204\pdf.dll No File

CHR Plugin: (Google Gears 0.5.33.0) - C:\Users\Tom\AppData\Local\Google\Chrome\Application\10.0.648.204\gears.dll No File

CHR Plugin: (Shockwave Flash) - C:\Users\Tom\AppData\Local\Google\Chrome\Application\10.0.648.204\gcswf32.dll No File

CHR Plugin: (Foxit Reader Plugin for Mozilla) - C:\Program Files (x86)\Firefox\plugins\npFoxitReaderPlugin.dll (Foxit Software Company)

CHR Plugin: (2007 Microsoft Office system) - C:\Program Files (x86)\Firefox\plugins\NPOFF12.DLL (Microsoft Corporation)

CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

CHR Plugin: (Google Update) - C:\Users\Tom\AppData\Local\Google\Update\1.2.183.39\npGoogleOneClick8.dll No File

CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File

CHR Plugin: (Default Plug-in) - default_plugin No File

CHR HKLM-x32\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Ext\rphtml5video.crx

CHR HKLM-x32\...\Chrome\Extension: [ofnnlhbgdcabppjmlijllkhekcglbjlg] - C:\Program Files (x86)\Lyrics_Monkey\128.crx
 

==================== Services (Whitelisted) =================
 

R2 Garmin Core Update Service; C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [185688 2013-03-27] (Garmin Ltd or its subsidiaries)

R2 HPSLPSVC; C:\Users\Tom\AppData\Local\Temp\7zS3579\hpslpsvc64.dll [1039360 2012-11-14] (Hewlett-Packard Co.)

R2 lmhosts; C:\Windows\system32\svchost.exe [29696 2012-09-20] (Microsoft Corporation)

S3 Microsoft SharePoint Workspace Audit Service; C:\Program Files (x86)\Microsoft Office2010\Office14\GROOVE.EXE [30785672 2012-09-20] (Microsoft Corporation)

R2 MSMQ; C:\Windows\system32\mqsvc.exe [25088 2012-07-26] (Microsoft Corporation)

R2 NlaSvc; C:\Windows\System32\svchost.exe [29696 2012-09-20] (Microsoft Corporation)

R2 nsi; C:\Windows\system32\svchost.exe [29696 2012-09-20] (Microsoft Corporation)

R2 PMBDeviceInfoProvider; C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe [474168 2012-04-22] (Sony Corporation)

S2 SynoDrService; C:\Program Files (x86)\Synology Data Replicator  3\SynoDrServicex64.exe [380928 2010-06-02] ()

R2 TVGOnlineUpdateSvc; C:\Program Files (x86)\TVG\OnlineUpdate\OnlineUpdateSvc.exe [398128 2010-12-14] ()

R2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [471552 2012-07-26] (Microsoft Corporation)

R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)
 

==================== Drivers (Whitelisted) ====================
 

S3 androidusb; C:\Windows\System32\Drivers\androidusb.sys [32768 2010-04-29] (Google Inc)

S3 DigiartyVirtualCDBus; C:\Windows\System32\drivers\DigiartyVirtualCDBus.sys [276256 2013-08-28] (Digiarty Software, Inc.)

R2 easycvfs; C:\WINDOWS\system32\drivers\easycvfs.sys [109960 2009-11-09] ()

S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [17480 2012-12-21] ()

S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [17480 2012-12-21] ()

S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9800 2012-12-21] ()

S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9800 2012-12-21] ()

R1 HWiNFO32; C:\Program Files (x86)\HWiNFO32\HWiNFO64A.SYS [29288 2009-05-21] (REALiX(tm))

R1 HWiNFO32; C:\Program Files (x86)\HWiNFO32\HWiNFO64A.SYS [29288 2009-05-21] (REALiX(tm))

R3 MQAC; C:\Windows\System32\drivers\mqac.sys [185856 2012-07-26] (Microsoft Corporation)

S1 NNSNAHSL; C:\Windows\System32\DRIVERS\NNSNAHSL.sys [33320 2012-10-22] (Panda Security, S.L.)

S3 NTIOLib_1_0_4; C:\Program Files (x86)\MSI\Live Update 5\NTIOLib_X64.sys [14136 2010-10-22] (MSI)

S3 NTIOLib_1_0_4; C:\Program Files (x86)\MSI\Live Update 5\NTIOLib_X64.sys [14136 2010-10-22] (MSI)

S3 NTIOLib_1_0_6; C:\Program Files (x86)\Setup Files\Ms7586v1B0\NTIOLib_X64.sys [11888 2011-01-06] (MSI)

S3 NTIOLib_1_0_6; C:\Program Files (x86)\Setup Files\Ms7586v1B0\NTIOLib_X64.sys [11888 2011-01-06] (MSI)

R3 seehcri; C:\Windows\System32\drivers\seehcri.sys [34032 2008-01-09] (Sony Ericsson Mobile Communications)

R3 SKYNET; C:\Windows\system32\DRIVERS\SkyNET_AMD64.SYS [615440 2009-09-11] (TechniSat Digital, S.A.)

S4 sptd; C:\Windows\System32\Drivers\sptd.sys [828912 2011-08-16] (Duplex Secure Ltd.)

