| |
| |||||||
Log-Analyse und Auswertung: WProtectManager unter ProgramData und 337-Games in der StartleisteWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
01.04.2014, 18:00
| #1 | |
| |  WProtectManager unter ProgramData und 337-Games in der Startleiste Hallo zusammen, ich habe mir wohl etwas eingefangen :/. Seit wenigen Tagen meldet sich mein AntiVir etwa alle zwei Stunden und weist mich darauf hin, dass es einen Virusverdacht bei einer Datei gibt. Hier der Bericht von AntiVir: Zitat:
Habe mich dann auf die Suche nach Lösungen begeben und folgende Threads bei euch gefunden: http://www.trojaner-board.de/151640-...e-rechner.html und http://www.trojaner-board.de/146622-...-verdacht.html Habe dann analog dazu ComboFix laufen lassen (bitte nicht hauen, ich weiss es wurde nicht MIR explizit empfohlen). Anschliessend habe ich mit RevoUninstaller das Programm "337-Games" deinstalliert. Auch Malwarebytes Anti-Malware ist fündig geworden. Mittlerweile bestehen keine ernsten Probleme mehr. Doch habe ich eben bemerkt, dass ich den "AntiVit-Echtzeitschutz" nicht mehr deaktivieren kann. Es erscheint folgende Meldung:  Die Logs habe ich als Archiv angehängt  Vielen Dank im Voraus für Eure Hilfestellungen! steve |
|
01.04.2014, 18:33
| #2 |
| /// the machine /// TB-Ausbilder    | WProtectManager unter ProgramData und 337-Games in der Startleiste Hi,
__________________Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen. Ich kann auf Arbeit keine Anhänge öffnen, danke.  So funktioniert es:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
|
01.04.2014, 19:08
| #3 | ||
| | WProtectManager unter ProgramData und 337-Games in der Startleiste defogger_disable.txt
__________________Zitat:
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014 Ran by steve (administrator) on steve-PC on 01-04-2014 18:31:55 Running from C:\Users\steve\Desktop Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe () C:\ProgramData\DatacardService\HWDeviceService64.exe (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (VIA Technologies, Inc.) C:\Windows\system32\viakaraokesrv.exe (Seiko Epson Corporation) C:\Windows\system32\EscSvc64.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe (VIA Technologies, Inc.) C:\VIA_XHCI\usb3Monitor.exe (Sun Microsystems, Inc.) C:\Program Files\Java\jre6\bin\jusched.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe (Google Inc.) C:\Users\steve\AppData\Local\Google\Chrome\Application\chrome.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe (Dropbox, Inc.) C:\Users\steve\AppData\Roaming\Dropbox\bin\Dropbox.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe (SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Microsoft Corporation) C:\Windows\splwow64.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Microsoft Corporation) C:\Windows\system32\wbem\WMIADAP.EXE (Google Inc.) C:\Users\steve\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\steve\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\steve\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\steve\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\steve\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\steve\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\steve\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\steve\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\steve\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\steve\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\steve\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\steve\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\steve\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\steve\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\steve\AppData\Local\Google\Chrome\Application\chrome.exe (Avira Operations GmbH & Co. KG) C:\program files (x86)\avira\antivir desktop\ipmGui.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [VIAxHCUtl] - C:\VIA_XHCI\usb3Monitor.exe [331776 2011-07-12] (VIA Technologies, Inc.) HKLM\...\Run: [BCSSync] - C:\Program Files\Microsoft Office\Office14\BCSSync.exe [108144 2012-11-05] (Microsoft Corporation) HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Java\jre6\bin\jusched.exe [170496 2012-10-15] (Sun Microsystems, Inc.) HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1012000 2013-05-16] (NVIDIA Corporation) HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [444904 2012-09-20] (Adobe Systems Incorporated) HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-11-29] (Intel Corporation) HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291648 2012-05-20] (Intel Corporation) HKLM-x32\...\Run: [] - [X] HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe [39136 2012-12-18] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Acrobat Assistant 8.0] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe [825560 2012-12-18] (Adobe Systems Inc.) HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-06] (Apple Inc.) HKLM-x32\...\Run: [EEventManager] - C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [1058912 2012-04-02] (SEIKO EPSON CORPORATION) HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-06] (Apple Inc.) HKLM-x32\...\RunOnce: [GBTUpd] - C:\Program Files (x86)\Gigabyte\UpdManager\PreRun.exe [297480 2008-04-03] (PreRun) HKU\S-1-5-21-2280969488-2109145150-2365161803-1000\...\Run: [iCloudServices] - C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-11-20] (Apple Inc.) HKU\S-1-5-21-2280969488-2109145150-2365161803-1000\...\Run: [85DBE9CD5C641104D2F436A3E6535A29577D79AD._service_run] - C:\Users\steve\AppData\Local\Google\Chrome\Application\chrome.exe [859976 2014-03-15] (Google Inc.) HKU\S-1-5-21-2280969488-2109145150-2365161803-1000\...\Run: [ApplePhotoStreams] - C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-11-20] (Apple Inc.) HKU\S-1-5-21-2280969488-2109145150-2365161803-1000\...\Run: [Mobile Partner] - C:\Program Files (x86)\My Broadband\My Broadband Startup: C:\Users\steve\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\steve\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x3780B8F9C60ACE01 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.aartemis.com/web/?type=ds&ts=1388547520&from=cor&uid=M4-CT128M4SSD2_0000000012080907680D&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.aartemis.com/web/?type=ds&ts=1388547520&from=cor&uid=M4-CT128M4SSD2_0000000012080907680D&q={searchTerms} StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe BHO: No Name - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - No File BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: No Name - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - No File BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File DPF: HKLM-x32 {0D6709DD-4ED8-40CA-B459-2757AEEF7BEE} hxxp://download.gigabyte.com.tw/object/Dldrv.ocx Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\..\Interfaces\{1E2A2F41-C006-4388-81AE-B59AD0F37157}: [NameServer]192.168.178.1 Chrome: ======= CHR HomePage: CHR Plugin: (Shockwave Flash) - C:\Users\steve\AppData\Local\Google\Chrome\Application\21.0.1180.89\PepperFlash\pepflashplayer.dll No File CHR Plugin: (Shockwave Flash) - C:\Users\steve\AppData\Local\Google\Chrome\Application\33.0.1750.154\gcswf32.dll No File CHR Plugin: (Remoting Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Users\steve\AppData\Local\Google\Chrome\Application\33.0.1750.154\ppGoogleNaClPluginChrome.dll () CHR Plugin: (Chrome PDF Viewer) - C:\Users\steve\AppData\Local\Google\Chrome\Application\33.0.1750.154\pdf.dll () CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation) CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation) CHR Plugin: (Google Update) - C:\Users\steve\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File CHR Extension: (Web Developer) - C:\Users\steve\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfbameneiokkgbdmiekhjnmfkcnldhhm [2013-01-03] CHR Extension: (Adblock Plus) - C:\Users\steve\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-01-28] CHR Extension: (Add to Wunderlist) - C:\Users\steve\AppData\Local\Google\Chrome\User Data\Default\Extensions\dmnddeddcgdllibmaodanoonljfdmooc [2013-11-07] CHR Extension: (Suche Wechseln) - C:\Users\steve\AppData\Local\Google\Chrome\User Data\Default\Extensions\dopemniaeocfenlpnoannaefnhfcjcgi [2014-03-30] CHR Extension: (Wunderlist - To-do and Task list) - C:\Users\steve\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjliknjliaohjgjajlgolhijphojjdkc [2012-12-20] CHR Extension: (Windows Media Player Extension for HTML5) - C:\Users\steve\AppData\Local\Google\Chrome\User Data\Default\Extensions\hokdglbhghcebcopdbanieangmcamaak [2013-10-08] CHR Extension: (ShiftEdit) - C:\Users\steve\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcgmndephhjcabhhjfcmncnhbmgbkpij [2013-01-20] CHR Extension: (FVD Downloader) - C:\Users\steve\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfmhcpmkbdkbgbmkjoiopeeegenkdikp [2013-09-24] CHR Extension: (qipu Cashbackmelder open beta) - C:\Users\steve\AppData\Local\Google\Chrome\User Data\Default\Extensions\mloigoojndlehdjiemdfpiikieonngel [2012-12-30] CHR Extension: (Google Wallet) - C:\Users\steve\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23] CHR Extension: (Extended Protection) - C:\Users\steve\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogfjmhfnldnajmfaofeiaepghjenbgjo [2014-03-30] CHR HKLM-x32\...\Chrome\Extension: [dopemniaeocfenlpnoannaefnhfcjcgi] - C:\Users\steve\AppData\Local\Google\Chrome\User Data\Default\Extensions\searchswitch.crx [2014-03-30] CHR HKLM-x32\...\Chrome\Extension: [ogfjmhfnldnajmfaofeiaepghjenbgjo] - C:\Users\steve\AppData\Local\Google\Chrome\User Data\Default\Extensions\ep.crx [2014-03-30] ==================== Services (Whitelisted) ================= R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG) S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1017424 2014-02-20] (Avira Operations GmbH & Co. KG) R2 EpsonScanSvc; C:\Windows\system32\EscSvc64.exe [135824 2011-12-12] (Seiko Epson Corporation) R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] () R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165144 2012-05-10] (Intel Corporation) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-03-05] (Malwarebytes Corporation) S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [857912 2014-03-05] (Malwarebytes Corporation) R2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27792 2012-08-03] (VIA Technologies, Inc.) ==================== Drivers (Whitelisted) ==================== R3 AnyDVD; C:\Windows\System32\Drivers\AnyDVD.sys [138400 2012-08-26] (SlySoft, Inc.) R3 AnyDVD; C:\Windows\SysWOW64\Drivers\AnyDVD.sys [138400 2012-08-26] (SlySoft, Inc.) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG) R3 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2012-09-02] (DT Soft Ltd) U5 ew_hwusbdev; C:\Windows\System32\Drivers\ew_hwusbdev.sys [117248 2010-07-27] (Huawei Technologies Co., Ltd.) R3 L1C; C:\Windows\System32\DRIVERS\L1C62x64.sys [104560 2012-04-25] (Qualcomm Atheros Co., Ltd.) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-03-05] (Malwarebytes Corporation) S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63192 2014-03-05] (Malwarebytes Corporation) S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.) S4 sptd; C:\Windows\System32\Drivers\sptd.sys [560184 2013-04-03] (Duplex Secure Ltd.) R3 VUSB3HUB; C:\Windows\System32\DRIVERS\ViaHub3.sys [205312 2012-01-20] (VIA Technologies, Inc.) R3 xhcdrv; C:\Windows\System32\DRIVERS\xhcdrv.sys [254464 2012-01-20] (VIA Technologies, Inc.) S3 catchme; \??\C:\ComboFix\catchme.sys [X] S3 cpuz135; \??\C:\Windows\TEMP\cpuz135\cpuz135_x64.sys [X] S3 gdrv; \??\C:\Windows\gdrv.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-04-01 18:31 - 2014-04-01 18:32 - 00018108 _____ () C:\Users\steve\Desktop\FRST.txt 2014-04-01 18:31 - 2014-04-01 18:31 - 00000000 ____D () C:\FRST 2014-04-01 18:25 - 2014-04-01 18:25 - 02157056 _____ (Farbar) C:\Users\steve\Desktop\FRST64.exe 2014-04-01 18:25 - 2014-04-01 18:25 - 00050477 _____ () C:\Users\steve\Desktop\Defogger.exe 2014-04-01 18:25 - 2014-04-01 18:25 - 00000586 _____ () C:\Users\steve\Desktop\defogger_disable.log 2014-04-01 18:25 - 2014-04-01 18:25 - 00000020 _____ () C:\Users\steve\defogger_reenable 2014-04-01 18:24 - 2014-04-01 18:24 - 00380416 _____ () C:\Users\steve\Desktop\gup35mqd.exe 2014-04-01 07:52 - 2014-04-01 07:52 - 00001605 _____ () C:\Users\steve\Desktop\TB.txt 2014-03-31 22:57 - 2014-03-31 22:57 - 00022172 _____ () C:\Users\steve\Desktop\ComboFix.txt 2014-03-31 22:53 - 2014-03-31 22:57 - 00000000 ____D () C:\Qoobox 2014-03-31 22:53 - 2014-03-31 22:56 - 00000000 ____D () C:\Windows\erdnt 2014-03-31 22:53 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe 2014-03-31 22:53 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe 2014-03-31 22:53 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2014-03-31 22:53 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2014-03-31 22:53 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2014-03-31 22:53 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe 2014-03-31 22:53 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe 2014-03-31 22:53 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe 2014-03-31 20:34 - 2014-03-31 20:34 - 05192353 ____R (Swearware) C:\Users\steve\Desktop\ComboFix.exe 2014-03-30 22:24 - 2014-04-01 06:52 - 00053392 _____ () C:\Windows\PFRO.log 2014-03-30 22:11 - 2014-04-01 07:17 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-03-30 21:57 - 2014-03-30 21:57 - 00001228 _____ () C:\Users\steve\Desktop\Revo Uninstaller.lnk 2014-03-30 21:57 - 2014-03-30 21:57 - 00001066 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-03-30 21:57 - 2014-03-30 21:57 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-03-30 21:57 - 2014-03-30 21:57 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group 2014-03-30 21:57 - 2014-03-30 21:57 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-03-30 21:57 - 2014-03-05 09:26 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-03-30 21:57 - 2014-03-05 09:26 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-03-30 21:57 - 2014-03-05 09:26 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-03-30 21:50 - 2014-03-30 21:50 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\steve\Downloads\mbam-setup-2.0.0.1000.exe 2014-03-30 21:50 - 2014-03-30 21:50 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\steve\Downloads\revosetup95.exe 2014-03-30 21:37 - 2014-03-30 22:21 - 00000000 ____D () C:\Users\steve\AppData\Roaming\SupTab 2014-03-27 19:16 - 2014-03-27 23:26 - 457173402 _____ () C:\Users\steve\Downloads\s1619.rar 2014-03-13 17:30 - 2014-03-01 08:05 - 23133696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-03-13 17:30 - 2014-03-01 07:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-03-13 17:30 - 2014-03-01 07:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-03-13 17:30 - 2014-03-01 06:58 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-03-13 17:30 - 2014-03-01 06:52 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-03-13 17:30 - 2014-03-01 06:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-03-13 17:30 - 2014-03-01 06:42 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-03-13 17:30 - 2014-03-01 06:40 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-03-13 17:30 - 2014-03-01 06:37 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-03-13 17:30 - 2014-03-01 06:33 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-03-13 17:30 - 2014-03-01 06:33 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-03-13 17:30 - 2014-03-01 06:32 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-03-13 17:30 - 2014-03-01 06:30 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-03-13 17:30 - 2014-03-01 06:23 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-03-13 17:30 - 2014-03-01 06:17 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-03-13 17:30 - 2014-03-01 06:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-03-13 17:30 - 2014-03-01 06:02 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-03-13 17:30 - 2014-03-01 05:54 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-03-13 17:30 - 2014-03-01 05:52 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-03-13 17:30 - 2014-03-01 05:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-03-13 17:30 - 2014-03-01 05:47 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-03-13 17:30 - 2014-03-01 05:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-03-13 17:30 - 2014-03-01 05:43 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-03-13 17:30 - 2014-03-01 05:42 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-03-13 17:30 - 2014-03-01 05:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-03-13 17:30 - 2014-03-01 05:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-03-13 17:30 - 2014-03-01 05:37 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-03-13 17:30 - 2014-03-01 05:35 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-03-13 17:30 - 2014-03-01 05:18 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-03-13 17:30 - 2014-03-01 05:16 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-03-13 17:30 - 2014-03-01 05:14 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-03-13 17:30 - 2014-03-01 05:10 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-03-13 17:30 - 2014-03-01 05:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-03-13 17:30 - 2014-03-01 05:00 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-03-13 17:30 - 2014-03-01 04:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-03-13 17:30 - 2014-03-01 04:38 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-03-13 17:30 - 2014-03-01 04:32 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-03-13 17:30 - 2014-03-01 04:27 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-03-13 17:30 - 2014-03-01 04:25 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-03-13 17:30 - 2014-03-01 04:25 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-03-13 17:30 - 2014-02-07 03:23 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-03-13 17:30 - 2014-01-29 04:32 - 00484864 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll 2014-03-13 17:30 - 2014-01-29 04:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll 2014-03-13 17:30 - 2014-01-28 04:32 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll 2014-03-13 17:29 - 2014-02-04 04:32 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2014-03-13 17:29 - 2014-02-04 04:32 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll 2014-03-13 17:29 - 2014-02-04 04:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll 2014-03-13 17:29 - 2014-02-04 04:04 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll 2014-03-02 12:26 - 2014-03-02 12:26 - 00005402 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log ==================== One Month Modified Files and Folders ======= 2014-04-01 18:32 - 2014-04-01 18:31 - 00018108 _____ () C:\Users\steve\Desktop\FRST.txt 2014-04-01 18:31 - 2014-04-01 18:31 - 00000000 ____D () C:\FRST 2014-04-01 18:31 - 2012-08-31 18:00 - 00000000 ____D () C:\Users\steve\AppData\Roaming\Dropbox 2014-04-01 18:31 - 2012-08-31 14:05 - 01572026 _____ () C:\Windows\WindowsUpdate.log 2014-04-01 18:31 - 2011-04-12 09:43 - 00699416 _____ () C:\Windows\system32\perfh007.dat 2014-04-01 18:31 - 2011-04-12 09:43 - 00149556 _____ () C:\Windows\system32\perfc007.dat 2014-04-01 18:31 - 2009-07-14 07:13 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-04-01 18:30 - 2012-08-31 18:03 - 00000000 ___RD () C:\Users\steve\Dropbox 2014-04-01 18:30 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\system32\FxsTmp 2014-04-01 18:27 - 2014-02-28 21:56 - 00001120 _____ () C:\Windows\setupact.log 2014-04-01 18:27 - 2012-08-31 14:41 - 00000000 ____D () C:\ProgramData\NVIDIA 2014-04-01 18:27 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-04-01 18:26 - 2013-12-31 11:48 - 00000000 ____D () C:\Users\steve\AppData\Roaming\TS3Client 2014-04-01 18:26 - 2012-09-06 14:42 - 00000000 ____D () C:\Users\steve\Documents\Outlook-Dateien 2014-04-01 18:26 - 2012-08-31 17:57 - 00000000 ____D () C:\Program Files (x86)\Steam 2014-04-01 18:25 - 2014-04-01 18:25 - 02157056 _____ (Farbar) C:\Users\steve\Desktop\FRST64.exe 2014-04-01 18:25 - 2014-04-01 18:25 - 00050477 _____ () C:\Users\steve\Desktop\Defogger.exe 2014-04-01 18:25 - 2014-04-01 18:25 - 00000586 _____ () C:\Users\steve\Desktop\defogger_disable.log 2014-04-01 18:25 - 2014-04-01 18:25 - 00000020 _____ () C:\Users\steve\defogger_reenable 2014-04-01 18:25 - 2012-08-31 14:05 - 00000000 ____D () C:\Users\steve 2014-04-01 18:24 - 2014-04-01 18:24 - 00380416 _____ () C:\Users\steve\Desktop\gup35mqd.exe 2014-04-01 18:20 - 2012-10-31 19:35 - 00000000 ____D () C:\ProgramData\Sonos,_Inc 2014-04-01 18:10 - 2012-09-08 08:22 - 00000000 ____D () C:\Users\steve\AppData\Local\A19D0D92-E506-4870-A46E-0FC261FF6DC1.aplzod 2014-04-01 07:52 - 2014-04-01 07:52 - 00001605 _____ () C:\Users\steve\Desktop\TB.txt 2014-04-01 07:33 - 2012-08-31 14:32 - 00001128 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2280969488-2109145150-2365161803-1000UA.job 2014-04-01 07:17 - 2014-03-30 22:11 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-04-01 06:59 - 2009-07-14 06:45 - 00021872 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-04-01 06:59 - 2009-07-14 06:45 - 00021872 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-04-01 06:52 - 2014-03-30 22:24 - 00053392 _____ () C:\Windows\PFRO.log 2014-03-31 22:57 - 2014-03-31 22:57 - 00022172 _____ () C:\Users\steve\Desktop\ComboFix.txt 2014-03-31 22:57 - 2014-03-31 22:53 - 00000000 ____D () C:\Qoobox 2014-03-31 22:57 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default 2014-03-31 22:56 - 2014-03-31 22:53 - 00000000 ____D () C:\Windows\erdnt 2014-03-31 22:56 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini 2014-03-31 22:33 - 2012-08-31 14:32 - 00001076 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2280969488-2109145150-2365161803-1000Core.job 2014-03-31 20:34 - 2014-03-31 20:34 - 05192353 ____R (Swearware) C:\Users\steve\Desktop\ComboFix.exe 2014-03-30 22:24 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\addins 2014-03-30 22:24 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PLA 