JS/EXP.Redir.EL.7 auf allen Webservern eingeschlichen

Tino Schmoz · 04.06.2013, 19:14

Hallo liebe Gemeinde,

wir haben das gleiche Problem wie wohl einige andere auch in den letzten Tagen, von nichts auf gleich wurden viele unserer Webprojekte in den letzten Tagen von "JS/EXP.Redir.EL.7" befallen. Allem Anschein nach würden sämtliche FTP Daten von unserem Bearbeitungsrechner per Trojaner entwendet und FTP Verbindungen aufgebaut. In etliche php, html und htacess Dateien wurde ein Script implementiert.

Wenn ich die Dateien vom Server bereinigen möchte indem ich das Script aus den Dateien lösche springt auch sofort der Virenkiller an. Er will das Problem allerdings nicht beheben sondern nur gleich löschen, ohne die Dateien zu bereinigen. (Kaspersky und Avira reagieren beide gleich). Wie soll ich die Daten auf dem Webserver bereinigen, ohne mir selbst was auf die Platte heu zu holen ?

Auch haben wir versucht den VK abzuschalten ein projekt zu bereinigen, es wieder hochzuladen und die FTP-Zugangsdaten zu ändern. Das hat aber nichts geholfen, die Seite war nach 2 Tagen wieder befallen.

Habt Ihr Lösungsansätze für uns ?

Eines der Beispielprojekte von vielen .... hxxp://www.pizzeria-lukas.de

beste Grüße

Tino Schmoz

schrauber · 04.06.2013, 19:29

Hi,

Systemscan mit FRST
Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32bit oder FRST 64bit
(Wenn du nicht sicher bist: Start > Computer (Rechtsklick) > Eigenschaften)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Scan.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Tino Schmoz · 04.06.2013, 19:38

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-06-2013
Ran by Tino (administrator) on 04-06-2013 20:33:07
Running from F:\
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal
 
==================== Processes (Whitelisted) =================
 
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe
() C:\Windows\SysWOW64\srvany.exe
() C:\Windows\KMService.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version7\TeamViewer.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesApp64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version7\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version7\tv_x64.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
() C:\Program Files\Corsair VENGEANCE 2000\CPL\CAHS2.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Dropbox, Inc.) C:\Users\Tino\AppData\Roaming\Dropbox\bin\Dropbox.exe
(NEC Electronics Corporation) C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
(Bandoo Media, inc) C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\datamngrUI.exe
(Nullsoft, Inc.) C:\Program Files (x86)\Winamp\winampa.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Ghisler Software GmbH) C:\totalcmd\TOTALCMD.EXE
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Microsoft Corporation) C:\Windows\system32\AUDIODG.EXE
 
==================== Registry (Whitelisted) ==================
 
HKLM\...\Run: [SYMPHONYSound] C:\Program Files\Corsair VENGEANCE 2000\CPL\CAHS2.exe -show_trayicon [1733120 2012-04-11] ()
HKCU\...\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun [1475584 2010-11-20] (Microsoft Corporation)
HKCU\...\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun [18678376 2013-04-19] (Skype Technologies S.A.)
HKCU\...\Run: [Spybot-S&D Cleaning] "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe" /autoclean [3713032 2012-11-13] (Safer-Networking Ltd.)
MountPoints2: K - K:\LaunchU3.exe -a
MountPoints2: M - M:\LaunchU3.exe -a
MountPoints2: {01332cd1-1e11-11df-95dd-001f3f0801d2} - I:\setup.exe
MountPoints2: {0c2bca64-0135-11e1-af1d-00e04c1cab8a} - K:\LaunchU3.exe -a
MountPoints2: {22560e36-56e5-11df-97f8-001f3f0801d2} - J:\autorun.exe -auto
MountPoints2: {888dbb56-66be-11e0-ac04-806e6f6e6963} - H:\autorun.exe
MountPoints2: {a75dba78-4496-11df-9245-002421b8bc80} - M:\LaunchU3.exe -a
MountPoints2: {c244ec08-66bc-11e0-97ac-806e6f6e6963} - H:\Run.exe
MountPoints2: {c30bd719-cb3e-11de-a7fb-806e6f6e6963} - K:\pushinst.exe
HKLM-x32\...\Run: [NUSB3MON] "C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [106496 2009-11-20] (NEC Electronics Corporation)
HKLM-x32\...\Run: [] [x]
HKLM-x32\...\Run: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [825560 2012-12-18] (Adobe Systems Inc.)
HKLM-x32\...\Run: [DATAMNGR] C:\PROGRA~2\WIA6EB~1\Datamngr\DATAMN~1.EXE [1823160 2012-06-06] (Bandoo Media, inc)
HKLM-x32\...\Run: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin [406992 2010-02-22] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [WinampAgent] "C:\Program Files (x86)\Winamp\winampa.exe" [74752 2012-06-28] (Nullsoft, Inc.)
HKLM-x32\...\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min [345312 2013-05-07] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [AVP] "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe" [356376 2013-05-15] (Kaspersky Lab ZAO)
HKLM-x32\...\Run: [SDTray] "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe" [3825176 2012-11-13] (Safer-Networking Ltd.)
HKU\Gast\...\Run: [LightScribe Control Panel] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden [x]
HKU\Gast\...\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized [18678376 2013-04-19] (Skype Technologies S.A.)
HKU\Gast\...\Policies\system: [LogonHoursAction] 2
HKU\Gast\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
AppInit_DLLs: C:\PROGRA~2\WIA6EB~1\Datamngr\x64\datamngr.dll C:\PROGRA~2\WIA6EB~1\Datamngr\x64\IEBHO.dll [1528760 2012-06-06] (Bandoo Media, inc)
Startup: C:\Users\Tino\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk
ShortcutTarget: Adobe Gamma.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
Startup: C:\Users\Tino\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Tino\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
BootExecute: autocheck autochk * sdnclean64.exe
 
==================== Internet (Whitelisted) ====================
 
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
URLSearchHook: (No Name) - {1E864EAC-892F-4A60-8C17-63123FD5731C} - No File
URLSearchHook: (No Name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - No File
URLSearchHook: SearchHook Class - {BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\AddressBarSearch64.dll (DeviceVM, Inc.)
URLSearchHook: (No Name) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - No File
HKLM SearchScopes: DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=413&sr=0&q={searchTerms}
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=413&sr=0&q={searchTerms}
HKLM-x32 SearchScopes: DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=413&sr=0&q={searchTerms}
SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=413&sr=0&q={searchTerms}
SearchScopes: HKLM-x32 - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050
HKCU SearchScopes: DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=413&sr=0&q={searchTerms}
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://search.babylon.com/web/{searchTerms}?babsrc=browsersearch&AF=18826
SearchScopes: HKCU - {22C5A487-E29B-4e18-8FCE-D14C495F6FDB} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-devicevm&type=STDVM
SearchScopes: HKCU - {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL = 
SearchScopes: HKCU - {6552C7DD-90A4-4387-B795-F8F96747DE19} URL = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=413&sr=0&q={searchTerms}
SearchScopes: HKCU - {AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8} URL = hxxp://www.daemon-search.com/search?q={searchTerms}
SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050
SearchScopes: HKCU - {B861081E-2B1D-4931-9694-E7C1C0FA7431} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=244506&p={searchTerms}
SearchScopes: HKCU - {BE9654C9-9D79-42ec-B55A-3CAEB12DBF58} URL = hxxp://www.icq.com/search/results.php?q={searchTerms}&ch_id=osd
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: XTTBPos00 Class - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~2\ICQTOO~1\toolbaru.dll (IE Toolbar)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Koyote Soft Toolbar - {1E864EAC-892F-4A60-8C17-63123FD5731C} - C:\Program Files (x86)\Koyote Soft Toolbar\IE\5.1\koyotesoftToolbarIE.dll (Spigot, Inc.)
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: DivX HiQ - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: DVDVideoSoftTB Toolbar - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.)
BHO-x32: Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\WIA6EB~1\Datamngr\ToolBar\searchqudtx.dll ()
BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM - DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll ()
Toolbar: HKLM-x32 - ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)
Toolbar: HKLM-x32 - DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll ()
Toolbar: HKLM-x32 - DVDVideoSoftTB Toolbar - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Koyote Soft Toolbar - {1E864EAC-892F-4A60-8C17-63123FD5731C} - C:\Program Files (x86)\Koyote Soft Toolbar\IE\5.1\koyotesoftToolbarIE.dll (Spigot, Inc.)
Toolbar: HKLM-x32 - Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\WIA6EB~1\Datamngr\ToolBar\searchqudtx.dll ()
Toolbar: HKCU - DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll ()
Toolbar: HKCU - No Name - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - No File
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
PDF: HKLM {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab
PDF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
PDF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
 
FireFox:
========
FF ProfilePath: C:\Users\Tino\AppData\Roaming\Mozilla\Firefox\Profiles\1cw0covu.default
FF SelectedSearchEngine: Delta Search
FF Homepage: https://www.google.de/
FF NetworkProxy: "no_proxies_on", "fritz.box"
FF NetworkProxy: "type", 4
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll ()
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX OVS Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @divx.com/DivX Player Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll No File
FF Plugin-x32: @java.com/JavaPlugin,version=10.21.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.0 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Acrobat - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Searchqu Toolbar - C:\Users\Tino\AppData\Roaming\Mozilla\Firefox\Profiles\1cw0covu.default\Extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}
FF Extension: firebug - C:\Users\Tino\AppData\Roaming\Mozilla\Firefox\Profiles\1cw0covu.default\Extensions\firebug@software.joehewitt.com.xpi
FF Extension: koyotesoft - C:\Users\Tino\AppData\Roaming\Mozilla\Firefox\Profiles\1cw0covu.default\Extensions\koyotesoft@mybrowserbar.com
FF Extension: No Name - C:\Users\Tino\AppData\Roaming\Mozilla\Firefox\Profiles\1cw0covu.default\Extensions\{097d3191-e6fa-4728-9826-b533d755359d}.xpi
FF Extension: No Name - C:\Users\Tino\AppData\Roaming\Mozilla\Firefox\Profiles\1cw0covu.default\Extensions\{1FD91A9C-410C-4090-BBCC-55D3450EF433}
FF Extension: No Name - C:\Users\Tino\AppData\Roaming\Mozilla\Firefox\Profiles\1cw0covu.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi
FF Extension: No Name - C:\Users\Tino\AppData\Roaming\Mozilla\Firefox\Profiles\1cw0covu.default\Extensions\{c45c406e-ab73-11d8-be73-000a95be3b12}.xpi
FF Extension: No Name - C:\Users\Tino\AppData\Roaming\Mozilla\Firefox\Profiles\1cw0covu.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: No Name - C:\Users\Tino\AppData\Roaming\Mozilla\Firefox\Profiles\1cw0covu.default\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
 
Chrome: 
=======
CHR Extension: (DivX HiQ) - C:\Users\Tino\AppData\Local\Google\Chrome\User Data\Default\Extensions\fnjbmmemklcjgepojigaapkoodmkgbae\2.1.0.900_0
CHR Extension: (Skype Click to Call) - C:\Users\Tino\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.6.0.8442_0
CHR Extension: (DivX Plus Web Player HTML5 \u003Cvideo\u003E) - C:\Users\Tino\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.0.900_0
 
==================== Services (Whitelisted) =================
 
S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2009-11-19] (Adobe Systems)
S4 Akamai; c:\program files (x86)\common files\akamai/netsession_win_7de0ed9.dll [3340064 2012-02-13] ()
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [86752 2013-03-29] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [110816 2013-03-29] (Avira Operations GmbH & Co. KG)
S3 AppleChargerSrv; C:\Windows\System32\AppleChargerSrv.exe [31272 2010-04-06] ()
S4 AVM WLAN Connection Service; C:\Program Files (x86)\avmwlanstick\WlanNetService.exe [368640 2009-03-20] (AVM Berlin)
R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe [356376 2013-05-15] (Kaspersky Lab ZAO)
S4 Futuremark SystemInfo Service; C:\Program Files (x86)\Common Files\Futuremark Shared\Futuremark SystemInfo\FMSISvc.exe [128928 2010-11-11] (Futuremark Corporation)
S2 gupdate1ca6e09601fd91e; C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [133104 2009-11-25] (Google Inc.)
S4 ICQ Service; C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe [247608 2010-11-21] ()
S4 JMB36X; C:\Windows\SysWOW64\XSrvSetup.exe [72304 2010-01-19] ()
R2 KMService; C:\Windows\SysWow64\srvany.exe [8192 2003-04-18] ()
S4 NMSAccessU; C:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe [71096 2009-09-06] ()
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1103392 2012-11-13] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1369624 2012-11-13] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [168384 2012-11-13] (Safer-Networking Ltd.)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe [2402080 2013-01-28] (TuneUp Software)
S3 TunngleService; C:\Program Files (x86)\Tunngle\TnglCtrl.exe [745368 2012-11-26] (Tunngle.net GmbH)
 