S3 vvftav; C:\Windows\System32\drivers\vvftav.sys [300800 2007-02-02] (Vimicro Corporation)

S3 ZSMC0305; C:\Windows\System32\Drivers\usbVM305.sys [1541120 2007-03-08] (Vimicro Corporation)

S3 catchme; \??\C:\ComboFix\catchme.sys [x]

U3 idsvc; 

S3 MSI_MSIBIOS_010507; \??\C:\Program Files (x86)\MSI\Live Update 5\msibios64_100507.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-09-29 23:34 - 2013-09-29 23:35 - 02347384 _____ (ESET) C:\Users\Tom\Downloads\esetsmartinstaller_enu.exe

2013-09-29 22:31 - 2013-09-29 22:33 - 00000387 _____ C:\DeQuarantine.txt

2013-09-29 22:30 - 2013-09-29 22:31 - 00000000 ___SD C:\ComboFix

2013-09-29 21:13 - 2013-09-29 21:13 - 22537616 _____ (Mozilla) C:\Users\Tom\Downloads\Firefox Setup 24.0.exe

2013-09-29 20:22 - 2013-09-29 20:22 - 05130789 _____ (Swearware) C:\Users\Tom\Downloads\ComboFix.exe

2013-09-29 17:49 - 2013-09-30 20:24 - 00000000 ____D C:\Users\Tom\Desktop\Trojan

2013-09-29 16:47 - 2013-09-29 16:47 - 00001125 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-09-29 16:47 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys

2013-09-29 14:13 - 2013-09-29 22:31 - 00000000 ____D C:\Qoobox

2013-09-29 14:13 - 2013-09-29 20:38 - 00000000 ____D C:\WINDOWS\erdnt

2013-09-29 14:13 - 2011-06-26 08:45 - 00256000 _____ C:\WINDOWS\PEV.exe

2013-09-29 14:13 - 2010-11-07 19:20 - 00208896 _____ C:\WINDOWS\MBR.exe

2013-09-29 14:13 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\WINDOWS\SWREG.exe

2013-09-29 14:13 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\WINDOWS\SWSC.exe

2013-09-29 14:13 - 2000-08-31 02:00 - 00212480 _____ (SteelWerX) C:\WINDOWS\SWXCACLS.exe

2013-09-29 14:13 - 2000-08-31 02:00 - 00098816 _____ C:\WINDOWS\sed.exe

2013-09-29 14:13 - 2000-08-31 02:00 - 00080412 _____ C:\WINDOWS\grep.exe

2013-09-29 14:13 - 2000-08-31 02:00 - 00068096 _____ C:\WINDOWS\zip.exe

2013-09-29 14:07 - 2013-09-29 21:41 - 05130789 ____R (Swearware) C:\Users\Tom\Desktop\ComboFix.exe

2013-09-29 14:01 - 2013-09-29 22:15 - 00000000 ____D C:\FRST

2013-09-27 14:21 - 2013-09-27 14:21 - 00000000 ____D C:\Users\Tom\Documents\SelfMV

2013-09-27 14:10 - 2013-09-27 14:10 - 00002018 _____ C:\Users\Public\Desktop\Samsung Kies (Lite).lnk

2013-09-27 14:10 - 2013-09-27 14:10 - 00002008 _____ C:\Users\Public\Desktop\Samsung Kies.lnk

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\WINDOWS\LastGood.Tmp

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Tom\Documents\samsung

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Tom\AppData\Roaming\Samsung

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Tom\AppData\Local\Samsung

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Public\Documents\NativeFus_Log

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Public\Documents\CrashDump

2013-09-27 14:08 - 2013-09-27 14:08 - 00000000 ____D C:\Program Files (x86)\MyFree Codec

2013-09-27 14:05 - 2013-09-27 14:09 - 00000000 ____D C:\ProgramData\Samsung

2013-09-27 14:05 - 2013-09-27 14:09 - 00000000 ____D C:\Program Files (x86)\Samsung

2013-09-27 14:05 - 2013-07-18 14:33 - 04659712 _____ (Dmitry Streblechenko) C:\WINDOWS\SysWOW64\Redemption.dll

2013-09-27 14:05 - 2013-07-18 14:32 - 00821824 _____ (Devguru Co., Ltd.) C:\WINDOWS\SysWOW64\dgderapi.dll

2013-09-27 13:59 - 2013-09-27 13:59 - 00001059 _____ C:\Users\Public\Desktop\DriverTuner.lnk

2013-09-27 13:59 - 2013-09-27 13:59 - 00000000 ____D C:\Program Files (x86)\DriverTuner

2013-09-27 13:54 - 2013-09-27 13:54 - 00000000 ____D C:\Users\Tom\.android

2013-09-26 10:35 - 2013-09-26 10:35 - 00000103 _____ C:\WINDOWS\ParrotFlashWiz.INI

2013-09-26 10:33 - 2013-09-26 10:33 - 00000000 ____D C:\Program Files (x86)\Parrot Software Update Tool

2013-09-23 11:12 - 2013-09-23 11:12 - 1285878931 _____ C:\WINDOWS\MEMORY.DMP

2013-09-16 20:47 - 2013-08-07 07:15 - 00144896 _____ (Microsoft Corporation) C:\WINDOWS\system32\tssdisai.dll

2013-09-15 13:06 - 2013-09-15 13:07 - 00531240 _____ C:\WINDOWS\system32\FNTCACHE.DAT

2013-09-15 10:43 - 2013-09-29 22:34 - 00009676 _____ C:\WINDOWS\PFRO.log

2013-09-14 17:15 - 2013-09-29 23:33 - 00317715 _____ C:\WINDOWS\setupact.log

2013-09-14 17:15 - 2013-09-14 17:15 - 00000000 _____ C:\WINDOWS\setuperr.log

2013-09-13 10:57 - 2013-09-30 12:30 - 02084708 _____ C:\WINDOWS\WindowsUpdate.log

2013-09-13 09:24 - 2013-08-16 07:41 - 00058200 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dam.sys

2013-09-13 09:24 - 2013-08-16 07:39 - 02371728 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSService.dll

2013-09-13 09:24 - 2013-08-16 07:39 - 00059416 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe

2013-09-13 09:24 - 2013-08-16 07:32 - 00209200 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationUI.exe

2013-09-13 09:24 - 2013-08-16 07:22 - 04917760 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppsvc.exe

