| |
| |||||||
Log-Analyse und Auswertung: Bankdaten ausgespät, Trojaner entfernenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
10.06.2014, 13:02
| #1 | |||
| |  Bankdaten ausgespät, Trojaner entfernen Hallo, am Samstag wurde mir durch meine Bank mitgeteilt, das ich einen Trojaner auf meinem Laptop haben soll und daraufhin mein Online-Banking gesperrt. Ich solle den Trojaner entfernen bzw. entfernen lassen. Leider habe ich keinen Zugriff mehr auf Antivir. Meldung: Dieses Programm wurde durch eine Gruppenrichtlinie blockiert. Weitere Infos erhalten Sie vom Systemadmin. (Bin selbst als Admin eingetragen.) Deinstallieren ist nicht möglich, dort kommt folgende Meldung: Sie verfügen nicht über ausreichnende Berechtigungen, Um Avira zu deinstallieren. Wenden Sie sich an den Systemadministrator. Habe Defogger, FRST und GMER durchgeführt und hänge diese jetzt an. Defogger hat keine Log erstellt: Zitat:
Zitat:
Zitat:
|
|
10.06.2014, 13:36
| #2 |
| /// the machine /// TB-Ausbilder    | Bankdaten ausgespät, Trojaner entfernen hi,
__________________ So funktioniert es:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter HKLM Group Policy restriction on software: C:\Program Files\Avira <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Microsoft Security Client <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Adware & Co. deinstallieren
Solltest Du ein Programm nicht finden oder nicht deinstallieren können, mache bitte mit dem nächsten Schritt weiter: Scan mit Combofix
__________________ |
|
10.06.2014, 14:44
| #3 |
| | Bankdaten ausgespät, Trojaner entfernen FRST Logfile:
__________________FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:09-06-2014 03 Ran by Anke (administrator) on ANKE-PC on 10-06-2014 14:59:00 Running from C:\Users\Anke\Downloads Platform: Microsoft Windows 7 Home Premium (X86) OS Language: German Standard Internet Explorer Version 9 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe () C:\Program Files\Samsung\Samsung Update Plus\SUPBackGround.exe (Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe (Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe (DoctorSoft) C:\Program Files\AnyPC Client\APLanMgrC.exe (SAMSUNG Electronics) C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Teruten) C:\Windows\System32\FsUsbExService.Exe (SEC) C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe (Deutsche Telekom AG) C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe () C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe (Ralink Technology, Corp.) C:\Program Files\Ralink\Common\RaRegistry.exe () C:\Program Files\CyberLink\Shared files\RichVideo.exe () C:\Users\Anke\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe (Intel Corporation) C:\Windows\System32\igfxext.exe (Intel Corporation) C:\Windows\System32\igfxsrvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe () C:\Program Files\Phoenix Technologies Ltd\FailSafe\FailSafeNotifier.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (CyberLink Corp.) C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe (Google Inc.) C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Samsung) C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe (Samsung) C:\Program Files\Samsung\Kies\Kies.exe (Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Ralink Technology, Corp.) C:\Program Files\Ralink\Common\RaUI.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_clipbook.exe (Microsoft Corporation) C:\Windows\System32\wuauclt.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [fsn] => C:\Program Files\Phoenix Technologies Ltd\FailSafe\FailSafeNotifier.exe [137792 2010-04-26] () HKLM\...\Run: [UpdateLBPShortCut] => C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.) HKLM\...\Run: [UpdateP2GoShortCut] => C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.) HKLM\...\Run: [UpdatePPShortCut] => C:\Program Files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.) HKLM\...\Run: [UpdatePSTShortCut] => C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe [210216 2009-07-21] (CyberLink Corp.) HKLM\...\Run: [UCam_Menu] => C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.) HKLM\...\Run: [PDVD8LanguageShortcut] => C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe [50472 2009-04-15] (CyberLink Corp.) HKLM\...\Run: [RemoteControl8] => C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe [91432 2009-04-15] (CyberLink Corp.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [8120864 2009-12-14] (Realtek Semiconductor) HKLM\...\Run: [Ocs_SM] => C:\Users\Anke\AppData\Roaming\OCS\SM\SearchAnonymizer.exe [106496 2012-08-10] (OCS) HKLM\...\Run: [UpdatePDRShortCut] => C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe [222504 2008-01-04] (CyberLink Corp.) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1713448 2010-02-26] (Synaptics Incorporated) HKLM\...\Run: [Windows Mobile Device Center] => C:\windows\WindowsMobile\wmdc.exe [648072 2007-05-31] (Microsoft Corporation) HKLM\...\Run: [] => [X] HKLM\...\Run: [KiesTrayAgent] => C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [311152 2013-07-26] (Samsung Electronics Co., Ltd.) HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [737872 2014-05-22] (Avira Operations GmbH & Co. KG) HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation) HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [951576 2014-03-11] (Microsoft Corporation) HKLM Group Policy restriction on software: C:\Program Files\Avira <====== ATTENTION HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION HKLM Group Policy restriction on software: C:\Program Files\Microsoft Security Client <====== ATTENTION HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [Facebook Update] => C:\Users\Anke\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-07-15] (Facebook Inc.) HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [RemoteControl8] => C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe [91432 2009-04-15] (CyberLink Corp.) HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [PDVD8LanguageShortcut] => C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe [50472 2009-04-15] (CyberLink Corp.) HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [swg] => C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2009-12-05] (Google Inc.) HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [KiesPDLR] => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844656 2013-07-26] (Samsung) HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [KiesPreload] => C:\Program Files\Samsung\Kies\Kies.exe [1564016 2013-07-26] (Samsung) HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [] => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844656 2013-07-26] (Samsung) HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\MountPoints2: {1239e2fa-b05f-11e0-9ffc-002454e4b71c} - F:\AutoRun.exe HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\MountPoints2: {1239e33a-b05f-11e0-9ffc-002454e4b71c} - F:\AutoRun.exe HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\MountPoints2: {1239e37d-b05f-11e0-9ffc-002454e4b71c} - F:\AutoRun.exe HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\MountPoints2: {6d985358-73cd-11e3-a05a-002454e4b71c} - F:\SETUP.EXE HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\MountPoints2: {a8e64919-ae4a-11e0-aafd-002454e4b71c} - F:\AutoRun.exe HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\MountPoints2: {a8e6494c-ae4a-11e0-aafd-002454e4b71c} - F:\AutoRun.exe Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Ralink Wireless Utility.lnk ShortcutTarget: Ralink Wireless Utility.lnk -> C:\Program Files\Ralink\Common\RaUI.exe (Ralink Technology, Corp.) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=smsn&bmod=smsn HKCU\Software\Microsoft\Internet Explorer\Main,ICQ Search = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = https://www.facebook.com/ URLSearchHook: HKLM - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046} URLSearchHook: HKLM - (No Name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - No File URLSearchHook: HKCU - UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) URLSearchHook: HKCU - Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.) SearchScopes: HKLM - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=101&systemid=406&sr=0&q={searchTerms} SearchScopes: HKCU - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.de/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN_deDE376DE376 SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com.anonymize-me.de/?anonymto=687474703A2F2F7777772E62696E672E636F6D2F7365617263683F713D7B7365617263685465726D737D267372633D49452D536561726368426F7826464F524D3D494538535243&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&k=0 SearchScopes: HKCU - {291FBCDC-92E5-427D-A712-1449AF5758F0} URL = hxxp://www.pricerunner.de.anonymize-me.de/?to=707269636572756E6E65722E6465&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0 SearchScopes: HKCU - {3626E536-84F8-41F2-ABE8-D7A21962E6BD} URL = hxxp://www.amazon.de.anonymize-me.de/?to=616D617A6F6E2E6465&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0 SearchScopes: HKCU - {43E73F3A-F350-48D0-8BEE-9B93B9514929} URL = hxxp://search.ebay.de.anonymize-me.de/?to=656261792E6465&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0 SearchScopes: HKCU - {615D6B1F-D615-4511-B82F-6873B8E04546} URL = hxxp://go.web.