==================== Drivers (Whitelisted) ====================
 
R3 AnyDVD; C:\Windows\System32\Drivers\AnyDVD.sys [123840 2010-04-23] (SlySoft, Inc.)
R1 AppleCharger; C:\Windows\System32\DRIVERS\AppleCharger.sys [21544 2010-04-22] ()
S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [14120 2009-03-20] (AVM Berlin)
R3 ElbyCDFL; C:\Windows\System32\Drivers\ElbyCDFL.sys [40648 2007-02-16] (SlySoft, Inc.)
R1 ElbyCDIO; C:\Windows\SysWow64\Drivers\ElbyCDIO.sys [9728 2003-11-29] (Elaborate Bytes AG)
S3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [460800 2009-03-20] (AVM GmbH)
S3 fwlanusbn; C:\Windows\System32\DRIVERS\fwlanusbn.sys [552704 2009-03-20] (AVM GmbH)
S3 gdrv; C:\Windows\gdrv.sys [25640 2011-09-06] (Windows (R) Server 2003 DDK provider)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458584 2012-06-19] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [620128 2013-05-15] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [28504 2012-08-02] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29016 2012-10-25] (Kaspersky Lab)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29528 2012-10-25] (Kaspersky Lab)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55056 2013-05-15] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178448 2013-05-15] (Kaspersky Lab ZAO)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2010-02-20] ()
S3 StarOpen; C:\Windows\System32\Drivers\StarOpen.sys [5504 2009-11-12] ()
S3 SYMPHONY; C:\Windows\System32\DRIVERS\Symphony.sys [190976 2012-04-25] (C-Media Inc.)
R3 tap0901t; C:\Windows\System32\DRIVERS\tap0901t.sys [31232 2009-09-16] (Tunngle.net)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesDriver64.sys [11880 2012-11-16] (TuneUp Software)
U3 a09t6foy; C:\Windows\System32\Drivers\a09t6foy.sys [0 ] (Microsoft Corporation)
R2 avgntflt; system32\DRIVERS\avgntflt.sys [x]
R1 avipbb; system32\DRIVERS\avipbb.sys [x]
R1 avkmgr; system32\DRIVERS\avkmgr.sys [x]
 
==================== NetSvcs (Whitelisted) ===================
 
 
==================== One Month Created Files and Folders ========
 
2013-06-04 20:32 - 2013-06-04 20:32 - 00000000 ____D C:\FRST
2013-06-04 18:49 - 2013-06-04 18:49 - 00000056 ____A C:\Windows\setupact.log
2013-06-04 18:41 - 2013-06-04 18:41 - 00000054 ____A C:\Users\Tino\Desktop\virusname.txt
2013-05-26 07:55 - 2013-05-26 07:55 - 00000000 ____D C:\Users\Tino\AppData\Roaming\7road
2013-05-24 18:36 - 2013-05-24 18:36 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-05-20 21:09 - 2013-05-20 21:09 - 00000150 ____A C:\Users\Tino\Desktop\todooo.txt
2013-05-20 14:17 - 2013-05-20 14:17 - 00002173 ____A C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2013-05-20 14:17 - 2013-05-20 14:17 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2013-05-20 14:17 - 2009-01-25 12:14 - 00017272 ____A (Safer Networking Limited) C:\Windows\System32\sdnclean64.exe
2013-05-15 19:27 - 2013-05-15 19:27 - 00262144 ____A C:\Windows\System32\config\elam
2013-05-15 19:16 - 2013-05-15 19:16 - 00001111 ____A C:\Users\Public\Desktop\Kaspersky Anti-Virus 2013.lnk
2013-05-15 19:16 - 2012-07-11 17:09 - 00064856 ____A (Kaspersky Lab) C:\Windows\System32\klfphc.dll
2013-05-15 19:15 - 2013-06-04 19:18 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-05-15 19:15 - 2013-05-15 19:24 - 00620128 ____A (Kaspersky Lab ZAO) C:\Windows\System32\Drivers\klif.sys
2013-05-15 19:15 - 2013-05-15 19:24 - 00090208 ____A (Kaspersky Lab ZAO) C:\Windows\System32\Drivers\klflt.sys
2013-05-15 19:15 - 2013-05-15 19:15 - 00000000 ____D C:\Windows\ELAMBKUP
2013-05-15 19:15 - 2013-05-15 19:15 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab
2013-05-15 18:07 - 2013-04-05 08:52 - 02242048 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-05-15 18:07 - 2013-04-05 08:52 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-05-15 18:07 - 2013-04-05 08:52 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-05-15 18:07 - 2013-04-05 08:50 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-05-15 18:07 - 2013-04-05 08:50 - 02647552 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-05-15 18:07 - 2013-04-05 08:50 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-05-15 18:07 - 2013-04-05 08:50 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-05-15 18:07 - 2013-04-05 08:50 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-05-15 18:07 - 2013-04-05 08:50 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-05-15 18:07 - 2013-04-05 08:50 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-05-15 18:07 - 2013-04-05 08:50 - 00053248 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-05-15 18:07 - 2013-04-05 08:50 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-05-15 18:07 - 2013-04-05 07:28 - 01767424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-05-15 18:07 - 2013-04-05 07:28 - 01130496 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-05-15 18:07 - 2013-04-05 07:26 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-05-15 18:07 - 2013-04-05 07:26 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-05-15 18:07 - 2013-04-05 07:26 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-05-15 18:07 - 2013-04-05 07:26 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-05-15 18:07 - 2013-04-05 07:26 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-05-15 18:07 - 2013-04-05 07:26 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-05-15 18:07 - 2013-04-05 07:26 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-05-15 18:07 - 2013-04-05 07:26 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-05-15 18:07 - 2013-04-05 07:26 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-05-15 18:07 - 2013-04-05 06:43 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-05-15 18:07 - 2013-04-05 06:29 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-05-15 18:07 - 2013-04-05 05:51 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-05-15 18:07 - 2013-04-05 05:38 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-05-15 18:06 - 2013-04-05 08:50 - 19231232 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-05-15 18:06 - 2013-04-05 08:50 - 15404032 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-05-15 18:06 - 2013-04-05 07:26 - 14323712 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-05-15 18:06 - 2013-04-05 07:26 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-05-15 18:01 - 2013-04-10 08:01 - 00983400 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgkrnl.sys
2013-05-15 18:01 - 2013-04-10 08:01 - 00265064 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgmms1.sys
2013-05-15 18:01 - 2013-04-10 05:30 - 03153920 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2013-05-15 18:01 - 2013-03-19 07:53 - 00230400 ____A (Microsoft Corporation) C:\Windows\System32\wwansvc.dll
2013-05-15 18:01 - 2013-03-19 07:53 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\wwanprotdim.dll
2013-05-15 18:01 - 2013-02-27 08:02 - 00111448 ____A (Microsoft Corporation) C:\Windows\System32\consent.exe
2013-05-15 18:01 - 2013-02-27 07:52 - 14172672 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll
2013-05-15 18:01 - 2013-02-27 07:52 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\shdocvw.dll
2013-05-15 18:01 - 2013-02-27 07:48 - 01930752 ____A (Microsoft Corporation) C:\Windows\System32\authui.dll
2013-05-15 18:01 - 2013-02-27 07:47 - 00070144 ____A (Microsoft Corporation) C:\Windows\System32\appinfo.dll
2013-05-15 18:01 - 2013-02-27 06:55 - 12872704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-05-15 18:01 - 2013-02-27 06:55 - 00180224 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-05-15 18:01 - 2013-02-27 06:49 - 01796096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2013-05-15 18:01 - 2011-02-03 13:25 - 00144384 ____A (Microsoft Corporation) C:\Windows\System32\cdd.dll
2013-05-10 15:05 - 2013-05-10 15:07 - 00000000 ____D C:\Program Files (x86)\TuneUp Utilities 2013
2013-05-10 15:05 - 2013-05-10 15:05 - 00002209 ____A C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk
2013-05-10 15:05 - 2013-05-10 15:05 - 00002189 ____A C:\Users\Public\Desktop\TuneUp Utilities 2013.lnk
2013-05-10 15:05 - 2013-01-28 14:19 - 00035104 ____A (TuneUp Software) C:\Windows\System32\TURegOpt.exe
2013-05-10 15:05 - 2013-01-28 14:19 - 00026400 ____A (TuneUp Software) C:\Windows\System32\authuitu.dll
2013-05-10 15:05 - 2013-01-28 14:19 - 00021792 ____A (TuneUp Software) C:\Windows\SysWOW64\authuitu.dll
2013-05-10 15:03 - 2013-05-10 15:14 - 00000000 __SHD C:\ProgramData\{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F}
2013-05-10 07:27 - 2013-05-10 07:27 - 20900984 ____A (Mozilla) C:\Users\Tino\Desktop\Firefox Setup 20.0.1.exe
2013-05-09 16:58 - 2013-05-15 17:56 - 00001147 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-05-07 21:12 - 2013-05-07 23:32 - 00002702 ____A C:\Windows\wininit.ini
2013-05-07 17:12 - 2013-04-04 05:35 - 00095648 ____A (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-05-07 17:12 - 2013-04-04 05:30 - 00174496 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-05-07 17:12 - 2013-04-04 05:29 - 00174496 ____A (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-05-07 17:11 - 2013-05-07 17:12 - 00004032 ____A C:\Windows\SysWOW64\jupdate-1.7.0_21-b11.log
2013-05-07 13:04 - 2013-05-07 13:03 - 00083160 ____A (Avira GmbH) C:\Windows\System32\Drivers\avnetflt.sys
2013-05-06 19:10 - 2013-03-15 09:20 - 00001969 ____A C:\Users\Tino\Desktop\Skype.lnk
 