2013-09-13 09:24 - 2013-08-16 07:22 - 00040448 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe

2013-09-13 09:24 - 2013-08-16 07:21 - 03275776 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 01621504 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 01164288 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00773120 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00688640 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00368640 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppwinob.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00252416 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00204800 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSClient.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00183808 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSSync.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00174592 _____ (Microsoft Corporation) C:\WINDOWS\system32\storewuauth.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00163840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00142848 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00120320 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppc.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00099328 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00081408 _____ (Microsoft Corporation) C:\WINDOWS\system32\setupcln.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00049664 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups.dll

2013-09-13 09:24 - 2013-08-16 07:21 - 00049152 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups2.dll

2013-09-13 09:24 - 2013-08-16 07:20 - 00105984 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinSetupUI.dll

2013-09-13 09:24 - 2013-08-16 00:43 - 00628736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll

2013-09-13 09:24 - 2013-08-16 00:43 - 00562688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll

2013-09-13 09:24 - 2013-08-16 00:43 - 00167424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSClient.dll

2013-09-13 09:24 - 2013-08-16 00:43 - 00159232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSSync.dll

2013-09-13 09:24 - 2013-08-16 00:43 - 00143872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.dll

2013-09-13 09:24 - 2013-08-16 00:43 - 00126976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll

2013-09-13 09:24 - 2013-08-16 00:43 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll

2013-09-13 09:24 - 2013-08-16 00:43 - 00084992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll

2013-09-13 09:24 - 2013-08-16 00:43 - 00083968 _____ C:\WINDOWS\SysWOW64\OEMLicense.dll

2013-09-13 09:24 - 2013-08-16 00:43 - 00035328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe

2013-09-13 09:24 - 2013-08-16 00:43 - 00020992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wups.dll

2013-09-13 09:24 - 2013-08-16 00:42 - 00091648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sppc.dll

2013-09-13 09:24 - 2013-08-16 00:42 - 00076800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\setupcln.dll

2013-09-13 09:23 - 2013-08-21 06:12 - 02241024 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll

2013-09-13 09:23 - 2013-08-21 06:12 - 00051712 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe

2013-09-13 09:23 - 2013-08-21 06:11 - 19246592 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 15404544 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 03959296 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 02647040 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 01365504 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 00915968 _____ (Microsoft Corporation) C:\WINDOWS\system32\uxtheme.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 00855552 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 00603136 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 00136704 _____ (Microsoft Corporation) C:\WINDOWS\system32\iesysprep.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 00067072 _____ (Microsoft Corporation) C:\WINDOWS\system32\iesetup.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 00053760 _____ (Microsoft Corporation) C:\WINDOWS\system32\UXInit.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 00053760 _____ (Microsoft Corporation) C:\WINDOWS\system32\jsproxy.dll

2013-09-13 09:23 - 2013-08-21 06:11 - 00039936 _____ (Microsoft Corporation) C:\WINDOWS\system32\iernonce.dll

2013-09-13 09:23 - 2013-08-21 04:34 - 02706432 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.tlb

2013-09-13 09:23 - 2013-08-21 04:06 - 01767936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll

2013-09-13 09:23 - 2013-08-21 04:06 - 01141248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll

2013-09-13 09:23 - 2013-08-21 04:06 - 00044032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UXInit.dll

2013-09-13 09:23 - 2013-08-21 04:05 - 14332928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll

2013-09-13 09:23 - 2013-08-21 04:05 - 13761024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll

2013-09-13 09:23 - 2013-08-21 04:05 - 02876928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll

2013-09-13 09:23 - 2013-08-21 04:05 - 02048000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll

2013-09-13 09:23 - 2013-08-21 04:05 - 00690688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll

2013-09-13 09:23 - 2013-08-21 04:05 - 00493056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll

2013-09-13 09:23 - 2013-08-21 04:05 - 00109056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iesysprep.dll

2013-09-13 09:23 - 2013-08-21 04:05 - 00061440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iesetup.dll

2013-09-13 09:23 - 2013-08-21 04:05 - 00039936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jsproxy.dll

2013-09-13 09:23 - 2013-08-21 04:05 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iernonce.dll

2013-09-13 09:23 - 2013-08-21 03:43 - 02706432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.tlb

2013-09-13 09:23 - 2013-08-21 01:52 - 00534528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\uxtheme.dll

2013-09-13 09:23 - 2013-08-03 06:30 - 04038144 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys

2013-09-12 22:38 - 2013-09-12 22:38 - 00001604 _____ C:\Users\Public\Desktop\Angry Birds Star Wars.lnk

2013-09-11 21:10 - 2013-07-09 10:04 - 00120144 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\msgpioclx.sys

2013-09-11 21:10 - 2013-07-09 08:18 - 00439488 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe

2013-09-11 21:10 - 2013-07-09 06:25 - 00385768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe

2013-09-11 21:10 - 2013-07-09 00:46 - 00414208 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanconn.dll

2013-09-11 21:10 - 2013-07-09 00:46 - 00370688 _____ (Microsoft Corporation) C:\WINDOWS\system32\Wwanadvui.dll

2013-09-11 21:10 - 2013-07-06 02:16 - 01025024 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll

2013-09-11 21:10 - 2013-07-03 02:23 - 00778752 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleaut32.dll

2013-09-11 21:10 - 2013-07-03 02:22 - 02839552 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll

2013-09-11 21:10 - 2013-07-03 02:22 - 01300480 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32.dll

2013-09-11 21:10 - 2013-07-03 02:11 - 00551424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleaut32.dll

2013-09-11 21:10 - 2013-07-03 02:11 - 00268800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.BackgroundTransfer.dll

2013-09-11 21:10 - 2013-07-03 02:10 - 02273792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll

2013-09-11 21:10 - 2013-06-29 08:15 - 00195416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys

2013-09-11 21:10 - 2013-06-29 08:15 - 00125784 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpsd.sys

2013-09-11 21:10 - 2013-06-29 07:43 - 00327512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Classpnp.sys

2013-09-11 21:10 - 2013-06-25 00:54 - 00447488 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll

2013-09-11 21:10 - 2013-06-25 00:54 - 00263680 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmsvc.dll

2013-09-11 21:10 - 2013-06-25 00:54 - 00074240 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmcsp.dll

2013-09-11 21:10 - 2013-06-19 07:36 - 00183808 _____ (Microsoft Corporation) C:\WINDOWS\system32\winmmbase.dll

2013-09-11 21:10 - 2013-06-19 07:36 - 00115712 _____ (Microsoft Corporation) C:\WINDOWS\system32\winmm.dll

2013-09-11 21:10 - 2013-06-19 00:38 - 00160256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmmbase.dll

2013-09-11 21:10 - 2013-06-19 00:38 - 00125440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmm.dll

2013-09-11 21:10 - 2013-06-12 01:26 - 00230912 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinSCard.dll

2013-09-11 21:10 - 2013-06-10 23:17 - 00096512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wfplwfs.sys

2013-09-11 21:10 - 2013-06-10 21:15 - 01156096 _____ (Microsoft Corporation) C:\WINDOWS\system32\IKEEXT.DLL

2013-09-11 21:10 - 2013-06-10 21:15 - 00723968 _____ (Microsoft Corporation) C:\WINDOWS\system32\BFE.DLL

2013-09-11 21:10 - 2013-06-10 21:15 - 00381952 _____ (Microsoft Corporation) C:\WINDOWS\system32\FWPUCLNT.DLL

2013-09-11 21:10 - 2013-06-06 10:03 - 00119040 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBSTOR.SYS

2013-09-11 21:09 - 2013-07-09 05:57 - 00245760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LocationApi.dll

2013-09-11 21:09 - 2013-07-09 00:46 - 00543744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanmm.dll

2013-09-11 21:09 - 2013-07-09 00:45 - 00312832 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationApi.dll

2013-09-11 21:09 - 2013-07-03 02:23 - 00391168 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.BackgroundTransfer.dll

2013-09-11 21:09 - 2013-07-02 00:08 - 00387583 _____ C:\WINDOWS\system32\ApnDatabase.xml

2013-09-11 21:09 - 2013-07-01 00:30 - 00067072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\openfiles.exe

2013-09-11 21:09 - 2013-07-01 00:29 - 00077312 _____ (Microsoft Corporation) C:\WINDOWS\system32\openfiles.exe

2013-09-11 21:09 - 2013-06-29 03:12 - 01022464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32.dll

2013-09-11 21:09 - 2013-06-26 05:01 - 00321536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\udfs.sys

2013-09-11 21:09 - 2013-06-12 01:43 - 00154112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinSCard.dll

2013-09-11 21:09 - 2013-06-10 21:16 - 00888832 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshwfp.dll

2013-09-11 21:09 - 2013-06-10 21:10 - 00702464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nshwfp.dll

2013-09-11 21:09 - 2013-06-10 21:10 - 00245248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FWPUCLNT.DLL

2013-09-11 21:09 - 2013-04-03 01:37 - 00025088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cryptdlg.dll

2013-09-11 21:09 - 2013-04-03 01:12 - 00030720 _____ (Microsoft Corporation) C:\WINDOWS\system32\cryptdlg.dll

2013-09-11 21:09 - 2013-03-22 05:49 - 02382336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\esent.dll

2013-09-11 21:09 - 2013-03-22 00:47 - 02851840 _____ (Microsoft Corporation) C:\WINDOWS\system32\esent.dll

2013-09-11 21:09 - 2013-03-02 10:23 - 00375808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ReAgent.dll

2013-09-11 21:09 - 2013-03-02 04:44 - 01011200 _____ (Microsoft Corporation) C:\WINDOWS\system32\reseteng.dll

2013-09-11 21:09 - 2012-12-15 06:55 - 00443392 _____ (Microsoft Corporation) C:\WINDOWS\system32\ReAgent.dll

2013-09-11 21:09 - 2012-11-03 07:26 - 00132096 _____ (Microsoft Corporation) C:\WINDOWS\system32\sysreset.exe

2013-09-11 21:09 - 2012-11-03 07:25 - 00945152 _____ (Microsoft Corporation) C:\WINDOWS\system32\resetengmig.dll

2013-09-11 21:09 - 2012-10-24 05:25 - 00026624 _____ (Microsoft Corporation) C:\WINDOWS\system32\ReAgentc.exe

2013-09-11 21:09 - 2012-10-24 05:25 - 00013312 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcalua.exe

2013-09-11 21:09 - 2012-10-24 05:24 - 00405504 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcasvc.dll

2013-09-11 21:09 - 2012-10-24 05:24 - 00031232 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcadm.dll

2013-09-11 21:09 - 2012-10-24 05:05 - 00011776 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcaevts.dll

2013-09-11 21:09 - 2012-10-24 04:48 - 00024064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ReAgentc.exe

2013-09-09 10:23 - 2013-06-09 21:59 - 00216064 _____ C:\WINDOWS\SysWOW64\gcapi_dll.dll

2013-09-01 16:29 - 2013-09-01 16:29 - 00000000 ____D C:\WINDOWS\SysWOW64\fstrainer2011

2013-09-01 16:29 - 2008-01-03 19:19 - 00581632 _____ (Adobe Systems, Inc.) C:\WINDOWS\SysWOW64\Control.dll

2013-09-01 16:29 - 2004-12-07 10:09 - 00347136 _____ C:\WINDOWS\SysWOW64\unicows.pdb