2014-03-30 22:21 - 2014-03-30 21:37 - 00000000 ____D () C:\Users\steve\AppData\Roaming\SupTab 2014-03-30 21:57 - 2014-03-30 21:57 - 00001228 _____ () C:\Users\steve\Desktop\Revo Uninstaller.lnk 2014-03-30 21:57 - 2014-03-30 21:57 - 00001066 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-03-30 21:57 - 2014-03-30 21:57 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-03-30 21:57 - 2014-03-30 21:57 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group 2014-03-30 21:57 - 2014-03-30 21:57 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-03-30 21:50 - 2014-03-30 21:50 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\steve\Downloads\mbam-setup-2.0.0.1000.exe 2014-03-30 21:50 - 2014-03-30 21:50 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\steve\Downloads\revosetup95.exe 2014-03-30 21:00 - 2012-09-11 12:40 - 00000000 ____D () C:\Users\steve\Downloads\JDownloader 2014-03-29 18:21 - 2013-02-12 14:31 - 00001907 _____ () C:\Users\Public\Desktop\Sonos.lnk 2014-03-29 18:21 - 2012-10-31 19:35 - 00000000 ____D () C:\Program Files (x86)\Sonos 2014-03-29 18:20 - 2012-10-31 19:35 - 00000000 ____D () C:\Users\steve\AppData\Local\Downloaded Installations 2014-03-27 23:26 - 2014-03-27 19:16 - 457173402 _____ () C:\Users\steve\Downloads\s1619.rar 2014-03-24 23:28 - 2012-08-31 14:32 - 00004102 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2280969488-2109145150-2365161803-1000UA 2014-03-24 23:28 - 2012-08-31 14:32 - 00003706 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2280969488-2109145150-2365161803-1000Core 2014-03-19 02:06 - 2012-09-06 14:36 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-03-17 18:18 - 2013-03-13 23:48 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2014-03-17 18:18 - 2013-03-13 23:48 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight 2014-03-17 18:18 - 2009-07-14 06:45 - 05075608 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-03-13 17:31 - 2013-12-31 11:48 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client 2014-03-05 09:26 - 2014-03-30 21:57 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-03-05 09:26 - 2014-03-30 21:57 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-03-05 09:26 - 2014-03-30 21:57 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-03-04 23:31 - 2013-05-24 14:42 - 01593956 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI 2014-03-03 15:02 - 2013-06-12 16:44 - 00000000 ____D () C:\Users\steve\AppData\Roaming\FileZilla 2014-03-02 12:26 - 2014-03-02 12:26 - 00005402 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log 2014-03-02 12:26 - 2013-09-22 17:59 - 00000000 ____D () C:\ProgramData\Oracle 2014-03-02 12:26 - 2013-09-22 17:58 - 00000000 ____D () C:\Program Files (x86)\Java Some content of TEMP: ==================== C:\Users\steve\AppData\Local\Temp\avgnt.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-03-30 15:22 ==================== End Of Log ============================ Additions.txt Zitat:
GMER Logfile: Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net Rootkit scan 2014-04-01 18:46:23 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Samsung_ rev.EXT0 232,89GB Running: gup35mqd.exe; Driver: C:\Users\steve\AppData\Local\Temp\kxdiifob.sys ---- User code sections - GMER 2.1 ---- .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[1968] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075b61465 2 bytes [B6, 75] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[1968] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075b614bb 2 bytes [B6, 75] .text ... * 2 .text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[4072] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075b61465 2 bytes [B6, 75] .text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[4072] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075b614bb 2 bytes [B6, 75] .text ... * 2 .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[700] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075b61465 2 bytes [B6, 75] .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[700] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075b614bb 2 bytes [B6, 75] .text ... * 2 ---- EOF - GMER 2.1 ---- |
|
01.04.2014, 19:11
| #4 | |
| | WProtectManager unter ProgramData und 337-Games in der Startleiste ComboFix.txt Combofix Logfile: Code:
ATTFilter ComboFix 14-03-24.01 - steve 31.03.2014 22:53:45.1.4 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1252.49.1031.18.8152.6297 [GMT 2:00]
ausgeführt von:: c:\users\steve\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\steve\AppData\Local\assembly\tmp
c:\users\steve\AppData\Roaming\inst.exe
c:\users\steve\AppData\Roaming\vso_ts_preview.xml
c:\windows\IsUn0407.exe
c:\windows\Temp\log.txt
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-02-28 bis 2014-03-31 ))))))))))))))))))))))))))))))
.
.
2014-03-31 20:56 . 2014-03-31 20:56 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2014-03-31 20:56 . 2014-03-31 20:56 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-03-30 20:11 . 2014-03-31 20:29 119512 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-03-30 19:57 . 2014-03-30 19:57 -------- d-----w- c:\program files (x86)\ Malwarebytes Anti-Malware
2014-03-30 19:57 . 2014-03-30 19:57 -------- d-----w- c:\programdata\Malwarebytes
2014-03-30 19:57 . 2014-03-05 07:26 63192 ----a-w- c:\windows\system32\drivers\mwac.sys
2014-03-30 19:57 . 2014-03-05 07:26 88280 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-03-30 19:57 . 2014-03-05 07:26 25816 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-03-30 19:57 . 2014-03-30 19:57 -------- d-----w- c:\program files (x86)\VS Revo Group
2014-03-30 19:37 . 2014-03-30 20:21 -------- d-----w- c:\users\steve\AppData\Roaming\SupTab
2014-03-13 15:29 . 2014-02-04 02:32 1424384 ----a-w- c:\windows\system32\WindowsCodecs.dll
2014-03-13 15:29 . 2014-02-04 02:32 624128 ----a-w- c:\windows\system32\qedit.dll
2014-03-13 15:29 . 2014-02-04 02:04 1230336 ----a-w- c:\windows\SysWow64\WindowsCodecs.dll
2014-03-13 15:29 . 2014-02-04 02:04 509440 ----a-w- c:\windows\SysWow64\qedit.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-02-18 02:13 . 2012-09-22 21:24 88567024 ----a-w- c:\windows\system32\MRT.exe
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 131248 ----a-w- c:\users\steve\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 131248 ----a-w- c:\users\steve\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 131248 ----a-w- c:\users\steve\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Mobile Partner"="c:\program files (x86)\My Broadband\My Broadband" [X]
"iCloudServices"="c:\program files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe" [2013-11-20 59720]
"85DBE9CD5C641104D2F436A3E6535A29577D79AD._service_run"="c:\users\steve\AppData\Local\Google\Chrome\Application\chrome.exe" [2014-03-15 859976]
"ApplePhotoStreams"="c:\program files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe" [2013-11-20 59720]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-11-29 284440]
"USB3MON"="c:\program files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [2012-05-20 291648]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"Adobe Acrobat Speed Launcher"="c:\program files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" [2012-12-18 39136]
"Acrobat Assistant 8.0"="c:\program files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [2012-12-18 825560]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2014-02-05 43848]
"EEventManager"="c:\program files (x86)\Epson Software\Event Manager\EEventManager.exe" [2012-04-02 1058912]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2014-02-20 689744]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2014-02-06 152392]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
"GBTUpd"="c:\program files (x86)\Gigabyte\UpdManager\PreRun.exe" [2008-04-03 297480]
.
c:\users\steve\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\steve\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2014-1-3 30714328]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 cpuz135;cpuz135;c:\windows\TEMP\cpuz135\cpuz135_x64.sys;c:\windows\TEMP\cpuz135\cpuz135_x64.sys [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 ew_usbenumfilter;huawei_CompositeFilter;c:\windows\system32\DRIVERS\ew_usbenumfilter.sys;c:\windows\SYSNATIVE\DRIVERS\ew_usbenumfilter.sys [x]
R3 Futuremark SystemInfo Service;Futuremark SystemInfo Service;c:\program files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe;c:\program files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe [x]
R3 huawei_cdcacm;huawei_cdcacm;c:\windows\system32\DRIVERS\ew_jucdcacm.sys;c:\windows\SYSNATIVE\DRIVERS\ew_jucdcacm.sys [x]
R3 huawei_cdcecm;huawei_cdcecm;c:\windows\system32\DRIVERS\ew_jucdcecm.sys;c:\windows\SYSNATIVE\DRIVERS\ew_jucdcecm.sys [x]
R3 huawei_ext_ctrl;huawei_ext_ctrl;c:\windows\system32\DRIVERS\ew_juextctrl.sys;c:\windows\SYSNATIVE\DRIVERS\ew_juextctrl.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WSDScan;WSD-Scanunterstützung durch UMB;c:\windows\system32\drivers\WSDScan.sys;c:\windows\SYSNATIVE\drivers\WSDScan.sys [x]
R4 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [x]
S0 iusb3hcs;Intel(R) USB 3.0 Hostcontroller-Switchtreiber;c:\windows\system32\DRIVERS\iusb3hcs.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hcs.sys [x]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 EpsonScanSvc;Epson Scanner Service;c:\windows\system32\EscSvc64.exe;c:\windows\SYSNATIVE\EscSvc64.exe [x]
S2 HWDeviceService64.exe;HWDeviceService64.exe;c:\programdata\DatacardService\HWDeviceService64.exe;c:\programdata\DatacardService\HWDeviceService64.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]
S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [x]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [x]
S2 MBAMService;MBAMService;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S2 VIAKaraokeService;VIA Karaoke digital mixer Service;c:\windows\system32\viakaraokesrv.exe;c:\windows\SYSNATIVE\viakaraokesrv.exe [x]
S3 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys;c:\windows\SYSNATIVE\DRIVERS\ew_jubusenum.sys [x]
S3 iusb3hub;Intel(R) USB 3.0-Hubtreiber;c:\windows\system32\DRIVERS\iusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hub.sys [x]
S3 iusb3xhc;Intel(R) USB 3.0 eXtensible-Hostcontrollertreiber;c:\windows\system32\DRIVERS\iusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3xhc.sys [x]
S3 L1C;NDIS Miniport Driver for Atheros AR81xx PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C62x64.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys;c:\windows\SYSNATIVE\drivers\MBAMSwissArmy.sys [x]
S3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys;c:\windows\SYSNATIVE\drivers\viahduaa.sys [x]
S3 VUSB3HUB;VIA USB 3 Root Hub Service;c:\windows\system32\DRIVERS\ViaHub3.sys;c:\windows\SYSNATIVE\DRIVERS\ViaHub3.sys [x]
S3 xhcdrv;VIA USB eXtensible Host Controller Service;c:\windows\system32\DRIVERS\xhcdrv.sys;c:\windows\SYSNATIVE\DRIVERS\xhcdrv.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - MBAMSWISSARMY
*NewlyCreated* - MBAMWEBACCESSCONTROL
.
