| |
| |||||||
Log-Analyse und Auswertung: Windows 7: Trojaner o.ä. aus eMail AnhangWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
29.08.2013, 19:51
| #1 |
 |  Windows 7: Trojaner o.ä. aus eMail Anhang Hallo, Vor kurzem hat mein Vater eine eMail von einem unbekannten Absender bekommen, beim öffnen des Anhangs wurde wahrscheinlich ein Trojaner o.ä. übertragen. Nachdem ich Avira und Malwarebytes Anti-Malware über den PC meines Vaters laufen lies, wurden mehrere infizierte Dateien entdeckt. Im folgenden sind die zusammen gestellten Informationen: Hier der defogger_disable Log Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 17:43 on 25/08/2013 (*****)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Anschließend habe ich mir den Farbar's Recovery Scan Tool heruntergeladen und den scan durchgeführt. Hier die FRST.txt Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-08-2013 02 Ran by ***** (administrator) on 25-08-2013 23:51:00 Running from C:\Users\*****\Desktop\Downloads Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 10 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Adobe Systems Incorporated) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe (CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe (Memeo) C:\Program Files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Smartbar) C:\Users\*****\AppData\Local\Smartbar\Application\QuickShare.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Microsoft Corporation) C:\Windows\SysWOW64\schtasks.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (IObit) C:\Program Files (x86)\IObit\Game Booster 3\gbtray.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE (Microsoft Corporation) C:\Windows\splwow64.exe (Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12445288 2012-01-16] (Realtek Semiconductor) HKLM\...\Run: [Windows Mobile Device Center] - C:\Windows\WindowsMobile\wmdc.exe [660360 2007-05-31] (Microsoft Corporation) HKLM\...\Run: [ISW] - [x] HKLM\...\RunOnce: [MedionReminder] - C:\Program Files (x86)\CyberLink\PowerRecover\Reminder.exe /DeleteRunKey [443688 2011-05-26] (CyberLink) HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware ] - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation) HKCU\...\Run: [Browser Infrastructure Helper] - C:\Users\*****\AppData\Local\Smartbar\Application\QuickShare.exe [13824 2013-02-10] (Smartbar) HKCU\...\Run: [EADM] - C:\Program Files (x86)\Origin\Origin.exe [3549528 2013-07-31] (Electronic Arts) HKCU\...\Run: [eqtvrvvq] - C:\Users\*****\AppData\Local\Temp\Mfwssv\liilozzrvvq.exe [116224 2013-08-25] () <===== ATTENTION HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2012-02-02] (Intel Corporation) HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-08-20] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated) HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation) HKU\Default User\...\RunOnce: [HKCU] - C:\Windows\System32\oobe\info\HKCU.vbs [126 2009-11-12] () HKU\Default User\...\RunOnce: [Screensaver] - C:\Windows\Web\Wallpaper\MEDION\start.vbs [x] Startup: C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2YourFace_Updater.lnk ShortcutTarget: 2YourFace_Updater.lnk -> C:\Users\*****\AppData\Roaming\2YourFace\Updater.exe () ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.babylon.com/?affID=121150&babsrc=HP_ss_din2g&mntrId=204C0008CAE006FC HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.chatzum.com/?orig=HP&affid=62&cztbid=184930497 SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM-x32 - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://search.chatzum.com/?orig=DS&affid=62&cztbid=184930497&q={searchTerms} SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM-x32 - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://search.chatzum.com/?orig=DS&affid=62&cztbid=184930497&q={searchTerms} SearchScopes: HKCU - DefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://search.babylon.com/?q={searchTerms}&affID=121150&babsrc=SP_ss_din2g&mntrId=204C0008CAE006FC SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://search.babylon.com/?q={searchTerms}&affID=121150&babsrc=SP_ss_din2g&mntrId=204C0008CAE006FC SearchScopes: HKCU - {3103D6ED-5587-4A0B-937C-BDCC76576A59} URL = hxxp://search.softonic.com/MOY00009/tb_v1?q={searchTerms}&SearchSource=4&cc=&r=40 SearchScopes: HKCU - {C8A8AEB9-C4EE-4820-B3BC-5F057B105362} URL = hxxp://search.chatzum.com/?orig=DS&affid=62&cztbid=184930497&q={searchTerms} BHO: QuickShare WidgetEngine - {31ad400d-1b06-4e33-a59a-90c2c140cba0} - C:\Windows\System32\mscoree.dll (Microsoft Corporation) BHO: ZoneAlarm Security Engine Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll No File BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: Deal Boat - {11111111-1111-1111-1111-110111271147} - C:\Program Files (x86)\Deal Boat\Deal Boat-bho.dll (Innovative Apps) BHO-x32: 2YourFace Addon - {1185823F-F22F-4027-80E5-4F68ACD5DE5E} - C:\Users\*****\AppData\Roaming\2YourFace\bho.dll () BHO-x32: QuickShare WidgetEngine - {31ad400d-1b06-4e33-a59a-90c2c140cba0} - C:\Windows\\SysWOW64\mscoree.dll (Microsoft Corporation) BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: ZoneAlarm Security Engine Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll No File BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll No File Toolbar: HKLM - QuickShare Widget - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\System32\mscoree.dll (Microsoft Corporation) Toolbar: HKLM-x32 - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll No File Toolbar: HKLM-x32 - QuickShare Widget - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\\SysWOW64\mscoree.dll (Microsoft Corporation) Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File Toolbar: HKCU - No Name - {EEE6C35B-6118-11DC-9C72-001320C79847} - No File Handler: msdaipp - No CLSID Value - Handler-x32: msdaipp - No CLSID Value - Tcpip\Parameters: [DhcpNameServer] 192.168.1.254 FireFox: ======== FF ProfilePath: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\n7uh2i73.default FF user.js: detected! => C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\n7uh2i73.default\user.js FF NetworkProxy: "http", "www-proxy.t-online.de" FF NetworkProxy: "http_port", 80 FF NetworkProxy: "share_proxy_settings", true FF NetworkProxy: "type", 0 FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll () FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1200112.dll (Adobe Systems, Inc.) FF Plugin-x32: @checkpoint.com/FFApi - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\npFFApi.dll No File FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @ngm.nexoneu.com/NxGame - C:\ProgramData\NexonEU\NGM\npNxGameeu.dll No File FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\*****\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF Plugin HKCU: electronicarts.com/GameFacePlugin - C:\Users\*****\AppData\Roaming\Electronic Arts\Game Face\npGameFacePlugin.dll (Electronic Arts) FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\n7uh2i73.default\searchplugins\11-suche.xml FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\n7uh2i73.default\searchplugins\babylon.xml FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\n7uh2i73.default\searchplugins\BrowserProtect.xml FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\n7uh2i73.default\searchplugins\delta.xml FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\n7uh2i73.default\searchplugins\englische-ergebnisse.xml FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\n7uh2i73.default\searchplugins\gmx-suche.xml FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\n7uh2i73.default\searchplugins\lastminute.xml FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\n7uh2i73.default\searchplugins\webde-suche.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml FF Extension: DoNotTrackMe - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\n7uh2i73.default\Extensions\donottrackplus@abine.com FF Extension: No Name - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\n7uh2i73.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF HKLM\...\Firefox\Extensions: [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}] C:\Program Files\CheckPoint\ZAForceField\TrustChecker FF HKLM-x32\...\Firefox\Extensions: [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}] C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker FF HKLM-x32\...\Firefox\Extensions: [support@2yourface.com] C:\Users\*****\AppData\Roaming\2YourFace\ffextension FF Extension: 2YourFace - C:\Users\*****\AppData\Roaming\2YourFace\ffextension FF HKCU\...\Firefox\Extensions: [support@2yourface.com] C:\Users\*****\AppData\Roaming\2YourFace\ffextension FF Extension: 2YourFace - C:\Users\*****\AppData\Roaming\2YourFace\ffextension Chrome: ======= CHR HomePage: hxxp://search.babylon.com/?affID=121150&babsrc=HP_ss_din2g&mntrId=204C0008CAE006FC CHR RestoreOnStartup: "hxxp://search.babylon.com/?affID=121150&babsrc=HP_ss_din2g&mntrId=204C0008CAE006FC", "hxxp://www.delta-search.com/?affID=121150&babsrc=HP_ss&mntrId=204C0008CAE006FC" CHR DefaultSearchURL: (Babylon) - hxxp://search.babylon.com/?q={searchTerms}&affID=121150&babsrc=SP_ss_din2g&mntrId=204C0008CAE006FC CHR DefaultSuggestURL: (Babylon) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter} CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.89\PepperFlash\pepflashplayer.dll No File CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.57\gcswf32.dll No File CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File CHR Plugin: (Remoting Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.57\ppGoogleNaClPluginChrome.dll () CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.57\pdf.dll () CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.) CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll No File CHR Plugin: (Java(TM) Platform SE 7 U3) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) CHR Plugin: (Pando Web Plugin) - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File CHR Plugin: (Windows Live Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) CHR Plugin: (npFFApi) - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\npFFApi.dll No File CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll No File CHR Plugin: (Windows Activation Technologies) - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation) CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File CHR Extension: (Adblock Plus) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.5.4_0 CHR Extension: (Chrome In-App Payments service) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.10_0 CHR HKLM-x32\...\Chrome\Extension: [blaofbhgbmeikidhlkmjhbkbfohpgekf] - C:\Program Files (x86)\Movie2KDownloader.com\Movie2KDownloader10.crx CHR HKLM-x32\...\Chrome\Extension: [jcdgjdiieiljkfkdcloehkohchhpekkn] - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\External Extensions\{EEE6C373-6118-11DC-9C72-001320C79847}\SweetFB.crx CHR HKLM-x32\...\Chrome\Extension: [lmblfngognklgemafekefcdjcnkdhmdm] - C:\Users\*****\AppData\Roaming\2YourFace\2YourFace.crx CHR HKLM-x32\...\Chrome\Extension: [ogccgbmabaphcakpiclgcnmcnimhokcj] - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\External Extensions\{EEE6C373-6118-11DC-9C72-001320C79847}\SweetNT.crx ==================== Services (Whitelisted) ================= R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-08-20] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-08-20] (Avira Operations GmbH & Co. KG) R2 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [70952 2011-04-14] (CyberLink) R2 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [312616 2011-04-14] (CyberLink) S3 aspnet_state; %SystemRoot%\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [x] ==================== Drivers (Whitelisted) ==================== R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-08-20] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-08-20] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-03-27] (Avira Operations GmbH & Co. KG) R3 WinRing0_1_2_0; C:\Program Files (x86)\IObit\Game Booster 3\Driver\WinRing0x64.sys [14544 2010-11-01] (OpenLibSys.org) R3 WinRing0_1_2_0; C:\Program Files (x86)\IObit\Game Booster 3\Driver\WinRing0x64.sys [14544 2010-11-01] (OpenLibSys.org) S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-08-25 17:43 - 2013-08-25 17:43 - 00000000 _____ C:\Users\*****\defogger_reenable 2013-08-25 16:51 - 2013-08-25 16:51 - 00001117 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2013-08-25 16:51 - 2013-08-25 16:51 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-08-25 16:51 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2013-08-25 14:46 - 2013-08-25 14:46 - 00000000 ____D C:\Users\*****\AppData\Local\{5C6D133D-1259-4D1D-B03C-2373D1FE1525} 2013-08-25 10:32 - 2013-08-25 22:32 - 100156396 _____ C:\Windows\SysWOW64\�熆ᵌ) 2013-08-19 12:31 - 2013-08-20 17:49 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird 2013-08-17 13:38 - 2013-08-17 13:38 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-08-15 23:36 - 2013-08-15 23:36 - 00000000 ____D C:\Users\*****\AppData\Local\{EEED3BF8-2587-4A15-B97B-5DDE5FFB926D} 2013-08-14 21:50 - 2013-08-14 21:51 - 00000000 ____D C:\Users\*****\AppData\Local\{3B17203F-F504-4467-A11A-ABB3E9C563A5} 2013-08-12 10:31 - 2013-08-12 10:31 - 00000000 ____D C:\Users\*****\AppData\Local\{C50F3E57-575D-4E3E-BB26-4FB268892BD0} 2013-07-29 01:09 - 2013-07-29 01:09 - 00200107 _____ C:\Users\*****\Desktop\InventoryTweaks 1.6.2.jar 2013-07-29 00:16 - 2013-07-29 00:17 - 04233715 _____ C:\Users\*****\Desktop\minecraftforge-installer-1.6.2-9.10.0.804(1).jar 2013-07-28 23:06 - 