2013-09-01 16:29 - 2004-08-04 07:21 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msado27.tlb

2013-09-01 16:29 - 2004-03-08 21:00 - 00152848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comdlg32.ocx

2013-09-01 14:49 - 2013-09-09 10:36 - 00000942 _____ C:\Users\Public\Desktop\calibre 64bit - E-book management.lnk

2013-09-01 14:49 - 2013-09-09 10:36 - 00000000 ____D C:\Program Files\Calibre2

2013-09-01 14:49 - 2013-09-01 18:42 - 00000000 ____D C:\Users\Tom\AppData\Local\calibre-cache
 

==================== One Month Modified Files and Folders =======
 

2013-09-30 20:24 - 2013-09-29 17:49 - 00000000 ____D C:\Users\Tom\Desktop\Trojan

2013-09-30 20:21 - 2012-08-15 10:55 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job

2013-09-30 20:15 - 2009-07-14 04:34 - 00001106 _____ C:\WINDOWS\win.ini

2013-09-30 19:02 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\system32\sru

2013-09-30 12:30 - 2013-09-13 10:57 - 02084708 _____ C:\WINDOWS\WindowsUpdate.log

2013-09-29 23:37 - 2013-02-26 22:16 - 00000000 ____D C:\Users\Tom\AppData\Roaming\Simple Sudoku

2013-09-29 23:35 - 2013-09-29 23:34 - 02347384 _____ (ESET) C:\Users\Tom\Downloads\esetsmartinstaller_enu.exe

2013-09-29 23:33 - 2013-09-14 17:15 - 00317715 _____ C:\WINDOWS\setupact.log

2013-09-29 23:33 - 2013-01-02 02:50 - 00000000 ____D C:\ProgramData\NVIDIA

2013-09-29 23:33 - 2012-07-26 09:22 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT

2013-09-29 22:34 - 2013-09-15 10:43 - 00009676 _____ C:\WINDOWS\PFRO.log

2013-09-29 22:33 - 2013-09-29 22:31 - 00000387 _____ C:\DeQuarantine.txt

2013-09-29 22:31 - 2013-09-29 22:30 - 00000000 ___SD C:\ComboFix

2013-09-29 22:31 - 2013-09-29 14:13 - 00000000 ____D C:\Qoobox

2013-09-29 22:31 - 2013-08-17 10:39 - 00000000 ____D C:\Program Files (x86)\Firefox

2013-09-29 22:15 - 2013-09-29 14:01 - 00000000 ____D C:\FRST

2013-09-29 21:47 - 2012-07-26 07:26 - 00000215 _____ C:\WINDOWS\system.ini

2013-09-29 21:41 - 2013-09-29 14:07 - 05130789 ____R (Swearware) C:\Users\Tom\Desktop\ComboFix.exe

2013-09-29 21:13 - 2013-09-29 21:13 - 22537616 _____ (Mozilla) C:\Users\Tom\Downloads\Firefox Setup 24.0.exe

2013-09-29 20:38 - 2013-09-29 14:13 - 00000000 ____D C:\WINDOWS\erdnt

2013-09-29 20:22 - 2013-09-29 20:22 - 05130789 _____ (Swearware) C:\Users\Tom\Downloads\ComboFix.exe

2013-09-29 17:50 - 2012-07-26 12:27 - 00863478 _____ C:\WINDOWS\system32\perfh007.dat

2013-09-29 17:50 - 2012-07-26 12:27 - 00197036 _____ C:\WINDOWS\system32\perfc007.dat

2013-09-29 17:50 - 2012-07-26 09:28 - 02029610 _____ C:\WINDOWS\system32\PerfStringBackup.INI

2013-09-29 17:44 - 2013-08-25 14:40 - 00000000 ____D C:\Program Files (x86)\MyPC Backup

2013-09-29 17:35 - 2013-06-01 13:54 - 00000000 ____D C:\Users\Tom\Desktop\Calibre

2013-09-29 16:47 - 2013-09-29 16:47 - 00001125 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-09-29 16:47 - 2012-09-09 20:42 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-09-29 16:16 - 2013-01-02 02:54 - 00000000 ____D C:\Users\Tom_Admin

2013-09-27 17:20 - 2013-03-18 16:32 - 00013213 _____ C:\Users\Tom\Desktop\Wasserverbrauch.xlsx

2013-09-27 17:10 - 2013-03-18 16:19 - 00015297 _____ C:\Users\Tom\Desktop\Stromverbrauch.xlsx

2013-09-27 14:41 - 2012-12-02 22:30 - 00000000 ____D C:\Users\Tom\AppData\Roaming\MyPhoneExplorer

2013-09-27 14:21 - 2013-09-27 14:21 - 00000000 ____D C:\Users\Tom\Documents\SelfMV

2013-09-27 14:10 - 2013-09-27 14:10 - 00002018 _____ C:\Users\Public\Desktop\Samsung Kies (Lite).lnk

2013-09-27 14:10 - 2013-09-27 14:10 - 00002008 _____ C:\Users\Public\Desktop\Samsung Kies.lnk

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\WINDOWS\LastGood.Tmp

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Tom\Documents\samsung

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Tom\AppData\Roaming\Samsung

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Tom\AppData\Local\Samsung

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Public\Documents\NativeFus_Log

2013-09-27 14:10 - 2013-09-27 14:10 - 00000000 ____D C:\Users\Public\Documents\CrashDump

2013-09-27 14:09 - 2013-09-27 14:05 - 00000000 ____D C:\ProgramData\Samsung

2013-09-27 14:09 - 2013-09-27 14:05 - 00000000 ____D C:\Program Files (x86)\Samsung

2013-09-27 14:08 - 2013-09-27 14:08 - 00000000 ____D C:\Program Files (x86)\MyFree Codec

2013-09-27 14:05 - 2010-01-24 03:50 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information