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8 SearchScopes: HKCU - {6552C7DD-90A4-4387-B795-F8F96747DE19} URL = hxxp://search.icq.com.anonymize-me.de/?anonymto=687474703A2F2F7365617263682E6963712E636F6D2F7365617263682F726573756C74732E7068703F713D7B7365617263685465726D737D2663685F69643D6F7364&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&k=0 SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.de/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN_deDE376DE376 SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com.anonymize-me.de/?anonymto=687474703A2F2F7777772E676F6F676C652E636F6D2F7365617263683F713D7B7365617263685465726D737D26726C733D636F6D2E6D6963726F736F66743A7B6C616E67756167657D3A7B72656665727265723A736F757263653F7D2669653D7B696E707574456E636F64696E677D266F653D7B6F7574707574456E636F64696E677D26736F7572636569643D696537&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&k=0 SearchScopes: HKCU - {7A33B853-20BD-44F1-8EA3-4C4F0DAEDF61} URL = hxxp://go.mail.com/tb/en-us/ie_searchplugin/?q={searchTerms}&enc=UTF-8 SearchScopes: HKCU - {8246A879-D4B8-4767-A85B-3E1C7CE09E0F} URL = hxxp://www.otto.de.anonymize-me.de/?to=6F74746F2E6465&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0 SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com.anonymize-me.de/?anonymto=687474703A2F2F6474732E7365617263682D726573756C74732E636F6D2F73723F7372633D6965622661707069643D3130312673797374656D69643D3430362673723D3026713D7B7365617263685465726D737D&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&k=0 SearchScopes: HKCU - {A77A1A9D-84E7-4CFC-B52C-856B0FDC714B} URL = hxxp://go.gmx.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8 SearchScopes: HKCU - {B7346A11-27AB-450F-8B41-857F3FA50296} URL = hxxp://www.myvideo.de.anonymize-me.de/?to=6D79766964656F2E6465&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0 SearchScopes: HKCU - {D3381FF7-E6DD-4B70-992E-B66611B65949} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8 SearchScopes: HKCU - {FA3102A5-D4D7-446A-877C-4EBFCF469E71} URL = hxxp://de.wikipedia.org.anonymize-me.de/?to=64652E77696B6970656469612E6F7267&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0 BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.) BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.) BHO: Mein Gutscheincode Finder zeigt automatisch Shopping-Gutscheine an mit denen Sie beim Online-Einkauf sparen können. - {1ED16E0A-E8C4-40A0-8BC2-79485D21F796} - C:\Program Files\Mein Gutscheincode Finder\Internet Explorer\x86\ConversionOneIE.dll (Conversion One GmbH) BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc) BHO: ICQ Sparberater - {FE163F11-1919-4257-A280-FF5AF8DAEECB} - No File BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.) Toolbar: HKLM - No Name - {DFEFCDEE-CF1A-4FC8-89AF-189327213627} - No File Toolbar: HKLM - Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.) Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Toolbar: HKCU - No Name - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - No File Toolbar: HKCU - Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) Toolbar: HKCU - No Name - {C424171E-592A-415A-9EB1-DFD6D95D3530} - No File DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab DPF: {902CCC37-E74D-49F0-8C10-5F10151BE923} hxxp://www.flexwatch.com/app_link/download/SmartViewer.cab DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default FF DefaultSearchEngine: Google FF SearchEngineOrder.1: Ask.com FF SelectedSearchEngine: Google FF Homepage: hxxp://www.flightradar24.com/53.27,7.18/10|https://www.google.de/ FF NetworkProxy: "type", 0 FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF32_13_0_0_214.dll () FF Plugin: @adobe.com/ShockwavePlayer - C:\windows\system32\Adobe\Director\np32dsw_1203133.dll (Adobe Systems, Inc.) FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin: @oberon-media.com/ONCAdapter - C:\Program Files\Common Files\Oberon Media\NCAdapter\1.0.0.8\npapicomadapter.dll (Oberon-Media ) FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @veetle.com/veetleCorePlugin,version=0.9.18 - C:\Program Files\Veetle\plugins\npVeetle.dll (Veetle Inc) FF Plugin: @veetle.com/veetlePlayerPlugin,version=0.9.18 - C:\Program Files\Veetle\Player\npvlc.dll (Veetle Inc) FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Anke\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited) FF Plugin HKCU: @yahoo.com/BrowserPlus,version=2.9.8 - C:\Users\Anke\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll (Yahoo! Inc.) FF user.js: detected! => C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\user.js FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\askcom.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-1.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-10.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-11.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-12.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-13.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-14.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-15.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-16.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-17.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-18.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-19.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-2.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-20.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-21.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-22.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-3.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-4.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-5.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-6.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-7.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-8.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-9.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin.gif FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin.src FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\searchplugins-backup FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\Search_Results.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\{815A4F63-B897-442D-9F2D-90F99FF6FE0A}.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\{96FD8767-6827-4D9B-AC7B-3CA21566B5B2}.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\{D644E5AF-3CEF-46E9-8330-BDF49F489C9C}.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: Avira SearchFree Toolbar plus Web Protection - C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\Extensions\toolbar@ask.com [2012-10-16] FF Extension: toolplugin - C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\Extensions\welcome@toolmin.com [2011-11-02] FF Extension: YouTube Unblocker - C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\Extensions\youtubeunblocker@unblocker.yt [2014-03-23] FF Extension: ICQ Toolbar - C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\Extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2012-07-28] FF Extension: ICQ Sparberater - C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\Extensions\ciuvo-extension@icq.de.xpi [2011-10-05] FF Extension: Google Search by Image - C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\Extensions\google@hitachi.com.xpi [2012-08-10] FF Extension: Adblock Plus - C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-01-27] FF Extension: preisspion.de - C:\Program Files\Mein Gutscheincode Finder\Firefox [2011-07-13] FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2014-02-23] FF HKCU\...\Firefox\Extensions: [finder@meingutscheincode.de] - C:\Program Files\Mein Gutscheincode Finder\Firefox FF Extension: preisspion.de - C:\Program Files\Mein Gutscheincode Finder\Firefox [2011-07-13] FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2014-02-23] Chrome: ======= CHR HomePage: hxxp://www.google.com/ CHR StartupUrls: "hxxp://www.google.com/" CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\34.0.1847.116\PepperFlash\pepflashplayer.dll No File CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\34.0.1847.116\ppGoogleNaClPluginChrome.dll No File CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\34.0.1847.116\pdf.dll No File CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll No File CHR Plugin: (Java Deployment Toolkit 6.0.300.12) - C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll (Sun Microsystems, Inc.) CHR Plugin: (Java(TM) Platform SE 6 U30) - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) CHR Plugin: (Oberon com adapter) - C:\Program Files\Common Files\Oberon Media\NCAdapter\1.0.0.8\npapicomadapter.dll (Oberon-Media ) CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) CHR Plugin: (Veetle TV Player) - C:\Program Files\Veetle\Player\npvlc.dll (Veetle Inc) CHR Plugin: (Veetle TV Core) - C:\Program Files\Veetle\plugins\npVeetle.dll (Veetle Inc) CHR Plugin: (Windows Live® Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) CHR Plugin: (Facebook Video Calling Plugin) - C:\Users\Anke\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited) CHR Plugin: (BrowserPlus (from Yahoo!) v2.9.8) - C:\Users\Anke\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll (Yahoo! Inc.) CHR Plugin: (Shockwave Flash) - C:\windows\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll No File CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File CHR Extension: (YouTube) - C:\Users\Anke\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-12-02] CHR Extension: (Google-Suche) - C:\Users\Anke\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-12-02] CHR Extension: (preisspion.de) - C:\Users\Anke\AppData\Local\Google\Chrome\User Data\Default\Extensions\jgfpelakfkbbkkdchaaaknckhoadkcbo [2012-12-02] CHR Extension: (Google Wallet) - C:\Users\Anke\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-22] CHR Extension: (Google Mail) - C:\Users\Anke\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-12-02] CHR HKLM\...