2013-08-25 16:33 - 00000000 ____D C:\Users\*****\AppData\Roaming\.minecraft 2013-07-28 23:04 - 2013-07-28 23:04 - 00675988 _____ C:\Users\*****\Desktop\Minecraft.exe 2013-07-28 21:03 - 2013-07-28 21:03 - 00000000 ____D C:\Users\*****\AppData\Roaming\Notepad++ 2013-07-28 21:03 - 2013-07-28 21:03 - 00000000 ____D C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Notepad++ 2013-07-28 21:03 - 2013-07-28 21:03 - 00000000 ____D C:\Program Files (x86)\Notepad++ 2013-07-26 23:28 - 2013-07-26 23:28 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2013-07-26 23:28 - 2013-07-26 23:28 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2013-07-26 23:28 - 2013-07-26 23:28 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2013-07-26 23:28 - 2013-07-26 23:28 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2013-07-26 23:28 - 2013-07-26 23:28 - 00000000 ____D C:\Program Files (x86)\Java 2013-07-26 23:06 - 2013-07-26 23:06 - 00003164 _____ C:\Windows\System32\Tasks\Game_Booster_AutoUpdate 2013-07-26 23:06 - 2013-07-26 23:06 - 00001190 _____ C:\Users\Public\Desktop\Switch to Gaming Mode.lnk 2013-07-26 23:06 - 2013-07-26 23:06 - 00001178 _____ C:\Users\Public\Desktop\Game Booster 3.lnk 2013-07-26 23:06 - 2013-07-26 23:06 - 00000000 ____D C:\ProgramData\IObit 2013-07-26 23:06 - 2013-07-26 23:06 - 00000000 ____D C:\Program Files (x86)\IObit ==================== One Month Modified Files and Folders ======= 2013-08-25 23:49 - 2013-08-25 23:49 - 00000000 ____D C:\FRST 2013-08-25 23:42 - 2012-06-16 12:59 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2013-08-25 23:32 - 2013-03-20 16:51 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-08-25 23:15 - 2012-06-16 12:54 - 01720189 _____ C:\Windows\WindowsUpdate.log 2013-08-25 22:32 - 2013-08-25 10:32 - 100156396 _____ C:\Windows\SysWOW64\�熆ᵌ) 2013-08-25 18:11 - 2009-07-14 06:51 - 00204509 _____ C:\Windows\setupact.log 2013-08-25 17:43 - 2013-08-25 17:43 - 00000000 _____ C:\Users\*****\defogger_reenable 2013-08-25 17:43 - 2012-06-16 13:01 - 00000000 ____D C:\Users\***** 2013-08-25 16:52 - 2009-07-14 06:45 - 00017152 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-08-25 16:52 - 2009-07-14 06:45 - 00017152 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-08-25 16:51 - 2013-08-25 16:51 - 00001117 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2013-08-25 16:51 - 2013-08-25 16:51 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-08-25 16:33 - 2013-07-28 23:06 - 00000000 ____D C:\Users\*****\AppData\Roaming\.minecraft 2013-08-25 14:46 - 2013-08-25 14:46 - 00000000 ____D C:\Users\*****\AppData\Local\{5C6D133D-1259-4D1D-B03C-2373D1FE1525} 2013-08-25 14:42 - 2012-06-16 12:59 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2013-08-25 10:31 - 2013-04-14 13:23 - 00000000 ____D C:\Program Files (x86)\Origin 2013-08-25 10:31 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2013-08-25 10:30 - 2010-11-21 05:47 - 00317486 _____ C:\Windows\PFRO.log 2013-08-22 10:48 - 2012-06-16 12:59 - 00002187 _____ C:\Users\Public\Desktop\Google Chrome.lnk 2013-08-21 09:45 - 2012-06-16 18:28 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2013-08-20 17:49 - 2013-08-19 12:31 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird 2013-08-20 10:33 - 2013-05-07 13:35 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys 2013-08-20 10:33 - 2013-03-27 11:15 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys 2013-08-20 10:33 - 2013-03-27 11:15 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys 2013-08-17 13:38 - 2013-08-17 13:38 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-08-15 23:36 - 2013-08-15 23:36 - 00000000 ____D C:\Users\*****\AppData\Local\{EEED3BF8-2587-4A15-B97B-5DDE5FFB926D} 2013-08-14 21:51 - 2013-08-14 21:50 - 00000000 ____D C:\Users\*****\AppData\Local\{3B17203F-F504-4467-A11A-ABB3E9C563A5} 2013-08-12 10:31 - 2013-08-12 10:31 - 00000000 ____D C:\Users\*****\AppData\Local\{C50F3E57-575D-4E3E-BB26-4FB268892BD0} 2013-08-08 10:42 - 2011-05-16 16:04 - 00664764 _____ C:\Windows\system32\perfh007.dat 2013-08-08 10:42 - 2011-05-16 16:04 - 00134932 _____ C:\Windows\system32\perfc007.dat 2013-08-08 10:42 - 2009-07-14 07:13 - 01528340 _____ C:\Windows\system32\PerfStringBackup.INI 2013-07-29 10:20 - 2012-10-25 19:43 - 00000000 ____D C:\Users\*****\Desktop\Thomas 2013-07-29 01:09 - 2013-07-29 01:09 - 00200107 _____ C:\Users\*****\Desktop\InventoryTweaks 1.6.2.jar 2013-07-29 00:47 - 2013-04-03 10:29 - 00000000 ____D C:\Users\*****\AppData\Roaming\2YourFace 2013-07-29 00:17 - 2013-07-29 00:16 - 04233715 _____ C:\Users\*****\Desktop\minecraftforge-installer-1.6.2-9.10.0.804(1).jar 2013-07-28 23:04 - 2013-07-28 23:04 - 00675988 _____ C:\Users\*****\Desktop\Minecraft.exe 2013-07-28 21:03 - 2013-07-28 21:03 - 00000000 ____D C:\Users\*****\AppData\Roaming\Notepad++ 2013-07-28 21:03 - 2013-07-28 21:03 - 00000000 ____D C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Notepad++ 2013-07-28 21:03 - 2013-07-28 21:03 - 00000000 ____D C:\Program Files (x86)\Notepad++ 2013-07-26 23:28 - 2013-07-26 23:28 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2013-07-26 23:28 - 2013-07-26 23:28 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2013-07-26 23:28 - 2013-07-26 23:28 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2013-07-26 23:28 - 2013-07-26 23:28 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2013-07-26 23:28 - 2013-07-26 23:28 - 00000000 ____D C:\Program Files (x86)\Java 2013-07-26 23:28 - 2012-01-25 22:13 - 00867240 _____ (Oracle Corporation) C:\Windows\SysWOW64\npdeployJava1.dll 2013-07-26 23:28 - 2011-07-18 23:13 - 00789416 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll 2013-07-26 23:06 - 2013-07-26 23:06 - 00003164 _____ C:\Windows\System32\Tasks\Game_Booster_AutoUpdate 2013-07-26 23:06 - 2013-07-26 23:06 - 00001190 _____ C:\Users\Public\Desktop\Switch to Gaming Mode.lnk 2013-07-26 23:06 - 2013-07-26 23:06 - 00001178 _____ C:\Users\Public\Desktop\Game Booster 3.lnk 2013-07-26 23:06 - 2013-07-26 23:06 - 00000000 ____D C:\ProgramData\IObit 2013-07-26 23:06 - 2013-07-26 23:06 - 00000000 ____D C:\Program Files (x86)\IObit 2013-07-26 18:06 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF 2013-07-26 13:30 - 2013-07-19 20:40 - 00000000 ____D C:\Users\*****\Documents\resourcepacks 2013-07-26 13:15 - 2013-07-19 18:18 - 00000000 ____D C:\Users\*****\Documents\versions 2013-07-26 13:04 - 2013-01-07 19:56 - 00000000 ____D C:\Program Files (x86)\Steam Files to move or delete: ==================== C:\Users\*****\AppData\Local\Temp\Mfwssv\liilozzrvvq.exe C:\Users\*****\AppData\Local\Temp\AskSLib.dll C:\Users\*****\AppData\Local\Temp\CDur6m_q.exe.part C:\Users\*****\AppData\Local\Temp\chatzum_softonic_yahoo_62_v5.exe C:\Users\*****\AppData\Local\Temp\COMAP.EXE C:\Users\*****\AppData\Local\Temp\i4jdel0.exe C:\Users\*****\AppData\Local\Temp\i4jdel1.exe C:\Users\*****\AppData\Local\Temp\i4jdel2.exe C:\Users\*****\AppData\Local\Temp\i4jdel3.exe C:\Users\*****\AppData\Local\Temp\PPOkAUQh.exe.part C:\Users\*****\AppData\Local\Temp\SetupAuto.exe C:\Users\*****\AppData\Local\Temp\SetupUpdater.exe C:\Users\*****\AppData\Local\Temp\setup_fsu_cid.exe C:\Users\*****\AppData\Local\Temp\uninst1.exe C:\Users\*****\AppData\Local\Temp\Uninstall.exe C:\Users\*****\AppData\Local\Temp\uql_sOEV.exe.part C:\Users\*****\AppData\Local\Temp\xgO0ZHT3.exe.part C:\Users\*****\AppData\Local\Temp\xmlUpdater.exe C:\Users\*****\AppData\Local\Temp\{907A1104-E812-4b5c-959B-E4DAB37A96AB}\AvBasesCheck.exe C:\Users\*****\AppData\Local\Temp\{907A1104-E812-4b5c-959B-E4DAB37A96AB}\Clean_tool.exe C:\Users\*****\AppData\Local\Temp\{907A1104-E812-4b5c-959B-E4DAB37A96AB}\Clean_tool64.exe C:\Users\*****\AppData\Local\Temp\{907A1104-E812-4b5c-959B-E4DAB37A96AB}\CUninstallerZA.exe C:\Users\*****\AppData\Local\Temp\{907A1104-E812-4b5c-959B-E4DAB37A96AB}\handlecmsg.exe C:\Users\*****\AppData\Local\Temp\{907A1104-E812-4b5c-959B-E4DAB37A96AB}\Install.exe C:\Users\*****\AppData\Local\Temp\{907A1104-E812-4b5c-959B-E4DAB37A96AB}\Launcher.exe C:\Users\*****\AppData\Local\Temp\{907A1104-E812-4b5c-959B-E4DAB37A96AB}\Uninst.exe C:\Users\*****\AppData\Local\Temp\{907A1104-E812-4b5c-959B-E4DAB37A96AB}\vistalib32.dll C:\Users\*****\AppData\Local\Temp\{907A1104-E812-4b5c-959B-E4DAB37A96AB}\vistalib64.dll C:\Users\*****\AppData\Local\Temp\{907A1104-E812-4b5c-959B-E4DAB37A96AB}\vsdrinst.exe C:\Users\*****\AppData\Local\Temp\{907A1104-E812-4b5c-959B-E4DAB37A96AB}\vsdrinst64.exe C:\Users\*****\AppData\Local\Temp\updE17E\BabScheduler2000201.exe C:\Users\*****\AppData\Local\Temp\texture pack\mcpatcher-2.4.3_04.exe C:\Users\*****\AppData\Local\Temp\MozUpdater\updater.exe C:\Users\*****\AppData\Local\Temp\is-QO127.tmp\gbinit.exe C:\Users\*****\AppData\Local\Temp\is-DRALA.tmp\botva2.dll C:\Users\*****\AppData\Local\Temp\is-DRALA.tmp\dbww.exe C:\Users\*****\AppData\Local\Temp\is-DRALA.tmp\DeltaTB.exe C:\Users\*****\AppData\Local\Temp\is-DRALA.tmp\InnoCallback.dll C:\Users\*****\AppData\Local\Temp\is-DRALA.tmp\itdownload.dll C:\Users\*****\AppData\Local\Temp\is-DRALA.tmp\_isetup\_shfoldr.dll C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\CbsProvider.dll C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\CompatProvider.dll C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\DismCore.dll C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\DismCorePS.dll C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\DismHost.exe C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\DismProv.dll C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\DmiProvider.dll C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\FolderProvider.dll C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\IntlProvider.dll C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\LogProvider.dll C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\MsiProvider.dll C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\OSProvider.dll C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\SmiProvider.dll C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\TransmogProvider.dll C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\UnattendProvider.dll C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\wdscore.dll C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\WimProvider.dll C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\de-DE\CbsProvider.dll.mui C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\de-DE\CompatProvider.dll.mui C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\de-DE\DismCore.dll.mui C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\de-DE\DismProv.dll.mui C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\de-DE\DmiProvider.dll.mui C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\de-DE\FolderProvider.dll.mui C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\de-DE\IntlProvider.dll.mui C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\de-DE\LogProvider.dll.mui C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\de-DE\MsiProvider.dll.mui C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\de-DE\OSProvider.dll.mui C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\de-DE\SmiProvider.dll.mui C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\de-DE\TransmogProvider.dll.mui C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\de-DE\UnattendProvider.dll.mui C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\de-DE\WimProvider.dll.mui C:\Users\*****\AppData\Local\Temp\bus92CF\BabScheduler3.exe C:\Users\*****\AppData\Local\Temp\bus6B9D\ChromeExtUpdater.exe C:\Users\*****\AppData\Local\Temp\bus3F0B\ff21v.exe C:\Users\*****\AppData\Local\Temp\B6F5B7DD-BAB0-7891-BE19-B04326A49B21\Setup.exe C:\Users\*****\AppData\Local\Temp\B6F5B7DD-BAB0-7891-BE19-B04326A49B21\sqlite3.dll C:\Users\*****\AppData\Local\Temp\B6F5B7DD-BAB0-7891-BE19-B04326A49B21\Latest\ccp.exe C:\Users\*****\AppData\Local\Temp\B6F5B7DD-BAB0-7891-BE19-B04326A49B21\Latest\ChromeToolbarSetup.dll C:\Users\*****\AppData\Local\Temp\B6F5B7DD-BAB0-7891-BE19-B04326A49B21\Latest\CrxInstaller.dll C:\Users\*****\AppData\Local\Temp\B6F5B7DD-BAB0-7891-BE19-B04326A49B21\Latest\GUninstaller.exe C:\Users\*****\AppData\Local\Temp\B6F5B7DD-BAB0-7891-BE19-B04326A49B21\Latest\IEHelper.dll C:\Users\*****\AppData\Local\Temp\B6F5B7DD-BAB0-7891-BE19-B04326A49B21\Latest\MyBabylonTB.exe C:\Users\*****\AppData\Local\Temp\B6F5B7DD-BAB0-7891-BE19-B04326A49B21\Latest\Setup.exe C:\Users\*****\AppData\Local\Temp\B6F5B7DD-BAB0-7891-BE19-B04326A49B21\Latest\sqlite3.dll C:\Users\*****\AppData\Local\Temp\94E4DB11-BAB0-7891-BEA7-AC76F3215973\Setup.exe C:\Users\*****\AppData\Local\Temp\94E4DB11-BAB0-7891-BEA7-AC76F3215973\sqlite3.dll C:\Users\*****\AppData\Local\Temp\94E4DB11-BAB0-7891-BEA7-AC76F3215973\Latest\ccp.exe C:\Users\*****\AppData\Local\Temp\94E4DB11-BAB0-7891-BEA7-AC76F3215973\Latest\ChromeToolbarSetup.dll C:\Users\*****\AppData\Local\Temp\94E4DB11-BAB0-7891-BEA7-AC76F3215973\Latest\CrxInstaller.dll C:\Users\*****\AppData\Local\Temp\94E4DB11-BAB0-7891-BEA7-AC76F3215973\Latest\GUninstaller.exe C:\Users\*****\AppData\Local\Temp\94E4DB11-BAB0-7891-BEA7-AC76F3215973\Latest\IEHelper.dll C:\Users\*****\AppData\Local\Temp\94E4DB11-BAB0-7891-BEA7-AC76F3215973\Latest\MyBabylonTB.exe C:\Users\*****\AppData\Local\Temp\94E4DB11-BAB0-7891-BEA7-AC76F3215973\Latest\Setup.exe C:\Users\*****\AppData\Local\Temp\94E4DB11-BAB0-7891-BEA7-AC76F3215973\Latest\sqlite3.dll C:\Users\*****\AppData\Local\Temp\34A2EE20-BAB0-7891-8D9A-98B68F560A48\Setup.exe C:\Users\*****\AppData\Local\Temp\34A2EE20-BAB0-7891-8D9A-98B68F560A48\sqlite3.dll C:\Users\*****\AppData\Local\Temp\34A2EE20-BAB0-7891-8D9A-98B68F560A48\Latest\ccp.exe