2013-09-27 13:59 - 2013-09-27 13:59 - 00001059 _____ C:\Users\Public\Desktop\DriverTuner.lnk

2013-09-27 13:59 - 2013-09-27 13:59 - 00000000 ____D C:\Program Files (x86)\DriverTuner

2013-09-27 13:54 - 2013-09-27 13:54 - 00000000 ____D C:\Users\Tom\.android

2013-09-27 13:54 - 2013-01-02 02:54 - 00000000 ____D C:\Users\Tom

2013-09-27 13:54 - 2012-12-02 22:30 - 00002073 _____ C:\Users\Public\Desktop\MyPhoneExplorer.lnk

2013-09-27 13:54 - 2012-12-02 22:30 - 00000000 ____D C:\Program Files (x86)\MyPhoneExplorer

2013-09-26 11:47 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\AUInstallAgent

2013-09-26 10:35 - 2013-09-26 10:35 - 00000103 _____ C:\WINDOWS\ParrotFlashWiz.INI

2013-09-26 10:33 - 2013-09-26 10:33 - 00000000 ____D C:\Program Files (x86)\Parrot Software Update Tool

2013-09-25 17:58 - 2011-03-22 23:38 - 00000000 ____D C:\Users\Tom\AppData\Roaming\Foxit Software

2013-09-23 11:12 - 2013-09-23 11:12 - 1285878931 _____ C:\WINDOWS\MEMORY.DMP

2013-09-23 11:12 - 2013-01-12 07:48 - 00000000 ____D C:\WINDOWS\Minidump

2013-09-19 01:26 - 2013-01-10 23:02 - 00694232 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe

2013-09-19 01:26 - 2013-01-10 23:02 - 00078296 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl

2013-09-18 16:22 - 2013-06-05 11:18 - 00322048 ___SH C:\Users\Tom\Desktop\Thumbs.db

2013-09-18 16:22 - 2013-02-06 22:20 - 00000000 ____D C:\Users\Tom\Desktop\KabelBW

2013-09-15 15:57 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\rescache

2013-09-15 15:38 - 2013-02-23 11:24 - 00000586 _____ C:\Users\Public\Desktop\mkvmerge GUI.lnk

2013-09-15 13:07 - 2013-09-15 13:06 - 00531240 _____ C:\WINDOWS\system32\FNTCACHE.DAT

2013-09-15 01:14 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\WinStore

2013-09-15 01:14 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\PolicyDefinitions

2013-09-15 00:05 - 2010-06-01 00:58 - 00000000 ____D C:\Users\Tom\AppData\Local\QuickPar

2013-09-14 17:15 - 2013-09-14 17:15 - 00000000 _____ C:\WINDOWS\setuperr.log

2013-09-14 11:57 - 2010-06-01 01:01 - 00018944 _____ C:\Users\Tom\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2013-09-14 03:02 - 2010-05-09 20:21 - 00000000 ____D C:\ProgramData\Microsoft Help

2013-09-13 11:06 - 2013-08-19 11:05 - 00000000 ____D C:\WINDOWS\system32\MRT

2013-09-13 11:03 - 2009-10-14 07:12 - 79143768 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe

2013-09-13 09:58 - 2013-08-25 14:42 - 00000834 _____ C:\Users\Public\Desktop\CCleaner.lnk

2013-09-13 09:58 - 2013-08-25 14:42 - 00000000 ____D C:\Program Files\CCleaner

2013-09-13 09:05 - 2012-07-26 07:38 - 00000000 ____D C:\WINDOWS\system32\oobe

2013-09-12 22:38 - 2013-09-12 22:38 - 00001604 _____ C:\Users\Public\Desktop\Angry Birds Star Wars.lnk

2013-09-12 22:38 - 2013-07-05 12:47 - 00000000 ____D C:\Users\Tom\AppData\Roaming\Rovio Entertainment Ltd

2013-09-10 15:45 - 2013-05-04 21:34 - 00000000 ____D C:\Users\Tom\Documents\Settlers7

2013-09-09 10:36 - 2013-09-01 14:49 - 00000942 _____ C:\Users\Public\Desktop\calibre 64bit - E-book management.lnk

2013-09-09 10:36 - 2013-09-01 14:49 - 00000000 ____D C:\Program Files\Calibre2

2013-09-02 16:17 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\system32\NDF

2013-09-01 18:42 - 2013-09-01 14:49 - 00000000 ____D C:\Users\Tom\AppData\Local\calibre-cache

2013-09-01 16:29 - 2013-09-01 16:29 - 00000000 ____D C:\WINDOWS\SysWOW64\fstrainer2011

2013-09-01 16:29 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\SysWOW64\Macromed

2013-09-01 16:29 - 2012-07-10 13:44 - 00000000 ____D C:\WINDOWS\SysWOW64\Adobe

2013-09-01 14:41 - 2013-02-17 20:48 - 00000000 ____D C:\Users\TomAdminPW_Ur\AppData\Roaming\SpeedProject
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 

==================== End Of Log ============================

--- --- ---

--- --- ---

aharonov

30.09.2013 19:34

Hallo,

ausser das ESET nicht so Freude an deinen Downloads hatte, war da nichts relevantes dabei.
Welche Probleme bestehen jetzt noch?

Rupsi

30.09.2013 20:10

Wirkliche Probleme bestehen eigentlich keine mehr. Firefox läuft auch wieder. Nur würde ich den gerne auch wieder deinstallieren können. Er ist ja nicht mehr in den installierten Programmen enthalten

aharonov

30.09.2013 20:13

Und wenn du den Firefox nochmals drüberinstallierst?

Rupsi

30.09.2013 20:29

Ich werde es gleich versuchen

Hat geklappert. :-)

So. Nun noch einmal ganz herzlichen Dank für Deine professionelle Hilfe!! Es ist nicht selbstverständlich so lange und stetig Hilfe zu bekommen.