Inhalt des "geplante Tasks" Ordners
.
2014-03-31 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2280969488-2109145150-2365161803-1000Core.job
- c:\users\steve\AppData\Local\Google\Update\GoogleUpdate.exe [2012-08-31 12:32]
.
2014-03-31 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2280969488-2109145150-2365161803-1000UA.job
- c:\users\steve\AppData\Local\Google\Update\GoogleUpdate.exe [2012-08-31 12:32]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 164016 ----a-w- c:\users\steve\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 164016 ----a-w- c:\users\steve\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 164016 ----a-w- c:\users\steve\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 164016 ----a-w- c:\users\steve\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VIAxHCUtl"="c:\via_xhci\usb3Monitor.exe" [2011-07-12 331776]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2012-11-05 108144]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2012-10-15 170496]
"Nvtmru"="c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe" [2013-05-16 1012000]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-09-20 444904]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
mDefault_Search_URL = hxxp://www.aartemis.com/web/?type=ds&ts=1388547520&from=cor&uid=M4-CT128M4SSD2_0000000012080907680D&q={searchTerms}
mDefault_Page_URL = about:blank
mStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Page = hxxp://www.aartemis.com/web/?type=ds&ts=1388547520&from=cor&uid=M4-CT128M4SSD2_0000000012080907680D&q={searchTerms}
uInternet Settings,ProxyOverride = *.local
IE: An vorhandene PDF-Datei anfügen - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: E&xport to Microsoft Excel - c:\program files\Microsoft Office 15\Root\Office15\EXCEL.EXE/3000
IE: In Adobe PDF konvertieren - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Linkziel an vorhandene PDF-Datei anhängen - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Linkziel in Adobe PDF konvertieren - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\program files\Microsoft Office 15\Root\Office15\ONBttnIE.dll/105
LSP: c:\program files (x86)\Avira\AntiVir Desktop\avsda.dll
TCP: Interfaces\{1E2A2F41-C006-4388-81AE-B59AD0F37157}: NameServer = 192.168.178.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-AdobeBridge - (no file)
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_175_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_175_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_175_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_175_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_175.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_175.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_175.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_175.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-03-31 22:57:29
ComboFix-quarantined-files.txt 2014-03-31 20:57
.
Vor Suchlauf: 9 Verzeichnis(se), 133.014.388.736 Bytes frei
Nach Suchlauf: 13 Verzeichnis(se), 132.895.969.280 Bytes frei
.
- - End Of File - - 2D644AF88E7106A6983287E244B037B9
MBAM.txt Zitat:
|
|
02.04.2014, 13:37
| #5 |
| /// the machine /// TB-Ausbilder | WProtectManager unter ProgramData und 337-Games in der Startleiste hi, So funktioniert es:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
03.04.2014, 00:02
| #6 |
| | WProtectManager unter ProgramData und 337-Games in der Startleiste Huhu, vielen Dank schon einmal. Hier die Logdateien: AdwCleaner.txt Code:
ATTFilter # AdwCleaner v3.023 - Bericht erstellt am 03/04/2014 um 00:51:18
# Aktualisiert 01/04/2014 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : steve - steve-PC
# Gestartet von : C:\Users\steve\Desktop\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\Users\steve\AppData\Roaming\SupTab
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Schlüssel Gelöscht : HKLM\Software\aartemisSoftware
Schlüssel Gelöscht : HKLM\Software\supTab
Schlüssel Gelöscht : HKLM\Software\supWPM
Schlüssel Gelöscht : HKLM\Software\Wpm
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.16521
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
-\\ Google Chrome v
[ Datei : C:\Users\steve\AppData\Local\Google\Chrome\User Data\Default\preferences ]
*************************
AdwCleaner[R0].txt - [1683 octets] - [03/04/2014 00:50:43]
AdwCleaner[S0].txt - [1384 octets] - [03/04/2014 00:51:18]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1444 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.3 (03.23.2014:1)
OS: Windows 7 Professional x64
Ran by steve on 03.04.2014 at 0:56:03,73
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 03.04.2014 at 0:59:19,77
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST.log FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014 Ran by steve (administrator) on steve-PC on 03-04-2014 01:00:04 Running from C:\Users\steve\Desktop Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe () C:\ProgramData\DatacardService\HWDeviceService64.exe (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (VIA Technologies, Inc.) C:\Windows\system32\viakaraokesrv.exe (Seiko Epson Corporation) C:\Windows\system32\EscSvc64.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe (VIA Technologies, Inc.) C:\VIA_XHCI\usb3Monitor.exe (Sun Microsystems, Inc.) C:\Program Files\Java\jre6\bin\jusched.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Dropbox, Inc.) C:\Users\steve\AppData\Roaming\Dropbox\bin\Dropbox.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe (SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Google Inc.) C:\Users\steve\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\steve\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\steve\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\steve\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\steve\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\steve\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\steve\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\steve\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\steve\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\steve\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\steve\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\steve\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\steve\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\steve\AppData\Local\Google\Chrome\Application\chrome.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [VIAxHCUtl] - C:\VIA_XHCI\usb3Monitor.exe [331776 2011-07-12] (VIA Technologies, Inc.) HKLM\...\Run: [BCSSync] - C:\Program Files\Microsoft Office\Office14\BCSSync.exe [108144 2012-11-05] (Microsoft Corporation) HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Java\jre6\bin\jusched.exe [170496 2012-10-15] (Sun Microsystems, Inc.) HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1012000 2013-05-16] (NVIDIA Corporation) HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [444904 2012-09-20] (Adobe Systems Incorporated) HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-11-29] (Intel Corporation) HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291648 2012-05-20] (Intel Corporation) HKLM-x32\...\Run: [] - [X] HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe [39136 2012-12-18] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Acrobat Assistant 8.0] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe [825560 2012-12-18] (Adobe Systems Inc.) HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-06] (Apple Inc.) HKLM-x32\...\Run: [EEventManager] - C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [1058912 2012-04-02] (SEIKO EPSON CORPORATION) HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-06] (Apple Inc.) HKLM-x32\...\RunOnce: [GBTUpd] - C:\Program Files (x86)\Gigabyte\UpdManager\PreRun.exe [297480 2008-04-03] (PreRun) HKU\S-1-5-21-2280969488-2109145150-2365161803-1000\...\Run: [iCloudServices] - C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-11-20] (Apple Inc.) HKU\S-1-5-21-2280969488-2109145150-2365161803-1000\...\Run: [85DBE9CD5C641104D2F436A3E6535A29577D79AD._service_run] - C:\Users\steve\AppData\Local\Google\Chrome\Application\chrome.exe [859976 2014-03-15] (Google Inc.) HKU\S-1-5-21-2280969488-2109145150-2365161803-1000\...\Run: [ApplePhotoStreams] - C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-11-20] (Apple Inc.) HKU\S-1-5-21-2280969488-2109145150-2365161803-1000\...\Run: [Mobile Partner] - C:\Program Files (x86)\My Broadband\My Broadband Startup: C:\Users\steve\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\steve\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x3780B8F9C60ACE01 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe BHO: No Name - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - No File BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: No Name - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - No File BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File DPF: HKLM-x32 {0D6709DD-4ED8-40CA-B459-2757AEEF7BEE} hxxp://download.gigabyte.com.tw/object/Dldrv.ocx Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\..\Interfaces\{1E2A2F41-C006-4388-81AE-B59AD0F37157}: [NameServer]192.168.178.1 Chrome: ======= CHR HomePage: CHR Extension: (Web Developer) - C:\Users\steve\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfbameneiokkgbdmiekhjnmfkcnldhhm [2013-01-03] CHR Extension: (Adblock Plus) - C:\Users\steve\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-01-28] CHR Extension: (Add to Wunderlist) - C:\Users\steve\AppData\Local\Google\Chrome\User Data\Default\Extensions\dmnddeddcgdllibmaodanoonljfdmooc [2013-11-07] CHR Extension: (Suche Wechseln) - C:\Users\steve\AppData\Local\Google\Chrome\User Data\Default\Extensions\dopemniaeocfenlpnoannaefnhfcjcgi [2014-03-30] CHR Extension: (Wunderlist - To-do and Task list) - C:\Users\steve\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjliknjliaohjgjajlgolhijphojjdkc [2012-12-20] CHR Extension: (Windows Media Player Extension for HTML5) - C:\Users\steve\AppData\Local\Google\Chrome\User Data\Default\Extensions\hokdglbhghcebcopdbanieangmcamaak [2013-10-08] CHR Extension: (ShiftEdit) - C:\Users\steve\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcgmndephhjcabhhjfcmncnhbmgbkpij [2013-01-20] CHR Extension: (FVD Downloader) - C:\Users\steve\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfmhcpmkbdkbgbmkjoiopeeegenkdikp [2013-09-24] CHR Extension: (qipu Cashbackmelder open beta) - C:\Users\steve\AppData\Local\Google\Chrome\User Data\Default\Extensions\mloigoojndlehdjiemdfpiikieonngel [2012-12-30] CHR Extension: (Google Wallet) - C:\Users\steve\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23] CHR Extension: (Extended Protection) - C:\Users\steve\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogfjmhfnldnajmfaofeiaepghjenbgjo [2014-03-30] CHR HKLM-x32\...