C:\Users\*****\AppData\Local\Temp\34A2EE20-BAB0-7891-8D9A-98B68F560A48\Latest\ChromeToolbarSetup.dll C:\Users\*****\AppData\Local\Temp\34A2EE20-BAB0-7891-8D9A-98B68F560A48\Latest\CrxInstaller.dll C:\Users\*****\AppData\Local\Temp\34A2EE20-BAB0-7891-8D9A-98B68F560A48\Latest\GUninstaller.exe C:\Users\*****\AppData\Local\Temp\34A2EE20-BAB0-7891-8D9A-98B68F560A48\Latest\IEHelper.dll C:\Users\*****\AppData\Local\Temp\34A2EE20-BAB0-7891-8D9A-98B68F560A48\Latest\MyBabylonTB.exe C:\Users\*****\AppData\Local\Temp\34A2EE20-BAB0-7891-8D9A-98B68F560A48\Latest\Setup.exe C:\Users\*****\AppData\Local\Temp\34A2EE20-BAB0-7891-8D9A-98B68F560A48\Latest\sqlite3.dll ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-08-22 01:09 ==================== End Of Log ============================ Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 25-08-2013 02 Ran by ***** at 2013-08-25 23:51:24 Running from C:\Users\*****\Desktop\Downloads Boot Mode: Normal ========================================================== ==================== Installed Programs ======================= 2YourFace 1.0 (x32 Version: 1.0) Adobe AIR (x32 Version: 3.1.0.4880) Adobe Flash Player 11 ActiveX (x32 Version: 11.7.700.224) Adobe Flash Player 11 Plugin (x32 Version: 11.7.700.224) Adobe Reader X (10.1.7) MUI (x32 Version: 10.1.7) Adobe Shockwave Player 12.0 (x32 Version: 12.0.0.112) Ashampoo Burning Studio (x32 Version: 10.0.10) Ashampoo Photo Commander (x32 Version: 9.2.0) Ashampoo Photo Optimizer (x32 Version: 4.0.0) Ashampoo Snap (x32 Version: 4.3.0) Asmedia ASM104x USB 3.0 Host Controller Driver (x32 Version: 1.12.9.0) Avira Free Antivirus (x32 Version: 13.0.0.4045) Battlefield 1942™ (x32 Version: 1.6.20.0) Chivalry: Medieval Warfare (x32) CyberLink LabelPrint (x32 Version: 2.5.3624) CyberLink MediaEspresso (x32 Version: 6.5.1508_36229) CyberLink PhotoDirector 2011 (x32 Version: 2.0.2430) CyberLink Power2Go (x32 Version: 7.0.0.1327) CyberLink PowerDVD 10 (x32 Version: 10.0.3622.02) CyberLink PowerDVD Copy (x32 Version: 1.5.1306) CyberLink PowerRecover (x32 Version: 5.5.4125) CyberLink WaveEditor (x32 Version: 1.0.1.3320) D3DX10 (x32 Version: 15.4.2368.0902) Deal Boat (x32 Version: 1.27.153.4) EA SPORTS Game Face Browser Plugin 1.8.0.0 (HKCU Version: 1.8.0.0) ELAN 2013 NW (x32 Version: 4.0.0.0) Falk Navi-Manager classic (x32 Version: 2.11.0) Fotogalerija Windows Live (x32 Version: 15.4.3502.0922) Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922) Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922) Galeria fotografii usługi Windows Live (x32 Version: 15.4.3502.0922) Galerie de photos Windows Live (x32 Version: 15.4.3502.0922) Game Booster 3 (x32 Version: 3.4) Google Chrome (x32 Version: 29.0.1547.57) Google Earth Plug-in (x32 Version: 7.1.1.1888) Google Update Helper (x32 Version: 1.3.21.153) Intel(R) Management Engine Components (x32 Version: 7.0.0.1144) Intel(R) OpenCL CPU Runtime (x32) Intel(R) Processor Graphics (x32 Version: 8.15.10.2669) Intel(R) Rapid Storage Technology (x32 Version: 11.1.0.1006) Java 7 Update 25 (x32 Version: 7.0.250) Java Auto Updater (x32 Version: 2.1.9.5) Java(TM) 7 Update 3 (64-bit) (Version: 7.0.30) Junk Mail filter update (x32 Version: 15.4.3502.0922) Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300) Medion Home Cinema (x32 Version: 8.0.3216) Memeo Instant Backup (x32 Version: 4.60.0.7943) Mesh Runtime (x32 Version: 15.4.5722.2) Microsoft .NET Framework 1.1 (x32 Version: 1.1.4322) Microsoft Application Error Reporting (Version: 12.0.6015.5000) Microsoft Office 2007 Service Pack 3 (SP3) (x32) Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003) Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Live Add-in 1.5 (x32 Version: 2.0.4024.1) Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000) Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014) Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32) Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Silverlight (Version: 5.1.20513.0) Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.50727.42) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001) Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219) Mozilla Firefox 23.0.1 (x86 de) (x32 Version: 23.0.1) Mozilla Maintenance Service (x32 Version: 17.0.8) Mozilla Thunderbird 17.0.8 (x86 de) (x32 Version: 17.0.8) MSVCRT (x32 Version: 15.4.2862.0708) MSVCRT_amd64 (x32 Version: 15.4.2862.0708) MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0) MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0) Notepad++ (x32 Version: 6.4.2) Origin (x32 Version: 9.1.15.109) PlayReady PC Runtime amd64 (Version: 1.3.0) Poczta usługi Windows Live (x32 Version: 15.4.3502.0922) Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922) Pošta Windows Live (x32 Version: 15.4.3502.0922) QuickShare (x32 Version: 1.6.1.804) Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922) Realtek High Definition Audio Driver (x32 Version: 6.0.1.6554) rosoft .NET Framework 4 Client Profile (Version: 4.0.30319) Spelling Dictionaries Support For Adobe Reader X (x32 Version: 10.0.0) Steam (x32 Version: 1.0.0.0) swMSM (x32 Version: 12.0.0.1) Unity Web Player (HKCU Version: ) Update for 2007 Microsoft Office System (KB967642) (x32) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1) Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32) Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition (x32) Update for Microsoft Office 2007 suites (KB2596802) 32-Bit Edition (x32) Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition (x32) Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (x32) Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32) Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (x32) Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2817563) 32-Bit Edition (x32) Update für Microsoft Office Excel 2007 Help (KB963678) (x32) Update für Microsoft Office Outlook 2007 Help (KB963677) (x32) Update für Microsoft Office Powerpoint 2007 Help (KB963669) (x32) Update für Microsoft Office Word 2007 Help (KB963665) (x32) VC 9.0 Runtime (x32 Version: 1.0.0) Windows Live Communications Platform (x32 Version: 15.4.3502.0922) Windows Live Essentials (x32 Version: 15.4.3502.0922) Windows Live Essentials (x32 Version: 15.4.3538.0513) Windows Live Fotogalerie (x32 Version: 15.4.3502.0922) Windows Live Fotoğraf Galerisi (x32 Version: 15.4.3502.0922) Windows Live Fotótár (x32 Version: 15.4.3502.0922) Windows Live ID Sign-in Assistant (Version: 7.250.4232.0) Windows Live Installer (x32 Version: 15.4.3502.0922) Windows Live Language Selector (Version: 15.4.3538.0513) Windows Live Mail (x32 Version: 15.4.3502.0922) Windows Live Mesh (x32 Version: 15.4.3502.0922) Windows Live Messenger (x32 Version: 15.4.3538.0513) Windows Live MIME IFilter (Version: 15.4.3502.0922) Windows Live Movie Maker (x32 Version: 15.4.3502.0922) Windows Live Photo Common (x32 Version: 15.4.3502.0922) Windows Live Photo Gallery (x32 Version: 15.4.3502.0922) Windows Live PIMT Platform (x32 Version: 15.4.3508.1109) Windows Live Remote Client (Version: 15.4.5722.2) Windows Live Remote Client Resources (Version: 15.4.5722.2) Windows Live Remote Service (Version: 15.4.5722.2) Windows Live Remote Service Resources (Version: 15.4.5722.2) Windows Live SOXE (x32 Version: 15.4.3502.0922) Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922) Windows Live Temel Parçalar (x32 Version: 15.4.3502.0922) Windows Live UX Platform (x32 Version: 15.4.3502.0922) Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109) Windows Live Writer (x32 Version: 15.4.3502.0922) Windows Live Writer Resources (x32 Version: 15.4.3502.0922) Windows Mobile-Gerätecenter (Version: 6.1.6965.0) WinRAR 4.20 (32-Bit) (x32 Version: 4.20.0) ZoneAlarm LTD Toolbar Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922) ==================== Restore Points ========================= 28-07-2013 17:00:25 Windows-Sicherung 04-08-2013 17:00:24 Windows-Sicherung 11-08-2013 17:00:24 Windows-Sicherung 18-08-2013 17:00:22 Windows-Sicherung 25-08-2013 14:52:33 Windows Update 25-08-2013 17:00:26 Windows-Sicherung ==================== Hosts content: ========================== 2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: {071CCF5E-FEDC-4E11-BC07-4DD3DF3D8A0F} - System32\Tasks\Microsoft\Windows\WindowsBackup\Windows Backup Monitor => C:\Windows\system32\sdclt.exe [2010-11-21] (Microsoft Corporation) Task: {3731D4EA-0FBC-444A-A81F-6AE11A723175} - System32\Tasks\Game_Booster_AutoUpdate => C:\Program Files (x86)\IObit\Game Booster 3\AutoUpdate.exe [2013-07-26] () Task: {4C31CB68-5C5D-49FA-83E6-D15ABD2A0C4B} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-06-16] (Google Inc.) Task: {66700F3D-2ABE-4082-87B8-8D546CAE53C0} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task Task: {82C8BA32-6E02-4D07-BB93-A288851F8BFC} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-06-16] (Google Inc.) Task: {87EE2F9B-5397-48CF-A058-B113DAAB2087} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => C:\Windows\system32\rundll32.exe [2009-07-14] (Microsoft Corporation) Task: {8E837E2E-4F10-408C-BB41-ECBBA5A325DE} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2010-11-21] (Microsoft Corporation) Task: {8F4A043E-E53A-442B-A5F3-E4E44DE7B55F} - System32\Tasks\AdobeFlashPlayerUpdate 2 => C:\Windows\SysWOW64\FlashPlayerUpdateService.exe [2013-05-28] (Adobe Systems Incorporated) Task: {9FC0F5A9-870F-42D4-966D-2CA8AA29808F} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-05-28] (Adobe Systems Incorporated) Task: {A50DB85E-2408-419C-A0DF-3BC8FBA8839D} - System32\Tasks\AdobeFlashPlayerUpdate => C:\Windows\SysWOW64\FlashPlayerUpdateService.exe [2013-05-28] (Adobe Systems Incorporated) Task: {C4A39E40-50B5-4549-98FE-A9A36313D50C} - System32\Tasks\Updater12747.exe => C:\Users\*****\AppData\Local\Updater12747\Updater12747.exe No File Task: {CA7F72EB-975B-4414-B3D4-CAB371218687} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2009-07-14] (Microsoft Corporation) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (08/25/2013 11:32:02 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: FlashPlayerUpdateService.exe, Version: 11.6.602.180, Zeitstempel: 0x51a4ab8c Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel: 0x4ec49b8f Ausnahmecode: 0xc0000005 Fehleroffset: 0x0002e243 ID des fehlerhaften Prozesses: 0xe04 Startzeit der fehlerhaften Anwendung: 0xFlashPlayerUpdateService.exe0 Pfad der fehlerhaften Anwendung: FlashPlayerUpdateService.exe1 Pfad des fehlerhaften Moduls: FlashPlayerUpdateService.exe2 Berichtskennung: FlashPlayerUpdateService.exe3 Error: (08/25/2013 10:32:07 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: FlashPlayerUpdateService.exe, Version: 11.6.602.180, Zeitstempel: 0x51a4ab8c Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel: 0x4ec49b8f Ausnahmecode: 0xc0000005 Fehleroffset: 0x0002e243 ID des fehlerhaften Prozesses: 0x19c8 Startzeit der fehlerhaften Anwendung: 0xFlashPlayerUpdateService.exe0 Pfad der fehlerhaften Anwendung: FlashPlayerUpdateService.exe1 Pfad des fehlerhaften Moduls: FlashPlayerUpdateService.exe2 Berichtskennung: FlashPlayerUpdateService.exe3 Error: (08/25/2013 10:31:53 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: avnotify.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6b921 Name des fehlerhaften Moduls: avnotify.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6b921 Ausnahmecode: 0xc0000005 Fehleroffset: 0x00011380 ID des fehlerhaften Prozesses: 0x1a64 Startzeit der fehlerhaften Anwendung: 0xavnotify.exe0 Pfad der fehlerhaften Anwendung: avnotify.exe1 Pfad des fehlerhaften Moduls: avnotify.exe2 Berichtskennung: avnotify.exe3 Error: (08/25/2013 09:32:02 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: FlashPlayerUpdateService.exe, Version: 11.6.602.180, Zeitstempel: 0x51a4ab8c Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel: 0x4ec49b8f Ausnahmecode: 0xc0000005 Fehleroffset: 0x0002e243 ID des fehlerhaften Prozesses: 0x190c Startzeit der fehlerhaften Anwendung: 0xFlashPlayerUpdateService.exe0 Pfad der fehlerhaften Anwendung: FlashPlayerUpdateService.exe1 Pfad des fehlerhaften Moduls: FlashPlayerUpdateService.exe2 Berichtskennung: FlashPlayerUpdateService.exe3 Error: (08/25/2013 08:32:01 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: FlashPlayerUpdateService.exe, Version: 11.6.602.180, Zeitstempel: 0x51a4ab8c Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel: 0x4ec49b8f Ausnahmecode: 0xc0000005 Fehleroffset: 0x0002e243 ID des fehlerhaften Prozesses: 0x1530 Startzeit der fehlerhaften Anwendung: 0xFlashPlayerUpdateService.exe0 Pfad der fehlerhaften Anwendung: FlashPlayerUpdateService.exe1 Pfad des fehlerhaften Moduls: FlashPlayerUpdateService.exe2 Berichtskennung: FlashPlayerUpdateService.exe3 Error: (08/25/2013 07:32:03 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: FlashPlayerUpdateService.exe, Version: 11.6.602.180, Zeitstempel: 0x51a4ab8c Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel: 0x4ec49b8f Ausnahmecode: 0xc0000005 Fehleroffset: 0x0002e243 ID des fehlerhaften Prozesses: 0x928 Startzeit der fehlerhaften Anwendung: 0xFlashPlayerUpdateService.exe0 Pfad der fehlerhaften Anwendung: FlashPlayerUpdateService.exe1 Pfad des fehlerhaften Moduls: FlashPlayerUpdateService.exe2 Berichtskennung: FlashPlayerUpdateService.exe3 Error: (08/25/2013 07:02:40 PM) (Source: Windows Backup) (User: ) Description: Die Sicherung war nicht erfolgreich. Fehler: "Auf diesem Laufwerk ist nicht genügend Speicherplatz zum Speichern der Sicherung verfügbar. Löschen Sie ältere Sicherungen und nicht benötigte Daten, um Speicherplatz freizugeben, oder ändern Sie die Sicherungseinstellungen. (0x81000005)" Error: (08/25/2013 06:32:02 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: FlashPlayerUpdateService.exe, Version: 11.6.602.180, Zeitstempel: 0x51a4ab8c Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel: 0x4ec49b8f Ausnahmecode: 0xc0000005 Fehleroffset: 0x0002e243 ID des fehlerhaften Prozesses: 0x2c4 Startzeit der fehlerhaften Anwendung: 0xFlashPlayerUpdateService.exe0 Pfad der fehlerhaften Anwendung: FlashPlayerUpdateService.exe1 Pfad des fehlerhaften Moduls: FlashPlayerUpdateService.exe2 Berichtskennung: FlashPlayerUpdateService.exe3 Error: (08/25/2013 05:32:07 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: FlashPlayerUpdateService.exe, Version: 11.6.602.180, Zeitstempel: 0x51a4ab8c Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel: 0x4ec49b8f Ausnahmecode: 0xc0000005 Fehleroffset: 0x0002e243 ID des fehlerhaften Prozesses: 0x15a8 Startzeit der fehlerhaften Anwendung: 0xFlashPlayerUpdateService.exe0 Pfad der fehlerhaften Anwendung: FlashPlayerUpdateService.exe1 Pfad des fehlerhaften Moduls: FlashPlayerUpdateService.exe2 Berichtskennung: FlashPlayerUpdateService.exe3 Error: (08/25/2013 05:08:56 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3. Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion. In Konflikt stehende Komponenten:. Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest. Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest. System errors: ============= Error: (08/25/2013 01:10:56 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Windows-Zeitgeber" wurde mit folgendem Fehler beendet: %%1115 Error: (08/22/2013 10:11:41 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "MemeoBackgroundService" wurde aufgrund folgenden Fehlers nicht gestartet: %%1053 Error: (08/22/2013 10:11:41 AM) (Source: Service Control Manager) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst MemeoBackgroundService erreicht. Error: (08/15/2013 08:47:56 PM) (Source: Microsoft-Windows-Application-Experience) (User: NT-AUTORITÄT) Description: Der Dienst "Programmkompatibilitäts-Assistent" konnte Phase 2 nicht initialisieren. Error: (08/14/2013 10:26:38 PM) (Source: Microsoft-Windows-Application-Experience) (User: NT-AUTORITÄT) Description: Der Dienst "Programmkompatibilitäts-Assistent" konnte Phase 2 nicht initialisieren. Error: (08/13/2013 10:41:56 PM) (Source: Microsoft-Windows-Application-Experience) (User: NT-AUTORITÄT) Description: Der Dienst "Programmkompatibilitäts-Assistent" konnte Phase 2 nicht initialisieren. Error: (08/13/2013 00:47:27 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Windows Driver Foundation - Benutzermodus-Treiberframework" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts. Error: (08/13/2013 00:47:27 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Automatische WLAN-Konfiguration" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts. Error: (08/13/2013 00:47:27 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Sitzungs-Manager für Desktopfenster-Manager" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts. Error: (08/13/2013 00:47:27 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Superfetch" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts. Microsoft Office Sessions: ========================= CodeIntegrity Errors: =================================== Date: 2013-03-30 20:28:23.496 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-03-30 20:01:54.066 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-03-30 18:28:31.734 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-03-30 17:55:42.768 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-03-30 11:49:08.767 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-03-30 11:33:11.869 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-03-30 10:41:40.950 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-03-30 10:17:32.913 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-03-30 09:55:44.176 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-03-30 08:44:16.793 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. ==================== Memory info =========================== Percentage of memory in use: 58% Total physical RAM: 3975.64 MB Available physical RAM: 1656.35 MB Total Pagefile: 7949.46 MB Available Pagefile: 5180.42 MB Total Virtual: 8192 MB Available Virtual: 8191.82 MB ==================== Drives ================================ Drive c: (Boot) (Fixed) (Total:226.81 GB) (Free:159.84 GB) NTFS Drive d: (Recovery) (Fixed) (Total:39.06 GB) (Free:0 GB) NTFS Drive l: (Speicher) (Fixed) (Total:198.78 GB) (Free:197.88 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 466 GB) (Disk ID: DD3B8AC5) Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=227 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=238 GB) - (Type=OF Extended) Partition 4: (Not Active) - (Size=1 GB) - (Type=12) ==================== End Of Log ============================ Leider konnte ich mein Anti Virus system AVIRA nicht deaktiviren, es kam eine fehlermeldung in der stand, dass ich nicht berechtigt bin etwas zu ändern. Ansonsten habe ich alles genau so gemacht, wie es in der Checkliste erklärt war. Ich hoffe es ist kein allzu großes Problem, sonst muss ich nochmal schauen ob ich es irgendwie hinkriege, mein AVIRA zu deaktiviren. Hier der Log file des GMER.txt Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-08-26 13:03:15
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST350041 rev.JC47 465,76GB
Running: gmer_2.1.19163(1).exe; Driver: C:\Users\*****\AppData\Local\Temp\uxtiyfow.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 560 fffff80003ba3000 45 bytes [C1, 8B, C2, 48, 3B, C7, 72, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 606 fffff80003ba302e 31 bytes [44, 8A, F0, 48, 39, 1D, 10, ...]
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe[1664] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076071465 2 bytes [07, 76]
.text C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe[1664] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000760714bb 2 bytes [07, 76]
.text ... * 2
.text C:\Users\*****\AppData\Local\Smartbar\Application\QuickShare.exe[3480] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000076071465 2 bytes [07, 76]
.text C:\Users\*****\AppData\Local\Smartbar\Application\QuickShare.exe[3480] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000760714bb 2 bytes [07, 76]
.text ... * 2
.text C:\Windows\SysWOW64\svchost.exe[4068] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076071465 2 bytes [07, 76]
.text C:\Windows\SysWOW64\svchost.exe[4068] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000760714bb 2 bytes [07, 76]
.text ... * 2
.text C:\Windows\SysWOW64\explorer.exe[1216] C:\Windows\SysWOW64\wsock32.DLL!setsockopt + 322 000000006e7b1a22 2 bytes [7B, 6E]
.text C:\Windows\SysWOW64\explorer.exe[1216] C:\Windows\SysWOW64\wsock32.DLL!setsockopt + 496 000000006e7b1ad0 2 bytes [7B, 6E]
.text C:\Windows\SysWOW64\explorer.exe[1216] C:\Windows\SysWOW64\wsock32.DLL!setsockopt + 552 000000006e7b1b08 2 bytes [7B, 6E]
.text C:\Windows\SysWOW64\explorer.exe[1216] C:\Windows\SysWOW64\wsock32.DLL!setsockopt + 730 000000006e7b1bba 2 bytes [7B, 6E]
.text C:\Windows\SysWOW64\explorer.exe[1216] C:\Windows\SysWOW64\wsock32.DLL!setsockopt + 762 000000006e7b1bda 2 bytes [7B, 6E]
.text C:\Windows\SysWOW64\explorer.exe[1216] C:\Windows\syswow64\wininet.DLL!InternetCloseHandle 0000000075ad4282 5 bytes JMP 0000000100852c10
.text C:\Windows\SysWOW64\explorer.exe[1216] C:\Windows\syswow64\wininet.DLL!HttpQueryInfoA 0000000075ad7079 5 bytes JMP 0000000100852ab8
.text C:\Windows\SysWOW64\explorer.exe[1216] C:\Windows\syswow64\wininet.DLL!HttpQueryInfoW 0000000075ad77c2 5 bytes JMP 0000000100852b64
.text C:\Windows\SysWOW64\explorer.exe[1216] C:\Windows\syswow64\wininet.DLL!HttpSendRequestW 0000000075ad7ca6 5 bytes JMP 00000001008525c8
.text C:\Windows\SysWOW64\explorer.exe[1216] C:\Windows\syswow64\wininet.DLL!HttpOpenRequestW 0000000075ad83dd 5 bytes JMP 0000000100851494
.text C:\Windows\SysWOW64\explorer.exe[1216] C:\Windows\syswow64\wininet.DLL!InternetQueryDataAvailable 0000000075ae92e9 5 bytes JMP 0000000100852970
.text C:\Windows\SysWOW64\explorer.exe[1216] C:\Windows\syswow64\wininet.DLL!InternetReadFile 0000000075ae972b 5 bytes JMP 00000001008529bc
.text C:\Windows\SysWOW64\explorer.exe[1216] C:\Windows\syswow64\wininet.DLL!InternetReadFileExW 0000000075afadd7 5 bytes JMP 0000000100852a64
.text C:\Windows\SysWOW64\explorer.exe[1216] C:\Windows\syswow64\wininet.DLL!InternetReadFileExA 0000000075afae2e 5 bytes JMP 0000000100852a10
.text C:\Windows\SysWOW64\explorer.exe[1216] C:\Windows\syswow64\wininet.DLL!HttpSendRequestA 0000000075ba32f2 5 bytes JMP 0000000100852614
.text C:\Windows\SysWOW64\explorer.exe[1216] C:\Windows\syswow64\wininet.DLL!HttpOpenRequestA 0000000075ba3595 5 bytes JMP 0000000100851650
.text C:\Windows\SysWOW64\explorer.exe[1216] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076071465 2 bytes [07, 76]
.text C:\Windows\SysWOW64\explorer.exe[1216] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000760714bb 2 bytes [07, 76]
.text ... * 2
---- Threads - GMER 2.1 ----
Thread C:\Windows\SysWOW64\svchost.exe [4068:3188] 000000007efa0000
Thread C:\Windows\SysWOW64\svchost.exe [4068:3236] 000000007efa4c6d
Thread C:\Windows\SysWOW64\svchost.exe [4068:3232] 000000007efa7f06
Thread C:\Windows\SysWOW64\svchost.exe [4068:3220] 000000007efa6980
Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [3544:2120] 000007fefb842a7c
Thread C:\Windows\System32\svchost.exe [2844:4056] 000007feedf29688
Thread C:\Windows\SysWOW64\explorer.exe [1216:2584] 0000000000856310
Thread C:\Windows\SysWOW64\explorer.exe [1216:796] 0000000000856160
Thread C:\Windows\SysWOW64\explorer.exe [1216:4756] 00000000008483ac
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
Zum Schluss noch Logfiles meiner Virenscanner. Der logfile von Malwarebytes Anti-Malware befindet sich im Anhang, da annähernd 1000 infizierte Dateien gefunden wurden und somit das Zeichenlimit weit überschritten wäre. und hier von AVIRA: Code:
ATTFilter Exportierte Ereignisse:
25.08.2013 16:03 [System-Scanner] Malware gefunden
Die Datei 'C:\Users\*****\Desktop\Downloads\Ausgleich der stornierten
Lastschrift Ihrer Bestellung 22.08.2013.zip'
enthielt einen Virus oder unerwünschtes Programm 'TR/Spy.Injector.AH' [trojan].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5408ae45.qua'
verschoben!
25.08.2013 16:03 [System-Scanner] Malware gefunden
Die Datei 'C:\Users\*****\AppData\Local\Temp\{00015571-7FF1-ADF5}'
enthielt einen Virus oder unerwünschtes Programm 'TR/BankZone.A.3' [trojan].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4c58802d.qua'
verschoben!
25.08.2013 16:03 [System-Scanner] Malware gefunden
Die Datei 'C:\Users\*****\AppData\Local\Temp\gupzlcjxkv.pre'
enthielt einen Virus oder unerwünschtes Programm 'TR/Spy.Injector.AH' [trojan].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '1ec7db0a.qua'
verschoben!
23.08.2013 18:28 [System-Scanner] Malware gefunden
Die Datei 'D:\*****-PC\Backup Set 2013-05-08 163924\Backup Files 2013-06-09
190000\Backup files 3.zip'
enthielt einen Virus oder unerwünschtes Programm 'Adware/IWantThis.L' [adware].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4e7c0cd7.qua'
verschoben!
23.08.2013 18:28 [System-Scanner] Malware gefunden
Die Datei 'C:\Windows\System32\SensprsApi.exe'
enthielt einen Virus oder unerwünschtes Programm 'ADWARE/GFilter.Gen2' [adware].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5614208c.qua'
verschoben!
Ich hoffe ich habe nichts vergessen und bedanke mich schonmal im Vorfeld.  Gruß ketubli |
|
29.08.2013, 21:28
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Windows 7: Trojaner o.ä. aus eMail Anhang Hallo,
__________________bitte ein Log mit CF machen Scan mit Combofix
__________________ |
|
29.08.2013, 22:59
| #3 |
| | Windows 7: Trojaner o.ä. aus eMail Anhang Hallo,
__________________Erst einmal vielen Dank für die Antwort, mit Combofix hat alles geklappt. Hier der Logfile: Code:
ATTFilter ComboFix 13-08-29.02 - ***** 29.08.2013 23:42:16.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.3976.2459 [GMT 2:00]
ausgeführt von:: c:\users\*****\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\*****\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_eooncjejnppfjjklapaamhcdmjbilmde_0.localstorage
c:\users\*****\AppData\Roaming\2YourFace
c:\users\*****\AppData\Roaming\2YourFace\2YourFace.crx
c:\users\*****\AppData\Roaming\2YourFace\bho.dll
c:\users\*****\AppData\Roaming\2YourFace\FF8Installer.exe
c:\users\*****\AppData\Roaming\2YourFace\ffextension\chrome.manifest
c:\users\*****\AppData\Roaming\2YourFace\ffextension\chrome\content\ff-overlay.js
c:\users\*****\AppData\Roaming\2YourFace\ffextension\chrome\content\ff-overlay.xul
c:\users\*****\AppData\Roaming\2YourFace\ffextension\chrome\content\overlay.js
c:\users\*****\AppData\Roaming\2YourFace\ffextension\chrome\locale\en-US\overlay.dtd
c:\users\*****\AppData\Roaming\2YourFace\ffextension\chrome\locale\en-US\overlay.properties
c:\users\*****\AppData\Roaming\2YourFace\ffextension\chrome\skin\overlay.css
c:\users\*****\AppData\Roaming\2YourFace\ffextension\defaults\preferences\prefs.js
c:\users\*****\AppData\Roaming\2YourFace\ffextension\install.rdf
c:\users\*****\AppData\Roaming\2YourFace\uninst.exe
c:\users\*****\AppData\Roaming\2YourFace\Updater.exe
c:\users\*****\AppData\Roaming\2YourFace\version.exe
c:\users\*****\AppData\Roaming\execau.exe
c:\users\*****\AppData\Roaming\execqlplay.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-07-28 bis 2013-08-29 ))))))))))))))))))))))))))))))
.