Ich hatte schon Angst, ich muss auf eine Datensicherung neu aufsetzen. nun muss ich allerdings noch 2 USB-Platten und eine Netzwerkplatte mit insgesamt rd. 3 TB an Daten scannen, ebenso einige Memorysticks um sicher zu gehen, dass ich keine ungebetenen Gäste mehr habe.

aharonov

30.09.2013 20:40

Prima, dann räumen wir noch auf.

Überprüfe noch mit diesem Plugin-Check (mit dem Firefox hier), ob alle deine verwendeten Plugin-Versionen aktuell sind und update sie anderenfalls.

Cleanup

Zum Schluss werden wir jetzt noch unsere Tools (inklusive der Quarantäne-Ordner) wegräumen, die verseuchten Systemwiederherstellungspunkte löschen und alle Einstellungen wieder herrichten. Auch diese Schritte sind noch wichtig und sollten in der angegebenen Reihenfolge ausgeführt werden.

Deaktiviere jetzt temporär das Antivirenprogramm, benenne bei der auf dem Desktop vorhandenen Combofix.exe das "Combofix" im Dateinamen um in Uninstall und führe sie mit Doppelklick aus.
Bei MBAM würd ich dir unbedingt empfehlen, es zu behalten und wöchentlich einen Quick-Scan durchzuführen. Wenn du es nicht weiter verwenden möchtest, kannst du es jetzt normal über die Systemsteuerung deinstallieren.
Auch den ESET Online Scanner kannst du behalten, um ab und zu (monatlich) für eine Zweitmeinung dein System damit zu scannen. Falls du ESET deinstallieren möchtest, dann kannst du das ebenfalls über die Systemsteuerung tun.
Downloade dir bitte auf jeden Fall DelFix auf deinen Desktop.
- Schliesse alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- DelFix entfernt u.a. alle von uns verwendeten Programme und löscht sich anschliessend selbst.
Wenn jetzt noch etwas übriggeblieben ist, dann kannst du es einfach manuell löschen.

>> OK <<
Wir sind durch, deine Logs sehen für mich im Moment sauber aus. :daumenhoc

Ich habe dir nachfolgend ein paar Hinweise und Tipps zusammengestellt, die dazu beitragen sollen, dass du in Zukunft unsere Hilfe nicht mehr brauchen wirst.

Bitte gib mir danach noch eine kurze Rückmeldung, wenn auch von deiner Seite keine Probleme oder Fragen mehr offen sind, damit ich dieses Thema als erledigt betrachten kann.

Epilog: Tipps, Dos & Don'ts

Aktualität von System und Software

Das Betriebsystem Windows muss zwingend immer auf dem neusten Stand sein. Stelle sicher, dass die automatischen Updates aktiviert sind:

Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren

Auch die installierte Software sollte immer in der aktuellsten Version vorliegen.
Speziell gilt das für den Browser, Java, Flash-Player und PDF-Reader, denn bekannte Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim blossen Besuch einer präparierten Website per Drive-by Download Malware zu installieren. Das kann sogar auf normalerweise legitimen Websites geschehen, wenn es einem Angreifer gelungen ist, seinen Code in die Seite einzuschleusen, und ist deshalb relativ unberechenbar.

Mit diesem kleinen Plugin-Check kannst du regelmässig diese Komponenten auf deren Aktualität überprüfen.
Achte auch darauf, dass alte, nicht mehr verwendete Versionen deinstalliert sind.
Optional: Das Programm Secunia Personal Software Inspector kann dich dabei unterstützen, stets die aktuellen Versionen sämtlicher installierter Software zu nutzen.

Sicherheits-Software

Eine Bemerkung vorneweg: Jede Softwarelösung hat ihre Schwächen. Die gesamte Verantwortung für die Sicherheit auf Software zu übertragen und einen Rundum-Schutz zu erwarten, wäre eine gefährliche Illusion. Bei unbedachtem oder bewusst risikoreichem Verhalten wird auch das beste Programm früher oder später seinen Dienst versagen (z.B. ein Virenscanner, der eine verseuchte Datei nicht erkennt).
Trotzdem ist entsprechende Software natürlich wichtig und hilft dir in Kombination mit einem gut gewarteten (up-to-date) System und durchdachtem Verhalten, deinen Rechner sauber zu halten.

Nutze einen Virenscanner mit Hintergrundwächter mit stets aktueller Datenbank. Welches Produkt gewählt wird, spielt keine so entscheidende Rolle. Es gibt kommerzielle Versionen, aber ein kostenloser Scanner mit den Grundfunktionen wie beispielsweise Avast! Free Antivirus sollte ausreichen. Betreibe aber keinesfalls zwei Wächter parallel, die würden sich gegenseitig behindern.
Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig.
Zusätzlich zum Virenscanner kannst du dein System regelmässig mit einem On-Demand Antimalwareprogramm scannen. Empfehlenswert ist die Free-Version von Malwarebytes Anti-Malware. Vor jedem Scan die Datenbank updaten.
Optional: Das Programm Sandboxie führt Anwendungen in einer isolierten Umgebung ("Sandkasten") aus, so dass keine Änderungen am System vorgenommen werden können. Wenn du deinen Browser darin startest, vermindert sich die Chance, dass beim Surfen eingefangene Malware sich dauerhaft im System festsetzen kann.
Optional: Das Addon WOT (web of trust) warnt dich vor einer als schädlich gemeldeten Website, bevor sie geladen wird. Für verschiedene Browser erhältlich.