\Chrome\Extension: [dopemniaeocfenlpnoannaefnhfcjcgi] - C:\Users\steve\AppData\Local\Google\Chrome\User Data\Default\Extensions\searchswitch.crx [2014-03-30] CHR HKLM-x32\...\Chrome\Extension: [ogfjmhfnldnajmfaofeiaepghjenbgjo] - C:\Users\steve\AppData\Local\Google\Chrome\User Data\Default\Extensions\ep.crx [2014-03-30] ==================== Services (Whitelisted) ================= R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG) S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1017424 2014-02-20] (Avira Operations GmbH & Co. KG) R2 EpsonScanSvc; C:\Windows\system32\EscSvc64.exe [135824 2011-12-12] (Seiko Epson Corporation) R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] () R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165144 2012-05-10] (Intel Corporation) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-03-05] (Malwarebytes Corporation) S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [857912 2014-03-05] (Malwarebytes Corporation) R2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27792 2012-08-03] (VIA Technologies, Inc.) ==================== Drivers (Whitelisted) ==================== R3 AnyDVD; C:\Windows\System32\Drivers\AnyDVD.sys [138400 2012-08-26] (SlySoft, Inc.) R3 AnyDVD; C:\Windows\SysWOW64\Drivers\AnyDVD.sys [138400 2012-08-26] (SlySoft, Inc.) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG) R3 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2012-09-02] (DT Soft Ltd) U5 ew_hwusbdev; C:\Windows\System32\Drivers\ew_hwusbdev.sys [117248 2010-07-27] (Huawei Technologies Co., Ltd.) R3 L1C; C:\Windows\System32\DRIVERS\L1C62x64.sys [104560 2012-04-25] (Qualcomm Atheros Co., Ltd.) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-03-05] (Malwarebytes Corporation) S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2014-04-02] (Malwarebytes Corporation) S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63192 2014-03-05] (Malwarebytes Corporation) S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.) S4 sptd; C:\Windows\System32\Drivers\sptd.sys [560184 2013-04-03] (Duplex Secure Ltd.) R3 VUSB3HUB; C:\Windows\System32\DRIVERS\ViaHub3.sys [205312 2012-01-20] (VIA Technologies, Inc.) R3 xhcdrv; C:\Windows\System32\DRIVERS\xhcdrv.sys [254464 2012-01-20] (VIA Technologies, Inc.) S3 catchme; \??\C:\ComboFix\catchme.sys [X] S3 cpuz135; \??\C:\Windows\TEMP\cpuz135\cpuz135_x64.sys [X] S3 gdrv; \??\C:\Windows\gdrv.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-04-03 00:59 - 2014-04-03 00:59 - 00000627 _____ () C:\Users\steve\Desktop\JRT.txt 2014-04-03 00:56 - 2014-04-03 00:56 - 00000000 ____D () C:\Windows\ERUNT 2014-04-03 00:54 - 2014-04-03 00:55 - 00001518 _____ () C:\Users\steve\Desktop\AdwCleaner[S0].txt 2014-04-03 00:50 - 2014-04-03 00:51 - 00000000 ____D () C:\AdwCleaner 2014-04-03 00:49 - 2014-04-03 00:49 - 01426178 _____ () C:\Users\steve\Desktop\adwcleaner.exe 2014-04-03 00:49 - 2014-04-03 00:49 - 01038974 _____ (Thisisu) C:\Users\steve\Desktop\JRT.exe 2014-04-01 20:02 - 2014-04-01 20:02 - 00022136 _____ () C:\Users\steve\Desktop\ComboFix2.txt 2014-04-01 18:47 - 2014-04-01 18:58 - 00032693 _____ () C:\Users\steve\Desktop\mbam.txt 2014-04-01 18:46 - 2014-04-01 18:57 - 00001948 _____ () C:\Users\steve\Desktop\GMER.log 2014-04-01 18:32 - 2014-04-01 18:57 - 00034665 _____ () C:\Users\steve\Desktop\Addition.txt 2014-04-01 18:31 - 2014-04-03 01:00 - 00016436 _____ () C:\Users\steve\Desktop\FRST.txt 2014-04-01 18:31 - 2014-04-03 01:00 - 00000000 ____D () C:\FRST 2014-04-01 18:25 - 2014-04-01 18:56 - 00000584 _____ () C:\Users\steve\Desktop\defogger_disable.log 2014-04-01 18:25 - 2014-04-01 18:25 - 02157056 _____ (Farbar) C:\Users\steve\Desktop\FRST64.exe 2014-04-01 18:25 - 2014-04-01 18:25 - 00050477 _____ () C:\Users\steve\Desktop\Defogger.exe 2014-04-01 18:25 - 2014-04-01 18:25 - 00000020 _____ () C:\Users\steve\defogger_reenable 2014-04-01 18:24 - 2014-04-01 18:24 - 00380416 _____ () C:\Users\steve\Desktop\gup35mqd.exe 2014-04-01 07:52 - 2014-04-01 07:52 - 00001605 _____ () C:\Users\steve\Desktop\TB.txt 2014-03-31 22:57 - 2014-03-31 22:57 - 00022172 _____ () C:\Users\steve\Desktop\ComboFix.txt 2014-03-31 22:53 - 2014-03-31 22:57 - 00000000 ____D () C:\Qoobox 2014-03-31 22:53 - 2014-03-31 22:56 - 00000000 ____D () C:\Windows\erdnt 2014-03-31 22:53 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe 2014-03-31 22:53 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe 2014-03-31 22:53 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2014-03-31 22:53 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2014-03-31 22:53 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2014-03-31 22:53 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe 2014-03-31 22:53 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe 2014-03-31 22:53 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe 2014-03-31 20:34 - 2014-03-31 20:34 - 05192353 ____R (Swearware) C:\Users\steve\Desktop\ComboFix.exe 2014-03-30 22:24 - 2014-04-01 06:52 - 00053392 _____ () C:\Windows\PFRO.log 2014-03-30 22:11 - 2014-04-02 17:05 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-03-30 21:57 - 2014-03-30 21:57 - 00001228 _____ () C:\Users\steve\Desktop\Revo Uninstaller.lnk 2014-03-30 21:57 - 2014-03-30 21:57 - 00001066 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-03-30 21:57 - 2014-03-30 21:57 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-03-30 21:57 - 2014-03-30 21:57 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group 2014-03-30 21:57 - 2014-03-30 21:57 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-03-30 21:57 - 2014-03-05 09:26 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-03-30 21:57 - 2014-03-05 09:26 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-03-30 21:57 - 2014-03-05 09:26 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-03-30 21:50 - 2014-03-30 21:50 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\steve\Downloads\mbam-setup-2.0.0.1000.exe 2014-03-30 21:50 - 2014-03-30 21:50 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\steve\Downloads\revosetup95.exe 2014-03-27 19:16 - 2014-03-27 23:26 - 457173402 _____ () C:\Users\steve\Downloads\s1619.rar 2014-03-13 17:30 - 2014-03-01 08:05 - 23133696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-03-13 17:30 - 2014-03-01 07:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-03-13 17:30 - 2014-03-01 07:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-03-13 17:30 - 2014-03-01 06:58 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-03-13 17:30 - 2014-03-01 06:52 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-03-13 17:30 - 2014-03-01 06:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-03-13 17:30 - 2014-03-01 06:42 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-03-13 17:30 - 2014-03-01 06:40 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-03-13 17:30 - 2014-03-01 06:37 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-03-13 17:30 - 2014-03-01 06:33 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-03-13 17:30 - 2014-03-01 06:33 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-03-13 17:30 - 2014-03-01 06:32 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-03-13 17:30 - 2014-03-01 06:30 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-03-13 17:30 - 2014-03-01 06:23 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-03-13 17:30 - 2014-03-01 06:17 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-03-13 17:30 - 2014-03-01 06:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-03-13 17:30 - 2014-03-01 06:02 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-03-13 17:30 - 2014-03-01 05:54 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-03-13 17:30 - 2014-03-01 05:52 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-03-13 17:30 - 2014-03-01 05:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-03-13 17:30 - 2014-03-01 05:47 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-03-13 17:30 - 2014-03-01 05:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-03-13 17:30 - 2014-03-01 05:43 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-03-13 17:30 - 2014-03-01 05:42 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-03-13 17:30 - 2014-03-01 05:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-03-13 17:30 - 2014-03-01 05:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-03-13 17:30 - 2014-03-01 05:37 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-03-13 17:30 - 2014-03-01 05:35 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-03-13 17:30 - 2014-03-01 05:18 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-03-13 17:30 - 2014-03-01 05:16 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-03-13 17:30 - 2014-03-01 05:14 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-03-13 17:30 - 2014-03-01 05:10 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-03-13 17:30 - 2014-03-01 05:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-03-13 17:30 - 2014-03-01 05:00 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-03-13 17:30 - 2014-03-01 04:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-03-13 17:30 - 2014-03-01 04:38 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-03-13 17:30 - 2014-03-01 04:32 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-03-13 17:30 - 2014-03-01 04:27 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-03-13 17:30 - 2014-03-01 04:25 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-03-13 17:30 - 2014-03-01 04:25 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-03-13 17:30 - 2014-02-07 03:23 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-03-13 17:30 - 2014-01-29 04:32 - 00484864 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll 2014-03-13 17:30 - 2014-01-29 04:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll 2014-03-13 17:30 - 2014-01-28 04:32 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll 2014-03-13 17:29 - 2014-02-04 04:32 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2014-03-13 17:29 - 2014-02-04 04:32 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll 2014-03-13 17:29 - 2014-02-04 04:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll 2014-03-13 17:29 - 2014-02-04 04:04 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll ==================== One Month Modified Files and Folders ======= 2014-04-03 01:00 - 2014-04-01 18:31 - 00016436 _____ () C:\Users\steve\Desktop\FRST.txt 2014-04-03 01:00 - 2014-04-01 18:31 - 00000000 ____D () C:\FRST 2014-04-03 00:59 - 2014-04-03 00:59 - 00000627 _____ () C:\Users\steve\Desktop\JRT.txt 2014-04-03 00:59 - 2009-07-14 06:45 - 00021872 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-04-03 00:59 - 2009-07-14 06:45 - 00021872 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-04-03 00:58 - 2011-04-12 09:43 - 00699416 _____ () C:\Windows\system32\perfh007.dat 2014-04-03 00:58 - 2011-04-12 09:43 - 00149556 _____ () C:\Windows\system32\perfc007.dat 2014-04-03 00:58 - 2009-07-14 07:13 