.
2013-08-29 21:47 . 2013-08-29 21:47 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-08-29 08:31 . 2013-08-29 08:31 -------- d-----w- c:\program files (x86)\7-Zip
2013-08-28 08:44 . 2013-08-29 10:26 76232 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{75DAA8F6-9116-4119-8DE0-8DDB90D64FBC}\offreg.dll
2013-08-27 08:05 . 2013-08-19 22:46 9515512 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{75DAA8F6-9116-4119-8DE0-8DDB90D64FBC}\mpengine.dll
2013-08-25 22:44 . 2013-07-26 05:12 19239424 ----a-w- c:\windows\system32\mshtml.dll
2013-08-25 22:44 . 2013-07-26 05:12 15405056 ----a-w- c:\windows\system32\ieframe.dll
2013-08-25 21:49 . 2013-08-25 21:49 -------- d-----w- C:\FRST
2013-08-25 15:18 . 2013-07-09 05:52 224256 ----a-w- c:\windows\system32\wintrust.dll
2013-08-25 15:18 . 2013-07-09 05:46 1472512 ----a-w- c:\windows\system32\crypt32.dll
2013-08-25 15:18 . 2013-07-09 04:52 175104 ----a-w- c:\windows\SysWow64\wintrust.dll
2013-08-25 15:18 . 2013-07-09 04:46 1166848 ----a-w- c:\windows\SysWow64\crypt32.dll
2013-08-25 15:18 . 2013-07-09 05:46 184320 ----a-w- c:\windows\system32\cryptsvc.dll
2013-08-25 15:18 . 2013-07-09 05:46 139776 ----a-w- c:\windows\system32\cryptnet.dll
2013-08-25 15:18 . 2013-07-09 04:46 140288 ----a-w- c:\windows\SysWow64\cryptsvc.dll
2013-08-25 15:18 . 2013-07-09 04:46 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll
2013-08-25 15:13 . 2013-07-19 01:58 2048 ----a-w- c:\windows\system32\tzres.dll
2013-08-25 15:13 . 2013-07-19 01:41 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2013-08-25 15:13 . 2013-07-25 09:25 1888768 ----a-w- c:\windows\system32\WMVDECOD.DLL
2013-08-25 15:13 . 2013-07-25 08:57 1620992 ----a-w- c:\windows\SysWow64\WMVDECOD.DLL
2013-08-25 15:13 . 2013-07-09 05:51 1217024 ----a-w- c:\windows\system32\rpcrt4.dll
2013-08-25 15:13 . 2013-07-09 04:52 663552 ----a-w- c:\windows\SysWow64\rpcrt4.dll
2013-08-25 15:11 . 2013-06-15 04:32 39936 ----a-w- c:\windows\system32\drivers\tssecsrv.sys
2013-08-25 15:11 . 2013-07-06 06:03 1910208 ----a-w- c:\windows\system32\drivers\tcpip.sys
2013-08-25 14:51 . 2013-08-25 14:51 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2013-08-25 14:51 . 2013-04-04 12:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-08-19 10:31 . 2013-08-20 15:49 -------- d-----w- c:\program files (x86)\Mozilla Thunderbird
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-08-25 22:40 . 2011-07-18 20:31 78161360 ----a-w- c:\windows\system32\MRT.exe
2013-08-20 08:33 . 2013-05-07 11:35 81112 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2013-08-20 08:33 . 2013-03-27 09:15 132088 ----a-w- c:\windows\system32\drivers\avipbb.sys
2013-08-20 08:33 . 2013-03-27 09:15 105344 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2013-08-07 02:22 . 2010-11-21 03:27 278800 ------w- c:\windows\system32\MpSigStub.exe
2013-07-26 21:28 . 2013-07-26 21:28 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-07-26 21:28 . 2012-01-25 20:13 867240 ----a-w- c:\windows\SysWow64\npdeployJava1.dll
2013-07-26 21:28 . 2011-07-18 21:13 789416 ----a-w- c:\windows\SysWow64\deployJava1.dll
2013-06-12 12:32 . 2013-03-20 14:51 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-06-12 12:32 . 2011-12-01 21:26 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-06-05 03:34 . 2013-07-10 10:11 3153920 ----a-w- c:\windows\system32\win32k.sys
2013-06-04 06:00 . 2013-07-10 10:11 624128 ----a-w- c:\windows\system32\qedit.dll
2013-06-04 04:53 . 2013-07-10 10:11 509440 ----a-w- c:\windows\SysWow64\qedit.dll
2012-05-15 09:33 . 2013-02-08 21:44 1456640 ----a-w- c:\program files (x86)\Common Files\Falk Navi-Manager classic.msi
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{11111111-1111-1111-1111-110111271147}]
2013-06-08 17:59 750472 ----a-w- c:\program files (x86)\Deal Boat\Deal Boat-bho.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{31ad400d-1b06-4e33-a59a-90c2c140cba0}]
2010-11-21 03:24 297808 ----a-w- c:\windows\System32\mscoree.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"Browser Infrastructure Helper"="c:\users\*****\AppData\Local\Smartbar\Application\QuickShare.exe" [2013-02-10 13824]
"EADM"="c:\program files (x86)\Origin\Origin.exe" [2013-07-31 3549528]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe" [2012-02-29 56088]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-08-20 347192]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys;c:\windows\SYSNATIVE\drivers\EagleX64.sys [x]
R3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\DRIVERS\ss_bbus.sys;c:\windows\SYSNATIVE\DRIVERS\ss_bbus.sys [x]
R3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\DRIVERS\ss_bmdfl.sys;c:\windows\SYSNATIVE\DRIVERS\ss_bmdfl.sys [x]
R3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\DRIVERS\ss_bmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ss_bmdm.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R3 WinRing0_1_2_0;WinRing0_1_2_0;c:\program files (x86)\IObit\Game Booster 3\Driver\WinRing0x64.sys;c:\program files (x86)\IObit\Game Booster 3\Driver\WinRing0x64.sys [x]
R3 wsvd;wsvd;c:\windows\system32\DRIVERS\wsvd.sys;c:\windows\SYSNATIVE\DRIVERS\wsvd.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 CyberLink PowerDVD 10 MS Monitor Service;CyberLink PowerDVD 10 MS Monitor Service;c:\program files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe;c:\program files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [x]
S2 CyberLink PowerDVD 10 MS Service;CyberLink PowerDVD 10 MS Service;c:\program files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe;c:\program files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 MemeoBackgroundService;MemeoBackgroundService;c:\program files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe;c:\program files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys;c:\windows\SYSNATIVE\DRIVERS\asmthub3.sys [x]
S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys;c:\windows\SYSNATIVE\DRIVERS\asmtxhci.sys [x]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192su.sys;c:\windows\SYSNATIVE\DRIVERS\RTL8192su.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-08-22 08:46 1177552 ----a-w- c:\program files (x86)\Google\Chrome\Application\29.0.1547.57\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2013-08-29 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-03-20 13:05]
.
2013-08-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-06-16 10:58]
.
2013-08-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-06-16 10:58]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-03-07 170264]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-03-07 398616]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-03-07 439576]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2012-01-16 12445288]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 660360]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"MedionReminder"="c:\program files (x86)\CyberLink\PowerRecover\Reminder.exe" [2011-05-25 443688]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://search.babylon.com/?affID=121150&babsrc=HP_ss_din2g&mntrId=204C0008CAE006FC
mStart Page = hxxp://search.chatzum.com/?orig=HP&affid=62&cztbid=184930497
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Nach Microsoft &Excel exportieren - c:\progra~2\MICROS~2\Office10\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4
TCP: DhcpNameServer = 192.168.1.254
FF - ProfilePath - c:\users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\n7uh2i73.default\
FF - prefs.js: browser.search.defaulturl -
FF - prefs.js: network.proxy.http - www-proxy.t-online.de
FF - prefs.js: network.proxy.http_port - 80
FF - prefs.js: network.proxy.type - 0
FF - ExtSQL: !HIDDEN! 2013-04-03 10:29; support@2yourface.com; c:\users\*****\AppData\Roaming\2YourFace\ffextension
FF - user.js: extensions.zonealarm.autoRvrt - false
FF - user.js: extensions.zonealarm_i.newTab - false
FF - user.js: extensions.zonealarm.tlbrSrchUrl - hxxp://search.zonealarm.com/search?Source=ToolBar&oemCode=ZLN27671584370666-1043&toolbarId=base&affiliateId=1001&Lan={dfltLng}&utid=204c3cc00000000000000008cae006fc&q=
FF - user.js: extensions.zonealarm.id - 204c3cc00000000000000008cae006fc
FF - user.js: extensions.zonealarm.instlDay - 15515
FF - user.js: extensions.zonealarm.vrsn - 1.5.24.4
FF - user.js: extensions.zonealarm.vrsni - 1.5.24.4
FF - user.js: extensions.zonealarm_i.vrsnTs - 1.5.24.413:57
FF - user.js: extensions.zonealarm.prtnrId - checkpoint
FF - user.js: extensions.zonealarm.prdct - zonealarm
FF - user.js: extensions.zonealarm.aflt - 1001
FF - user.js: extensions.zonealarm_i.smplGrp - none
FF - user.js: extensions.zonealarm.tlbrId - base
FF - user.js: extensions.zonealarm.instlRef - ZLN27671584370666-1043
FF - user.js: extensions.zonealarm.dfltLng - de
FF - user.js: extensions.zonealarm.excTlbr - false
FF - user.js: extensions.zonealarm.admin - false
FF - user.js: extensions.BabylonToolbar_i.id - 204c3cc00000000000000008cae006fc
FF - user.js: extensions.BabylonToolbar_i.hardId - 204c3cc00000000000000008cae006fc
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15532
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.tlbrId - base
FF - user.js: extensions.BabylonToolbar_i.instlRef - std
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=109958&tt=3412_4
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar.tlbrSrchUrl - hxxp://www.google.com/search?babsrc=TB_ggl&q=
FF - user.js: extensions.BabylonToolbar.id - 204c3cc00000000000000008cae006fc
FF - user.js: extensions.BabylonToolbar.instlDay - 15574
FF - user.js: extensions.BabylonToolbar.vrsn - 1.6.4.6
FF - user.js: extensions.BabylonToolbar.vrsni - 1.6.4.6
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.6.4.621:56
FF - user.js: extensions.BabylonToolbar.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar.tlbrId - base
FF - user.js: extensions.BabylonToolbar.instlRef - sst
FF - user.js: extensions.BabylonToolbar.dfltLng - en
FF - user.js: extensions.BabylonToolbar.excTlbr - false
FF - user.js: extensions.BabylonToolbar.admin - false
FF - user.js: extensions.Softonic.hpOld0 - hxxps://www.google.de/
FF - user.js: extensions.Softonic.tlbrSrchUrl - hxxp://search.softonic.com/MOY00009/tb_v1?SearchSource=1&cc=&q=
FF - user.js: extensions.Softonic.id - 204c3cc00000000000000008cae006fc
FF - user.js: extensions.Softonic.appId - {7ABBFE1C-E485-44AA-8F36-353751B4124D}
FF - user.js: extensions.Softonic.instlDay - 15765
FF - user.js: extensions.Softonic.vrsn - 1.8.8.11
FF - user.js: extensions.Softonic.vrsni - 1.8.8.11
FF - user.js: extensions.Softonic_i.vrsnTs - 1.8.8.1115:54
FF - user.js: extensions.Softonic.prtnrId - softonic
FF - user.js: extensions.Softonic.prdct - Softonic
FF - user.js: extensions.Softonic.aflt - SD
FF - user.js: extensions.Softonic_i.smplGrp - none
FF - user.js: extensions.Softonic.tlbrId - BASEirobinhoodActive
FF - user.js: extensions.Softonic.instlRef - MOY00009
FF - user.js: extensions.Softonic.dfltLng - de
FF - user.js: extensions.Softonic_i.excTlbr - false
FF - user.js: extensions.Softonic.excTlbr - false
FF - user.js: extensions.Softonic.admin - false
FF - user.js: extensions.Softonic.autoRvrt - false
FF - user.js: extensions.Softonic.rvrt - true
FF - user.js: extensions.Softonic_i.hmpg - true
FF - user.js: extensions.Softonic.hmpgUrl - hxxp://search.softonic.com/MOY00009/tb_v1?SearchSource=13&cc=
FF - user.js: extensions.Softonic.dfltSrch - true
FF - user.js: extensions.Softonic.srchPrvdr - Search the web (Softonic)
FF - user.js: extensions.Softonic.kw_url - hxxp://search.softonic.com/MOY00009/tb_v1?SearchSource=2&cc=&q=
FF - user.js: extensions.Softonic_i.dnsErr - true
FF - user.js: extensions.Softonic_i.newTab - true
FF - user.js: extensions.Softonic.newTabUrl - hxxp://search.softonic.com/MOY00009/tb_v1?SearchSource=15&cc=
FF - user.js: extensions.delta.tlbrSrchUrl -
FF - user.js: extensions.delta.id - 204c3cc00000000000000008cae006fc
FF - user.js: extensions.delta.appId - {C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
FF - user.js: extensions.delta.instlDay - 15864
FF - user.js: extensions.delta.vrsn - 1.8.21.5
FF - user.js: extensions.delta.vrsni - 1.8.21.5
FF - user.js: extensions.delta.vrsnTs - 1.8.21.519:58
FF - user.js: extensions.delta.prtnrId - delta
FF - user.js: extensions.delta.prdct - delta
FF - user.js: extensions.delta.aflt - babsst
FF - user.js: extensions.delta.smplGrp - none
FF - user.js: extensions.delta.tlbrId - base
FF - user.js: extensions.delta.instlRef - sst
FF - user.js: extensions.delta.dfltLng - en
FF - user.js: extensions.delta.excTlbr - false
FF - user.js: extensions.delta.ffxUnstlRst - true
FF - user.js: extensions.delta.admin - false
FF - user.js: extensions.delta_i.babTrack - affID=121150
FF - user.js: extensions.delta_i.babExt -
FF - user.js: extensions.delta_i.srcExt - ss
FF - user.js: extensions.delta.autoRvrt - false
FF - user.js: extensions.delta.rvrt - false
FF - user.js: extensions.delta.newTab - false
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{1185823F-F22F-4027-80E5-4F68ACD5DE5E} - c:\users\*****\AppData\Roaming\2YourFace\bho.dll
Wow6432Node-HKCU-Run-execqlplay - c:\users\*****\AppData\Roaming\execqlplay.exe
Wow6432Node-HKCU-Run-execau - c:\users\*****\AppData\Roaming\execau.exe
c:\users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2YourFace_Updater.lnk - c:\users\*****\AppData\Roaming\2YourFace\Updater.exe
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
HKLM-Run-ISW - (no file)
AddRemove-2YourFace - c:\users\*****\AppData\Roaming\2YourFace\uninst.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows CE Services]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-08-29 23:50:07
ComboFix-quarantined-files.txt 2013-08-29 21:50
.