\Chrome\Extension: [jgfpelakfkbbkkdchaaaknckhoadkcbo] - C:\Program Files\Mein Gutscheincode Finder\Chrome\chrome-extension.crx [2011-07-13] ========================== Services (Whitelisted) ================= R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-05-22] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-05-22] (Avira Operations GmbH & Co. KG) R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe [1039952 2014-05-22] (Avira Operations GmbH & Co. KG) R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation) R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22216 2014-03-11] (Microsoft Corporation) R2 Net Driver HPZ12; C:\windows\system32\HPZinw12.dll [44032 2010-08-06] (Hewlett-Packard) [File not signed] R2 Netzmanager Service; C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe [2635776 2012-07-20] (Deutsche Telekom AG) [File not signed] S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [279776 2014-03-11] (Microsoft Corporation) R2 OberonGameConsoleService; C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe [44312 2009-08-13] () R2 Pml Driver HPZ12; C:\windows\system32\HPZipm12.dll [53760 2010-08-06] (Hewlett-Packard) [File not signed] R2 RalinkRegistryWriter; C:\Program Files\Ralink\Common\RaRegistry.exe [374112 2010-11-11] (Ralink Technology, Corp.) S3 RaMediaServer; C:\Program Files\Ralink\Common\RaMediaServer.exe [619872 2010-12-31] () R2 RichVideo; C:\Program Files\CyberLink\Shared files\RichVideo.exe [247152 2009-07-07] () R2 SearchAnonymizer; C:\Users\Anke\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe [40960 2012-08-10] () [File not signed] ==================== Drivers (Whitelisted) ==================== R2 avgntflt; C:\windows\System32\DRIVERS\avgntflt.sys [93528 2014-04-29] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\windows\System32\DRIVERS\avipbb.sys [136216 2014-04-29] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\windows\System32\DRIVERS\avkmgr.sys [37352 2014-01-07] (Avira Operations GmbH & Co. KG) R2 avnetflt; C:\windows\System32\DRIVERS\avnetflt.sys [69240 2014-01-07] (Avira Operations GmbH & Co. KG) R1 dtsoftbus01; C:\windows\System32\DRIVERS\dtsoftbus01.sys [243128 2014-01-02] (Disc Soft Ltd) R3 FsUsbExDisk; C:\windows\system32\FsUsbExDisk.SYS [36608 2010-06-14] () [File not signed] R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-06-10] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [51928 2014-05-12] (Malwarebytes Corporation) R0 MpFilter; C:\windows\System32\DRIVERS\MpFilter.sys [231960 2014-01-25] (Microsoft Corporation) S3 netr28u; C:\windows\System32\DRIVERS\netr28u.sys [1174880 2010-12-28] (Ralink Technology Corp.) R1 ssmdrv; C:\windows\System32\DRIVERS\ssmdrv.sys [28520 2014-01-07] (Avira GmbH) S3 TelekomNM3; C:\Program Files\Netzmanager\NMInfraIS2\Driver\TelekomNM3.sys [35040 2010-09-16] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH) R3 yukonw7; C:\windows\System32\DRIVERS\yk62x86.sys [315392 2009-09-28] () S3 dg_ssudbus; system32\DRIVERS\ssudbus.sys [X] S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [X] S3 ew_usbenumfilter; system32\DRIVERS\ew_usbenumfilter.sys [X] S3 huawei_cdcacm; system32\DRIVERS\ew_jucdcacm.sys [X] S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X] S3 huawei_ext_ctrl; system32\DRIVERS\ew_juextctrl.sys [X] S3 huawei_wwanecm; system32\DRIVERS\ew_juwwanecm.sys [X] S3 massfilter; system32\drivers\massfilter.sys [X] S1 MpKslabc952c6; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{18B604BB-4DC4-400F-B83B-F427DB61300C}\MpKslabc952c6.sys [X] S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [X] S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [X] S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-06-10 14:58 - 2014-06-10 14:58 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Anke\Downloads\revosetup95.exe 2014-06-10 14:57 - 2014-06-10 14:57 - 00000589 _____ () C:\Users\Anke\Desktop\fixlist.txt 2014-06-10 14:05 - 2014-06-10 14:53 - 00110296 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys 2014-06-10 14:05 - 2014-06-10 14:05 - 00001024 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-06-10 14:05 - 2014-06-10 14:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-06-10 14:05 - 2014-06-10 14:05 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-06-10 14:05 - 2014-06-10 14:05 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2014-06-10 14:05 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys 2014-06-10 14:05 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys 2014-06-10 14:05 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys 2014-06-10 14:04 - 2014-06-10 14:04 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Anke\Downloads\mbam-setup-2.0.2.1012.exe 2014-06-10 13:46 - 2014-06-10 13:46 - 00002951 _____ () C:\Users\Anke\Desktop\gmer.log 2014-06-10 13:23 - 2014-06-10 13:23 - 00000242 _____ () C:\Users\Anke\Downloads\defogger_enable.log 2014-06-10 13:19 - 2014-06-10 13:19 - 00051480 _____ () C:\Users\Anke\Desktop\Addition.txt 2014-06-10 13:19 - 2014-06-10 13:19 - 00042947 _____ () C:\Users\Anke\Desktop\FRST.txt 2014-06-10 13:17 - 2014-06-10 13:17 - 00380416 _____ () C:\Users\Anke\Downloads\nhmwyhxd.exe 2014-06-10 13:11 - 2014-06-10 13:12 - 00051480 _____ () C:\Users\Anke\Downloads\Addition.txt 2014-06-10 13:10 - 2014-06-10 14:59 - 00033479 _____ () C:\Users\Anke\Downloads\FRST.txt 2014-06-10 13:10 - 2014-06-10 14:59 - 00000000 ____D () C:\FRST 2014-06-10 13:09 - 2014-06-10 13:09 - 01177600 _____ (Farbar) C:\Users\Anke\Downloads\FRST.exe 2014-06-10 13:08 - 2014-06-10 13:23 - 00000470 _____ () C:\Users\Anke\Downloads\defogger_disable.log 2014-06-10 13:08 - 2014-06-10 13:08 - 00000156 _____ () C:\Users\Anke\Desktop\defogger_reenable 2014-06-10 13:07 - 2014-06-10 13:07 - 00050477 _____ () C:\Users\Anke\Downloads\Defogger (1).exe 2014-06-10 13:02 - 2014-06-10 13:02 - 00139752 _____ () C:\Users\Rolf\AppData\Local\GDIPFONTCACHEV1.DAT 2014-06-10 13:02 - 2014-06-10 13:02 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Yahoo! 2014-06-10 13:02 - 2014-06-10 13:02 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Macromedia 2014-06-10 13:02 - 2014-06-10 13:02 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Google 2014-06-10 13:02 - 2014-06-10 13:02 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Adobe 2014-06-10 13:01 - 2014-06-10 13:01 - 00001373 _____ () C:\Users\Rolf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-06-10 12:58 - 2014-06-10 13:02 - 00000000 ____D () C:\Users\Rolf\AppData\Local\Google 2014-06-10 12:57 - 2014-06-10 13:04 - 00000000 ____D () C:\Users\Rolf\AppData\Local\Temp 2014-06-10 12:57 - 2014-06-10 13:02 - 00001130 _____ () C:\Users\Rolf\Desktop\CyberLink DVD Suite.lnk 2014-06-10 12:57 - 2014-06-10 13:02 - 00001079 _____ () C:\Users\Rolf\Desktop\CyberLink YouCam.lnk 2014-06-10 12:57 - 2014-06-10 13:02 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite 2014-06-10 12:57 - 2014-06-10 12:58 - 00000000 ____D () C:\Users\Rolf 2014-06-10 12:57 - 2014-06-10 12:57 - 00000020 ___SH () C:\Users\Rolf\ntuser.ini 2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\Startmenü 2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\Netzwerkumgebung 2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\Druckumgebung 2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\Documents\Eigene Musik 2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\Documents\Eigene Bilder 2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\AppData\Roaming\Microsoft\Windows\Start Menu\Programme 2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\AppData\Local\Verlauf 2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 ____D () C:\Users\Rolf\AppData\Local\VirtualStore 2014-06-10 12:57 - 2010-11-10 23:25 - 00000000 ____D () C:\Users\Rolf\AppData\Local\Microsoft Help 2014-06-10 12:57 - 2010-04-24 15:55 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink YouCam 2014-06-10 12:57 - 2009-07-14 06:42 - 00000000 ___RD () C:\Users\Rolf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories 2014-06-10 12:57 - 2009-07-14 06:37 - 00000000 ___RD () C:\Users\Rolf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance 2014-05-16 11:08 - 2014-05-16 11:08 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER ==================== One Month Modified Files and Folders ======= 2014-06-10 14:59 - 2014-06-10 13:10 - 00033479 _____ () C:\Users\Anke\Downloads\FRST.txt 2014-06-10 14:59 - 2014-06-10 13:10 - 00000000 ____D () C:\FRST 2014-06-10 14:59 - 2010-04-24 15:38 - 00000000 ____D () C:\Users\Anke\AppData\Local\Temp 2014-06-10 14:58 - 2014-06-10 14:58 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Anke\Downloads\revosetup95.exe 2014-06-10 14:57 - 2014-06-10 14:57 - 00000589 _____ () C:\Users\Anke\Desktop\fixlist.txt 2014-06-10 14:53 - 2014-06-10 14:05 - 00110296 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys 2014-06-10 14:52 - 2013-08-31 19:10 - 00000374 _____ () C:\windows\system32\Drivers\etc\hosts.ics 2014-06-10 14:52 - 2010-04-24 15:38 - 00000000 ____D () C:\Users\Anke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite 2014-06-10 14:50 - 2012-12-03 11:05 - 00018495 _____ () C:\windows\setupact.log 2014-06-10 14:50 - 2010-04-24 16:55 - 00001094 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-06-10 14:50 - 2009-07-14 06:53 - 00000006 ____H () C:\windows\Tasks\SA.DAT 2014-06-10 14:49 - 2012-12-16 11:56 - 04194830 _____ () C:\windows\PFRO.log 2014-06-10 14:49 - 2009-07-14 04:37 - 00000000 ____D () C:\windows\IME 2014-06-10 14:48 - 2009-12-05 04:40 - 01352990 _____ () C:\windows\WindowsUpdate.log 2014-06-10 14:25 - 2010-04-24 16:55 - 00001098 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-06-10 14:05 - 2014-06-10 14:05 - 00001024 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-06-10 14:05 - 2014-06-10 14:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-06-10 14:05 - 2014-06-10 14:05 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-06-10 14:05 - 2014-06-10 14:05 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2014-06-10 14:04 - 2014-06-10 14:04 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Anke\Downloads\mbam-setup-2.0.2.1012.exe 2014-06-10 14:01 - 2012-05-03 13:10 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job 2014-06-10 13:46 - 2014-06-10 13:46 - 00002951 _____ () C:\Users\Anke\Desktop\gmer.log 2014-06-10 13:23 - 2014-06-10 13:23 - 00000242 _____ () C:\Users\Anke\Downloads\defogger_enable.log 2014-06-10 13:23 - 2014-06-10 13:08 - 00000470 _____ () C:\Users\Anke\Downloads\defogger_disable.log 2014-06-10 13:23 - 2010-04-24 15:38 - 00000000 ____D () C:\Users\Anke 2014-06-10 13:19 - 2014-06-10 13:19 - 00051480 _____ () C:\Users\Anke\Desktop\Addition.txt 2014-06-10 13:19 - 2014-06-10 13:19 - 00042947 _____ () C:\Users\Anke\Desktop\FRST.txt 2014-06-10 13:17 - 2014-06-10 13:17 - 00380416 _____ () C:\Users\Anke\Downloads\nhmwyhxd.exe 2014-06-10 13:12 - 2014-06-10 13:11 - 00051480 _____ () C:\Users\Anke\Downloads\Addition.txt 2014-06-10 13:09 - 2014-06-10 13:09 - 01177600 _____ (Farbar) C:\Users\Anke\Downloads\FRST.exe 2014-06-10 13:08 - 2014-06-10 13:08 - 00000156 _____ () C:\Users\Anke\Desktop\defogger_reenable 2014-06-10 13:07 - 2014-06-10 13:07 - 00050477 _____ () C:\Users\Anke\Downloads\Defogger (1).exe 2014-06-10 13:04 - 2014-06-10 12:57 - 00000000 ____D () C:\Users\Rolf\AppData\Local\Temp 2014-06-10 13:02 - 2014-06-10 13:02 - 00139752 _____ () C:\Users\Rolf\AppData\Local\GDIPFONTCACHEV1.DAT 2014-06-10 13:02 - 2014-06-10 13:02 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Yahoo! 2014-06-10 13:02 - 2014-06-10 13:02 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Macromedia 2014-06-10 13:02 - 2014-06-10 13:02 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Google 2014-06-10 13:02 - 2014-06-10 13:02 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Adobe 2014-06-10 13:02 - 2014-06-10 12:58 - 00000000 ____D () C:\Users\Rolf\AppData\Local\Google 2014-06-10 13:02 - 2014-06-10 12:57 - 00001130 _____ () C:\Users\Rolf\Desktop\CyberLink DVD Suite.lnk 2014-06-10 13:02 - 2014-06-10 12:57 - 00001079 _____ () C:\Users\Rolf\Desktop\CyberLink YouCam.lnk 2014-06-10 13:02 - 2014-06-10 12:57 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite 2014-06-10 13:01 - 2014-06-10 13:01 - 00001373 _____ () C:\Users\Rolf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-06-10 12:58 - 2014-06-10 12:57 - 00000000 ____D () C:\Users\Rolf 2014-06-10 12:58 - 2009-07-26 22:06 - 01498742 _____ () C:\windows\system32\PerfStringBackup.INI 2014-06-10 12:57 - 2014-06-10 12:57 - 00000020 ___SH () C:\Users\Rolf\ntuser.ini 2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\Startmenü 2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\Netzwerkumgebung 2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\Druckumgebung 2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\Documents\Eigene Musik 2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\Documents\Eigene Bilder 2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\AppData\Roaming\Microsoft\Windows\Start Menu\Programme 2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\AppData\Local\Verlauf 2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 ____D () C:\Users\Rolf\AppData\Local\VirtualStore 2014-06-10 12:23 - 2011-10-16 18:08 - 00001112 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1871111397-3539990770-1974983793-1000Core.job 2014-06-10 12:18 - 2011-10-16 18:08 - 00001134 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1871111397-3539990770-1974983793-1000UA.job 2014-06-09 12:41 - 2009-07-14 06:34 - 00014512 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-06-09 12:41 - 2009-07-14 06:34 - 00014512 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-05-16 11:10 - 2010-04-24 15:45 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-05-16 11:08 - 2014-05-16 11:08 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER 2014-05-16 11:08 - 2013-08-12 09:43 - 00000000 ____D () C:\windows\system32\MRT 2014-05-16 11:02 - 2010-04-27 20:46 - 90547776 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe 2014-05-15 12:01 - 2012-05-03 13:10 - 00692400 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerApp.exe 2014-05-15 12:01 - 2011-07-24 21:59 - 00070832 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerCPLApp.cpl 2014-05-12 07:26 - 2014-06-10 14:05 - 00051928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys 2014-05-12 07:25 - 2014-06-10 14:05 - 00074456 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys 2014-05-12 07:25 - 2014-06-10 14:05 - 00023256 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys Some content of TEMP: ==================== C:\Users\Anke\AppData\Local\Temp\avgnt.exe C:\Users\Anke\AppData\Local\Temp\COMPUTERBILD Vorteil-Center-Installation.exe C:\Users\Anke\AppData\Local\Temp\DseShExt-x86.dll C:\Users\Anke\AppData\Local\Temp\ose00000.exe C:\Users\Anke\AppData\Local\Temp\SDShelEx-win32.dll C:\Users\Anke\AppData\Local\Temp\_is6E7B.exe ==================== Bamital & volsnap Check ================= C:\windows\explorer.exe => File is digitally signed C:\windows\system32\winlogon.exe => File is digitally signed C:\windows\system32\wininit.exe => File is digitally signed C:\windows\system32\svchost.exe => File is digitally signed C:\windows\system32\services.exe => File is digitally signed C:\windows\system32\User32.dll => File is digitally signed C:\windows\system32\userinit.exe => File is digitally signed C:\windows\system32\rpcss.dll => File is digitally signed C:\windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-06-08 13:56 ==================== End Of Log ============================ --- --- --- --- --- --- Hy Combofix, läuft nicht bis zum Ende durch, da ich weder Antivir noch Windows Security Essentials, sowohl als Antivir als auch als Antispy nicht beenden kann, da auch hier die Meldung erscheint, Zugriff verweigert... Code:
ATTFilter omboFix 14-06-10.01 - Anke 10.06.2014 15:24:08.1.2 - x86
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.49.1031.18.3033.1868 [GMT 2:00]
ausgeführt von:: c:\users\Anke\Desktop\ComboFix.exe
AV: Avira Desktop *Enabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Microsoft Security Essentials *Enabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}
SP: Avira Desktop *Enabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Microsoft Security Essentials *Enabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Anke\AppData\Local\Microsoft\Windows\Temporary Internet Files\{1CD0CB2B-84B4-452D-8919-DC503DF260AE}.xps
c:\users\Anke\AppData\Local\Microsoft\Windows\Temporary Internet Files\{B963BFB0-1472-45CF-A74B-539404A932F2}.xps
c:\users\Anke\AppData\Local\Microsoft\Windows\Temporary Internet Files\{EBE21F1F-1356-43F5-B73D-C893A24EBEA0}.xps
c:\users\Anke\AppData\Roaming\.#
c:\users\Anke\AppData\Roaming\.#\MBX@C3C@1572760.###
c:\users\Anke\AppData\Roaming\.#\MBX@C3C@1572790.###
c:\users\Anke\AppData\Roaming\Kysea
c:\users\Anke\AppData\Roaming\Kysea\liyhe.eqo
c:\users\Anke\ia_remove.sh4401.tmp
c:\users\Anke\ia_remove.sh6433.tmp
c:\windows\system32\System32\MASetupCleaner.exe
c:\windows\system32\System32\muzapp.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-05-10 bis 2014-06-10 ))))))))))))))))))))))))))))))
.
.