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-04-03 00:56 - 2014-04-03 00:56 - 00000000 ____D () C:\Windows\ERUNT 2014-04-03 00:55 - 2014-04-03 00:54 - 00001518 _____ () C:\Users\steve\Desktop\AdwCleaner[S0].txt 2014-04-03 00:54 - 2012-08-31 18:03 - 00000000 ___RD () C:\Users\steve\Dropbox 2014-04-03 00:54 - 2012-08-31 18:00 - 00000000 ____D () C:\Users\steve\AppData\Roaming\Dropbox 2014-04-03 00:54 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\system32\FxsTmp 2014-04-03 00:52 - 2014-02-28 21:56 - 00001232 _____ () C:\Windows\setupact.log 2014-04-03 00:52 - 2012-08-31 14:41 - 00000000 ____D () C:\ProgramData\NVIDIA 2014-04-03 00:52 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-04-03 00:51 - 2014-04-03 00:50 - 00000000 ____D () C:\AdwCleaner 2014-04-03 00:51 - 2012-08-31 14:32 - 00001076 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2280969488-2109145150-2365161803-1000Core.job 2014-04-03 00:51 - 2012-08-31 14:05 - 01594657 _____ () C:\Windows\WindowsUpdate.log 2014-04-03 00:49 - 2014-04-03 00:49 - 01426178 _____ () C:\Users\steve\Desktop\adwcleaner.exe 2014-04-03 00:49 - 2014-04-03 00:49 - 01038974 _____ (Thisisu) C:\Users\steve\Desktop\JRT.exe 2014-04-03 00:48 - 2012-08-31 14:32 - 00001128 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2280969488-2109145150-2365161803-1000UA.job 2014-04-02 17:05 - 2014-03-30 22:11 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-04-01 22:50 - 2013-12-31 11:48 - 00000000 ____D () C:\Users\steve\AppData\Roaming\TS3Client 2014-04-01 22:50 - 2012-08-31 17:57 - 00000000 ____D () C:\Program Files (x86)\Steam 2014-04-01 22:32 - 2012-09-06 14:42 - 00000000 ____D () C:\Users\steve\Documents\Outlook-Dateien 2014-04-01 21:16 - 2012-09-08 08:22 - 00000000 ____D () C:\Users\steve\AppData\Local\A19D0D92-E506-4870-A46E-0FC261FF6DC1.aplzod 2014-04-01 20:02 - 2014-04-01 20:02 - 00022136 _____ () C:\Users\steve\Desktop\ComboFix2.txt 2014-04-01 19:11 - 2012-10-31 19:35 - 00000000 ____D () C:\ProgramData\Sonos,_Inc 2014-04-01 18:58 - 2014-04-01 18:47 - 00032693 _____ () C:\Users\steve\Desktop\mbam.txt 2014-04-01 18:57 - 2014-04-01 18:46 - 00001948 _____ () C:\Users\steve\Desktop\GMER.log 2014-04-01 18:57 - 2014-04-01 18:32 - 00034665 _____ () C:\Users\steve\Desktop\Addition.txt 2014-04-01 18:56 - 2014-04-01 18:25 - 00000584 _____ () C:\Users\steve\Desktop\defogger_disable.log 2014-04-01 18:25 - 2014-04-01 18:25 - 02157056 _____ (Farbar) C:\Users\steve\Desktop\FRST64.exe 2014-04-01 18:25 - 2014-04-01 18:25 - 00050477 _____ () C:\Users\steve\Desktop\Defogger.exe 2014-04-01 18:25 - 2014-04-01 18:25 - 00000020 _____ () C:\Users\steve\defogger_reenable 2014-04-01 18:25 - 2012-08-31 14:05 - 00000000 ____D () C:\Users\steve 2014-04-01 18:24 - 2014-04-01 18:24 - 00380416 _____ () C:\Users\steve\Desktop\gup35mqd.exe 2014-04-01 07:52 - 2014-04-01 07:52 - 00001605 _____ () C:\Users\steve\Desktop\TB.txt 2014-04-01 06:52 - 2014-03-30 22:24 - 00053392 _____ () C:\Windows\PFRO.log 2014-03-31 22:57 - 2014-03-31 22:57 - 00022172 _____ () C:\Users\steve\Desktop\ComboFix.txt 2014-03-31 22:57 - 2014-03-31 22:53 - 00000000 ____D () C:\Qoobox 2014-03-31 22:57 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default 2014-03-31 22:56 - 2014-03-31 22:53 - 00000000 ____D () C:\Windows\erdnt 2014-03-31 22:56 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini 2014-03-31 20:34 - 2014-03-31 20:34 - 05192353 ____R (Swearware) C:\Users\steve\Desktop\ComboFix.exe 2014-03-30 22:24 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\addins 2014-03-30 22:24 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PLA 2014-03-30 21:57 - 2014-03-30 21:57 - 00001228 _____ () C:\Users\steve\Desktop\Revo Uninstaller.lnk 2014-03-30 21:57 - 2014-03-30 21:57 - 00001066 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-03-30 21:57 - 2014-03-30 21:57 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-03-30 21:57 - 2014-03-30 21:57 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group 2014-03-30 21:57 - 2014-03-30 21:57 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-03-30 21:50 - 2014-03-30 21:50 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\steve\Downloads\mbam-setup-2.0.0.1000.exe 2014-03-30 21:50 - 2014-03-30 21:50 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\steve\Downloads\revosetup95.exe 2014-03-30 21:00 - 2012-09-11 12:40 - 00000000 ____D () C:\Users\steve\Downloads\JDownloader 2014-03-29 18:21 - 2013-02-12 14:31 - 00001907 _____ () C:\Users\Public\Desktop\Sonos.lnk 2014-03-29 18:21 - 2012-10-31 19:35 - 00000000 ____D () C:\Program Files (x86)\Sonos 2014-03-29 18:20 - 2012-10-31 19:35 - 00000000 ____D () C:\Users\steve\AppData\Local\Downloaded Installations 2014-03-27 23:26 - 2014-03-27 19:16 - 457173402 _____ () C:\Users\steve\Downloads\s1619.rar 2014-03-24 23:28 - 2012-08-31 14:32 - 00004102 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2280969488-2109145150-2365161803-1000UA 2014-03-24 23:28 - 2012-08-31 14:32 - 00003706 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2280969488-2109145150-2365161803-1000Core 2014-03-19 02:06 - 2012-09-06 14:36 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-03-17 18:18 - 2013-03-13 23:48 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2014-03-17 18:18 - 2013-03-13 23:48 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight 2014-03-17 18:18 - 2009-07-14 06:45 - 05075608 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-03-13 17:31 - 2013-12-31 11:48 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client 2014-03-05 09:26 - 2014-03-30 21:57 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-03-05 09:26 - 2014-03-30 21:57 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-03-05 09:26 - 2014-03-30 21:57 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-03-04 23:31 - 2013-05-24 14:42 - 01593956 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI Some content of TEMP: ==================== C:\Users\steve\AppData\Local\Temp\avgnt.exe C:\Users\steve\AppData\Local\Temp\Quarantine.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-03-30 15:22 ==================== End Of Log ============================ --- --- --- --- --- --- VG, steve |
|
03.04.2014, 12:14
| #7 |
| /// the machine /// TB-Ausbilder | WProtectManager unter ProgramData und 337-Games in der StartleisteESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
03.04.2014, 16:57
| #8 |
| | WProtectManager unter ProgramData und 337-Games in der Startleiste ESET: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=322a638a7fa83441b406b5d41703038a
# engine=17742
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-04-03 02:57:13
# local_time=2014-04-03 04:57:13 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 94 57910 167208338 50942 0
# compatibility_mode=5893 16776574 100 94 22963802 148166883 0 0
# scanned=48
# found=0
# cleaned=0
# scan_time=14
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=322a638a7fa83441b406b5d41703038a
# engine=17742
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-04-03 03:42:10
# local_time=2014-04-03 05:42:10 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 94 2773 167211035 0 0
# compatibility_mode=5893 16776574 100 94 22966499 148169580 0 0
# scanned=193521
# found=0
# cleaned=0
# scan_time=2670
Code:
ATTFilter Results of screen317's Security Check version 0.99.80 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 11 ``````````````Antivirus/Firewall Check:`````````````` Avira Desktop Antivirus up to date! (On Access scanning disabled!) `````````Anti-malware/Other Utilities Check:````````` Call of Duty: Ghosts Java 7 Update 51 Google Chrome 33.0.1750.146 Google Chrome 33.0.1750.154 ````````Process Check: objlist.exe by Laurent```````` Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbam.exe Avira Antivir avgnt.exe Avira Antivir avguard.exe Malwarebytes Anti-Malware mbamscheduler.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014 Ran by steve (administrator) on steve-PC on 03-04-2014 17:56:16 Running from C:\Users\steve\Desktop Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe () C:\ProgramData\DatacardService\HWDeviceService64.exe (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (VIA Technologies, Inc.) C:\Windows\system32\viakaraokesrv.exe (Seiko Epson Corporation) C:\Windows\system32\EscSvc64.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (VIA Technologies, Inc.) C:\VIA_XHCI\usb3Monitor.exe (Sun Microsystems, Inc.) C:\Program Files\Java\jre6\bin\jusched.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe (Google Inc.) C:\Users\steve\AppData\Local\Google\Chrome\Application\chrome.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe (Dropbox, Inc.) C:\Users\steve\AppData\Roaming\Dropbox\bin\Dropbox.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe (SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe (TeamSpeak Systems GmbH) C:\Program Files\TeamSpeak 3 Client\ts3client_win64.exe (Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Google Inc.) C:\Users\steve\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\steve\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\steve\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\steve\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\steve\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\steve\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\steve\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\steve\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\steve\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\steve\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\steve\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\steve\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\steve\AppData\Local\Google\Chrome\Application\chrome.exe (Sonos, Inc.) C:\Program Files (x86)\Sonos\Sonos.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe () C:\Users\steve\Downloads\SecurityCheck.exe (Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe (Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [VIAxHCUtl] - C:\VIA_XHCI\usb3Monitor.exe [331776 2011-07-12] (VIA Technologies, Inc.) HKLM\...\Run: [BCSSync] - C:\Program Files\Microsoft Office\Office14\BCSSync.exe [108144 2012-11-05] (Microsoft Corporation) HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Java\jre6\bin\jusched.exe [170496 2012-10-15] (Sun Microsystems, Inc.) HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1012000 2013-05-16] (NVIDIA Corporation) HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [444904 2012-09-20] (Adobe Systems Incorporated) HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-11-29] (Intel Corporation) HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291648 2012-05-20] (Intel Corporation) HKLM-x32\...\Run: [] - [X] HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe [39136 2012-12-18] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Acrobat Assistant 8.0] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe [825560 2012-12-18] (Adobe Systems Inc.) HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-06] (Apple Inc.) HKLM-x32\...