==================== One Month Modified Files and Folders =======
 
2013-06-04 20:34 - 2011-03-20 20:18 - 00000000 ____D C:\Users\Tino\Documents\Outlook-Dateien
2013-06-04 20:32 - 2013-06-04 20:32 - 00000000 ____D C:\FRST
2013-06-04 20:19 - 2009-11-07 03:40 - 01773011 ____A C:\Windows\WindowsUpdate.log
2013-06-04 19:52 - 2012-03-31 08:54 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-04 19:50 - 2009-11-06 21:57 - 00000000 ____D C:\Users\Tino\AppData\Roaming\Skype
2013-06-04 19:44 - 2011-05-08 03:18 - 00000000 ___HD C:\ProgramData\Spybot - Search & Destroy
2013-06-04 19:37 - 2009-11-25 22:06 - 00001110 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-06-04 19:18 - 2013-05-15 19:15 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-06-04 18:59 - 2009-07-14 06:45 - 00014976 ____A C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-04 18:59 - 2009-07-14 06:45 - 00014976 ____A C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-04 18:51 - 2011-09-24 14:38 - 00000000 ____D C:\Users\Tino\AppData\Roaming\Dropbox
2013-06-04 18:50 - 2011-09-24 14:41 - 00000000 __RAD C:\Users\Tino\Dropbox
2013-06-04 18:50 - 2009-11-25 22:06 - 00001106 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-06-04 18:49 - 2013-06-04 18:49 - 00000056 ____A C:\Windows\setupact.log
2013-06-04 18:49 - 2011-03-25 10:00 - 00235246 ____A C:\Windows\PFRO.log
2013-06-04 18:49 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-04 18:41 - 2013-06-04 18:41 - 00000054 ____A C:\Users\Tino\Desktop\virusname.txt
2013-06-04 16:49 - 2009-11-06 21:26 - 00000000 ____D C:\Users\Tino\AppData\Local\Adobe
2013-06-03 22:02 - 2010-07-29 17:22 - 00000000 ____D C:\Users\Tino\AppData\Roaming\TS3Client
2013-06-02 21:34 - 2013-03-11 19:01 - 00000000 ____D C:\Users\Tino\AppData\Roaming\Winamp
2013-06-02 19:06 - 2013-01-25 17:27 - 00001303 ____A C:\Users\Tino\Desktop\Logitech Webcam Software .lnk
2013-06-02 19:06 - 2011-05-25 13:13 - 00001125 ____A C:\Users\Tino\Desktop\Adobe Photoshop CS5.1 (64 Bit).lnk
2013-05-26 07:55 - 2013-05-26 07:55 - 00000000 ____D C:\Users\Tino\AppData\Roaming\7road
2013-05-25 08:19 - 2012-04-25 19:02 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-05-24 18:36 - 2013-05-24 18:36 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-05-24 16:40 - 2012-10-12 00:49 - 00003825 ____A C:\Users\Tino\Desktop\daten devil.txt
2013-05-22 16:23 - 2009-11-06 21:57 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-05-22 16:23 - 2009-11-06 21:57 - 00000000 ___HD C:\ProgramData\Skype
2013-05-21 17:33 - 2009-12-30 07:06 - 00032945 ____A C:\Users\Tino\Desktop\info.txt
2013-05-20 21:09 - 2013-05-20 21:09 - 00000150 ____A C:\Users\Tino\Desktop\todooo.txt
2013-05-20 15:29 - 2012-01-03 18:42 - 00019856 ____A C:\Users\Tino\Desktop\Abrechnung_designoffice.xlsx
2013-05-20 14:17 - 2013-05-20 14:17 - 00002173 ____A C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2013-05-20 14:17 - 2013-05-20 14:17 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2013-05-20 14:15 - 2011-05-08 03:18 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy
2013-05-18 22:38 - 2011-04-11 08:05 - 00000000 ____D C:\Users\Tino\AppData\Roaming\vlc
2013-05-15 22:38 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-05-15 19:52 - 2012-03-31 08:54 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-05-15 19:52 - 2011-05-17 16:46 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-05-15 19:39 - 2013-05-03 18:05 - 00000000 ____D C:\Users\Tino\AppData\Roaming\Pyqo
2013-05-15 19:27 - 2013-05-15 19:27 - 00262144 ____A C:\Windows\System32\config\elam
2013-05-15 19:24 - 2013-05-15 19:15 - 00620128 ____A (Kaspersky Lab ZAO) C:\Windows\System32\Drivers\klif.sys
2013-05-15 19:24 - 2013-05-15 19:15 - 00090208 ____A (Kaspersky Lab ZAO) C:\Windows\System32\Drivers\klflt.sys
2013-05-15 19:24 - 2012-08-13 16:49 - 00178448 ____A (Kaspersky Lab ZAO) C:\Windows\System32\Drivers\kneps.sys
2013-05-15 19:24 - 2012-06-08 11:38 - 00055056 ____A (Kaspersky Lab ZAO) C:\Windows\System32\Drivers\kltdi.sys
2013-05-15 19:16 - 2013-05-15 19:16 - 00001111 ____A C:\Users\Public\Desktop\Kaspersky Anti-Virus 2013.lnk
2013-05-15 19:15 - 2013-05-15 19:15 - 00000000 ____D C:\Windows\ELAMBKUP
2013-05-15 19:15 - 2013-05-15 19:15 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab
2013-05-15 18:24 - 2013-05-03 18:05 - 00000000 ____D C:\Users\Tino\AppData\Roaming\Afsi
2013-05-15 18:22 - 2009-07-14 06:45 - 05824808 ____A C:\Windows\System32\FNTCACHE.DAT
2013-05-15 18:11 - 2009-11-06 21:11 - 75016696 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-05-15 17:56 - 2013-05-09 16:58 - 00001147 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-05-10 15:14 - 2013-05-10 15:03 - 00000000 __SHD C:\ProgramData\{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F}
2013-05-10 15:14 - 2010-08-31 10:03 - 00000000 ____D C:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}
2013-05-10 15:14 - 2009-12-11 14:25 - 00000000 ____D C:\Users\Tino\AppData\Roaming\Nero
2013-05-10 15:14 - 2009-11-19 18:17 - 00000000 ____D C:\Users\Tino\AppData\Local\Downloaded Installations
2013-05-10 15:14 - 2009-11-06 22:01 - 00000000 ____D C:\Users\Tino\AppData\Local\Microsoft Help
2013-05-10 15:07 - 2013-05-10 15:05 - 00000000 ____D C:\Program Files (x86)\TuneUp Utilities 2013
2013-05-10 15:05 - 2013-05-10 15:05 - 00002209 ____A C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk
2013-05-10 15:05 - 2013-05-10 15:05 - 00002189 ____A C:\Users\Public\Desktop\TuneUp Utilities 2013.lnk
2013-05-10 15:05 - 2011-02-05 15:23 - 00000000 ____D C:\Users\Tino\AppData\Roaming\TuneUp Software
2013-05-10 15:05 - 2011-02-05 15:18 - 00000000 ___HD C:\ProgramData\TuneUp Software
2013-05-10 07:27 - 2013-05-10 07:27 - 20900984 ____A (Mozilla) C:\Users\Tino\Desktop\Firefox Setup 20.0.1.exe
2013-05-10 07:24 - 2013-04-06 13:13 - 00000000 ____D C:\ProgramData\TOSHIBA
2013-05-07 23:32 - 2013-05-07 21:12 - 00002702 ____A C:\Windows\wininit.ini
2013-05-07 17:12 - 2013-05-07 17:11 - 00004032 ____A C:\Windows\SysWOW64\jupdate-1.7.0_21-b11.log
2013-05-07 17:12 - 2009-11-19 15:47 - 00000000 ____D C:\Program Files (x86)\Java
2013-05-07 13:03 - 2013-05-07 13:04 - 00083160 ____A (Avira GmbH) C:\Windows\System32\Drivers\avnetflt.sys
2013-05-05 22:45 - 2013-05-04 21:24 - 00012535 ____A C:\Users\Tino\Desktop\Mappe1.xlsx
 
Files to move or delete:
====================
C:\Users\Public\LeagueofLegends.exe
C:\ProgramData\to_r0tsef.pad
 
==================== Bamital & volsnap Check =================
 
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 
Last Boot: 2013-06-03 21:40
 
==================== End Of Log ============================

--- --- ---

FRST Additions Logfile:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 04-06-2013
Ran by Tino at 2013-06-04 20:35:32 Run:
Running from F:\
Boot Mode: Normal
==========================================================
 
 
==================== Installed Programs =======================
 
@BIOS Ver.2.06 (Version: 2.06)
Add or Remove Adobe Creative Suite 4 Master Collection (Version: 4.0)
Adobe Acrobat X Pro - English, Français, Deutsch (Version: 10.1.6)
Adobe AIR (Version: 3.2.0.2070)
Adobe Anchor Service CS4 (Version: 2.0)
Adobe Asset Services CS3 (Version: 3)
Adobe Bridge 1.0 (Version: 001.000.001)
Adobe Bridge CS3 (Version: 2)
Adobe Bridge CS4 (Version: 3)
Adobe Bridge Start Meeting (Version: 1.0)
Adobe Camera Raw 4.0 (Version: 4.0)
Adobe CMaps CS4 (Version: 2.0)
Adobe Color EU Recommended Settings CS4 (Version: 2.0)
Adobe Color JA Extra Settings CS4 (Version: 2.0)
Adobe Color NA Extra Settings CS4 (Version: 2.0)
Adobe Common File Installer (Version: 1.00.001)
Adobe CSI CS4 (Version: 1)
Adobe CSI CS4 x64 (Version: 1)
Adobe Default Language CS4 (Version: 2.0)
Adobe Download Assistant (Version: 1.2)
Adobe Dreamweaver CS5.5 (Version: 11.5)
Adobe ExtendScript Toolkit 2 (Version: 2.0)
Adobe ExtendScript Toolkit CS4 (Version: 3.0.0)
Adobe Extension Manager CS3 (Version: 1.8)
Adobe Extension Manager CS4 (Version: 2.0)
Adobe Fireworks CS5 (Version: 11.0)
Adobe Fireworks CS6 (Version: 12.0.0)
Adobe Flash Player 10 ActiveX (Version: 10.0.42.34)
Adobe Flash Player 10 ActiveX 64-bit (Version: 10.3.162.28)
Adobe Flash Player 11 Plugin (Version: 11.7.700.202)
Adobe Fonts All (Version: 2.0)
Adobe Help Center 1.0 (Version: 1.0.1)
Adobe Help Manager (Version: 4.0.244)
Adobe Help Viewer CS3 (Version: 1)
Adobe Illustrator CS6 (Version: 16.0)
Adobe InDesign CS4 (Version: 6.0)
Adobe InDesign CS4 Application Feature Set Files (Roman) (Version: 6.0)
Adobe InDesign CS4 Common Base Files (Version: 6.0)
Adobe InDesign CS4 Icon Handler (Version: 6.0)
Adobe InDesign CS4 Icon Handler x64 (Version: 6.0)
Adobe InDesign CS6 (Version: 8.0)
Adobe Linguistics CS4 (Version: 4.0.0)
Adobe Media Player (Version: 0.0.0)
Adobe Media Player (Version: 1.1)
Adobe Output Module (Version: 2.0)
Adobe PDF Library Files CS4 (Version: 9.0)
Adobe Photoshop CS5.1 (Version: 12.1)
Adobe Reader X (10.1.6) - Deutsch (Version: 10.1.6)
Adobe Search for Help (Version: 1.0)
Adobe Service Manager Extension (Version: 1.0)
Adobe Setup (Version: 1.0)
Adobe Setup (Version: 2.0)
Adobe SGM CS4 (Version: 3.0)
Adobe SING CS4 (Version: 2.0)
Adobe Stock Photos 1.0 (Version: 1.0.1)
Adobe Support Advisor (Version: 1.6.1)
Adobe Support Advisor (Version: 1.6.1.20120504)
Adobe SVG Viewer 3.0 (Version: 3.0)
Adobe Type Support CS4 (Version: 9.0)
Adobe Update Manager CS4 (Version: 6.0.0)
Adobe Version Cue CS3 Client (Version: 3)
Adobe Widget Browser (Version: 2.0 Build 230)
Adobe Widget Browser (Version: 2.0.230)
Adobe WinSoft Linguistics Plugin (Version: 1.1)
Adobe XMP Panels CS3 (Version: 1.0)
Adobe XMP Panels CS4 (Version: 2.0)
AdobeColorCommonSetCMYK (Version: 2.0)
AdobeColorCommonSetRGB (Version: 2.0)
Advanced RAR Repair v1.2
Advanced Zip Repair v1.6
Akamai NetSession Interface
Akamai NetSession Interface Service
Alien Skin Xenofex 2.0
AMD Drag and Drop Transcoding (Version: 2.00.0000)
AnyDVD (Version: 6.6.4.2)
Apple Application Support (Version: 2.1.7)
Apple Software Update (Version: 2.1.3.127)
ATI AVIVO64 Codecs (Version: 10.10.0.40918)
ATI Catalyst Install Manager (Version: 3.0.808.0)
ATI Catalyst Registration (Version: 3.00.0000)
ATI Problem Report Wizard (Version: 3.0.745.0)
ATI Stream SDK v2 Developer (Version: 2.3.0.0)
Audiograbber 1.83 SE (Version: 1.83 SE)
Audiograbber MP3-Plugin (Version: 1.0)
Auto Mouse Click version 1.1 (Version: 1.1)
Avira Free Antivirus (Version: 13.0.0.3640)
AVM FRITZ!Box Dokumentation
AVM FRITZ!Box Druckeranschluss
AVM FRITZ!WLAN
Browser Configuration Utility (Version: 1.1.18.0)
Catalyst Control Center - Branding (Version: 1.00.0000)
Catalyst Control Center Graphics Previews Common (Version: 2011.0104.2155.39304)
Catalyst Control Center InstallProxy (Version: 2011.0104.2155.39304)
CCC Help English (Version: 2011.0104.2154.39304)
ccc-core-static (Version: 2011.0104.2155.39304)
ccc-utility64 (Version: 2011.0104.2155.39304)
CDBurnerXP (Version: 4.3.6.2284)
Connect (Version: 1.0.0.1)
Corsair VENGEANCE 2000 (Version: )
CSS3 Menu
DivX Converter (Version: 7.1.0)
DivX Plus DirectShow Filters
DivX-Setup (Version: 2.3.0.20)
Dropbox (Version: 1.6.18)
DVDVideoSoftTB Toolbar (Version: )
Eye Candy 4000
Facebook Video Calling 1.2.0.287 (Version: 1.2.287)
Free FLV Converter V 7.4.0 (Version: 7.4.0.0)
Free M4a to MP3 Converter 6.2
Free YouTube to MP3 Converter version 3.12.1.320 (Version: 3.12.1.320)
Futuremark SystemInfo (Version: 3.51.1.1)
Gigabyte Raid Configurer (Version: 1.00.0001)
Google Chrome (Version: 27.0.1453.94)
Google Update Helper (Version: 1.3.21.145)
HydraVision (Version: 4.2.114.0)
ICQ Toolbar (Version: 3.0.0)
ICQ7.5 (Version: 7.5)
ImagXpress (Version: 7.0.74.0)
Java 7 Update 21 (Version: 7.0.210)
Java Auto Updater (Version: 2.1.9.5)
Java(TM) 6 Update 22 (Version: 6.0.220)
Java(TM) 6 Update 30 (64-bit) (Version: 6.0.300)
Java(TM) 6 Update 35 (Version: 6.0.350)
Kaspersky Anti-Virus 2013 (Version: 13.0.1.4190)
Koyote Soft Toolbar v5.1 (Version: 5.1)
kuler (Version: 2.0)
Macromedia Extension Manager (Version: 1.5)
Microangelo Toolset 6 (Version: 6.10.1)
Microsoft .NET Compact Framework 2.0 SP1 (Version: 2.0.6129)
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 (Version: 1.1.4322)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft Office Access MUI (German) 2010 (Version: 14.0.4763.1000)
Microsoft Office Excel MUI (German) 2010 (Version: 14.0.4763.1000)
Microsoft Office Groove MUI (German) 2010 (Version: 14.0.4763.1000)
Microsoft Office InfoPath MUI (German) 2010 (Version: 14.0.4763.1000)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.4763.1000)
Microsoft Office OneNote MUI (German) 2010 (Version: 14.0.4763.1000)
Microsoft Office Outlook MUI (German) 2010 (Version: 14.0.4763.1000)
Microsoft Office PowerPoint MUI (German) 2010 (Version: 14.0.4763.1000)
Microsoft Office Professional Plus 2010 (Version: 14.0.4763.1000)
Microsoft Office Proof (English) 2010 (Version: 14.0.4763.1000)
Microsoft Office Proof (French) 2010 (Version: 14.0.4763.1000)
Microsoft Office Proof (German) 2010 (Version: 14.0.4763.1000)
Microsoft Office Proof (Italian) 2010 (Version: 14.0.4763.1000)
Microsoft Office Proofing (German) 2010 (Version: 14.0.4763.1000)
Microsoft Office Publisher MUI (German) 2010 (Version: 14.0.4763.1000)
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.4763.1000)
Microsoft Office Shared MUI (German) 2010 (Version: 14.0.4763.1000)
Microsoft Office Word MUI (German) 2010 (Version: 14.0.4763.1000)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Windows Media Video 9 VCM
Microsoft WSE 3.0 Runtime (Version: 3.0.5305.0)
Microsoft XNA Framework Redistributable 3.1 (Version: 3.1.10527.0)
Microsoft_VC80_ATL_x86 (Version: 8.0.50727.4053)
Microsoft_VC80_ATL_x86_x64 (Version: 8.0.50727.4053)
Microsoft_VC80_CRT_x86 (Version: 1.00.0000)
Microsoft_VC80_CRT_x86 (Version: 8.0.50727.4053)
Microsoft_VC80_CRT_x86_x64 (Version: 8.0.50727.4053)
Microsoft_VC80_MFC_x86 (Version: 8.0.50727.4053)
Microsoft_VC80_MFC_x86_x64 (Version: 8.0.50727.4053)
Microsoft_VC80_MFCLOC_x86 (Version: 8.0.50727.4053)
Microsoft_VC80_MFCLOC_x86_x64 (Version: 80.50727.4053)
Microsoft_VC90_ATL_x86 (Version: 1.00.0000)
Microsoft_VC90_ATL_x86_x64 (Version: 1.00.0000)
Microsoft_VC90_CRT_x86 (Version: 1.00.0000)
Microsoft_VC90_CRT_x86_x64 (Version: 1.00.0000)
Microsoft_VC90_MFC_x86 (Version: 1.00.0000)
Microsoft_VC90_MFC_x86_x64 (Version: 1.00.0000)
Microsoft_VC90_MFCLOC_x86 (Version: 1.00.0000)
Microsoft_VC90_MFCLOC_x86_x64 (Version: 1.00.0000)
Microsoft-Maus- und Tastatur-Center (Version: 2.1.177.0)
Mozilla Firefox 21.0 (x86 de) (Version: 21.0)
Mozilla Firefox 4.0 (x86 de) (Version: 4.0)
Mozilla Firefox 4.0b10 (x86 de) (Version: 4.0b10)
Mozilla Firefox 4.0b6 (x86 de) (Version: 4.0b6)
Mozilla Firefox 4.0b8 (x86 de) (Version: 4.0b8)
Mozilla Firefox 4.0b9 (x86 de) (Version: 4.0b9)
Mozilla Maintenance Service (Version: 21.0)
Mozilla Thunderbird (3.1.10) (Version: 3.1.10 (de))
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
NEC Electronics USB 3.0 Host Controller Driver (Version: 1.0.18.0)
neroxml (Version: 1.0.0)
NVIDIA PhysX (Version: 9.10.0513)
ON_OFF Charge B10.0422.2 (Version: 1.00.0001)
OpenAL
OpenOffice.org 3.3 (Version: 3.3.9567)
Pando Media Booster (Version: 2.6.0.7)
PDF Passwort Knacker 1
PDF Settings CS4 (Version: 9.0)
PDF Settings CS5 (Version: 10.0)
PDF Settings CS6 (Version: 11.0)
Photoshop Camera Raw (Version: 5.0)
PixiePack Codec Pack (Version: 1.1.1200.0)
ProtectDisc Driver, Version 11 (Version: 11.0.0.14)
QuickTime (Version: 7.72.80.56)
RAR Repair Tool v.4.0.1
Realtek Ethernet Controller Driver (Version: 7.46.531.2011)
Realtek High Definition Audio Driver (Version: 6.0.1.6077)
Skype Click to Call (Version: 5.9.9216)
Skype™ 6.3 (Version: 6.3.107)
Spelling Dictionaries Support For Adobe Reader 9 (Version: 9.0.0)
Spybot - Search & Destroy (Version: 2.0.12)
Suite Shared Configuration CS4 (Version: 1.0)
TeamSpeak 2 RC2 (Version: 2.0.32.60)
TeamSpeak 3 Client (Version: 3.0.10.1)
TeamViewer 6 (Version: 6.0.10722)
TeamViewer 7 (Version: 7.0.12799)
Total Commander (Remove or Repair) (Version: 7.55 public beta 3)
TS Notifier (Version: 1.3.6)
TuneUp Utilities 2013 (Version: 13.0.3020.2)
TuneUp Utilities Language Pack (de-DE) (Version: 10.0.3000.104)
TuneUp Utilities Language Pack (de-DE) (Version: 13.0.3020.2)
Tunngle beta
Ubisoft Game Launcher (Version: 1.0.0.0)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
VC80CRTRedist - 8.0.50727.4053 (Version: 1.1.0)
VCRedistSetup (Version: 1.0.0)
Virtual Audio Cable 4.10
VLC media player 2.0.0 (Version: 2.0.0)
Winamp (Version: 5.63 )
Winamp Erkennungs-Plug-in (Version: 1.0.0.1)
Windows Media Player Firefox Plugin (Version: 1.0.0.8)
Windows Searchqu Toolbar (Version: 4.1.0.2790)
WinRAR
Wise Registry Cleaner 5.9.1 (Version: 5.9.1)
WMV9/VC-1 Video Playback (Version: 1.00.0000)
XnView 1.96.5 (Version: 1.96.5)
 