2014-06-10 13:39 . 2014-06-10 13:40 -------- d-----w- c:\users\Anke\AppData\Local\temp
2014-06-10 13:39 . 2014-06-10 13:39 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-06-10 13:14 . 2014-06-10 13:14 39464 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{18B604BB-4DC4-400F-B83B-F427DB61300C}\MpKsl80f46909.sys
2014-06-10 13:02 . 2014-06-10 13:02 -------- d-----w- c:\program files\VS Revo Group
2014-06-10 12:05 . 2014-06-10 12:53 110296 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-06-10 12:05 . 2014-06-10 12:05 -------- d-----w- c:\program files\ Malwarebytes Anti-Malware
2014-06-10 12:05 . 2014-06-10 12:05 -------- d-----w- c:\programdata\Malwarebytes
2014-06-10 12:05 . 2014-05-12 05:26 51928 ----a-w- c:\windows\system32\drivers\mwac.sys
2014-06-10 12:05 . 2014-05-12 05:25 74456 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-06-10 12:05 . 2014-05-12 05:25 23256 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-06-10 12:05 . 2014-06-10 12:05 -------- d-----w- c:\users\Anke\AppData\Local\Programs
2014-06-10 11:10 . 2014-06-10 13:02 -------- d-----w- C:\FRST
2014-06-10 11:07 . 2014-04-30 23:37 8073384 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{18B604BB-4DC4-400F-B83B-F427DB61300C}\mpengine.dll
2014-06-10 10:57 . 2014-06-10 10:58 -------- d-----w- c:\users\Rolf
2014-06-09 10:44 . 2014-04-30 23:37 8073384 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2014-06-05 11:40 . 2014-05-02 11:27 765968 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C13CC024-D0E5-4524-915C-1EE8839D22E6}\gapaengine.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-05-15 10:01 . 2012-05-03 11:10 692400 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-05-15 10:01 . 2011-07-24 19:59 70832 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2014-05-02 11:27 . 2014-03-14 14:59 765968 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2014-04-29 08:37 . 2014-01-07 10:10 136216 ----a-w- c:\windows\system32\drivers\avipbb.sys
2014-04-29 08:37 . 2014-01-07 10:10 93528 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2014-04-15 00:34 . 2014-04-15 00:34 1070232 ----a-w- c:\windows\system32\MSCOMCTL.OCX
2010-06-11 14:24 . 2010-06-11 14:24 6 ----a-w- c:\program files\Common Files\UnInstallCompleted.tmp
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2013-04-30 1521800]
.
[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RemoteControl8"="c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2009-04-15 91432]
"PDVD8LanguageShortcut"="c:\program files\CyberLink\PowerDVD8\Language\Language.exe" [2009-04-15 50472]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-12-05 39408]
"KiesPDLR"="c:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2013-07-26 844656]
"KiesPreload"="c:\program files\Samsung\Kies\Kies.exe" [2013-07-26 1564016]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"fsn"="c:\program files\Phoenix Technologies Ltd\FailSafe\FailSafeNotifier.exe" [2010-04-26 137792]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-04-22 175640]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-04-22 141848]
"UpdateLBPShortCut"="c:\program files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
"UpdateP2GoShortCut"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
"UpdatePPShortCut"="c:\program files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" [2008-12-03 218408]
"UpdatePSTShortCut"="c:\program files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" [2009-07-21 210216]
"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
"PDVD8LanguageShortcut"="c:\program files\CyberLink\PowerDVD8\Language\Language.exe" [2009-04-15 50472]
"RemoteControl8"="c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2009-04-15 91432]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-12-14 8120864]
"Ocs_SM"="c:\users\Anke\AppData\Roaming\OCS\SM\SearchAnonymizer.exe" [2012-08-10 106496]
"UpdatePDRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-01-04 222504]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-02-26 1713448]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"KiesTrayAgent"="c:\program files\Samsung\Kies\KiesTrayAgent.exe" [2013-07-26 311152]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2014-05-22 737872]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2012-11-05 89184]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2014-03-11 951576]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-11-18 275072]
Ralink Wireless Utility.lnk - c:\program files\Ralink\Common\RaUI.exe -s [2013-12-7 11474272]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Facebook Update"="c:\users\Anke\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
"KiesPDLR"=c:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
"AutoStartNPSAgent"=c:\program files\Samsung\Samsung New PC Studio\NPSAgent.exe
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"APLangApp"="c:\program files\AnyPC Client\APLangApp.exe"
"CLMLServer"="c:\program files\CyberLink\Power2Go\CLMLSvc.exe"
"Persistence"=c:\windows\system32\igfxpers.exe
"KiesTrayAgent"=c:\program files\Samsung\Kies\KiesTrayAgent.exe
"HP Software Update"=c:\program files\HP\HP Software Update\HPWuSchd2.exe
.
R2 MBAMScheduler;MBAMScheduler;c:\program files\ Malwarebytes Anti-Malware \mbamscheduler.exe [2014-05-12 1809720]
R2 MBAMService;MBAMService;c:\program files\ Malwarebytes Anti-Malware \mbamservice.exe [2014-05-12 860472]
R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys [2011-12-08 30312]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [x]
R3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys [x]
R3 ew_usbenumfilter;huawei_CompositeFilter;c:\windows\system32\DRIVERS\ew_usbenumfilter.sys [x]
R3 huawei_cdcacm;huawei_cdcacm;c:\windows\system32\DRIVERS\ew_jucdcacm.sys [x]
R3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys [x]
R3 huawei_ext_ctrl;huawei_ext_ctrl;c:\windows\system32\DRIVERS\ew_juextctrl.sys [x]
R3 huawei_wwanecm;huawei_wwanecm;c:\windows\system32\DRIVERS\ew_juwwanecm.sys [x]
R3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [x]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2014-05-12 23256]
R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys [2014-05-12 51928]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2014-01-07 37352]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2014-01-02 243128]
S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2014-05-22 430160]
S2 AntiVirWebService;Avira Browser-Schutz;c:\program files\Avira\AntiVir Desktop\avwebg7.exe [2014-05-22 1039952]
S2 avnetflt;avnetflt;c:\windows\system32\DRIVERS\avnetflt.sys [2014-01-07 69240]
S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2010-07-29 238952]
S3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2010-01-08 126976]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - FSUSBEXDISK
*NewlyCreated* - MPKSL80F46909
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-05-22 08:27 1091912 ----a-w- c:\program files\Google\Chrome\Application\35.0.1916.114\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-06-10 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-03 10:01]
.
2014-06-10 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1871111397-3539990770-1974983793-1000Core.job
- c:\users\Anke\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-10-16 10:13]
.
2014-06-10 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1871111397-3539990770-1974983793-1000UA.job
- c:\users\Anke\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-10-16 10:13]
.
2014-06-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-24 14:55]
.