Vor Suchlauf: 9 Verzeichnis(se), 172.519.608.320 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 174.041.526.272 Bytes frei
.
- - End Of File - - 7792816FD67A273D3B3D8B9FB63BE5C3
|
|
29.08.2013, 23:30
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows 7: Trojaner o.ä. aus eMail Anhang Malwarebytes Anti-Rootkit (MBAR) Downloade dir bitte  Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers
__________________ Logfiles bitte immer in CODE-Tags posten |
|
30.08.2013, 12:01
| #5 |
| | Windows 7: Trojaner o.ä. aus eMail Anhang Hallo, Malwarebytes Anti-Rookit habe ich mir heruntergeladen und den Scan ausgeführt. Ich habe den durch zweimal laufen lassen, beim ersten mal ist er fündig geworden, beim zweiten mal nicht. Hier der Logfile des ersten Scan's: Code:
ATTFilter Malwarebytes Anti-Rootkit BETA 1.07.0.1005
www.malwarebytes.org
Database version: v2013.08.30.03
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16660
***** :: *****-PC [administrator]
30.08.2013 11:35:02
mbar-log-2013-08-30 (11-35-02).txt
Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 250850
Time elapsed: 11 minute(s), 10 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 1
C:\Users\*****\AppData\Roaming\File Scout\filescout.exe (Trojan.PUP.Optional.FileScout.A) -> Delete on reboot.
Physical Sectors Detected: 0
(No malicious items detected)
(end)
Code:
ATTFilter Malwarebytes Anti-Rootkit BETA 1.07.0.1005
www.malwarebytes.org
Database version: v2013.08.30.03
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16660
***** :: *****-PC [administrator]
30.08.2013 12:02:11
mbar-log-2013-08-30 (12-02-11).txt
Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 250803
Time elapsed: 12 minute(s), 59 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
Physical Sectors Detected: 0
(No malicious items detected)
(end)
|
|
30.08.2013, 12:57
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows 7: Trojaner o.ä. aus eMail Anhang Adware/Junkware/Toolbars entfernen 1. Schritt: adwCleaner Downloade Dir bitte  AdwCleaner auf deinen Desktop.
2. Schritt: JRT - Junkware Removal Tool Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
3. Schritt: Frisches Log mit FRST Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ --> Windows 7: Trojaner o.ä. aus eMail Anhang |
|
31.08.2013, 13:59
| #7 |
| | Windows 7: Trojaner o.ä. aus eMail Anhang Hallo, Ich habe alles wie befolgt gemacht, hier die Logfile's AdwCleaner: Code:
ATTFilter # AdwCleaner v3.001 - Report created 31/08/2013 at 13:54:05
# Updated 24/08/2013 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : ***** - *****-PC
# Running from : C:\Users\*****\Desktop\Downloads\Trojaner Bekämpfung\adwcleaner.exe
# Option : Clean
***** [ Services ] *****
***** [ Files / Folders ] *****
Folder Deleted : C:\ProgramData\Babylon
Folder Deleted : C:\ProgramData\Partner
Folder Deleted : C:\ProgramData\Tarma Installer
Folder Deleted : C:\Program Files (x86)\ChatZum Toolbar
Folder Deleted : C:\Program Files (x86)\Deal Boat
Folder Deleted : C:\Users\*****\AppData\Local\Deal Boat
Folder Deleted : C:\Users\*****\AppData\Local\PutLockerDownloader
Folder Deleted : C:\Users\*****\AppData\Local\Smartbar
Folder Deleted : C:\Users\*****\AppData\Local\Temp\Smartbar
Folder Deleted : C:\Users\*****\AppData\LocalLow\delta
Folder Deleted : C:\Users\*****\AppData\LocalLow\Smartbar
Folder Deleted : C:\Users\*****\AppData\Roaming\Babylon
Folder Deleted : C:\Users\*****\AppData\Roaming\CheckPoint\ZoneAlarm LTD Toolbar
Folder Deleted : C:\Users\*****\AppData\Roaming\file scout
Folder Deleted : C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\n7uh2i73.default\jetpack
File Deleted : C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\n7uh2i73.default\searchplugins\11-suche.xml
File Deleted : C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\n7uh2i73.default\searchplugins\Babylon.xml
File Deleted : C:\Program Files (x86)\Mozilla Firefox\searchplugins\Babylon.xml
File Deleted : C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\n7uh2i73.default\searchplugins\BrowserProtect.xml
File Deleted : C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\n7uh2i73.default\searchplugins\delta.xml
File Deleted : C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\n7uh2i73.default\\invalidprefs.js
File Deleted : C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\n7uh2i73.default\user.js
***** [ Shortcuts ] *****
***** [ Registry ] *****
Value Deleted : HKCU\Software\Mozilla\Firefox\Extensions [support@2yourface.com]
Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [support@2yourface.com]
Key Deleted : HKCU\Software\Google\Chrome\Extensions\amfclgbdpgndipgoegfpkkgobahigbcl
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\blaofbhgbmeikidhlkmjhbkbfohpgekf
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\lmblfngognklgemafekefcdjcnkdhmdm
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\ogccgbmabaphcakpiclgcnmcnimhokcj
Value Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Browser Infrastructure Helper]
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
Key Deleted : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr
Key Deleted : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr.1
Key Deleted : HKLM\SOFTWARE\Classes\IESmartBar.BandObjectAttribute
Key Deleted : HKLM\SOFTWARE\Classes\IESmartBar.BHO
Key Deleted : HKLM\SOFTWARE\Classes\IESmartBar.DockingPanel
Key Deleted : HKLM\SOFTWARE\Classes\IESmartBar.IESmartBar
Key Deleted : HKLM\SOFTWARE\Classes\IESmartBar.IESmartBarBandObject
Key Deleted : HKLM\SOFTWARE\Classes\IESmartBar.SmartbarDisplayState
Key Deleted : HKLM\SOFTWARE\Classes\IESmartBar.SmartbarMenuForm
Key Deleted : HKLM\SOFTWARE\Classes\Movie2KDownloader
Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\BundleSweetIMSetup_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\BundleSweetIMSetup_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Movie2KDownloader_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Movie2KDownloader_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\QuickShare_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\QuickShare_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SweetIM_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SweetIM_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SweetPacksUpdateManager_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SweetPacksUpdateManager_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\wajam_install_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\wajam_install_RASMANCS
Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@checkpoint.com/FFApi
Key Deleted : HKLM\SOFTWARE\Classes\CrossriderApp0012747.BHO
Key Deleted : HKLM\SOFTWARE\Classes\CrossriderApp0012747.Sandbox
Key Deleted : HKLM\SOFTWARE\Classes\CrossriderApp0012747.Sandbox.1
Key Deleted : HKCU\Software\596da8ab76fbf41
Key Deleted : HKLM\SOFTWARE\596da8ab76fbf41
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_battlefield-2_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_photoscape_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_photoscape_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_winrar_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_winrar_RASMANCS
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{7ABBFE1C-E485-44AA-8F36-353751B4124D}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1185823F-F22F-4027-80E5-4F68ACD5DE5E}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110111271147}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1185823F-F22F-4027-80E5-4F68ACD5DE5E}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110111271147}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110111271147}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}
Value Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Value Deleted : HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist [1]
Value Deleted : HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist [2]
Key Deleted : HKCU\Software\1ClickDownload
Key Deleted : HKCU\Software\2YourFace
Key Deleted : HKCU\Software\BabylonToolbar
Key Deleted : HKCU\Software\ChatZum Toolbar
[#] Key Deleted : HKCU\Software\DataMngr_Toolbar
Key Deleted : HKCU\Software\delta LTD
Key Deleted : HKCU\Software\filescout
Key Deleted : HKCU\Software\InstalledBrowserExtensions
Key Deleted : HKCU\Software\powerpack
Key Deleted : HKCU\Software\SmartbarBackup
Key Deleted : HKCU\Software\SmartbarLog
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKCU\Software\AppDataLow\Software\Crossrider
Key Deleted : HKCU\Software\AppDataLow\Software\Deal Boat
Key Deleted : HKLM\Software\Babylon
Key Deleted : HKLM\Software\BabylonToolbar
Key Deleted : HKLM\Software\ChatZum Toolbar
Key Deleted : HKLM\Software\DataMngr
Key Deleted : HKLM\Software\Deal Boat
Key Deleted : HKLM\Software\Iminent
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2F603A45-D956-496B-81B5-50D782424976}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{B85C4CB2-B352-4BD8-818C-BCE353599107}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2YourFace
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Deal Boat
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2F603A45-D956-496B-81B5-50D782424976}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{B85C4CB2-B352-4BD8-818C-BCE353599107}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZoneAlarm LTD Toolbar
***** [ Browsers ] *****
-\\ Internet Explorer v10.0.9200.16660
Setting Restored : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
Setting Restored : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
-\\ Mozilla Firefox v23.0.1 (de)
[ File : C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\n7uh2i73.default\prefs.js ]
Line Deleted : user_pref("avg.install.userHPSettings", "hxxp://www.delta-search.com/?affID=120651&babsrc=HP_ss&mntrId=204C0008CAE006FC");
Line Deleted : user_pref("avg.install.userSPSettings", "Delta Search");
Line Deleted : user_pref("extensions.BabylonToolbar.admin", false);
Line Deleted : user_pref("extensions.BabylonToolbar.aflt", "babsst");
Line Deleted : user_pref("extensions.BabylonToolbar.dfltLng", "en");
Line Deleted : user_pref("extensions.BabylonToolbar.excTlbr", false);
Line Deleted : user_pref("extensions.BabylonToolbar.id", "204c3cc00000000000000008cae006fc");
Line Deleted : user_pref("extensions.BabylonToolbar.instlDay", "15574");
Line Deleted : user_pref("extensions.BabylonToolbar.instlRef", "sst");
Line Deleted : user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar");
Line Deleted : user_pref("extensions.BabylonToolbar.prtnrId", "babylon");
Line Deleted : user_pref("extensions.BabylonToolbar.tlbrId", "base");
Line Deleted : user_pref("extensions.BabylonToolbar.tlbrSrchUrl", "hxxp://www.google.com/search?babsrc=TB_ggl&q=");
Line Deleted : user_pref("extensions.BabylonToolbar.vrsn", "1.6.4.6");
Line Deleted : user_pref("extensions.BabylonToolbar.vrsni", "1.6.4.6");
Line Deleted : user_pref("extensions.BabylonToolbar_i.aflt", "babsst");
Line Deleted : user_pref("extensions.BabylonToolbar_i.babExt", "");
Line Deleted : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=109958&tt=3412_4");
Line Deleted : user_pref("extensions.BabylonToolbar_i.hardId", "204c3cc00000000000000008cae006fc");
Line Deleted : user_pref("extensions.BabylonToolbar_i.id", "204c3cc00000000000000008cae006fc");
Line Deleted : user_pref("extensions.BabylonToolbar_i.instlDay", "15532");
Line Deleted : user_pref("extensions.BabylonToolbar_i.instlRef", "std");
Line Deleted : user_pref("extensions.BabylonToolbar_i.prdct", "BabylonToolbar");
Line Deleted : user_pref("extensions.BabylonToolbar_i.prtnrId", "babylon");
Line Deleted : user_pref("extensions.BabylonToolbar_i.smplGrp", "none");
Line Deleted : user_pref("extensions.BabylonToolbar_i.srcExt", "ss");
Line Deleted : user_pref("extensions.BabylonToolbar_i.tlbrId", "base");
Line Deleted : user_pref("extensions.BabylonToolbar_i.vrsn", "1.5.3.17");
Line Deleted : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.6.4.621:56:27");
Line Deleted : user_pref("extensions.BabylonToolbar_i.vrsni", "1.5.3.17");
Line Deleted : user_pref("extensions.Softonic.admin", false);
Line Deleted : user_pref("extensions.Softonic.aflt", "SD");
Line Deleted : user_pref("extensions.Softonic.appId", "{7ABBFE1C-E485-44AA-8F36-353751B4124D}");
Line Deleted : user_pref("extensions.Softonic.autoRvrt", "false");
Line Deleted : user_pref("extensions.Softonic.dfltLng", "de");
Line Deleted : user_pref("extensions.Softonic.dfltSrch", true);
Line Deleted : user_pref("extensions.Softonic.excTlbr", false);
Line Deleted : user_pref("extensions.Softonic.hmpgUrl", "hxxp://search.softonic.com/MOY00009/tb_v1?SearchSource=13&cc=");
Line Deleted : user_pref("extensions.Softonic.hpOld0", "hxxps://www.google.de/");
Line Deleted : user_pref("extensions.Softonic.id", "204c3cc00000000000000008cae006fc");
Line Deleted : user_pref("extensions.Softonic.instlDay", "15765");
Line Deleted : user_pref("extensions.Softonic.instlRef", "MOY00009");
Line Deleted : user_pref("extensions.Softonic.kw_url", "hxxp://search.softonic.com/MOY00009/tb_v1?SearchSource=2&cc=&q=");
Line Deleted : user_pref("extensions.Softonic.newTabUrl", "hxxp://search.softonic.com/MOY00009/tb_v1?SearchSource=15&cc=");
Line Deleted : user_pref("extensions.Softonic.prdct", "Softonic");
Line Deleted : user_pref("extensions.Softonic.prtnrId", "softonic");
Line Deleted : user_pref("extensions.Softonic.rvrt", "true");
Line Deleted : user_pref("extensions.Softonic.srchPrvdr", "Search the web (Softonic)");
Line Deleted : user_pref("extensions.Softonic.tlbrId", "BASEirobinhoodActive");
Line Deleted : user_pref("extensions.Softonic.tlbrSrchUrl", "hxxp://search.softonic.com/MOY00009/tb_v1?SearchSource=1&cc=&q=");
Line Deleted : user_pref("extensions.Softonic.vrsn", "1.8.8.11");
Line Deleted : user_pref("extensions.Softonic.vrsni", "1.8.8.11");
Line Deleted : user_pref("extensions.Softonic_i.dnsErr", true);
Line Deleted : user_pref("extensions.Softonic_i.excTlbr", false);
Line Deleted : user_pref("extensions.Softonic_i.hmpg", true);
Line Deleted : user_pref("extensions.Softonic_i.newTab", true);
Line Deleted : user_pref("extensions.Softonic_i.smplGrp", "none");
Line Deleted : user_pref("extensions.Softonic_i.vrsnTs", "1.8.8.1115:54:27");
Line Deleted : user_pref("extensions.crossrider.bic", "13f27eac379cef5b90386216d4ba0576");
Line Deleted : user_pref("extensions.delta.admin", false);
Line Deleted : user_pref("extensions.delta.aflt", "babsst");
Line Deleted : user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");
Line Deleted : user_pref("extensions.delta.autoRvrt", "false");
Line Deleted : user_pref("extensions.delta.dfltLng", "en");
Line Deleted : user_pref("extensions.delta.excTlbr", false);
Line Deleted : user_pref("extensions.delta.ffxUnstlRst", true);
Line Deleted : user_pref("extensions.delta.id", "204c3cc00000000000000008cae006fc");
Line Deleted : user_pref("extensions.delta.instlDay", "15864");
Line Deleted : user_pref("extensions.delta.instlRef", "sst");
Line Deleted : user_pref("extensions.delta.newTab", false);
Line Deleted : user_pref("extensions.delta.prdct", "delta");