\Run: [EEventManager] - C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [1058912 2012-04-02] (SEIKO EPSON CORPORATION) HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-06] (Apple Inc.) HKLM-x32\...\RunOnce: [GBTUpd] - C:\Program Files (x86)\Gigabyte\UpdManager\PreRun.exe [297480 2008-04-03] (PreRun) HKU\S-1-5-21-2280969488-2109145150-2365161803-1000\...\Run: [iCloudServices] - C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-11-20] (Apple Inc.) HKU\S-1-5-21-2280969488-2109145150-2365161803-1000\...\Run: [85DBE9CD5C641104D2F436A3E6535A29577D79AD._service_run] - C:\Users\steve\AppData\Local\Google\Chrome\Application\chrome.exe [859976 2014-03-15] (Google Inc.) HKU\S-1-5-21-2280969488-2109145150-2365161803-1000\...\Run: [ApplePhotoStreams] - C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-11-20] (Apple Inc.) HKU\S-1-5-21-2280969488-2109145150-2365161803-1000\...\Run: [Mobile Partner] - C:\Program Files (x86)\My Broadband\My Broadband Startup: C:\Users\steve\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\steve\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x3780B8F9C60ACE01 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe BHO: No Name - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - No File BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: No Name - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - No File BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File DPF: HKLM-x32 {0D6709DD-4ED8-40CA-B459-2757AEEF7BEE} hxxp://download.gigabyte.com.tw/object/Dldrv.ocx Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\..\Interfaces\{1E2A2F41-C006-4388-81AE-B59AD0F37157}: [NameServer]192.168.178.1 Chrome: ======= CHR HomePage: CHR Plugin: (Shockwave Flash) - C:\Users\steve\AppData\Local\Google\Chrome\Application\21.0.1180.89\PepperFlash\pepflashplayer.dll No File CHR Plugin: (Shockwave Flash) - C:\Users\steve\AppData\Local\Google\Chrome\Application\33.0.1750.154\gcswf32.dll No File CHR Plugin: (Remoting Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Users\steve\AppData\Local\Google\Chrome\Application\33.0.1750.154\ppGoogleNaClPluginChrome.dll () CHR Plugin: (Chrome PDF Viewer) - C:\Users\steve\AppData\Local\Google\Chrome\Application\33.0.1750.154\pdf.dll () CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation) CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation) CHR Plugin: (Google Update) - C:\Users\steve\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File CHR Extension: (Web Developer) - C:\Users\steve\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfbameneiokkgbdmiekhjnmfkcnldhhm [2013-01-03] CHR Extension: (Adblock Plus) - C:\Users\steve\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-01-28] CHR Extension: (Add to Wunderlist) - C:\Users\steve\AppData\Local\Google\Chrome\User Data\Default\Extensions\dmnddeddcgdllibmaodanoonljfdmooc [2013-11-07] CHR Extension: (Suche Wechseln) - C:\Users\steve\AppData\Local\Google\Chrome\User Data\Default\Extensions\dopemniaeocfenlpnoannaefnhfcjcgi [2014-03-30] CHR Extension: (Wunderlist - To-do and Task list) - C:\Users\steve\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjliknjliaohjgjajlgolhijphojjdkc [2012-12-20] CHR Extension: (Windows Media Player Extension for HTML5) - C:\Users\steve\AppData\Local\Google\Chrome\User Data\Default\Extensions\hokdglbhghcebcopdbanieangmcamaak [2013-10-08] CHR Extension: (ShiftEdit) - C:\Users\steve\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcgmndephhjcabhhjfcmncnhbmgbkpij [2013-01-20] CHR Extension: (FVD Downloader) - C:\Users\steve\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfmhcpmkbdkbgbmkjoiopeeegenkdikp [2013-09-24] CHR Extension: (qipu Cashbackmelder open beta) - C:\Users\steve\AppData\Local\Google\Chrome\User Data\Default\Extensions\mloigoojndlehdjiemdfpiikieonngel [2012-12-30] CHR Extension: (Google Wallet) - C:\Users\steve\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23] CHR Extension: (Extended Protection) - C:\Users\steve\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogfjmhfnldnajmfaofeiaepghjenbgjo [2014-03-30] CHR HKLM-x32\...\Chrome\Extension: [dopemniaeocfenlpnoannaefnhfcjcgi] - C:\Users\steve\AppData\Local\Google\Chrome\User Data\Default\Extensions\searchswitch.crx [2014-03-30] CHR HKLM-x32\...\Chrome\Extension: [ogfjmhfnldnajmfaofeiaepghjenbgjo] - C:\Users\steve\AppData\Local\Google\Chrome\User Data\Default\Extensions\ep.crx [2014-03-30] ==================== Services (Whitelisted) ================= R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG) S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1017424 2014-02-20] (Avira Operations GmbH & Co. KG) R2 EpsonScanSvc; C:\Windows\system32\EscSvc64.exe [135824 2011-12-12] (Seiko Epson Corporation) R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] () R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165144 2012-05-10] (Intel Corporation) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-03-05] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [857912 2014-03-05] (Malwarebytes Corporation) R2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27792 2012-08-03] (VIA Technologies, Inc.) ==================== Drivers (Whitelisted) ==================== R3 AnyDVD; C:\Windows\System32\Drivers\AnyDVD.sys [138400 2012-08-26] (SlySoft, Inc.) R3 AnyDVD; C:\Windows\SysWOW64\Drivers\AnyDVD.sys [138400 2012-08-26] (SlySoft, Inc.) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG) R3 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2012-09-02] (DT Soft Ltd) U5 ew_hwusbdev; C:\Windows\System32\Drivers\ew_hwusbdev.sys [117248 2010-07-27] (Huawei Technologies Co., Ltd.) R3 L1C; C:\Windows\System32\DRIVERS\L1C62x64.sys [104560 2012-04-25] (Qualcomm Atheros Co., Ltd.) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-03-05] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2014-04-03] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63192 2014-03-05] (Malwarebytes Corporation) S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.) S4 sptd; C:\Windows\System32\Drivers\sptd.sys [560184 2013-04-03] (Duplex Secure Ltd.) R3 VUSB3HUB; C:\Windows\System32\DRIVERS\ViaHub3.sys [205312 2012-01-20] (VIA Technologies, Inc.) R3 xhcdrv; C:\Windows\System32\DRIVERS\xhcdrv.sys [254464 2012-01-20] (VIA Technologies, Inc.) S3 catchme; \??\C:\ComboFix\catchme.sys [X] S3 cpuz135; \??\C:\Windows\TEMP\cpuz135\cpuz135_x64.sys [X] S3 gdrv; \??\C:\Windows\gdrv.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-04-03 17:53 - 2014-04-03 17:53 - 00987442 _____ () C:\Users\steve\Downloads\SecurityCheck.exe 2014-04-03 16:55 - 2014-04-03 16:55 - 00000000 ____D () C:\Program Files (x86)\ESET 2014-04-03 00:56 - 2014-04-03 00:56 - 00000000 ____D () C:\Windows\ERUNT 2014-04-03 00:54 - 2014-04-03 00:55 - 00001518 _____ () C:\Users\steve\Desktop\AdwCleaner[S0].txt 2014-04-03 00:50 - 2014-04-03 00:51 - 00000000 ____D () C:\AdwCleaner 2014-04-03 00:49 - 2014-04-03 00:49 - 01426178 _____ () C:\Users\steve\Desktop\adwcleaner.exe 2014-04-03 00:49 - 2014-04-03 00:49 - 01038974 _____ (Thisisu) C:\Users\steve\Desktop\JRT.exe 2014-04-01 20:02 - 2014-04-01 20:02 - 00022136 _____ () C:\Users\steve\Desktop\ComboFix2.txt 2014-04-01 18:47 - 2014-04-01 18:58 - 00032693 _____ () C:\Users\steve\Desktop\mbam.txt 2014-04-01 18:46 - 2014-04-01 18:57 - 00001948 _____ () C:\Users\steve\Desktop\GMER.log 2014-04-01 18:32 - 2014-04-01 18:57 - 00034665 _____ () C:\Users\steve\Desktop\Addition.txt 2014-04-01 18:31 - 2014-04-03 17:56 - 00018080 _____ () C:\Users\steve\Desktop\FRST.txt 2014-04-01 18:31 - 2014-04-03 17:56 - 00000000 ____D () C:\FRST 2014-04-01 18:25 - 2014-04-01 18:56 - 00000584 _____ () C:\Users\steve\Desktop\defogger_disable.log 2014-04-01 18:25 - 2014-04-01 18:25 - 02157056 _____ (Farbar) C:\Users\steve\Desktop\FRST64.exe 2014-04-01 18:25 - 2014-04-01 18:25 - 00050477 _____ () C:\Users\steve\Desktop\Defogger.exe 2014-04-01 18:25 - 2014-04-01 18:25 - 00000020 _____ () C:\Users\steve\defogger_reenable 2014-04-01 18:24 - 2014-04-01 18:24 - 00380416 _____ () C:\Users\steve\Desktop\gup35mqd.exe 2014-04-01 07:52 - 2014-04-01 07:52 - 00001605 _____ () C:\Users\steve\Desktop\TB.txt 2014-03-31 22:57 - 2014-03-31 22:57 - 00022172 _____ () C:\Users\steve\Desktop\ComboFix.txt 2014-03-31 22:53 - 2014-03-31 22:57 - 00000000 ____D () C:\Qoobox 2014-03-31 22:53 - 2014-03-31 22:56 - 00000000 ____D () C:\Windows\erdnt 2014-03-31 22:53 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe 2014-03-31 22:53 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe 2014-03-31 22:53 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2014-03-31 22:53 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2014-03-31 22:53 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2014-03-31 22:53 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe 2014-03-31 22:53 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe 2014-03-31 22:53 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe 2014-03-31 20:34 - 2014-03-31 20:34 - 05192353 ____R (Swearware) C:\Users\steve\Desktop\ComboFix.exe 2014-03-30 22:24 - 2014-04-01 06:52 - 00053392 _____ () C:\Windows\PFRO.log 2014-03-30 22:11 - 2014-04-03 16:58 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-03-30 21:57 - 2014-03-30 21:57 - 00001228 _____ () C:\Users\steve\Desktop\Revo Uninstaller.lnk 2014-03-30 21:57 - 2014-03-30 21:57 - 00001066 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-03-30 21:57 - 2014-03-30 21:57 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-03-30 21:57 - 2014-03-30 21:57 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group 2014-03-30 21:57 - 2014-03-30 21:57 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-03-30 21:57 - 2014-03-05 09:26 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-03-30 21:57 - 2014-03-05 09:26 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-03-30 21:57 - 2014-03-05 09:26 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-03-30 21:50 - 2014-03-30 21:50 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\steve\Downloads\mbam-setup-2.0.0.1000.exe 2014-03-27 19:16 - 2014-03-27 23:26 - 457173402 _____ () C:\Users\steve\Downloads\s1619.rar 2014-03-13 17:30 - 2014-03-01 08:05 - 23133696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-03-13 17:30 - 2014-03-01 07:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-03-13 17:30 - 2014-03-01 07:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-03-13 17:30 - 2014-03-01 06:58 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-03-13 17:30 - 2014-03-01 06:52 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-03-13 17:30 - 2014-03-01 06:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-03-13 17:30 - 2014-03-01 06:42 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-03-13 17:30 - 2014-03-01 06:40 