2014-06-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-24 14:55]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
uInternet Settings,ProxyOverride = <local>
IE: An OneNote s&enden - c:\progra~1\MICROS~3\Office14\ONBttnIE.dll/105
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~3\Office14\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: {{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37}
TCP: DhcpNameServer = 192.168.178.1
TCP: Interfaces\{036B15BC-BB13-470C-8C65-65E248313D7E}: DhcpNameServer = 192.168.178.1
TCP: Interfaces\{036B15BC-BB13-470C-8C65-65E248313D7E}\05C6169637965627: DhcpNameServer = 192.168.178.1
TCP: Interfaces\{036B15BC-BB13-470C-8C65-65E248313D7E}\75C414E4D2832353239383: DhcpNameServer = 192.168.2.1 192.168.2.1
DPF: {902CCC37-E74D-49F0-8C10-5F10151BE923} - hxxp://www.flexwatch.com/app_link/download/SmartViewer.cab
FF - ProfilePath - c:\users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.flightradar24.com/53.27,7.18/10|https://www.google.de/
FF - prefs.js: network.proxy.type - 0
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{FE163F11-1919-4257-A280-FF5AF8DAEECB} - (no file)
Toolbar-Locked - (no file)
Toolbar-10 - (no file)
SafeBoot-mcmscsvc
SafeBoot-MCODS
AddRemove-{43B74FAB-FB58-447D-8D3A-5F638AF36FD1} - c:\programdata\{87B61FE8-334F-4066-B7AA-68DC81782D4D}\Netzmanager1.071.0301_120720a.exe
AddRemove-01_Simmental - c:\program files\Samsung\USB Drivers\01_Simmental\Uninstall.exe
AddRemove-02_Siberian - c:\program files\Samsung\USB Drivers\02_Siberian\Uninstall.exe
AddRemove-03_Swallowtail - c:\program files\Samsung\USB Drivers\03_Swallowtail\Uninstall.exe
AddRemove-04_semseyite - c:\program files\Samsung\USB Drivers\04_semseyite\Uninstall.exe
AddRemove-05_Sloan - c:\program files\Samsung\USB Drivers\05_Sloan\Uninstall.exe
AddRemove-06_Spencer - c:\program files\Samsung\USB Drivers\06_Spencer\Uninstall.exe
AddRemove-07_Schorl - c:\program files\Samsung\USB Drivers\07_Schorl\Uninstall.exe
AddRemove-08_EMPChipset - c:\program files\Samsung\USB Drivers\08_EMPChipset\Uninstall.exe
AddRemove-09_Hsp - c:\program files\Samsung\USB Drivers\09_Hsp\Uninstall.exe
AddRemove-11_HSP_Plus_Default - c:\program files\Samsung\USB Drivers\11_HSP_Plus_Default\Uninstall.exe
AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe
AddRemove-17_EMP_Chipset2 - c:\program files\Samsung\USB Drivers\17_EMP_Chipset2\Uninstall.exe
AddRemove-18_Zinia_Serial_Driver - c:\program files\Samsung\USB Drivers\18_Zinia_Serial_Driver\Uninstall.exe
AddRemove-19_VIA_driver - c:\program files\Samsung\USB Drivers\19_VIA_driver\Uninstall.exe
AddRemove-20_NXP_Driver - c:\program files\Samsung\USB Drivers\20_NXP_Driver\Uninstall.exe
AddRemove-21_Searsburg - c:\program files\Samsung\USB Drivers\21_Searsburg\Uninstall.exe
AddRemove-22_WiBro_WiMAX - c:\program files\Samsung\USB Drivers\22_WiBro_WiMAX\Uninstall.exe
AddRemove-24_flashusbdriver - c:\program files\Samsung\USB Drivers\24_flashusbdriver\Uninstall.exe
AddRemove-25_escape - c:\program files\Samsung\USB Drivers\25_escape\Uninstall.exe
AddRemove-958610902.www.dreamload.com - c:\program files\Microsoft Silverlight\5.1.20913.0\Silverlight.Configuration.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-06-10 15:42:58
ComboFix-quarantined-files.txt 2014-06-10 13:42
.
Vor Suchlauf: 10 Verzeichnis(se), 73.167.224.832 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 76.034.895.872 Bytes frei
.
- - End Of File - - 0063E1D5C36869DF2EA37C9EB60BADC7
2E5DEBB2116B3417023E0D6562D7ED07
Geändert von jemgumeranke (10.06.2014 um 14:18 Uhr) Grund: Edit |
|
11.06.2014, 08:26
| #4 |
| /// the machine /// TB-Ausbilder | Bankdaten ausgespät, Trojaner entfernen Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
11.06.2014, 15:36
| #5 |
| | Bankdaten ausgespät, Trojaner entfernen Ja, habe die 3 Programme durchgeführt. Hier die Logs: Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Protection, 11.06.2014 15:42:34, SYSTEM, ANKE-PC, Protection, Malware Protection, Starting, Protection, 11.06.2014 15:42:34, SYSTEM, ANKE-PC, Protection, Malware Protection, Started, Protection, 11.06.2014 15:42:34, SYSTEM, ANKE-PC, Protection, Malicious Website Protection, Starting, Protection, 11.06.2014 16:01:26, SYSTEM, ANKE-PC, Protection, Malware Protection, Starting, Protection, 11.06.2014 16:01:26, SYSTEM, ANKE-PC, Protection, Malware Protection, Started, Protection, 11.06.2014 16:01:26, SYSTEM, ANKE-PC, Protection, Malicious Website Protection, Starting, Protection, 11.06.2014 16:03:01, SYSTEM, ANKE-PC, Protection, Malicious Website Protection, Started, Update, 11.06.2014 16:05:25, SYSTEM, ANKE-PC, Scheduler, Malware Database, 2014.6.10.6, 2014.6.11.4, Protection, 11.06.2014 16:05:27, SYSTEM, ANKE-PC, Protection, Refresh, Starting, Protection, 11.06.2014 16:05:27, SYSTEM, ANKE-PC, Protection, Malicious Website Protection, Stopping, Protection, 11.06.2014 16:05:27, SYSTEM, ANKE-PC, Protection, Malicious Website Protection, Stopped, Protection, 11.06.2014 16:05:34, SYSTEM, ANKE-PC, Protection, Refresh, Success, Protection, 11.06.2014 16:05:34, SYSTEM, ANKE-PC, Protection, Malicious Website Protection, Starting, Protection, 11.06.2014 16:05:35, SYSTEM, ANKE-PC, Protection, Malicious Website Protection, Started, (end) Code:
ATTFilter # AdwCleaner v3.212 - Bericht erstellt am 11/06/2014 um 16:16:12
# Aktualisiert 05/06/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium (32 bits)
# Benutzername : Anke - ANKE-PC
# Gestartet von : C:\Users\Anke\Desktop\adwcleaner_3.212.exe
# Option : Löschen
***** [ Dienste ] *****
Dienst Gelöscht : SearchAnonymizer
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\Partner
Ordner Gelöscht : C:\Program Files\Ask.com
Ordner Gelöscht : C:\Program Files\Conduit
Ordner Gelöscht : C:\Program Files\Mein Gutscheincode Finder
Ordner Gelöscht : C:\windows\installer\{86d4b82a-abed-442a-be86-96357b70f4fe}
Ordner Gelöscht : C:\Users\Anke\AppData\Local\AskToolbar
Ordner Gelöscht : C:\Users\Anke\AppData\Local\Ilivid Player
Ordner Gelöscht : C:\Users\Anke\AppData\Local\PackageAware
Ordner Gelöscht : C:\Users\Anke\AppData\LocalLow\AskToolbar
Ordner Gelöscht : C:\Users\Anke\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\Anke\AppData\LocalLow\DataMngr
Ordner Gelöscht : C:\Users\Anke\AppData\LocalLow\PriceGong
Ordner Gelöscht : C:\Users\Anke\AppData\LocalLow\searchquband
Ordner Gelöscht : C:\Users\Anke\AppData\Roaming\DesktopIconForAmazon
Ordner Gelöscht : C:\Users\Anke\AppData\Roaming\OCS
Ordner Gelöscht : C:\Users\Anke\AppData\Roaming\Toolplugin
Ordner Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\ICQToolbarData
Ordner Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\Extensions\welcome@toolmin.com
Datei Gelöscht : C:\Users\Anke\Desktop\eBay.lnk
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\Askcom.xml
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin.gif
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin.src
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin.xml
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-1.xml
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-10.xml
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-11.xml
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-12.xml
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-13.xml
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-14.xml
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-15.xml
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-16.xml
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-17.xml
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-18.xml
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-19.xml
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-2.xml
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-20.xml
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-21.xml
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-22.xml
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-3.xml