==================== Restore Points =========================
 
03-06-2013 19:48:36 Geplanter Prüfpunkt
 
==================== Hosts content: ==========================
 
127.0.0.1 199.7.54.72
127.0.0.1 gosredirector.ea.com
127.0.0.1 blazeserver.blazeemu.org
127.0.0.1 gosgvaprod-qos01.ea.com
127.0.0.1 gosiadprod-qos01.ea.com
127.0.0.1 gossjcprod-qos01.ea.com
127.0.0.1 demangler.ea.com
127.0.0.1 vmp.tools.gos.ea.com
127.0.0.1 activate.adobe.com
127.0.0.1 practivate.adobe.com
127.0.0.1 ereg.adobe.com
127.0.0.1 activate.wip3.adobe.com
127.0.0.1 wip3.adobe.com
127.0.0.1 3dns-3.adobe.com
127.0.0.1 3dns-2.adobe.com
127.0.0.1 adobe-dns.adobe.com
127.0.0.1 adobe-dns-2.adobe.com
127.0.0.1 adobe-dns-3.adobe.com
127.0.0.1 ereg.wip3.adobe.com
127.0.0.1 activate-sea.adobe.com
 
There are more than 17 lines starting with "127.0.0.1"
 
 
==================== Faulty Device Manager Devices =============
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (06/04/2013 05:56:56 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: SearchProtocolHost.exe, Version: 7.0.7601.17610, Zeitstempel: 0x4dc0d006
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel: 0x4ec4aa8e
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000009970a
ID des fehlerhaften Prozesses: 0x134c
Startzeit der fehlerhaften Anwendung: 0xSearchProtocolHost.exe0
Pfad der fehlerhaften Anwendung: SearchProtocolHost.exe1
Pfad des fehlerhaften Moduls: SearchProtocolHost.exe2
Berichtskennung: SearchProtocolHost.exe3
 
Error: (06/03/2013 09:57:31 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: DllHost.exe, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bca54
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel: 0x4ec4aa8e
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000009970a
ID des fehlerhaften Prozesses: 0x12b0
Startzeit der fehlerhaften Anwendung: 0xDllHost.exe0
Pfad der fehlerhaften Anwendung: DllHost.exe1
Pfad des fehlerhaften Moduls: DllHost.exe2
Berichtskennung: DllHost.exe3
 
Error: (06/03/2013 09:48:51 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: DllHost.exe, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bca54
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel: 0x4ec4aa8e
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000009970a
ID des fehlerhaften Prozesses: 0x1df4
Startzeit der fehlerhaften Anwendung: 0xDllHost.exe0
Pfad der fehlerhaften Anwendung: DllHost.exe1
Pfad des fehlerhaften Moduls: DllHost.exe2
Berichtskennung: DllHost.exe3
 
Error: (06/03/2013 09:44:16 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.
 
Error: (06/03/2013 09:12:01 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: DllHost.exe, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bca54
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel: 0x4ec4aa8e
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000009970a
ID des fehlerhaften Prozesses: 0xff8
Startzeit der fehlerhaften Anwendung: 0xDllHost.exe0
Pfad der fehlerhaften Anwendung: DllHost.exe1
Pfad des fehlerhaften Moduls: DllHost.exe2
Berichtskennung: DllHost.exe3
 
Error: (06/03/2013 08:57:15 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: DllHost.exe, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bca54
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel: 0x4ec4aa8e
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000009970a
ID des fehlerhaften Prozesses: 0x12f4
Startzeit der fehlerhaften Anwendung: 0xDllHost.exe0
Pfad der fehlerhaften Anwendung: DllHost.exe1
Pfad des fehlerhaften Moduls: DllHost.exe2
Berichtskennung: DllHost.exe3
 
Error: (06/03/2013 08:56:32 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Der Textzeichenfolgenwert zur Beschreibung des Leistungsindikators in der Registrierung ist falsch formatiert. Die falsch formatierte Zeichenfolge ist "". Das erste DWORD im Datenbereich enthält den Indexwert für die falsch formatierte Zeichenfolge, während das zweite und dritte DWORD im Datenbereich die letzten gültigen Indexwerte enthalten.
 
Error: (06/03/2013 07:20:40 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: DllHost.exe, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bca54
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel: 0x4ec4aa8e
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000009970a
ID des fehlerhaften Prozesses: 0x1588
Startzeit der fehlerhaften Anwendung: 0xDllHost.exe0
Pfad der fehlerhaften Anwendung: DllHost.exe1
Pfad des fehlerhaften Moduls: DllHost.exe2
Berichtskennung: DllHost.exe3
 
Error: (06/03/2013 07:19:14 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: DllHost.exe, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bca54
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel: 0x4ec4aa8e
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000009970a
ID des fehlerhaften Prozesses: 0x13f8
Startzeit der fehlerhaften Anwendung: 0xDllHost.exe0
Pfad der fehlerhaften Anwendung: DllHost.exe1
Pfad des fehlerhaften Moduls: DllHost.exe2
Berichtskennung: DllHost.exe3
 
Error: (06/03/2013 06:29:21 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: DllHost.exe, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bca54
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel: 0x4ec4aa8e
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000009970a
ID des fehlerhaften Prozesses: 0x1948
Startzeit der fehlerhaften Anwendung: 0xDllHost.exe0
Pfad der fehlerhaften Anwendung: DllHost.exe1
Pfad des fehlerhaften Moduls: DllHost.exe2
Berichtskennung: DllHost.exe3
 
 
System errors:
=============
Error: (06/04/2013 06:53:02 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "PnP-X-IP-Busenumerator" ist vom Dienst "Funktionssuchanbieter-Host" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1058
 
Error: (06/04/2013 06:52:02 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Heimnetzgruppen-Anbieter" ist vom Dienst "Funktionssuchanbieter-Host" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1058
 
Error: (06/04/2013 04:42:05 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "PnP-X-IP-Busenumerator" ist vom Dienst "Funktionssuchanbieter-Host" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1058
 
Error: (06/04/2013 04:42:03 PM) (Source: WMPNetworkSvc) (User: )
Description: WMPNetworkSvc0x80004005
 
Error: (06/04/2013 04:42:01 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Microsoft .NET Framework NGEN v4.0.30319_X86 erreicht.
 
Error: (06/04/2013 04:40:52 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Heimnetzgruppen-Anbieter" ist vom Dienst "Funktionssuchanbieter-Host" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1058
 
Error: (06/03/2013 09:54:58 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk3\DR4 gefunden.
 
Error: (06/03/2013 09:54:57 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk3\DR4 gefunden.
 
Error: (06/03/2013 09:54:56 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk3\DR4 gefunden.
 