Line Deleted : user_pref("extensions.delta.prtnrId", "delta");
Line Deleted : user_pref("extensions.delta.rvrt", "false");
Line Deleted : user_pref("extensions.delta.smplGrp", "none");
Line Deleted : user_pref("extensions.delta.tlbrId", "base");
Line Deleted : user_pref("extensions.delta.tlbrSrchUrl", "");
Line Deleted : user_pref("extensions.delta.vrsn", "1.8.21.5");
Line Deleted : user_pref("extensions.delta.vrsnTs", "1.8.21.519:58:51");
Line Deleted : user_pref("extensions.delta.vrsni", "1.8.21.5");
Line Deleted : user_pref("extensions.delta_i.babExt", "");
Line Deleted : user_pref("extensions.delta_i.babTrack", "affID=121150");
Line Deleted : user_pref("extensions.delta_i.srcExt", "ss");
Line Deleted : user_pref("extensions.helperbar.Country", "Germany");
Line Deleted : user_pref("extensions.helperbar.DockingPositionDown", false);
Line Deleted : user_pref("extensions.helperbar.LastHiddenTime", 22856644);
Line Deleted : user_pref("extensions.helperbar.SmartbarDisabled", true);
Line Deleted : user_pref("extensions.helperbar.SmartbarStateMinimaized", false);
Line Deleted : user_pref("extensions.helperbar.UserID", "e051c786-5d0f-4df9-8982-1d979773198b");
Line Deleted : user_pref("extensions.helperbar.Visibility", false);
Line Deleted : user_pref("id_chatzum_softonic_installed_version", "1.0.20");
Line Deleted : user_pref("sweetim.toolbar.previous.browser.startup.homepage", "");
Line Deleted : user_pref("sweetim.toolbar.urls.homepage", "hxxp://home.sweetim.com/?crg=3.1010000.10011&barid={B1374988-5289-11E2-909E-0008CAE006FC}");
-\\ Google Chrome v29.0.1547.57
[ File : C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\preferences ]
Deleted : homepage
Deleted : icon_url
Deleted : search_url
Deleted : keyword
Deleted : urls_to_restore_on_startup
*************************
AdwCleaner[R0].txt - [19267 octets] - [31/08/2013 13:53:15]
AdwCleaner[S0].txt - [18640 octets] - [31/08/2013 13:54:05]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [18701 octets] ##########
JRT.txt: Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.5.6 (08.30.2013:1)
OS: Windows 7 Home Premium x64
Ran by ***** on 31.08.2013 at 14:34:11,92
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\\DisplayName
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\\URL
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{2CE4D4CF-B278-4126-AD1E-B622DA2E8339}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\sweetim
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{22222222-2222-2222-2222-220122272247}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{55555555-5555-5555-5555-550155275547}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{66666666-6666-6666-6666-660166276647}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{22222222-2222-2222-2222-220122272247}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Wow6432Node\Interface\{55555555-5555-5555-5555-550155275547}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Wow6432Node\Interface\{66666666-6666-6666-6666-660166276647}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Interface\{55555555-5555-5555-5555-550155275547}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Interface\{66666666-6666-6666-6666-660166276647}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\Deal Boat-codedownloader_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\chatzum_softonic_yahoo_62_v5_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\Softonic_chr_1-8-8-11_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\Softonic_chr_1-8-8-11_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\Interface\{55555555-5555-5555-5555-550155275547}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\Interface\{66666666-6666-6666-6666-660166276647}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\Deal Boat-codedownloader_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\chatzum_softonic_yahoo_62_v5_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\Softonic_chr_1-8-8-11_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\Softonic_chr_1-8-8-11_RASMANCS
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{3103D6ED-5587-4A0B-937C-BDCC76576A59}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{C8A8AEB9-C4EE-4820-B3BC-5F057B105362}
~~~ Files
~~~ Folders
Successfully deleted: [Folder] "C:\Users\*****\appdata\local\download beast"
Successfully deleted: [Folder] "C:\Users\*****\appdata\local\updater12747"
Successfully deleted: [Empty Folder] C:\Users\*****\appdata\local\{05A0AA0D-FF5E-4EC5-A643-6B62CCBC04E6}
Successfully deleted: [Empty Folder] C:\Users\*****\appdata\local\{0D4FF173-CD9E-4A82-9FFB-9AB43291432D}
Successfully deleted: [Empty Folder] C:\Users\*****\appdata\local\{30279DF5-C9A4-4BD2-86B5-46B9618B21A1}
Successfully deleted: [Empty Folder] C:\Users\*****\appdata\local\{325F96CC-1A24-437B-B452-669A2B57DEE5}
Successfully deleted: [Empty Folder] C:\Users\*****\appdata\local\{3B17203F-F504-4467-A11A-ABB3E9C563A5}
Successfully deleted: [Empty Folder] C:\Users\*****\appdata\local\{451256DF-B19D-4692-A606-84B075BD4D1E}
Successfully deleted: [Empty Folder] C:\Users\*****\appdata\local\{47060562-1F65-4147-80A0-923C3EE9E63B}
Successfully deleted: [Empty Folder] C:\Users\*****\appdata\local\{52A4CEB9-FC71-4A8A-848F-0591BBCAE7AB}
Successfully deleted: [Empty Folder] C:\Users\*****\appdata\local\{5C6D133D-1259-4D1D-B03C-2373D1FE1525}
Successfully deleted: [Empty Folder] C:\Users\*****\appdata\local\{612FD23C-5BD1-4DB6-8057-B3A5AEB5DA9E}
Successfully deleted: [Empty Folder] C:\Users\*****\appdata\local\{6CD179C1-F76D-43CB-8087-F79B6BEE5D3C}
Successfully deleted: [Empty Folder] C:\Users\*****\appdata\local\{80E3CD84-9C6F-451C-AD77-06EA8622EDE2}
Successfully deleted: [Empty Folder] C:\Users\*****\appdata\local\{88E5B3E4-3DAA-4187-99D3-B22F24F4A50F}
Successfully deleted: [Empty Folder] C:\Users\*****\appdata\local\{901706DB-8F73-407E-94BB-4D173DA76EA0}
Successfully deleted: [Empty Folder] C:\Users\*****\appdata\local\{9099E92F-937E-4A19-ABFF-7D7A2AB0F152}
Successfully deleted: [Empty Folder] C:\Users\*****\appdata\local\{93204454-C102-4DEE-9F33-44DD995631D4}
Successfully deleted: [Empty Folder] C:\Users\*****\appdata\local\{A7E9E3D9-21D7-4423-8A97-5EB6BC01E0C0}
Successfully deleted: [Empty Folder] C:\Users\*****\appdata\local\{AEBD3DEA-0F42-4E66-94BF-0A9EC2553960}
Successfully deleted: [Empty Folder] C:\Users\*****\appdata\local\{B2901999-7739-4E14-88DC-5DED5E3ADC79}
Successfully deleted: [Empty Folder] C:\Users\*****\appdata\local\{BE3EEECE-E12E-4F6A-8320-D2C472E32509}
Successfully deleted: [Empty Folder] C:\Users\*****\appdata\local\{C411CC84-76BE-4864-BE68-FB1BF336E319}
Successfully deleted: [Empty Folder] C:\Users\*****\appdata\local\{C50F3E57-575D-4E3E-BB26-4FB268892BD0}
Successfully deleted: [Empty Folder] C:\Users\*****\appdata\local\{C740E0C7-3900-4214-9B98-F85F4143EB67}
Successfully deleted: [Empty Folder] C:\Users\*****\appdata\local\{C9030C35-429B-4464-B58C-0068F9E3DFEC}
Successfully deleted: [Empty Folder] C:\Users\*****\appdata\local\{CCD1FD8B-3C13-4FB3-999C-935EE88487DD}
Successfully deleted: [Empty Folder] C:\Users\*****\appdata\local\{DC6FD0CB-7558-47B6-8ED7-221B937630E4}
Successfully deleted: [Empty Folder] C:\Users\*****\appdata\local\{E1BE5E1F-BBA4-4CB6-A26C-9DD5FC93D9DD}
Successfully deleted: [Empty Folder] C:\Users\*****\appdata\local\{E74B5D96-B32F-45E2-804D-9C19CFEF1230}
Successfully deleted: [Empty Folder] C:\Users\*****\appdata\local\{E9A435A3-D7B7-43D5-B6E3-CCC6B20E1882}
Successfully deleted: [Empty Folder] C:\Users\*****\appdata\local\{EB9512EA-82F2-44CE-8AFC-2EA6004DFB4A}
Successfully deleted: [Empty Folder] C:\Users\*****\appdata\local\{EEED3BF8-2587-4A15-B97B-5DDE5FFB926D}
Successfully deleted: [Empty Folder] C:\Users\*****\appdata\local\{F80275EF-02B8-4BE3-B6BA-24D62978D95E}
Successfully deleted: [Empty Folder] C:\Users\*****\appdata\local\{F9A85556-2BD3-4249-91DB-24412EB73556}
Successfully deleted: [Empty Folder] C:\Users\*****\appdata\local\{FBBFE5B1-B5B8-4D93-9342-BFCF71F6EE42}
Successfully deleted: [Empty Folder] C:\Users\*****\appdata\local\{FD431128-4D76-46B2-98C5-E34626E47C50}
Successfully deleted: [Empty Folder] C:\Users\*****\appdata\local\{FF217F75-8D8B-462F-9241-51FD2D667377}
~~~ FireFox
Successfully deleted: [File] C:\user.js
Emptied folder: C:\Users\*****\AppData\Roaming\mozilla\firefox\profiles\n7uh2i73.default\minidumps [251 files]
~~~ Chrome
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\extensioninstallforcelist [Blacklisted Policy]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 31.08.2013 at 14:47:56,41
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST.txt: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 31-08-2013 03
Ran by ***** (administrator) on *****-PC on 31-08-2013 14:55:13
Running from C:\Users\*****\Desktop\Downloads\Trojaner Bekämpfung
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Adobe Systems Incorporated) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe
(Memeo) C:\Program Files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(IObit) C:\Program Files (x86)\IObit\Game Booster 3\gbtray.exe
(Microsoft Corporation) C:\Windows\SysWOW64\schtasks.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE
(Microsoft Corporation) C:\Windows\splwow64.exe
(Microsoft Corporation) c:\program files\windows defender\MpCmdRun.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12445288 2012-01-16] (Realtek Semiconductor)
HKLM\...\Run: [Windows Mobile Device Center] - C:\Windows\WindowsMobile\wmdc.exe [660360 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [ISW] - [x]
HKLM\...\RunOnce: [MedionReminder] - C:\Program Files (x86)\CyberLink\PowerRecover\Reminder.exe /DeleteRunKey [443688 2011-05-26] (CyberLink)
HKLM\...\Policies\Explorer: [NoDrives] 0
HKCU\...\Run: [EADM] - C:\Program Files (x86)\Origin\Origin.exe [3549528 2013-07-31] (Electronic Arts)
HKCU\...\Policies\Explorer: [NoDrives] 0
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2012-02-02] (Intel Corporation)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-08-20] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKU\Default\...\RunOnce: [HKCU] - C:\Windows\System32\oobe\info\HKCU.vbs [126 2009-11-12] ()
HKU\Default\...\RunOnce: [Screensaver] - C:\Windows\Web\Wallpaper\MEDION\start.vbs [x]
HKU\Default User\...\RunOnce: [HKCU] - C:\Windows\System32\oobe\info\HKCU.vbs [126 2009-11-12] ()
HKU\Default User\...\RunOnce: [Screensaver] - C:\Windows\Web\Wallpaper\MEDION\start.vbs [x]
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search
BHO: ZoneAlarm Security Engine Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll No File
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: ZoneAlarm Security Engine Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll No File
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll No File
Toolbar: HKLM-x32 - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Handler: msdaipp - No CLSID Value -
Handler-x32: msdaipp - No CLSID Value -
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254
FireFox:
========
FF ProfilePath: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\n7uh2i73.default
FF NetworkProxy: "http", "www-proxy.t-online.de"
FF NetworkProxy: "http_port", 80
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll ()
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1200112.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @ngm.nexoneu.com/NxGame - C:\ProgramData\NexonEU\NGM\npNxGameeu.dll No File
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\*****\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKCU: electronicarts.com/GameFacePlugin - C:\Users\*****\AppData\Roaming\Electronic Arts\Game Face\npGameFacePlugin.dll (Electronic Arts)
FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\n7uh2i73.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\n7uh2i73.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\n7uh2i73.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\n7uh2i73.default\searchplugins\webde-suche.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: DoNotTrackMe - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\n7uh2i73.default\Extensions\donottrackplus@abine.com
FF Extension: No Name - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\n7uh2i73.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF HKLM\...\Firefox\Extensions: [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}] C:\Program Files\CheckPoint\ZAForceField\TrustChecker
FF HKLM-x32\...\Firefox\Extensions: [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}] C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker
Chrome:
=======
CHR HomePage: hxxp://www.google.com
CHR RestoreOnStartup: "hxxp://www.google.com"
CHR DefaultSearchURL: (Babylon) - hxxp://www.google.com
CHR DefaultSuggestURL: (Babylon) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.89\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.57\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.57\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.57\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U3) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Pando Web Plugin) - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
CHR Plugin: (Windows Live Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (npFFApi) - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\npFFApi.dll No File
CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
CHR Plugin: (Windows Activation Technologies) - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Extension: (Adblock Plus) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.5.4_0
CHR Extension: (Chrome In-App Payments service) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.10_0
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-08-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-08-20] (Avira Operations GmbH & Co. KG)
R2 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [70952 2011-04-14] (CyberLink)
R2 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [312616 2011-04-14] (CyberLink)
S3 aspnet_state; %SystemRoot%\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [x]
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-08-20] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-08-20] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-03-27] (Avira Operations GmbH & Co. KG)
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R3 WinRing0_1_2_0; C:\Program Files (x86)\IObit\Game Booster 3\Driver\WinRing0x64.sys [14544 2010-11-01] (OpenLibSys.org)
R3 WinRing0_1_2_0; C:\Program Files (x86)\IObit\Game Booster 3\Driver\WinRing0x64.sys [14544 2010-11-01] (OpenLibSys.org)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-08-31 14:34 - 2013-08-31 14:34 - 00000000 ____D C:\Windows\ERUNT
2013-08-31 13:53 - 2013-08-31 13:54 - 00000000 ____D C:\AdwCleaner
2013-08-30 11:28 - 2013-08-30 12:45 - 00000000 ____D C:\Users\*****\Desktop\mbar