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-4.xml
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-5.xml
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-6.xml
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-7.xml
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-8.xml
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-9.xml
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\Search_Results.xml
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1EC9510D-A439-4950-9399-B6399EDF9EA7}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\ICQ\ICQToolBar
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\secman.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\WLXQuickTimeShellExt.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apntoolbarinstaller_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apntoolbarinstaller_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\datamngrUI_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\datamngrUI_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\LatestDLMgr_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\LatestDLMgr_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Searchqu Toolbar uninstall_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Searchqu Toolbar uninstall_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [Ocs_SM]
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_nasa-world-wind[1]_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_nasa-world-wind[1]_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{061F450C-37B9-4330-9235-0F25D9F75B33}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0FA32667-9A8A-4E9C-902F-CA3323180003}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1ED16E0A-E8C4-40A0-8BC2-79485D21F796}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{83CAD530-387D-40FD-82EA-B9E863D92A9B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C17DC5CF-54FF-4E63-8AC7-94335D6DA231}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D14D0EE2-2DD1-4230-BE70-3F3AD6172C40}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F994E0D9-8335-48F1-99C2-A712C21F8D5F}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EF99BD32-C1FB-11D2-892F-0090271D4F88}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{C424171E-592A-415A-9EB1-DFD6D95D3530}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{00000000-6E41-4FD3-8538-502F5495E5FC}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{EF99BD32-C1FB-11D2-892F-0090271D4F88}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{855F3B16-6D32-4FE6-8A56-BBB695989046}]
Schlüssel Gelöscht : HKCU\Software\APN
Schlüssel Gelöscht : HKCU\Software\Ask.com
Schlüssel Gelöscht : HKCU\Software\Ciuvo
Schlüssel Gelöscht : HKCU\Software\Myfree Codec
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\AskToolbar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\searchqutoolbar
Schlüssel Gelöscht : HKLM\Software\APN
Schlüssel Gelöscht : HKLM\Software\Myfree Codec
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DesktopIconAmazon
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchAnonymizer
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08121C32A9C319F4CB0C11FF059552A4
***** [ Browser ] *****
-\\ Internet Explorer v9.0.8112.16476
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]
-\\ Mozilla Firefox v27.0.1 (de)
[ Datei : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\prefs.js ]
Zeile gelöscht : user_pref("extensions.asktb.InstallDir", "C:\\Program Files\\Ask.com\\");
Zeile gelöscht : user_pref("extensions.asktb.OOBEVersion", "1");
Zeile gelöscht : user_pref("extensions.asktb.apn_dbr", "ie_9.0.8112.16421");
Zeile gelöscht : user_pref("extensions.asktb.autofill-text-highlight-enabled", true);
Zeile gelöscht : user_pref("extensions.asktb.cbid", "^AGS");
Zeile gelöscht : user_pref("extensions.asktb.config-updated", true);
Zeile gelöscht : user_pref("extensions.asktb.crumb", "2012.10.16+12.08.32-toolbar014iad-DE-S2Fzc2VsLEdlcm1hbnk%3D");
Zeile gelöscht : user_pref("extensions.asktb.default-channel-url-mask", "hxxp://avira-int.ask.com/web?q={query}&qsrc={qsrc}&o={o}&l={l}&gct=bar&locale={locale}");
Zeile gelöscht : user_pref("extensions.asktb.domain", "avira-int.ask.com");
Zeile gelöscht : user_pref("extensions.asktb.domainName", "avira-int.ask.com");
Zeile gelöscht : user_pref("extensions.asktb.dtid", "^YYYYYY^YY^DE");
Zeile gelöscht : user_pref("extensions.asktb.ff-original-keyword-url", "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.5.3&q=");
Zeile gelöscht : user_pref("extensions.asktb.fresh-install", false);
Zeile gelöscht : user_pref("extensions.asktb.guid", "7c03ab2d-32f2-475c-8015-036e72b51cea");
Zeile gelöscht : user_pref("extensions.asktb.hpr", "YES");
Zeile gelöscht : user_pref("extensions.asktb.if", "su");
Zeile gelöscht : user_pref("extensions.asktb.keyword-toggled-in-session", false);
Zeile gelöscht : user_pref("extensions.asktb.last-config-req", "1402413961012");
Zeile gelöscht : user_pref("extensions.asktb.last-search-timestamp", "1358092774601");
Zeile gelöscht : user_pref("extensions.asktb.last-v", "3.15.26.100015");
Zeile gelöscht : user_pref("extensions.asktb.locale", "de_DE");
Zeile gelöscht : user_pref("extensions.asktb.localePref", true);
Zeile gelöscht : user_pref("extensions.asktb.location", "Kassel,Germany");
Zeile gelöscht : user_pref("extensions.asktb.nthp", "YES");
Zeile gelöscht : user_pref("extensions.asktb.nthp_prev", "1");
Zeile gelöscht : user_pref("extensions.asktb.o", "APN10261");
Zeile gelöscht : user_pref("extensions.asktb.overlay-reloaded-using-restart", true);
Zeile gelöscht : user_pref("extensions.asktb.qsrc", "2871");
Zeile gelöscht : user_pref("extensions.asktb.r", "5");
Zeile gelöscht : user_pref("extensions.asktb.sa", "YES");
Zeile gelöscht : user_pref("extensions.asktb.saguid", "887AEBCC-AC07-4601-A9B7-0331970CA726");
Zeile gelöscht : user_pref("extensions.asktb.search-history-queries", "was ist Weinstein||cala ratjada neuigkeiten||ebay||unwetterzentrale deutschland||youtube mallorca||lionie ritchi||lionel Richi schönheitsoperation[...]
Zeile gelöscht : user_pref("extensions.asktb.search-suggestions-enabled", true);
Zeile gelöscht : user_pref("extensions.asktb.silent-upgrade", true);
Zeile gelöscht : user_pref("extensions.asktb.silent-upgrade-from-pre-newtabs-build", true);
Zeile gelöscht : user_pref("extensions.asktb.socialmini-first", true);
Zeile gelöscht : user_pref("extensions.asktb.socialmini-interval", "1200000");
Zeile gelöscht : user_pref("extensions.asktb.socialmini-max-char-ticker", "33");
Zeile gelöscht : user_pref("extensions.asktb.socialmini-max-items", "30");
Zeile gelöscht : user_pref("extensions.asktb.socialmini-native-on", true);
Zeile gelöscht : user_pref("extensions.asktb.socialmini-speed", "5000");
Zeile gelöscht : user_pref("extensions.asktb.themeid", "");
Zeile gelöscht : user_pref("extensions.asktb.timeinstalled", "20.10.2012 21:45:19");
Zeile gelöscht : user_pref("extensions.asktb.to", "");
Zeile gelöscht : user_pref("extensions.asktb.v", "3.15.26.100015");
Zeile gelöscht : user_pref("extensions.asktb.version", "5.15.26.45268");
Zeile gelöscht : user_pref("extensions.enabledAddons", "google%40hitachi.com:0.3,welcome%40toolmin.com:1.03,%7B800b5000-a755-47e1-992b-48a1c1357f07%7D:1.5.3,finder%40meingutscheincode.de:3.0.2,wrc%40avast.com:9.0.2018[...]
Zeile gelöscht : user_pref("icqtoolbar.allowSendURL", false);
Zeile gelöscht : user_pref("icqtoolbar.defSearchChange", true);
Zeile gelöscht : user_pref("icqtoolbar.engineVerified", true);
Zeile gelöscht : user_pref("icqtoolbar.facebookSmilesAddonShowedPopup", true);
Zeile gelöscht : user_pref("icqtoolbar.firstTbRun", false);
Zeile gelöscht : user_pref("icqtoolbar.geolastmodified", 1402413960);
Zeile gelöscht : user_pref("icqtoolbar.history", "ewe%20w%C3%A4rme%20plus%23||Kosten%20f%C3%BCr%20Anbau||Was%20kostest%20ein%20schl%C3%BCsselfertiger%20Anbau%20von%20ca.%2050%20m%C2%B2||welches%20flugzeug%20fliegt%20g[...]