Error: (06/03/2013 03:37:45 PM) (Source: DCOM) (User: )
Description: {4EB61BAC-A3B6-4760-9581-655041EF4D69}
 
 
Microsoft Office Sessions:
=========================
Error: (06/04/2013 05:56:56 PM) (Source: Application Error)(User: )
Description: SearchProtocolHost.exe7.0.7601.176104dc0d006ntdll.dll6.1.7601.177254ec4aa8ec0000005000000000009970a134c01ce613c22b21622C:\Windows\system32\SearchProtocolHost.exeC:\Windows\SYSTEM32\ntdll.dll613564c0-cd2f-11e2-bb07-00e04c1cab8a
 
Error: (06/03/2013 09:57:31 PM) (Source: Application Error)(User: )
Description: DllHost.exe6.1.7600.163854a5bca54ntdll.dll6.1.7601.177254ec4aa8ec0000005000000000009970a12b001ce609494413183C:\Windows\system32\DllHost.exeC:\Windows\SYSTEM32\ntdll.dlld31cda9c-cc87-11e2-b727-00e04c1cab8a
 
Error: (06/03/2013 09:48:51 PM) (Source: Application Error)(User: )
Description: DllHost.exe6.1.7600.163854a5bca54ntdll.dll6.1.7601.177254ec4aa8ec0000005000000000009970a1df401ce60935dd96b7aC:\Windows\system32\DllHost.exeC:\Windows\SYSTEM32\ntdll.dll9d2c1b11-cc86-11e2-b727-00e04c1cab8a
 
Error: (06/03/2013 09:44:16 PM) (Source: SideBySide)(User: )
Description: assemblyIdentityversionMAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINORC:\Program Files (x86)\Adobe\Adobe Fireworks CS4\Configuration\Win\Shared\AdobeAIR\SDK\runtime\Adobe AIR\Versions\1.0\Adobe AIR.dllC:\Program Files (x86)\Adobe\Adobe Fireworks CS4\Configuration\Win\Shared\AdobeAIR\SDK\runtime\Adobe AIR\Versions\1.0\Adobe AIR.dll3
 
Error: (06/03/2013 09:12:01 PM) (Source: Application Error)(User: )
Description: DllHost.exe6.1.7600.163854a5bca54ntdll.dll6.1.7601.177254ec4aa8ec0000005000000000009970aff801ce608e3949e0ecC:\Windows\system32\DllHost.exeC:\Windows\SYSTEM32\ntdll.dll778e50de-cc81-11e2-b727-00e04c1cab8a
 
Error: (06/03/2013 08:57:15 PM) (Source: Application Error)(User: )
Description: DllHost.exe6.1.7600.163854a5bca54ntdll.dll6.1.7601.177254ec4aa8ec0000005000000000009970a12f401ce608c290060eaC:\Windows\system32\DllHost.exeC:\Windows\SYSTEM32\ntdll.dll6779eb64-cc7f-11e2-b727-00e04c1cab8a
 
Error: (06/03/2013 08:56:32 PM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: 1600000000A7330000A7330000980B0000
 
Error: (06/03/2013 07:20:40 PM) (Source: Application Error)(User: )
Description: DllHost.exe6.1.7600.163854a5bca54ntdll.dll6.1.7601.177254ec4aa8ec0000005000000000009970a158801ce607eac0d1859C:\Windows\system32\DllHost.exeC:\Windows\SYSTEM32\ntdll.dlle9c4887a-cc71-11e2-b727-00e04c1cab8a
 
Error: (06/03/2013 07:19:14 PM) (Source: Application Error)(User: )
Description: DllHost.exe6.1.7600.163854a5bca54ntdll.dll6.1.7601.177254ec4aa8ec0000005000000000009970a13f801ce607e77c6fb67C:\Windows\system32\DllHost.exeC:\Windows\SYSTEM32\ntdll.dllb6072589-cc71-11e2-b727-00e04c1cab8a
 
Error: (06/03/2013 06:29:21 PM) (Source: Application Error)(User: )
Description: DllHost.exe6.1.7600.163854a5bca54ntdll.dll6.1.7601.177254ec4aa8ec0000005000000000009970a194801ce60777f29ad2fC:\Windows\system32\DllHost.exeC:\Windows\SYSTEM32\ntdll.dllbe0ecc4c-cc6a-11e2-b727-00e04c1cab8a
 
 
CodeIntegrity Errors:
===================================
Date: 2013-06-03 21:45:17.654
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 
Date: 2013-06-03 21:45:17.652
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 
Date: 2013-06-03 21:45:17.650
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 
Date: 2013-06-03 21:45:17.633
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 
Date: 2013-06-03 21:45:17.632
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 
Date: 2013-06-03 21:45:17.630
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 
Date: 2013-05-28 20:29:21.655
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 
Date: 2013-05-28 20:29:21.654
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 
Date: 2013-05-28 20:29:21.652
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 
Date: 2013-05-28 20:29:21.629
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 
 
==================== Memory info =========================== 
 
Percentage of memory in use: 59%
Total physical RAM: 6142.43 MB
Available physical RAM: 2491.62 MB
Total Pagefile: 12283.04 MB
Available Pagefile: 8430.71 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB
 
==================== Drives ================================
 
Drive c: () (Fixed) (Total:97.66 GB) (Free:28.5 GB) NTFS
Drive d: (Projekte) (Fixed) (Total:146.48 GB) (Free:38.54 GB) NTFS
Drive e: (Multimedia) (Fixed) (Total:465.76 GB) (Free:172.5 GB) NTFS (Disk=1 Partition=1)
Drive f: (Multimedia NEU) (Fixed) (Total:488.28 GB) (Free:105.37 GB) NTFS
Drive g: (Games) (Fixed) (Total:198.99 GB) (Free:27.06 GB) NTFS
Drive h: (CNC3) (CDROM) (Total:6.2 GB) (Free:0 GB) UDF
Drive k: (Medien) (Fixed) (Total:465.76 GB) (Free:27.89 GB) NTFS (Disk=2 Partition=1)
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 19654229)
Partition 1: (Not Active) - (Size=993 KB) - (Type=42)
Partition 2: (Active) - (Size=100 MB) - (Type=42)
Partition 3: (Not Active) - (Size=98 GB) - (Type=42)
Partition 4: (Not Active) - (Size=834 GB) - (Type=42)
 
========================================================
Disk: 1 (MBR Code: Windows 7 or Vista) (Size: 466 GB) (Disk ID: 18D865C9)
Partition 1: (Not Active) - (Size=466 GB) - (Type=07 NTFS)
 
========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: C2A42FE7)
Partition 1: (Not Active) - (Size=466 GB) - (Type=07 NTFS)
 
==================== End Of Log ============================

--- --- ---
--- --- ---
.

schrauber · 04.06.2013, 20:01

Hi,

warum läuft das Tool von Laufwerk F:?

Bitte auf den Desktop holen, dann das:

Fix mit FRST
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

C:\ProgramData\to_r0tsef.pad

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Fix Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Tino Schmoz · 04.06.2013, 20:07

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 04-06-2013
Ran by Tino at 2013-06-04 21:06:49 Run:1
Running from C:\Users\Tino\Desktop
Boot Mode: Normal
==============================================

C:\ProgramData\to_r0tsef.pad => Moved successfully.

==== End of Fixlog ====

schrauber · 04.06.2013, 20:08

supi,

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

Bitte ein frisches FRST SCanlog.

Logs in Codetags:

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Tino Schmoz · 05.06.2013, 06:07

Hier kommt Teil 1 ....

Zitat:

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=3fcb135f9b25a04891469201f8a9d57e
# engine=13995
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-06-05 03:15:12
# local_time=2013-06-05 05:15:12 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 96 37533 116165132 37838 0
# compatibility_mode=5893 16776574 100 94 6721653 122031962 0 0
# scanned=833474
# found=35
# cleaned=0
# scan_time=28401
sh=FFC2487F06FC60BC720510E5BE60447E4B153613 ft=0 fh=0000000000000000 vn="Win32/Bagle.gen.zip worm" ac=I fn="C:\ProgramData\Spybot - Search & Destroy\Recovery\SweetIM227.zip"
sh=B008101F5D29495721D9C930CC70D865127183DD ft=0 fh=0000000000000000 vn="Win32/Bagle.gen.zip worm" ac=I fn="C:\ProgramData\Spybot - Search & Destroy\Recovery\SweetIM228.zip"
sh=493771AFB7A51DDE3816D4403F4C84EFFC81ED56 ft=0 fh=0000000000000000 vn="Win32/Bagle.gen.zip worm" ac=I fn="C:\ProgramData\Spybot - Search & Destroy\Recovery\SweetIM229.zip"
sh=535B7D22D4BF5DC8F6E4FEE3004C16D494A650DA ft=0 fh=0000000000000000 vn="Win32/Bagle.gen.zip worm" ac=I fn="C:\ProgramData\Spybot - Search & Destroy\Recovery\SweetIM230.zip"
sh=F16F0C846A7ECFDEA3C52FD61D4002314617BBD7 ft=0 fh=0000000000000000 vn="Win32/Bagle.gen.zip worm" ac=I fn="C:\ProgramData\Spybot - Search & Destroy\Recovery\SweetIM462.zip"
sh=7695E96445243A8C2A0D9B296249B36F993D33B5 ft=0 fh=0000000000000000 vn="Win32/Bagle.gen.zip worm" ac=I fn="C:\ProgramData\Spybot - Search & Destroy\Recovery\SweetIM463.zip"
sh=FFC2487F06FC60BC720510E5BE60447E4B153613 ft=0 fh=0000000000000000 vn="Win32/Bagle.gen.zip worm" ac=I fn="C:\Users\All Users\Spybot - Search & Destroy\Recovery\SweetIM227.zip"
sh=B008101F5D29495721D9C930CC70D865127183DD ft=0 fh=0000000000000000 vn="Win32/Bagle.gen.zip worm" ac=I fn="C:\Users\All Users\Spybot - Search & Destroy\Recovery\SweetIM228.zip"
sh=493771AFB7A51DDE3816D4403F4C84EFFC81ED56 ft=0 fh=0000000000000000 vn="Win32/Bagle.gen.zip worm" ac=I fn="C:\Users\All Users\Spybot - Search & Destroy\Recovery\SweetIM229.zip"
sh=535B7D22D4BF5DC8F6E4FEE3004C16D494A650DA ft=0 fh=0000000000000000 vn="Win32/Bagle.gen.zip worm" ac=I fn="C:\Users\All Users\Spybot - Search & Destroy\Recovery\SweetIM230.zip"
sh=F16F0C846A7ECFDEA3C52FD61D4002314617BBD7 ft=0 fh=0000000000000000 vn="Win32/Bagle.gen.zip worm" ac=I fn="C:\Users\All Users\Spybot - Search & Destroy\Recovery\SweetIM462.zip"
sh=7695E96445243A8C2A0D9B296249B36F993D33B5 ft=0 fh=0000000000000000 vn="Win32/Bagle.gen.zip worm" ac=I fn="C:\Users\All Users\Spybot - Search & Destroy\Recovery\SweetIM463.zip"
sh=1FA2801776006BFD78666CFBC35E3C6D3F685967 ft=0 fh=0000000000000000 vn="Java/Exploit.Agent.NVU trojan" ac=I fn="C:\Users\Tino\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18\3c109712-556eb285"
sh=874777035C852F3B310F99348E2AF74320D92C5F ft=0 fh=0000000000000000 vn="a variant of Java/Exploit.CVE-2013-1493.BH trojan" ac=I fn="C:\Users\Tino\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43\4abbd2b-54148aa9"
sh=383E9137D90E18910F8EA49B14C2A813A088601C ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\Tino\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46\75fa62e-490a73a8"
sh=3DD01E97E7420D630DF78E994DBE1902AC4E027C ft=0 fh=0000000000000000 vn="PHP/Agent.AS trojan" ac=I fn="D:\01 Webprojekte 2009\CS-Agentur-Dresden\backup dez 12\wp-content\themes\slash\functions.php"
sh=3DD01E97E7420D630DF78E994DBE1902AC4E027C ft=0 fh=0000000000000000 vn="PHP/Agent.AS trojan" ac=I fn="D:\01 Webprojekte 2009\CS-Agentur-Dresden\Backup Wordpress\wp-content\themes\slash\functions.php"
sh=3DD01E97E7420D630DF78E994DBE1902AC4E027C ft=0 fh=0000000000000000 vn="PHP/Agent.AS trojan" ac=I fn="D:\01 Webprojekte 2009\CS-Agentur-Dresden\WP_Template\slash\functions.php"
sh=E48E9F154055DBA44EF807886C2ECF12B5689EA4 ft=0 fh=0000000000000000 vn="PHP/Kryptik.AB trojan" ac=I fn="D:\01 Webprojekte 2009\Cyntec-Design 2009\Backup-Webspace Februar 2012\wordpress\wp-content\themes\Stripey\footer.php"
sh=5EB78826E0D04CB11B38E051EE0060B9C877C9FE ft=0 fh=0000000000000000 vn="PHP/Agent.AS trojan" ac=I fn="D:\01 Webprojekte 2009\Palomita-Pix _ Alexander Wedekind\Slash_WP.rar"
sh=3DD01E97E7420D630DF78E994DBE1902AC4E027C ft=0 fh=0000000000000000 vn="PHP/Agent.AS trojan" ac=I fn="D:\01 Webprojekte 2009\Palomita-Pix _ Alexander Wedekind\backup Slash Theme Januar 2013 v1_21\slash\functions.php"
sh=3DD01E97E7420D630DF78E994DBE1902AC4E027C ft=0 fh=0000000000000000 vn="PHP/Agent.AS trojan" ac=I fn="D:\01 Webprojekte 2009\Palomita-Pix _ Alexander Wedekind\Backup- palomita-pix.de\relaunch\wp-content\themes\slash\functions.php"
sh=3DD01E97E7420D630DF78E994DBE1902AC4E027C ft=0 fh=0000000000000000 vn="PHP/Agent.AS trojan" ac=I fn="D:\01 Webprojekte 2009\Palomita-Pix _ Alexander Wedekind\Backup- palomita-pix.de januar 2013\wp-content\themes\slash\functions.php"
sh=3DD01E97E7420D630DF78E994DBE1902AC4E027C ft=0 fh=0000000000000000 vn="PHP/Agent.AS trojan" ac=I fn="D:\01 Webprojekte 2009\Palomita-Pix _ Alexander Wedekind\Slash WP\slash\functions.php"
sh=3A186C174C4F2C12885CC757527ECDC2D18FDDE3 ft=0 fh=0000000000000000 vn="PHP/Kryptik.AB trojan" ac=I fn="D:\01 Webprojekte 2009\Sudmerberg\2011\Bilder Sudmerberg\bilder\media\images\image.php"
sh=3A186C174C4F2C12885CC757527ECDC2D18FDDE3 ft=0 fh=0000000000000000 vn="PHP/Kryptik.AB trojan" ac=I fn="D:\01 Webprojekte 2009\Sudmerberg\Internetseite\Stand August2009\bilder\media\images\image.php"
sh=3A186C174C4F2C12885CC757527ECDC2D18FDDE3 ft=0 fh=0000000000000000 vn="PHP/Kryptik.AB trojan" ac=I fn="D:\01 Webprojekte 2009\Sudmerberg\Internetseite\Stand Juli2009\bilder\media\images\image.php"
sh=5EB78826E0D04CB11B38E051EE0060B9C877C9FE ft=0 fh=0000000000000000 vn="PHP/Agent.AS trojan" ac=I fn="D:\11_wordpress themes\Slash_WP.rar"
sh=3A186C174C4F2C12885CC757527ECDC2D18FDDE3 ft=0 fh=0000000000000000 vn="PHP/Kryptik.AB trojan" ac=I fn="E:\Backup Projektdaten 11_11_2009\Sudmerberg\Internetseite\Stand August2009\bilder\media\images\image.php"
sh=3A186C174C4F2C12885CC757527ECDC2D18FDDE3 ft=0 fh=0000000000000000 vn="PHP/Kryptik.AB trojan" ac=I fn="E:\Backup Projektdaten 11_11_2009\Sudmerberg\Internetseite\Stand Juli2009\bilder\media\images\image.php"
sh=4B175AA88422F0DD7302FBD396A343850207C8FA ft=0 fh=0000000000000000 vn="PHP/Agent.AS trojan" ac=I fn="F:\Classy-v.1.11_SUPER WP THEME CAR.rar"
sh=7415AE57BD072D31C4E5EF490713769B70C07743 ft=0 fh=0000000000000000 vn="PHP/Agent.AS trojan" ac=I fn="F:\config_v1.0.rar"
sh=929294DD5E7BBF666930A63D63FFB380811E78CE ft=0 fh=0000000000000000 vn="PHP/Agent.AS trojan" ac=I fn="F:\Progressio-v1.2_webdesign.rar"
sh=9A53F71A916F8259F19F1334333DC95C4DD934D4 ft=0 fh=0000000000000000 vn="PHP/Agent.AS trojan" ac=I fn="F:\slash_v1.0.rar"
sh=18C62A4719E7982F587A12969FF97C2CE512DDC2 ft=0 fh=0000000000000000 vn="PHP/Kryptik.AB trojan" ac=I fn="F:\Stripey.zip"