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-03-13 17:30 - 2014-03-01 06:37 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-03-13 17:30 - 2014-03-01 06:33 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-03-13 17:30 - 2014-03-01 06:33 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-03-13 17:30 - 2014-03-01 06:32 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-03-13 17:30 - 2014-03-01 06:30 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-03-13 17:30 - 2014-03-01 06:23 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-03-13 17:30 - 2014-03-01 06:17 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-03-13 17:30 - 2014-03-01 06:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-03-13 17:30 - 2014-03-01 06:02 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-03-13 17:30 - 2014-03-01 05:54 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-03-13 17:30 - 2014-03-01 05:52 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-03-13 17:30 - 2014-03-01 05:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-03-13 17:30 - 2014-03-01 05:47 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-03-13 17:30 - 2014-03-01 05:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-03-13 17:30 - 2014-03-01 05:43 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-03-13 17:30 - 2014-03-01 05:42 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-03-13 17:30 - 2014-03-01 05:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-03-13 17:30 - 2014-03-01 05:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-03-13 17:30 - 2014-03-01 05:37 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-03-13 17:30 - 2014-03-01 05:35 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-03-13 17:30 - 2014-03-01 05:18 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-03-13 17:30 - 2014-03-01 05:16 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-03-13 17:30 - 2014-03-01 05:14 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-03-13 17:30 - 2014-03-01 05:10 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-03-13 17:30 - 2014-03-01 05:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-03-13 17:30 - 2014-03-01 05:00 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-03-13 17:30 - 2014-03-01 04:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-03-13 17:30 - 2014-03-01 04:38 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-03-13 17:30 - 2014-03-01 04:32 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-03-13 17:30 - 2014-03-01 04:27 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-03-13 17:30 - 2014-03-01 04:25 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-03-13 17:30 - 2014-03-01 04:25 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-03-13 17:30 - 2014-02-07 03:23 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-03-13 17:30 - 2014-01-29 04:32 - 00484864 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll 2014-03-13 17:30 - 2014-01-29 04:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll 2014-03-13 17:30 - 2014-01-28 04:32 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll 2014-03-13 17:29 - 2014-02-04 04:32 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2014-03-13 17:29 - 2014-02-04 04:32 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll 2014-03-13 17:29 - 2014-02-04 04:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll 2014-03-13 17:29 - 2014-02-04 04:04 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll ==================== One Month Modified Files and Folders ======= 2014-04-03 17:56 - 2014-04-01 18:31 - 00018080 _____ () C:\Users\steve\Desktop\FRST.txt 2014-04-03 17:56 - 2014-04-01 18:31 - 00000000 ____D () C:\FRST 2014-04-03 17:53 - 2014-04-03 17:53 - 00987442 _____ () C:\Users\steve\Downloads\SecurityCheck.exe 2014-04-03 17:33 - 2012-08-31 14:32 - 00001128 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2280969488-2109145150-2365161803-1000UA.job 2014-04-03 16:58 - 2014-03-30 22:11 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-04-03 16:58 - 2009-07-14 06:45 - 00021872 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-04-03 16:58 - 2009-07-14 06:45 - 00021872 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-04-03 16:56 - 2011-04-12 09:43 - 00699416 _____ () C:\Windows\system32\perfh007.dat 2014-04-03 16:56 - 2011-04-12 09:43 - 00149556 _____ () C:\Windows\system32\perfc007.dat 2014-04-03 16:56 - 2009-07-14 07:13 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-04-03 16:55 - 2014-04-03 16:55 - 00000000 ____D () C:\Program Files (x86)\ESET 2014-04-03 16:55 - 2012-10-31 19:35 - 00000000 ____D () C:\ProgramData\Sonos,_Inc 2014-04-03 16:54 - 2013-12-31 11:48 - 00000000 ____D () C:\Users\steve\AppData\Roaming\TS3Client 2014-04-03 16:54 - 2012-08-31 18:03 - 00000000 ___RD () C:\Users\steve\Dropbox 2014-04-03 16:54 - 2012-08-31 18:00 - 00000000 ____D () C:\Users\steve\AppData\Roaming\Dropbox 2014-04-03 16:54 - 2012-08-31 17:57 - 00000000 ____D () C:\Program Files (x86)\Steam 2014-04-03 16:54 - 2012-08-31 14:05 - 01608135 _____ () C:\Windows\WindowsUpdate.log 2014-04-03 16:54 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\system32\FxsTmp 2014-04-03 16:50 - 2014-02-28 21:56 - 00001288 _____ () C:\Windows\setupact.log 2014-04-03 16:50 - 2012-08-31 14:41 - 00000000 ____D () C:\ProgramData\NVIDIA 2014-04-03 16:50 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-04-03 00:56 - 2014-04-03 00:56 - 00000000 ____D () C:\Windows\ERUNT 2014-04-03 00:55 - 2014-04-03 00:54 - 00001518 _____ () C:\Users\steve\Desktop\AdwCleaner[S0].txt 2014-04-03 00:51 - 2014-04-03 00:50 - 00000000 ____D () C:\AdwCleaner 2014-04-03 00:51 - 2012-08-31 14:32 - 00001076 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2280969488-2109145150-2365161803-1000Core.job 2014-04-03 00:49 - 2014-04-03 00:49 - 01426178 _____ () C:\Users\steve\Desktop\adwcleaner.exe 2014-04-03 00:49 - 2014-04-03 00:49 - 01038974 _____ (Thisisu) C:\Users\steve\Desktop\JRT.exe 2014-04-01 22:32 - 2012-09-06 14:42 - 00000000 ____D () C:\Users\steve\Documents\Outlook-Dateien 2014-04-01 21:16 - 2012-09-08 08:22 - 00000000 ____D () C:\Users\steve\AppData\Local\A19D0D92-E506-4870-A46E-0FC261FF6DC1.aplzod 2014-04-01 20:02 - 2014-04-01 20:02 - 00022136 _____ () C:\Users\steve\Desktop\ComboFix2.txt 2014-04-01 18:58 - 2014-04-01 18:47 - 00032693 _____ () C:\Users\steve\Desktop\mbam.txt 2014-04-01 18:57 - 2014-04-01 18:46 - 00001948 _____ () C:\Users\steve\Desktop\GMER.log 2014-04-01 18:57 - 2014-04-01 18:32 - 00034665 _____ () C:\Users\steve\Desktop\Addition.txt 2014-04-01 18:56 - 2014-04-01 18:25 - 00000584 _____ () C:\Users\steve\Desktop\defogger_disable.log 2014-04-01 18:25 - 2014-04-01 18:25 - 02157056 _____ (Farbar) C:\Users\steve\Desktop\FRST64.exe 2014-04-01 18:25 - 2014-04-01 18:25 - 00050477 _____ () C:\Users\steve\Desktop\Defogger.exe 2014-04-01 18:25 - 2014-04-01 18:25 - 00000020 _____ () C:\Users\steve\defogger_reenable 2014-04-01 18:25 - 2012-08-31 14:05 - 00000000 ____D () C:\Users\steve 2014-04-01 18:24 - 2014-04-01 18:24 - 00380416 _____ () C:\Users\steve\Desktop\gup35mqd.exe 2014-04-01 07:52 - 2014-04-01 07:52 - 00001605 _____ () C:\Users\steve\Desktop\TB.txt 2014-04-01 06:52 - 2014-03-30 22:24 - 00053392 _____ () C:\Windows\PFRO.log 2014-03-31 22:57 - 2014-03-31 22:57 - 00022172 _____ () C:\Users\steve\Desktop\ComboFix.txt 2014-03-31 22:57 - 2014-03-31 22:53 - 00000000 ____D () C:\Qoobox 2014-03-31 22:57 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default 2014-03-31 22:56 - 2014-03-31 22:53 - 00000000 ____D () C:\Windows\erdnt 2014-03-31 22:56 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini 2014-03-31 20:34 - 2014-03-31 20:34 - 05192353 ____R (Swearware) C:\Users\steve\Desktop\ComboFix.exe 2014-03-30 22:24 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\addins 2014-03-30 22:24 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PLA 2014-03-30 21:57 - 2014-03-30 21:57 - 00001228 _____ () C:\Users\steve\Desktop\Revo Uninstaller.lnk 2014-03-30 21:57 - 2014-03-30 21:57 - 00001066 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-03-30 21:57 - 2014-03-30 21:57 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-03-30 21:57 - 2014-03-30 21:57 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group 2014-03-30 21:57 - 2014-03-30 21:57 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-03-30 21:50 - 2014-03-30 21:50 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\steve\Downloads\mbam-setup-2.0.0.1000.exe 2014-03-30 21:00 - 2012-09-11 12:40 - 00000000 ____D () C:\Users\steve\Downloads\JDownloader 2014-03-29 18:21 - 2013-02-12 14:31 - 00001907 _____ () C:\Users\Public\Desktop\Sonos.lnk 2014-03-29 18:21 - 2012-10-31 19:35 - 00000000 ____D () C:\Program Files (x86)\Sonos 2014-03-29 18:20 - 2012-10-31 19:35 - 00000000 ____D () C:\Users\steve\AppData\Local\Downloaded Installations 2014-03-27 23:26 - 2014-03-27 19:16 - 457173402 _____ () C:\Users\steve\Downloads\s1619.rar 2014-03-24 23:28 - 2012-08-31 14:32 - 00004102 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2280969488-2109145150-2365161803-1000UA 2014-03-24 23:28 - 2012-08-31 14:32 - 00003706 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2280969488-2109145150-2365161803-1000Core 2014-03-19 02:06 - 2012-09-06 14:36 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-03-17 18:18 - 2013-03-13 23:48 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2014-03-17 18:18 - 2013-03-13 23:48 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight 2014-03-17 18:18 - 2009-07-14 06:45 - 05075608 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-03-13 17:31 - 2013-12-31 11:48 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client 2014-03-05 09:26 - 2014-03-30 21:57 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-03-05 09:26 - 2014-03-30 21:57 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-03-05 09:26 - 2014-03-30 21:57 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-03-04 23:31 - 2013-05-24 14:42 - 01593956 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI Some content of TEMP: ==================== C:\Users\steve\AppData\Local\Temp\avgnt.exe C:\Users\steve\AppData\Local\Temp\Quarantine.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-03-30 15:22 ==================== End Of Log ============================ --- --- --- |
|
04.04.2014, 11:36
| #9 |
| /// the machine /// TB-Ausbilder | WProtectManager unter ProgramData und 337-Games in der Startleiste Fertig Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu WProtectManager unter ProgramData und 337-Games in der Startleiste |
| aartemis, aartemis entfernen, adware, adware/adware.gen2, anti-malware, malwarebytes, nicht mehr, probleme, pup.optional.aartemis, pup.optional.aartemis.a, pup.optional.iepluginservice.a, pup.optional.installcore.a, pup.optional.qone8, pup.optional.quickstart.a, pup.optional.suptab.a, pup.optional.wpmanager, pup.optional.wpmanager.a, update.exe, virusverdacht, wprotectmanager |