2013-08-30 01:10 - 2013-07-09 08:03 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-30 01:10 - 2013-07-09 07:54 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-30 01:10 - 2013-07-09 07:53 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-08-30 01:10 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-08-30 01:10 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-08-30 01:10 - 2013-07-09 06:53 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-08-30 01:10 - 2013-07-09 06:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-08-30 01:10 - 2013-07-09 04:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-08-30 01:10 - 2013-07-09 04:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-08-30 01:10 - 2013-07-09 04:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-08-30 01:10 - 2013-07-09 04:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-08-29 23:50 - 2013-08-29 23:50 - 00026525 _____ C:\ComboFix.txt
2013-08-29 23:40 - 2013-08-29 23:39 - 05114906 ____R (Swearware) C:\Users\*****\Desktop\ComboFix.exe
2013-08-29 23:40 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-08-29 23:40 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-08-29 23:40 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-08-29 23:40 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-08-29 23:40 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-08-29 23:40 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-08-29 23:40 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-08-29 23:40 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-08-29 23:39 - 2013-08-29 23:50 - 00000000 ____D C:\Qoobox
2013-08-29 23:39 - 2013-08-29 23:49 - 00000000 ____D C:\Windows\erdnt
2013-08-29 10:31 - 2013-08-29 10:31 - 00000000 ____D C:\Program Files (x86)\7-Zip
2013-08-26 00:45 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-26 00:45 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-26 00:45 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-26 00:45 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-26 00:45 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-26 00:45 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-26 00:45 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-26 00:45 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-26 00:45 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-26 00:45 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-26 00:45 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-26 00:45 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-26 00:45 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-26 00:45 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-26 00:45 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-26 00:45 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-26 00:45 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-26 00:45 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-26 00:45 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-26 00:45 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-26 00:45 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-26 00:45 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-26 00:45 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-26 00:45 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-26 00:45 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-26 00:45 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-26 00:45 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-26 00:45 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-26 00:44 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-26 00:44 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-26 00:44 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-25 23:49 - 2013-08-25 23:49 - 00000000 ____D C:\FRST
2013-08-25 17:43 - 2013-08-25 17:43 - 00000000 _____ C:\Users\*****\defogger_reenable
2013-08-25 17:18 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-25 17:18 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-25 17:18 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-25 17:18 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-25 17:18 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-25 17:18 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-25 17:18 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-25 17:18 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-25 17:13 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-25 17:13 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-25 17:13 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-25 17:13 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-25 17:13 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-25 17:13 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-25 17:11 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-25 17:11 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-25 17:01 - 2013-08-26 12:33 - 00000667 _____ C:\Users\*****\Desktop\Trojaner Bekämpfung.lnk
2013-08-25 16:51 - 2013-08-25 16:51 - 00001117 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-25 16:51 - 2013-08-25 16:51 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-25 16:51 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-08-19 12:31 - 2013-08-20 17:49 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-08-17 13:38 - 2013-08-17 13:38 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
==================== One Month Modified Files and Folders =======
2013-08-31 14:47 - 2013-08-31 14:47 - 00007958 _____ C:\Users\*****\Desktop\JRT.txt
2013-08-31 14:42 - 2012-06-16 12:59 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-31 14:42 - 2012-06-16 12:59 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-31 14:34 - 2013-08-31 14:34 - 00000000 ____D C:\Windows\ERUNT
2013-08-31 14:32 - 2013-03-20 16:51 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-31 14:08 - 2013-07-28 23:06 - 00000000 ____D C:\Users\*****\AppData\Roaming\.minecraft
2013-08-31 14:03 - 2009-07-14 06:45 - 00017152 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-31 14:03 - 2009-07-14 06:45 - 00017152 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-31 13:57 - 2013-04-14 13:23 - 00000000 ____D C:\Program Files (x86)\Origin
2013-08-31 13:55 - 2010-11-21 05:47 - 00319964 _____ C:\Windows\PFRO.log
2013-08-31 13:55 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-31 13:55 - 2009-07-14 06:51 - 00205293 _____ C:\Windows\setupact.log
2013-08-31 13:54 - 2013-08-31 13:53 - 00000000 ____D C:\AdwCleaner
2013-08-31 13:54 - 2012-06-16 12:54 - 02049901 _____ C:\Windows\WindowsUpdate.log
2013-08-30 12:45 - 2013-08-30 11:28 - 00000000 ____D C:\Users\*****\Desktop\mbar
2013-08-30 11:59 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\Registration
2013-08-29 23:50 - 2013-08-29 23:50 - 00026525 _____ C:\ComboFix.txt
2013-08-29 23:50 - 2013-08-29 23:39 - 00000000 ____D C:\Qoobox
2013-08-29 23:50 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2013-08-29 23:49 - 2013-08-29 23:39 - 00000000 ____D C:\Windows\erdnt
2013-08-29 23:49 - 2012-06-16 13:02 - 00000000 ___RD C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-08-29 23:48 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2013-08-29 23:39 - 2013-08-29 23:40 - 05114906 ____R (Swearware) C:\Users\*****\Desktop\ComboFix.exe
2013-08-29 10:31 - 2013-08-29 10:31 - 00000000 ____D C:\Program Files (x86)\7-Zip
2013-08-28 13:39 - 2012-10-25 19:43 - 00000000 ____D C:\Users\*****\Desktop\Thomas
2013-08-26 12:33 - 2013-08-25 17:01 - 00000667 _____ C:\Users\*****\Desktop\Trojaner Bekämpfung.lnk
2013-08-26 12:07 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-08-26 00:44 - 2012-08-06 23:58 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-08-26 00:43 - 2011-05-16 16:04 - 00664764 _____ C:\Windows\system32\perfh007.dat
2013-08-26 00:43 - 2011-05-16 16:04 - 00134932 _____ C:\Windows\system32\perfc007.dat
2013-08-26 00:43 - 2009-07-14 07:13 - 01549396 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-26 00:41 - 2013-07-22 02:11 - 00000000 ____D C:\Windows\system32\MRT
2013-08-26 00:40 - 2011-07-18 22:31 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-25 23:49 - 2013-08-25 23:49 - 00000000 ____D C:\FRST
2013-08-25 17:43 - 2013-08-25 17:43 - 00000000 _____ C:\Users\*****\defogger_reenable
2013-08-25 17:43 - 2012-06-16 13:01 - 00000000 ____D C:\Users\*****
2013-08-25 16:51 - 2013-08-25 16:51 - 00001117 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-25 16:51 - 2013-08-25 16:51 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-22 10:48 - 2012-06-16 12:59 - 00002187 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-08-21 09:45 - 2012-06-16 18:28 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-20 17:49 - 2013-08-19 12:31 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-08-20 10:33 - 2013-05-07 13:35 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-08-20 10:33 - 2013-03-27 11:15 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-08-20 10:33 - 2013-03-27 11:15 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-08-17 13:38 - 2013-08-17 13:38 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-07 04:22 - 2010-11-21 05:27 - 00278800 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
Files to move or delete:
====================
C:\Users\*****\AppData\Local\Temp\Quarantine.exe
C:\Users\*****\AppData\Local\Temp\jrt\erunt\ERUNT.EXE
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-08-22 01:09
==================== End Of Log ============================
|
|
01.09.2013, 16:06
| #8 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows 7: Trojaner o.ä. aus eMail Anhang Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle einen Quickscan mit Malwarebytes Anti-Malware (MBAM) Hinweis: Denk bitte vorher daran, Malwarebytes Anti-Malware über den Updatebutton zu aktualisieren! Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt: ESET Online Scanner
__________________ Logfiles bitte immer in CODE-Tags posten |
|
03.09.2013, 14:21
| #9 |
| | Windows 7: Trojaner o.ä. aus eMail Anhang Hier der Logfile von ESET: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=7cd3734118c96e499028c95a86dfe094
# engine=14989
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-09-02 09:19:30
# local_time=2013-09-02 11:19:30 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 96 22875 243580060 15659 0
# compatibility_mode=5893 16776573 100 94 203822 129786620 0 0
# scanned=177350
# found=8
# cleaned=0
# scan_time=5469
sh=EE1F9B535CD8F08AA5D345E31AAFC6467975B904 ft=1 fh=7abf7744ce754ce3 vn="a variant of Win32/Kryptik.BJBI trojan" ac=I fn="C:\Qoobox\Quarantine\C\Users\*****\AppData\Roaming\execqlplay.exe.vir"
sh=AFA927C4E72C43473D64991C013C828E90C83D2B ft=1 fh=bb2bfa0022fa61b9 vn="Win32/Adware.Linkular.AD application" ac=I fn="C:\Users\*****\Desktop\Downloads\vlc setup(1).exe"
sh=AFA927C4E72C43473D64991C013C828E90C83D2B ft=1 fh=bb2bfa0022fa61b9 vn="Win32/Adware.Linkular.AD application" ac=I fn="C:\Users\*****\Desktop\Downloads\vlc setup(2).exe"
sh=AFA927C4E72C43473D64991C013C828E90C83D2B ft=1 fh=bb2bfa0022fa61b9 vn="Win32/Adware.Linkular.AD application" ac=I fn="C:\Users\*****\Desktop\Downloads\vlc setup(3).exe"
sh=AFA927C4E72C43473D64991C013C828E90C83D2B ft=1 fh=bb2bfa0022fa61b9 vn="Win32/Adware.Linkular.AD application" ac=I fn="C:\Users\*****\Desktop\Downloads\vlc setup(4).exe"
sh=AFA927C4E72C43473D64991C013C828E90C83D2B ft=1 fh=bb2bfa0022fa61b9 vn="Win32/Adware.Linkular.AD application" ac=I fn="C:\Users\*****\Desktop\Downloads\vlc setup.exe"
sh=C33B0D2BC9DD61B56CD663FB49C0AD2B8AA28CB4 ft=0 fh=0000000000000000 vn="Win32/Adware.Linkular.AD application" ac=I fn="D:\*****-PC\Backup Set 2013-05-08 163924\Backup Files 2013-05-08 163924\Backup files 1.zip"
sh=5443AAEF3A958B67FF38DDCF8CF3B4CFB69ABC91 ft=0 fh=0000000000000000 vn="Win32/Adware.Linkular.AD application" ac=I fn="D:\*****-PC\Backup Set 2013-06-23 190001\Backup Files 2013-06-23 190001\Backup files 1.zip"
|
|
03.09.2013, 14:39
| #10 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows 7: Trojaner o.ä. aus eMail Anhang Was ist mit Malwarebytes? Die Funde in ESET sind nicht wirklich schlimm, da keine aktiven Infektionen. Der erste Fund ist nur einer in der Qurantäne von combofix. Die anderen Funde in Download sind Müll-Setups von VLC aus einer Müll-Quelle. Software lädt man sich nicht vom erstbesten Suchergebnis runter!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
03.09.2013, 18:04
| #11 |
| | Windows 7: Trojaner o.ä. aus eMail Anhang Oh Malwarebytes hab ich wohl überlesen, hier der Logfile: Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.09.03.06 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16660 ***** :: *****-PC [Administrator] 03.09.2013 18:50:00 mbam-log-2013-09-03 (18-50-00).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 229062 Laufzeit: 4 Minute(n), 4 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) |
|
03.09.2013, 21:06
| #12 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows 7: Trojaner o.ä. aus eMail Anhang Sieht soweit ok aus  Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat. Info: Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie ) Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird. Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?
__________________ Logfiles bitte immer in CODE-Tags posten |
|
05.09.2013, 19:44
| #13 |
| | Windows 7: Trojaner o.ä. aus eMail Anhang Sonst gibt es keine Probleme mehr, vielen Dank für deine Hilfe |
|
06.09.2013, 10:57
| #14 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows 7: Trojaner o.ä. aus eMail Anhang Dann wären wir durch! Falls du noch Lob oder Kritik loswerden möchtest => Lob, Kritik und Wünsche - Trojaner-Board Die Programme, die hier zum Einsatz kamen, können alle deinstalliert werden. Helfen kann dir dabei delfix: Die Reihenfolge ist hier entscheidend.
Bitte abschließend noch die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden. Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern. Microsoftupdate Windows XP:Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren. Windows Vista/7: Start, Systemsteuerung, Windows-Update PDF-Reader aktualisieren Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast) Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader. Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers: Prüfen => Adobe - Flash Player Downloadlinks findest du hier => Browsers and Plugins - FilePony.de Alle Plugins im Firefox-Browser kannst du auch ganz einfach hier auf Aktualität prüfen => https://www.mozilla.org/de/plugincheck Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind. Java-Update Veraltete Java-Installationen sind ein großes Sicherheitsrisiko, daher solltest Du die alten Versionen deinstallieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software (bzw. Programme und Funktionen) und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu Windows 7: Trojaner o.ä. aus eMail Anhang |
| adblock, adware/gfilter.gen2, adware/iwantthis.l, antivirus, checkliste, desktop, excel, farbar, farbar recovery scan tool, firefox, firefox 23.0.1, flash player, homepage, ntdll.dll, plug-in, problem, richtlinie, scan, smartbar, software, speicherplatz, tr/bankzone.a.3, tr/spy.injector.ah, trojaner, win32/adware.linkular.ad, win32/kryptik.bjbi, ändern |
WARNUNG an die MITLESER: 