Es liegt in der Natur der Sache, dass die am weitesten verbreitete Anwendungs-Software auch am häufigsten von Malware-Autoren attackiert wird. Es kann daher bereits einen kleinen Sicherheitsgewinn darstellen, wenn man alternative Software (z.B. einen alternativen PDF Reader) benutzt.
Anstelle des Internet Explorers kann man beispielsweise den Mozilla Firefox einsetzen, für welchen es zwei nützliche Addons zur Empfehlung gibt:

NoScript verhindert standardmässig das Ausführen von aktiven Inhalten (Java, JavaScript, Flash, ..) für sämtliche Websites. Du kannst selber nach dem Prinzip einer Whitelist festlegen, welchen Seiten du vertrauen und Scripts erlauben willst, auch temporär.
Adblock Plus blockt die meisten Werbebanner weg. Solche Banner können nebst ihrer störenden Erscheinung auch als Infektionsherde fungieren.

(Un-)Sicheres Verhalten im Internet

Nebst unbemerkten Drive-by Installationen wird Malware aber auch oft mehr oder weniger aktiv vom Benutzer selbst installiert.

Der Besuch zwielichtiger Websites kann bereits Risiken bergen. Und Downloads aus dubiosen Quellen sind immer russisches Roulette. Auch wenn der Virenscanner im Moment darin keine Bedrohung erkennt, muss das nichts bedeuten.

Illegale Cracks, Keygens und Serials sind ein ausgesprochen einfacher (und ein beliebter) Weg, um Malware zu verbreiten.
Bei Dateien aus Peer-to-Peer- und Filesharingprogrammen oder von Filehostern kannst du dir nie sicher sein, ob auch wirklich drin ist, was drauf steht.

Oft wird auch versucht, den Benutzer mit mehr oder weniger trickreichen Methoden dazu zu bringen, eine für ihn verhängnisvolle Handlung selbst auszuführen (Überbegriff Social Engineering).

Surfe mit Vorsicht und lass dich nicht von irgendwie interessant erscheinenden Elementen zu einem vorschnellen Klick verleiten. Lass dich nicht von Popups täuschen, die aussehen wie System- oder Virenmeldungen.
Sei skeptisch bei unerwarteten E-Mails, insbesondere wenn sie Anhänge enthalten. Auch wenn sie auf den ersten Blick authentisch wirken, persönliche Daten von dir enthalten oder vermeintlich von einem bekannten Absender stammen: Lieber nochmals in Ruhe überdenken oder nachfragen, anstatt einfach mal Links oder ausführbare Anhänge öffnen oder irgendwo deine Daten eingeben.
Auch in sozialen Netzwerken oder über Instant Messaging Systeme können schädliche Links oder Dateien die Runde machen. Erhältst du von einem deiner Freunde eine Nachricht, die merkwürdig ist oder so sensationell interessant oder skandalös tönt, dass man einfach draufklicken muss, dann hat bei ihm/ihr wahrscheinlich Neugier über Verstand gesiegt und du solltest nicht denselben Fehler machen.
Lass die Dateiendungen anzeigen, so dass du dich nicht täuschen lässt, wenn eine ausführbare Datei über ein doppelte Dateiendung kaschiert wird, z.B. Nacktfoto.jpg.exe.

Nervige Adware (Werbung) und unnötige Toolbars werden auch meist durch den Benutzer selbst mitinstalliert.

Lade Software in erster Priorität immer direkt vom Hersteller herunter. Viele Softwareportale (z.B. Softonic) packen noch unnützes Zeug mit in die Installation. Alternativ dazu wähle ein sauberes Portal wie Filepony oder heise.
Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen fürs Programm irrelevanten Ergänzungen.

Allgemeine Hinweise

Abschliessend noch ein paar grundsätzliche Bemerkungen:

Dein Benutzerkonto für den alltäglichen Gebrauch sollte nicht über Administratorenrechte verfügen. Nutze ein Konto mit eingeschränkten Rechten (Windows XP) bzw. aktiviere die Benutzerkontensteuerung (UAC) auf der höchsten Stufe (Windows Vista / 7).
Erstelle regelmässig Backups deiner Daten und Dokumente auf externen Datenträgern, bei wichtigen Dateien mindestens zweifach. Nicht nur ein Malwarebefall kann schmerzhaften Datenverlust nach sich ziehen sondern auch ein gewöhnlicher Festplattendefekt.
Die Autorun/Autoplay-Funktion stellt ein Risiko dar, denn sie ermöglicht es, dass beispielsweise beim Einstecken eines entsprechend infizierten USB-Sticks der Befall auf den Rechner überspringt. Überlege dir, ob du diese Funktion nicht besser deaktivieren möchtest.
Wähle deine Passwörter gemäss den gängigen Regeln, um besser gegen Brute-Force- und Wörterbuchattacken gewappnet zu sein. Benutze jedes deiner Passwörter nur einmal und ändere sie regelmässig.
Der Nutzen von Registry-Cleanern zur Performancesteigerung ist umstritten. Auf jeden Fall lässt sich damit grosser Schaden anrichten, wenn man nicht weiss, was man tut. Wir empfehlen deshalb, die Finger von der Registry zu lassen. Um von Zeit zu Zeit die temporären Dateien zu löschen, genügt TFC.

Wenn du möchtest, kannst du das Forum mit einer kleinen Spende unterstützen.
Es bleibt mir nur noch, dir unbeschwertes und sicheres Surfen zu wünschen und dass wir uns hier so bald nicht wiedersehen. ;)

aharonov

17.11.2013 22:16

Dieses Thema scheint erledigt und wird aus meinen Abos gelöscht. Ich bekomme somit keine Benachrichtigung mehr über neue Antworten.
Solltest du das Thema erneut brauchen, schicke mir bitte eine PM und wir machen hier weiter.

Jeder andere bitte diese Anleitung lesen und einen eigenen Thread erstellen.

Alle Zeitangaben in WEZ +1. Es ist jetzt 00:36 Uhr.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131