Part 2 .....

Zitat:

Results of screen317's Security Check version 0.99.64
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 10
``````````````Antivirus/Firewall Check:``````````````
Kaspersky Anti-Virus
Avira Desktop
Antivirus up to date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
Spybot - Search & Destroy
TuneUp Utilities 2013
TuneUp Utilities Language Pack (de-DE)
TuneUp Utilities 2013
TuneUp Utilities Language Pack (de-DE)
Wise Registry Cleaner 5.9.1
Java(TM) 6 Update 22
Java(TM) 6 Update 35
Java 7 Update 21
Adobe Flash Player 10 Flash Player out of Date!
Adobe Flash Player 11.7.700.202
Adobe Reader 9 Adobe Reader out of Date!
Adobe Reader 10.1.6 Adobe Reader out of Date!
Mozilla Firefox 4.0b9 Firefox out of Date!
Mozilla Thunderbird (3.1.10) Thunderbird out of Date!
Google Chrome 26.0.1410.64
Google Chrome 27.0.1453.94
````````Process Check: objlist.exe by Laurent````````
Spybot Teatimer.exe is disabled!
Avira Antivir avgnt.exe
Avira Antivir avguard.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````

ein frisches FRST SCanlog.
---------------------------------

Zitat:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-06-2013
Ran by Tino (administrator) on 05-06-2013 07:17:26
Running from C:\Users\Tino\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
() C:\Windows\SysWOW64\srvany.exe
() C:\Windows\KMService.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version7\TeamViewer.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesApp64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version7\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version7\tv_x64.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
() C:\Program Files\Corsair VENGEANCE 2000\CPL\CAHS2.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Dropbox, Inc.) C:\Users\Tino\AppData\Roaming\Dropbox\bin\Dropbox.exe
(NEC Electronics Corporation) C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
(Bandoo Media, inc) C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\datamngrUI.exe
(Nullsoft, Inc.) C:\Program Files (x86)\Winamp\winampa.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Ghisler Software GmbH) C:\totalcmd\TOTALCMD.EXE
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Microsoft Corporation) C:\Windows\system32\AUDIODG.EXE
(Microsoft Corporation) C:\Windows\system32\msfeedssync.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SYMPHONYSound] C:\Program Files\Corsair VENGEANCE 2000\CPL\CAHS2.exe -show_trayicon [1733120 2012-04-11] ()
HKCU\...\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun [1475584 2010-11-20] (Microsoft Corporation)
HKCU\...\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun [18678376 2013-04-19] (Skype Technologies S.A.)
HKCU\...\Run: [Spybot-S&D Cleaning] "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe" /autoclean [3713032 2012-11-13] (Safer-Networking Ltd.)
MountPoints2: K - K:\LaunchU3.exe -a
MountPoints2: M - M:\LaunchU3.exe -a
MountPoints2: {01332cd1-1e11-11df-95dd-001f3f0801d2} - I:\setup.exe
MountPoints2: {0c2bca64-0135-11e1-af1d-00e04c1cab8a} - K:\LaunchU3.exe -a
MountPoints2: {22560e36-56e5-11df-97f8-001f3f0801d2} - J:\autorun.exe -auto
MountPoints2: {888dbb56-66be-11e0-ac04-806e6f6e6963} - H:\autorun.exe
MountPoints2: {a75dba78-4496-11df-9245-002421b8bc80} - M:\LaunchU3.exe -a
MountPoints2: {c244ec08-66bc-11e0-97ac-806e6f6e6963} - H:\Run.exe
MountPoints2: {c30bd719-cb3e-11de-a7fb-806e6f6e6963} - K:\pushinst.exe
HKLM-x32\...\Run: [NUSB3MON] "C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [106496 2009-11-20] (NEC Electronics Corporation)
HKLM-x32\...\Run: [] [x]
HKLM-x32\...\Run: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [825560 2012-12-18] (Adobe Systems Inc.)
HKLM-x32\...\Run: [DATAMNGR] C:\PROGRA~2\WIA6EB~1\Datamngr\DATAMN~1.EXE [1823160 2012-06-06] (Bandoo Media, inc)
HKLM-x32\...\Run: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin [406992 2010-02-22] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [WinampAgent] "C:\Program Files (x86)\Winamp\winampa.exe" [74752 2012-06-28] (Nullsoft, Inc.)
HKLM-x32\...\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min [345312 2013-05-07] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [AVP] "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe" [356376 2013-05-15] (Kaspersky Lab ZAO)
HKLM-x32\...\Run: [SDTray] "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe" [3825176 2012-11-13] (Safer-Networking Ltd.)
HKU\Gast\...\Run: [LightScribe Control Panel] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden [x]
HKU\Gast\...\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized [18678376 2013-04-19] (Skype Technologies S.A.)
HKU\Gast\...\Policies\system: [LogonHoursAction] 2
HKU\Gast\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
AppInit_DLLs: C:\PROGRA~2\WIA6EB~1\Datamngr\x64\datamngr.dll C:\PROGRA~2\WIA6EB~1\Datamngr\x64\IEBHO.dll [1528760 2012-06-06] (Bandoo Media, inc)
Startup: C:\Users\Tino\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk
ShortcutTarget: Adobe Gamma.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
Startup: C:\Users\Tino\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Tino\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = MSN Deutschland: Aktuelle Nachrichten, Outlook.com Email und Skype Login.
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
URLSearchHook: (No Name) - {1E864EAC-892F-4A60-8C17-63123FD5731C} - No File
URLSearchHook: (No Name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - No File
URLSearchHook: SearchHook Class - {BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\AddressBarSearch64.dll (DeviceVM, Inc.)
URLSearchHook: (No Name) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - No File
HKLM SearchScopes: DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=413&sr=0&q={searchTerms}
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=413&sr=0&q={searchTerms}
HKLM-x32 SearchScopes: DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=413&sr=0&q={searchTerms}
SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=413&sr=0&q={searchTerms}
SearchScopes: HKLM-x32 - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050
HKCU SearchScopes: DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=413&sr=0&q={searchTerms}
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://search.babylon.com/web/{searchTerms}?babsrc=browsersearch&AF=18826
SearchScopes: HKCU - {22C5A487-E29B-4e18-8FCE-D14C495F6FDB} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-devicevm&type=STDVM
SearchScopes: HKCU - {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL =
SearchScopes: HKCU - {6552C7DD-90A4-4387-B795-F8F96747DE19} URL = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=413&sr=0&q={searchTerms}
SearchScopes: HKCU - {AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8} URL = hxxp://www.daemon-search.com/search?q={searchTerms}
SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050
SearchScopes: HKCU - {B861081E-2B1D-4931-9694-E7C1C0FA7431} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=244506&p={searchTerms}
SearchScopes: HKCU - {BE9654C9-9D79-42ec-B55A-3CAEB12DBF58} URL = hxxp://www.icq.com/search/results.php?q={searchTerms}&ch_id=osd
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: XTTBPos00 Class - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~2\ICQTOO~1\toolbaru.dll (IE Toolbar)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Koyote Soft Toolbar - {1E864EAC-892F-4A60-8C17-63123FD5731C} - C:\Program Files (x86)\Koyote Soft Toolbar\IE\5.1\koyotesoftToolbarIE.dll (Spigot, Inc.)
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: DivX HiQ - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: DVDVideoSoftTB Toolbar - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.)
BHO-x32: Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\WIA6EB~1\Datamngr\ToolBar\searchqudtx.dll ()
BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM - DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll ()
Toolbar: HKLM-x32 - ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)
Toolbar: HKLM-x32 - DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll ()
Toolbar: HKLM-x32 - DVDVideoSoftTB Toolbar - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Koyote Soft Toolbar - {1E864EAC-892F-4A60-8C17-63123FD5731C} - C:\Program Files (x86)\Koyote Soft Toolbar\IE\5.1\koyotesoftToolbarIE.dll (Spigot, Inc.)
Toolbar: HKLM-x32 - Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\WIA6EB~1\Datamngr\ToolBar\searchqudtx.dll ()
Toolbar: HKCU - DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll ()
Toolbar: HKCU - No Name - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - No File
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
PDF: HKLM {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab
PDF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
PDF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Tino\AppData\Roaming\Mozilla\Firefox\Profiles\1cw0covu.default
FF SelectedSearchEngine: Delta Search
FF Homepage: https://www.google.de/
FF NetworkProxy: "no_proxies_on", "fritz.box"
FF NetworkProxy: "type", 4
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll ()
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX OVS Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @divx.com/DivX Player Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll No File
FF Plugin-x32: @java.com/JavaPlugin,version=10.21.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.0 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Acrobat - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Searchqu Toolbar - C:\Users\Tino\AppData\Roaming\Mozilla\Firefox\Profiles\1cw0covu.default\Extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}
FF Extension: firebug - C:\Users\Tino\AppData\Roaming\Mozilla\Firefox\Profiles\1cw0covu.default\Extensions\firebug@software.joehewitt.com.xpi
FF Extension: koyotesoft - C:\Users\Tino\AppData\Roaming\Mozilla\Firefox\Profiles\1cw0covu.default\Extensions\koyotesoft@mybrowserbar.com
FF Extension: No Name - C:\Users\Tino\AppData\Roaming\Mozilla\Firefox\Profiles\1cw0covu.default\Extensions\{097d3191-e6fa-4728-9826-b533d755359d}.xpi
FF Extension: No Name - C:\Users\Tino\AppData\Roaming\Mozilla\Firefox\Profiles\1cw0covu.default\Extensions\{1FD91A9C-410C-4090-BBCC-55D3450EF433}
FF Extension: No Name - C:\Users\Tino\AppData\Roaming\Mozilla\Firefox\Profiles\1cw0covu.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi
FF Extension: No Name - C:\Users\Tino\AppData\Roaming\Mozilla\Firefox\Profiles\1cw0covu.default\Extensions\{c45c406e-ab73-11d8-be73-000a95be3b12}.xpi
FF Extension: No Name - C:\Users\Tino\AppData\Roaming\Mozilla\Firefox\Profiles\1cw0covu.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: No Name - C:\Users\Tino\AppData\Roaming\Mozilla\Firefox\Profiles\1cw0covu.default\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi

Chrome:
=======
CHR Extension: (DivX HiQ) - C:\Users\Tino\AppData\Local\Google\Chrome\User Data\Default\Extensions\fnjbmmemklcjgepojigaapkoodmkgbae\2.1.0.900_0
CHR Extension: (Skype Click to Call) - C:\Users\Tino\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.6.0.8442_0
CHR Extension: (DivX Plus Web Player HTML5 \u003Cvideo\u003E) - C:\Users\Tino\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.0.900_0

==================== Services (Whitelisted) =================

S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2009-11-19] (Adobe Systems)
S4 Akamai; c:\program files (x86)\common files\akamai/netsession_win_7de0ed9.dll [3340064 2012-02-13] ()
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [86752 2013-03-29] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [110816 2013-03-29] (Avira Operations GmbH & Co. KG)
S3 AppleChargerSrv; C:\Windows\System32\AppleChargerSrv.exe [31272 2010-04-06] ()
S4 AVM WLAN Connection Service; C:\Program Files (x86)\avmwlanstick\WlanNetService.exe [368640 2009-03-20] (AVM Berlin)
S2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe [356376 2013-05-15] (Kaspersky Lab ZAO)
S4 Futuremark SystemInfo Service; C:\Program Files (x86)\Common Files\Futuremark Shared\Futuremark SystemInfo\FMSISvc.exe [128928 2010-11-11] (Futuremark Corporation)
S2 gupdate1ca6e09601fd91e; C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [133104 2009-11-25] (Google Inc.)
S4 ICQ Service; C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe [247608 2010-11-21] ()
S4 JMB36X; C:\Windows\SysWOW64\XSrvSetup.exe [72304 2010-01-19] ()
R2 KMService; C:\Windows\SysWow64\srvany.exe [8192 2003-04-18] ()
S4 NMSAccessU; C:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe [71096 2009-09-06] ()
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1103392 2012-11-13] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1369624 2012-11-13] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [168384 2012-11-13] (Safer-Networking Ltd.)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe [2402080 2013-01-28] (TuneUp Software)
S3 TunngleService; C:\Program Files (x86)\Tunngle\TnglCtrl.exe [745368 2012-11-26] (Tunngle.net GmbH)

==================== Drivers (Whitelisted) ====================

R3 AnyDVD; C:\Windows\System32\Drivers\AnyDVD.sys [123840 2010-04-23] (SlySoft, Inc.)
R1 AppleCharger; C:\Windows\System32\DRIVERS\AppleCharger.sys [21544 2010-04-22] ()
S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [14120 2009-03-20] (AVM Berlin)
R3 ElbyCDFL; C:\Windows\System32\Drivers\ElbyCDFL.sys [40648 2007-02-16] (SlySoft, Inc.)
R1 ElbyCDIO; C:\Windows\SysWow64\Drivers\ElbyCDIO.sys [9728 2003-11-29] (Elaborate Bytes AG)
S3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [460800 2009-03-20] (AVM GmbH)
S3 fwlanusbn; C:\Windows\System32\DRIVERS\fwlanusbn.sys [552704 2009-03-20] (AVM GmbH)
S3 gdrv; C:\Windows\gdrv.sys [25640 2011-09-06] (Windows (R) Server 2003 DDK provider)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458584 2012-06-19] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [620128 2013-05-15] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [28504 2012-08-02] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29016 2012-10-25] (Kaspersky Lab)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29528 2012-10-25] (Kaspersky Lab)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55056 2013-05-15] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178448 2013-05-15] (Kaspersky Lab ZAO)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2010-02-20] ()
S3 StarOpen; C:\Windows\System32\Drivers\StarOpen.sys [5504 2009-11-12] ()
S3 SYMPHONY; C:\Windows\System32\DRIVERS\Symphony.sys [190976 2012-04-25] (C-Media Inc.)
R3 tap0901t; C:\Windows\System32\DRIVERS\tap0901t.sys [31232 2009-09-16] (Tunngle.net)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesDriver64.sys [11880 2012-11-16] (TuneUp Software)
U3 a09t6foy; C:\Windows\System32\Drivers\a09t6foy.sys [0 ] (Microsoft Corporation)
R2 avgntflt; system32\DRIVERS\avgntflt.sys [x]
R1 avipbb; system32\DRIVERS\avipbb.sys [x]
R1 avkmgr; system32\DRIVERS\avkmgr.sys [x]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-06-05 07:11 - 2013-06-05 07:10 - 00890839 ____A C:\Users\Tino\Desktop\SecurityCheck.exe
2013-06-04 21:14 - 2013-06-04 21:14 - 02347384 ____A (ESET) C:\Users\Tino\Desktop\esetsmartinstaller_enu.exe
2013-06-04 21:03 - 2013-06-04 20:32 - 01916712 ____A (Farbar) C:\Users\Tino\Desktop\FRST64.exe
2013-06-04 20:32 - 2013-06-04 20:32 - 00000000 ____D C:\FRST
2013-06-04 18:49 - 2013-06-04 18:49 - 00000056 ____A C:\Windows\setupact.log
2013-06-04 18:41 - 2013-06-05 07:00 - 00007364 ____A C:\Users\Tino\Desktop\virusname.txt
2013-05-26 07:55 - 2013-05-26 07:55 - 00000000 ____D C:\Users\Tino\AppData\Roaming\7road
2013-05-24 18:36 - 2013-05-24 18:36 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-05-20 21:09 - 2013-05-20 21:09 - 00000150 ____A C:\Users\Tino\Desktop\todooo.txt
2013-05-20 14:17 - 2013-05-20 14:17 - 00002173 ____A C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2013-05-20 14:17 - 2013-05-20 14:17 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2013-05-20 14:17 - 2009-01-25 12:14 - 00017272 ____A (Safer Networking Limited) C:\Windows\System32\sdnclean64.exe
2013-05-15 19:27 - 2013-05-15 19:27 - 00262144 ____A C:\Windows\System32\config\elam
2013-05-15 19:16 - 2013-05-15 19:16 - 00001111 ____A C:\Users\Public\Desktop\Kaspersky Anti-Virus 2013.lnk
2013-05-15 19:16 - 2012-07-11 17:09 - 00064856 ____A (Kaspersky Lab) C:\Windows\System32\klfphc.dll
2013-05-15 19:15 - 2013-06-04 19:18 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-05-15 19:15 - 2013-05-15 19:24 - 00620128 ____A (Kaspersky Lab ZAO) C:\Windows\System32\Drivers\klif.sys
2013-05-15 19:15 - 2013-05-15 19:24 - 00090208 ____A (Kaspersky Lab ZAO) C:\Windows\System32\Drivers\klflt.sys
2013-05-15 19:15 - 2013-05-15 19:15 - 00000000 ____D C:\Windows\ELAMBKUP
2013-05-15 19:15 - 2013-05-15 19:15 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab
2013-05-15 18:07 - 2013-04-05 08:52 - 02242048 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-05-15 18:07 - 2013-04-05 08:52 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-05-15 18:07 - 2013-04-05 08:52 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-05-15 18:07 - 2013-04-05 08:50 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-05-15 18:07 - 2013-04-05 08:50 - 02647552 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-05-15 18:07 - 2013-04-05 08:50 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-05-15 18:07 - 2013-04-05 08:50 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-05-15 18:07 - 2013-04-05 08:50 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-05-15 18:07 - 2013-04-05 08:50 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-05-15 18:07 - 2013-04-05 08:50 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-05-15 18:07 - 2013-04-05 08:50 - 00053248 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-05-15 18:07 - 2013-04-05 08:50 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-05-15 18:07 - 2013-04-05 07:28 - 01767424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-05-15 18:07 - 2013-04-05 07:28 - 01130496 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-05-15 18:07 - 2013-04-05 07:26 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-05-15 18:07 - 2013-04-05 07:26 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-05-15 18:07 - 2013-04-05 07:26 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-05-15 18:07 - 2013-04-05 07:26 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-05-15 18:07 - 2013-04-05 07:26 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-05-15 18:07 - 2013-04-05 07:26 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-05-15 18:07 - 2013-04-05 07:26 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-05-15 18:07 - 2013-04-05 07:26 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-05-15 18:07 - 2013-04-05 07:26 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-05-15 18:07 - 2013-04-05 06:43 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-05-15 18:07 - 2013-04-05 06:29 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-05-15 18:07 - 2013-04-05 05:51 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-05-15 18:07 - 2013-04-05 05:38 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-05-15 18:06 - 2013-04-05 08:50 - 19231232 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-05-15 18:06 - 2013-04-05 08:50 - 15404032 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-05-15 18:06 - 2013-04-05 07:26 - 14323712 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-05-15 18:06 - 2013-04-05 07:26 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-05-15 18:01 - 2013-04-10 08:01 - 00983400 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgkrnl.sys
2013-05-15 18:01 - 2013-04-10 08:01 - 00265064 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgmms1.sys
2013-05-15 18:01 - 2013-04-10 05:30 - 03153920 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2013-05-15 18:01 - 2013-03-19 07:53 - 00230400 ____A (Microsoft Corporation) C:\Windows\System32\wwansvc.dll
2013-05-15 18:01 - 2013-03-19 07:53 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\wwanprotdim.dll
2013-05-15 18:01 - 2013-02-27 08:02 - 00111448 ____A (Microsoft Corporation) C:\Windows\System32\consent.exe
2013-05-15 18:01 - 2013-02-27 07:52 - 14172672 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll
2013-05-15 18:01 - 2013-02-27 07:52 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\shdocvw.dll
2013-05-15 18:01 - 2013-02-27 07:48 - 01930752 ____A (Microsoft Corporation) C:\Windows\System32\authui.dll
2013-05-15 18:01 - 2013-02-27 07:47 - 00070144 ____A (Microsoft Corporation) C:\Windows\System32\appinfo.dll
2013-05-15 18:01 - 2013-02-27 06:55 - 12872704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-05-15 18:01 - 2013-02-27 06:55 - 00180224 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-05-15 18:01 - 2013-02-27 06:49 - 01796096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2013-05-15 18:01 - 2011-02-03 13:25 - 00144384 ____A (Microsoft Corporation) C:\Windows\System32\cdd.dll
2013-05-10 15:05 - 2013-05-10 15:07 - 00000000 ____D C:\Program Files (x86)\TuneUp Utilities 2013
2013-05-10 15:05 - 2013-05-10 15:05 - 00002209 ____A C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk
2013-05-10 15:05 - 2013-05-10 15:05 - 00002189 ____A C:\Users\Public\Desktop\TuneUp Utilities 2013.lnk
2013-05-10 15:05 - 2013-01-28 14:19 - 00035104 ____A (TuneUp Software) C:\Windows\System32\TURegOpt.exe
2013-05-10 15:05 - 2013-01-28 14:19 - 00026400 ____A (TuneUp Software) C:\Windows\System32\authuitu.dll
2013-05-10 15:05 - 2013-01-28 14:19 - 00021792 ____A (TuneUp Software) C:\Windows\SysWOW64\authuitu.dll
2013-05-10 15:03 - 2013-05-10 15:14 - 00000000 __SHD C:\ProgramData\{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F}
2013-05-10 07:27 - 2013-05-10 07:27 - 20900984 ____A (Mozilla) C:\Users\Tino\Desktop\Firefox Setup 20.0.1.exe
2013-05-09 16:58 - 2013-05-15 17:56 - 00001147 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-05-07 21:12 - 2013-05-07 23:32 - 00002702 ____A C:\Windows\wininit.ini
2013-05-07 17:12 - 2013-04-04 05:35 - 00095648 ____A (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-05-07 17:12 - 2013-04-04 05:30 - 00174496 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-05-07 17:12 - 2013-04-04 05:29 - 00174496 ____A (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-05-07 17:11 - 2013-05-07 17:12 - 00004032 ____A C:\Windows\SysWOW64\jupdate-1.7.0_21-b11.log
2013-05-07 13:04 - 2013-05-07 13:03 - 00083160 ____A (Avira GmbH) C:\Windows\System32\Drivers\avnetflt.sys
2013-05-06 19:10 - 2013-03-15 09:20 - 00001969 ____A C:\Users\Tino\Desktop\Skype.lnk

==================== One Month Modified Files and Folders =======

2013-06-05 07:17 - 2011-03-20 20:18 - 00000000 ____D C:\Users\Tino\Documents\Outlook-Dateien
2013-06-05 07:10 - 2013-06-05 07:11 - 00890839 ____A C:\Users\Tino\Desktop\SecurityCheck.exe
2013-06-05 07:00 - 2013-06-04 18:41 - 00007364 ____A C:\Users\Tino\Desktop\virusname.txt
2013-06-05 06:52 - 2012-03-31 08:54 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-05 06:52 - 2009-11-06 21:57 - 00000000 ____D C:\Users\Tino\AppData\Roaming\Skype
2013-06-05 06:37 - 2009-11-25 22:06 - 00001110 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-06-05 03:00 - 2009-11-07 03:40 - 01773472 ____A C:\Windows\WindowsUpdate.log
2013-06-05 02:01 - 2009-11-06 21:26 - 00000000 ____D C:\Users\Tino\AppData\Local\Adobe
2013-06-04 22:37 - 2009-11-25 22:06 - 00001106 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-06-04 21:14 - 2013-06-04 21:14 - 02347384 ____A (ESET) C:\Users\Tino\Desktop\esetsmartinstaller_enu.exe
2013-06-04 20:32 - 2013-06-04 21:03 - 01916712 ____A (Farbar) C:\Users\Tino\Desktop\FRST64.exe
2013-06-04 20:32 - 2013-06-04 20:32 - 00000000 ____D C:\FRST
2013-06-04 19:44 - 2011-05-08 03:18 - 00000000 ___HD C:\ProgramData\Spybot - Search & Destroy
2013-06-04 19:18 - 2013-05-15 19:15 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-06-04 18:59 - 2009-07-14 06:45 - 00014976 ____A C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-04 18:59 - 2009-07-14 06:45 - 00014976 ____A C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-04 18:51 - 2011-09-24 14:38 - 00000000 ____D C:\Users\Tino\AppData\Roaming\Dropbox
2013-06-04 18:50 - 2011-09-24 14:41 - 00000000 __RAD C:\Users\Tino\Dropbox
2013-06-04 18:49 - 2013-06-04 18:49 - 00000056 ____A C:\Windows\setupact.log
2013-06-04 18:49 - 2011-03-25 10:00 - 00235246 ____A C:\Windows\PFRO.log
2013-06-04 18:49 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-03 22:02 - 2010-07-29 17:22 - 00000000 ____D C:\Users\Tino\AppData\Roaming\TS3Client
2013-06-02 21:34 - 2013-03-11 19:01 - 00000000 ____D C:\Users\Tino\AppData\Roaming\Winamp
2013-06-02 19:06 - 2013-01-25 17:27 - 00001303 ____A C:\Users\Tino\Desktop\Logitech Webcam Software .lnk
2013-06-02 19:06 - 2011-05-25 13:13 - 00001125 ____A C:\Users\Tino\Desktop\Adobe Photoshop CS5.1 (64 Bit).lnk
2013-05-26 07:55 - 2013-05-26 07:55 - 00000000 ____D C:\Users\Tino\AppData\Roaming\7road
2013-05-25 08:19 - 2012-04-25 19:02 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-05-24 18:36 - 2013-05-24 18:36 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-05-24 16:40 - 2012-10-12 00:49 - 00003825 ____A C:\Users\Tino\Desktop\daten devil.txt
2013-05-22 16:23 - 2009-11-06 21:57 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-05-22 16:23 - 2009-11-06 21:57 - 00000000 ___HD C:\ProgramData\Skype
2013-05-21 17:33 - 2009-12-30 07:06 - 00032945 ____A C:\Users\Tino\Desktop\info.txt
2013-05-20 21:09 - 2013-05-20 21:09 - 00000150 ____A C:\Users\Tino\Desktop\todooo.txt
2013-05-20 15:29 - 2012-01-03 18:42 - 00019856 ____A C:\Users\Tino\Desktop\Abrechnung_designoffice.xlsx
2013-05-20 14:17 - 2013-05-20 14:17 - 00002173 ____A C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2013-05-20 14:17 - 2013-05-20 14:17 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2013-05-20 14:15 - 2011-05-08 03:18 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy
2013-05-18 22:38 - 2011-04-11 08:05 - 00000000 ____D C:\Users\Tino\AppData\Roaming\vlc
2013-05-15 22:38 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-05-15 19:52 - 2012-03-31 08:54 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-05-15 19:52 - 2011-05-17 16:46 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-05-15 19:39 - 2013-05-03 18:05 - 00000000 ____D C:\Users\Tino\AppData\Roaming\Pyqo
2013-05-15 19:27 - 2013-05-15 19:27 - 00262144 ____A C:\Windows\System32\config\elam
2013-05-15 19:24 - 2013-05-15 19:15 - 00620128 ____A (Kaspersky Lab ZAO) C:\Windows\System32\Drivers\klif.sys
2013-05-15 19:24 - 2013-05-15 19:15 - 00090208 ____A (Kaspersky Lab ZAO) C:\Windows\System32\Drivers\klflt.sys
2013-05-15 19:24 - 2012-08-13 16:49 - 00178448 ____A (Kaspersky Lab ZAO) C:\Windows\System32\Drivers\kneps.sys
2013-05-15 19:24 - 2012-06-08 11:38 - 00055056 ____A (Kaspersky Lab ZAO) C:\Windows\System32\Drivers\kltdi.sys
2013-05-15 19:16 - 2013-05-15 19:16 - 00001111 ____A C:\Users\Public\Desktop\Kaspersky Anti-Virus 2013.lnk
2013-05-15 19:15 - 2013-05-15 19:15 - 00000000 ____D C:\Windows\ELAMBKUP
2013-05-15 19:15 - 2013-05-15 19:15 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab
2013-05-15 18:24 - 2013-05-03 18:05 - 00000000 ____D C:\Users\Tino\AppData\Roaming\Afsi
2013-05-15 18:22 - 2009-07-14 06:45 - 05824808 ____A C:\Windows\System32\FNTCACHE.DAT
2013-05-15 18:11 - 2009-11-06 21:11 - 75016696 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-05-15 17:56 - 2013-05-09 16:58 - 00001147 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-05-10 15:14 - 2013-05-10 15:03 - 00000000 __SHD C:\ProgramData\{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F}
2013-05-10 15:14 - 2010-08-31 10:03 - 00000000 ____D C:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}
2013-05-10 15:14 - 2009-12-11 14:25 - 00000000 ____D C:\Users\Tino\AppData\Roaming\Nero
2013-05-10 15:14 - 2009-11-19 18:17 - 00000000 ____D C:\Users\Tino\AppData\Local\Downloaded Installations
2013-05-10 15:14 - 2009-11-06 22:01 - 00000000 ____D C:\Users\Tino\AppData\Local\Microsoft Help
2013-05-10 15:07 - 2013-05-10 15:05 - 00000000 ____D C:\Program Files (x86)\TuneUp Utilities 2013
2013-05-10 15:05 - 2013-05-10 15:05 - 00002209 ____A C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk
2013-05-10 15:05 - 2013-05-10 15:05 - 00002189 ____A C:\Users\Public\Desktop\TuneUp Utilities 2013.lnk
2013-05-10 15:05 - 2011-02-05 15:23 - 00000000 ____D C:\Users\Tino\AppData\Roaming\TuneUp Software
2013-05-10 15:05 - 2011-02-05 15:18 - 00000000 ___HD C:\ProgramData\TuneUp Software
2013-05-10 07:27 - 2013-05-10 07:27 - 20900984 ____A (Mozilla) C:\Users\Tino\Desktop\Firefox Setup 20.0.1.exe
2013-05-10 07:24 - 2013-04-06 13:13 - 00000000 ____D C:\ProgramData\TOSHIBA
2013-05-07 23:32 - 2013-05-07 21:12 - 00002702 ____A C:\Windows\wininit.ini
2013-05-07 17:12 - 2013-05-07 17:11 - 00004032 ____A C:\Windows\SysWOW64\jupdate-1.7.0_21-b11.log
2013-05-07 17:12 - 2009-11-19 15:47 - 00000000 ____D C:\Program Files (x86)\Java
2013-05-07 13:03 - 2013-05-07 13:04 - 00083160 ____A (Avira GmbH) C:\Windows\System32\Drivers\avnetflt.sys

Files to move or delete:
====================
C:\Users\Public\LeagueofLegends.exe

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

Last Boot: 2013-06-03 21:40

==================== End Of Log ============================

schrauber · 05.06.2013, 08:21

Fix mit FRST
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

2013-05-15 19:39 - 2013-05-03 18:05 - 00000000 ____D C:\Users\Tino\AppData\Roaming\Pyqo

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Fix Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Bitte alle Software im SecurityCheck-Log, die rot ist, updaten.

Die Funde von ESET sind ja mal geil. Das müsstest Du alles löschen.

Tino Schmoz · 05.06.2013, 08:43

------------------
Bitte alle Software im SecurityCheck-Log, die rot ist, updaten.
------------------
Ich schau das ich die deinstallierere sind alles irgendwie veraltete versionen, die von den neueren nicht überschreiben würden......

------------------
Die Funde von ESET sind ja mal geil. Das müsstest Du alles löschen.
------------------
2 Drittel davon habe ich schon gelöscht .... melde mich gleich dazu nochmal, ein paar Sachen sind wichtige projektdateien, wenn ich die lösche, kann ich sie nicht wieder herstellen :-(

Das ganze lößt aber noch nicht das ursprüngliche Problem, aber ich gehe davon aus das wir daran arbeiten.... :-)

Zitat:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 04-06-2013
Ran by Tino at 2013-06-05 09:36:37 Run:2
Running from C:\Users\Tino\Desktop
Boot Mode: Normal
==============================================

C:\Users\Tino\AppData\Roaming\Pyqo => Moved successfully.

==== End of Fixlog ====

So Programme habe ich schonmal aktualisiert ....

Zitat:

Results of screen317's Security Check version 0.99.64
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 10
``````````````Antivirus/Firewall Check:``````````````
Kaspersky Anti-Virus
Avira Desktop
Antivirus up to date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
Spybot - Search & Destroy
TuneUp Utilities 2013
TuneUp Utilities Language Pack (de-DE)
TuneUp Utilities 2013
TuneUp Utilities Language Pack (de-DE)
Wise Registry Cleaner 5.9.1
Java(TM) 6 Update 22
Java(TM) 6 Update 35
Java 7 Update 21
Adobe Flash Player 11.7.700.202
Adobe Reader XI
Mozilla Firefox (21.0)
Google Chrome 26.0.1410.64
Google Chrome 27.0.1453.94
````````Process Check: objlist.exe by Laurent````````
Spybot Teatimer.exe is disabled!
Avira Antivir avgnt.exe
Avira Antivir avguard.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````

------------------
Die Funde von ESET sind ja mal geil. Das müsstest Du alles löschen.
------------------

So alle gelöscht.... was nun ?

------------------
Die Funde von ESET sind ja mal geil. Das müsstest Du alles löschen.
------------------

So alle gelöscht.... was nun ?

schrauber · 05.06.2013, 10:05

Der Rechner ist jetzt mal sauber. Wie sieht es denn aus mit dem ursprünglichen Problem?

Tino Schmoz · 05.06.2013, 10:15

Na das ist ja bisher noch ungelößt ... Idee ? Einige Webserver sind ja befallen...

Das Teilchen ist ja noch relativ neu, und ich weiß nicht wie man das am besten anstellen kann ... FTP Daten überall nochmal ändern ? Wie löschen ihne das ich es mit auf die Platte hole ?? :-(

schrauber · 05.06.2013, 12:36

FTP von anderem Rechner ändern.
Seiten entweder Quellcode öffnen und schadhafte Stellen entfernen, oder Seiten löschen und saubere Kopien von einem anderen Rechner hochladen.

Tino Schmoz · 05.06.2013, 12:48

Aber sobald ich eine Datei vom Server öffne von mir aus mit dem Texteditor, dann habe ich den kram doch sofort wieder auf dem Rechner.... :-( Wenn ich einen Antivirenprogramm aktiv habe läßt er mich nichtmal diese Datei öffnen. Der SChadcode ist mir bekannt, aber es sind hunderte von Seiten.

Gibt es keine Routine die man MIT FTP Verbindungen machen kann ?

Kann ich wirklich sicher gehen das ich nichts mehr auf meinem Rechner habe was die FTP Verbindung neu ausspionieren kann, und sich das Rad erneut beginnt zu drehen ?

Tino

schrauber · 05.06.2013, 14:44

Die Logfiles sind sauber, soweit ich das beurteilen kann ist dieser eine Rechner ok. Ist kein sauberes Backup der Webseiten vorhanden? Dann einfach die anderen, ohne zu öffnen, löschen, und ersetzen.

Tino Schmoz · 05.06.2013, 14:50

geht nicht .... sind CMS Systeme von denen wir keine regelmäßign Backups machen.

Wir haben vorhin einen Versuch von meinem Rechner gemacht da er ja sauber ist ......

.......................
1. Wir haben die FTP Daten von einem Projekt geändert ...
2. Eine saubere Version aufgespielt
.......................

Fazit .... nach 30minuten war die Website wieder infiziert!! :-( mit neuen Dateien und einem fremden Code.

Irgendwie muss sich das doch lösen lassen... es sind zum Teil sensible Projekte und wir haben schon einzelne Kundenbeschwerden :-(

Tino

05.06.2013, 10:05	#10
schrauber /// the machine /// TB-Ausbilder	JS/EXP.Redir.EL.7 auf allen Webservern eingeschlichen Der Rechner ist jetzt mal sauber. Wie sieht es denn aus mit dem ursprünglichen Problem? __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

JS/EXP.Redir.EL.7 auf allen Webservern eingeschlichen

Plagegeister aller Art und deren Bekämpfung: JS/EXP.Redir.EL.7 auf allen Webservern eingeschlichen