Zeile gelöscht : user_pref("icqtoolbar.hpChange", true);
Zeile gelöscht : user_pref("icqtoolbar.icqgeo", 49);
Zeile gelöscht : user_pref("icqtoolbar.installTime", "1343503399");
Zeile gelöscht : user_pref("icqtoolbar.installsource", "1");
Zeile gelöscht : user_pref("icqtoolbar.newtab_most_visited_state", "1");
Zeile gelöscht : user_pref("icqtoolbar.newtab_recently_closed_state", "1");
Zeile gelöscht : user_pref("icqtoolbar.newtab_state", "1");
Zeile gelöscht : user_pref("icqtoolbar.numberOfSearches", 0);
Zeile gelöscht : user_pref("icqtoolbar.previousFFVersion", "27.0.1");
Zeile gelöscht : user_pref("icqtoolbar.skip_default_search", "no");
Zeile gelöscht : user_pref("icqtoolbar.suggestions", false);
Zeile gelöscht : user_pref("icqtoolbar.uniqueID", "131772683613177267161317830510638");
Zeile gelöscht : user_pref("icqtoolbar.usageStatstTimestamp", 1402413972);
Zeile gelöscht : user_pref("icqtoolbar.userEngineApproved", true);
Zeile gelöscht : user_pref("icqtoolbar.userHpApproved", true);
Zeile gelöscht : user_pref("icqtoolbar.version", "1.5.3");
Zeile gelöscht : user_pref("icqtoolbar.voucherHideClicks", 0);
Zeile gelöscht : user_pref("icqtoolbar.voucherMoreLinkClicks", 0);
Zeile gelöscht : user_pref("icqtoolbar.voucherRedeemClicks", 0);
Zeile gelöscht : user_pref("icqtoolbar.voucherWasShown", 0);
Zeile gelöscht : user_pref("icqtoolbar.xmlEnableHomePageDsGuard", false);
Zeile gelöscht : user_pref("icqtoolbar.xmlEnableSuggestions", false);
Zeile gelöscht : user_pref("icqtoolbar.xmlLanguage", "de");
-\\ Google Chrome v35.0.1916.114
[ Datei : C:\Users\Anke\AppData\Local\Google\Chrome\User Data\Default\preferences ]
Gelöscht [Search Provider] : hxxp://de.ask.com/web?q={searchTerms}
*************************
AdwCleaner[R0].txt - [18862 octets] - [11/06/2014 16:14:35]
AdwCleaner[S0].txt - [18726 octets] - [11/06/2014 16:16:12]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [18787 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.3 (03.23.2014:1)
OS: Windows 7 Home Premium x86
Ran by Anke on 11.06.2014 at 16:23:36,85
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\taskhost_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\taskhost_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\iLividSetupV1[1]_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\iLividSetupV1[1]_RASMANCS
Successfully deleted: [Registry Key] "hkey_current_user\software\classes\typelib\{006ad7b2-968a-11de-88c9-5bde55d89593}"
Successfully deleted: [Registry Key] "hkey_current_user\software\microsoft\internet explorer\low rights\elevationpolicy\{a5aa24ea-11b8-4113-95ae-9ed71deaf12a}"
~~~ Files
~~~ Folders
Successfully deleted: [Folder] "C:\ProgramData\boost_interprocess"
Successfully deleted: [Folder] "C:\Program Files\myfree codec"
~~~ FireFox
Emptied folder: C:\Users\Anke\AppData\Roaming\mozilla\firefox\profiles\etpvy6y5.default\minidumps [119 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 11.06.2014 at 16:31:43,81
Computer was rebooted
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
12.06.2014, 08:00
| #6 |
| /// the machine /// TB-Ausbilder | Bankdaten ausgespät, Trojaner entfernenESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ --> Bankdaten ausgespät, Trojaner entfernen |
|
13.06.2014, 19:40
| #7 |
| | Bankdaten ausgespät, Trojaner entfernenCode:
ATTFilter SETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7587
# api_version=3.0.2
# EOSSerial=c9c44d9b498aee42a7c852c55672e5b2
# engine=18684
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-06-13 04:32:25
# local_time=2014-06-13 06:32:25 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7600 NT
# compatibility_mode_1='avast! Antivirus'
# compatibility_mode=783 16777213 100 95 139891 222887 0 0
# compatibility_mode_1='Microsoft Security Essentials'
# compatibility_mode=5895 16777213 100 100 6031577 25614339 0 0
# scanned=271732
# found=8
# cleaned=0
# scan_time=54472
sh=5E15B25E7002AF7308300569AFEBBEC992C1172A ft=0 fh=0000000000000000 vn="JS/SecurityDisabler.A.Gen evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Backup\C\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\prefs_11_06_2014_16_16_20.js"
sh=A47739F27C4BC8FD3A48B4A90B40679DF1218E1B ft=1 fh=ab4f3351c96b3042 vn="Win32/Toolbar.Conduit.Y evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Conduit\Community Alerts\Alert.dll.vir"
sh=9AC5040984D4B0DF00FD271BE03F559A9249C423 ft=0 fh=0000000000000000 vn="JS/SecurityDisabler.A.Gen evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\prefs.js"
sh=56C8CBAEB533088942E70ACFEA9B1FACD589560C ft=0 fh=0000000000000000 vn="JS/SecurityDisabler.A.Gen evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\prefs.js.BAK"
sh=A1303527D9A7BAF61130E38636FD53926A211D74 ft=1 fh=77b67014d8a47abf vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Anke\Downloads\airstrike2_free_setup-Downloader.exe"
sh=A7E501599B80D1E6548C85EF661C70D85A64ACD5 ft=1 fh=77b67014c21a5d01 vn="möglicherweise Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Anke\Downloads\airstrike2_free_setup.exe"
sh=B60CC8450EB91C56033D2ECA69506FB5B6D31122 ft=1 fh=598063cfc2fe7e7f vn="Win32/Malavida.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Anke\Downloads\desmume-windows-malavida.exe"
sh=C710AA620B81C1991468A33A5798DAF2ACED4C5E ft=1 fh=c1847d19b9c602ab vn="Variante von Win32/OpenInstall evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Anke\Downloads\FrikingShark-Downloader.exe"
Code:
ATTFilter Results of screen317's Security Check version 0.99.83
Windows 7 x86 (UAC is disabled!)
Out of date service pack!!
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Microsoft Security Essentials
avast! Antivirus
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
CCleaner
Java(TM) 6 Update 30
Java version out of Date!
Adobe Flash Player 13.0.0.214
Adobe Reader 9
Adobe Reader XI
Mozilla Firefox 27.0.1 Firefox out of Date!
Mozilla Thunderbird (24.3.0)
Google Chrome 35.0.1916.114
Google Chrome 35.0.1916.153
````````Process Check: objlist.exe by Laurent````````
Microsoft Security Essentials MSMpEng.exe
AVAST Software Avast AvastSvc.exe
AVAST Software Avast avastui.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:12-06-2014 02
Ran by Anke (administrator) on ANKE-PC on 13-06-2014 16:30:10
Running from C:\Users\Anke\Downloads
Platform: Microsoft Windows 7 Home Premium (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Teruten) C:\Windows\System32\FsUsbExService.Exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
(SAMSUNG Electronics) C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe
(DoctorSoft) C:\Program Files\AnyPC Client\APLanMgrC.exe
(SEC) C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(CyberLink Corp.) C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
(Ralink Technology, Corp.) C:\Program Files\Ralink\Common\RaUI.exe
() C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe
(Ralink Technology, Corp.) C:\Program Files\Ralink\Common\RaRegistry.exe
() C:\Program Files\CyberLink\Shared files\RichVideo.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_clipbook.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [fsn] => C:\Program Files\Phoenix Technologies Ltd\FailSafe\FailSafeNotifier.exe [137792 2010-04-26] ()
HKLM\...\Run: [UpdateLBPShortCut] => C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM\...\Run: [UpdateP2GoShortCut] => C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM\...\Run: [UpdatePPShortCut] => C:\Program Files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.)
HKLM\...\Run: [UpdatePSTShortCut] => C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe [210216 2009-07-21] (CyberLink Corp.)
HKLM\...\Run: [UCam_Menu] => C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM\...\Run: [PDVD8LanguageShortcut] => C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe [50472 2009-04-15] (CyberLink Corp.)
HKLM\...\Run: [RemoteControl8] => C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe [91432 2009-04-15] (CyberLink Corp.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [8120864 2009-12-14] (Realtek Semiconductor)
HKLM\...\Run: [UpdatePDRShortCut] => C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe [222504 2008-01-04] (CyberLink Corp.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1713448 2010-02-26] (Synaptics Incorporated)
HKLM\...\Run: [Windows Mobile Device Center] => C:\windows\WindowsMobile\wmdc.exe [648072 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [KiesTrayAgent] => C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [311152 2013-07-26] (Samsung Electronics Co., Ltd.)
HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [951576 2014-03-11] (Microsoft Corporation)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [3890208 2014-06-10] (AVAST Software)
HKLM Group Policy restriction on software: C:\Program Files\Avira <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Microsoft Security Client <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [RemoteControl8] => C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe [91432 2009-04-15] (CyberLink Corp.)
HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [PDVD8LanguageShortcut] => C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe [50472 2009-04-15] (CyberLink Corp.)
HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [KiesPDLR] => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844656 2013-07-26] (Samsung)
HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [KiesPreload] => C:\Program Files\Samsung\Kies\Kies.exe [1564016 2013-07-26] (Samsung)
HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [] => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844656 2013-07-26] (Samsung)
HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\RunOnce: [FlashPlayerUpdate] - C:\windows\system32\Macromed\Flash\FlashUtil32_13_0_0_214_ActiveX.exe [847536 2014-05-15] (Adobe Systems Incorporated)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Ralink Wireless Utility.lnk
ShortcutTarget: Ralink Wireless Utility.lnk -> C:\Program Files\Ralink\Common\RaUI.exe (Ralink Technology, Corp.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.bing.com
HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.facebook.de/
URLSearchHook: HKLM - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046}
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN
SearchScopes: HKCU - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.de/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN_deDE376DE376
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com.anonymize-me.de/?anonymto=687474703A2F2F7777772E62696E672E636F6D2F7365617263683F713D7B7365617263685465726D737D267372633D49452D536561726368426F7826464F524D3D494538535243&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&k=0
SearchScopes: HKCU - {291FBCDC-92E5-427D-A712-1449AF5758F0} URL = hxxp://www.pricerunner.de.anonymize-me.de/?to=707269636572756E6E65722E6465&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0
SearchScopes: HKCU - {3626E536-84F8-41F2-ABE8-D7A21962E6BD} URL = hxxp://www.amazon.de.anonymize-me.de/?to=616D617A6F6E2E6465&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0
SearchScopes: HKCU - {43E73F3A-F350-48D0-8BEE-9B93B9514929} URL = hxxp://search.ebay.de.anonymize-me.de/?to=656261792E6465&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0
SearchScopes: HKCU - {615D6B1F-D615-4511-B82F-6873B8E04546} URL = hxxp://go.web.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.de/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN_deDE376DE376
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com.anonymize-me.de/?anonymto=687474703A2F2F7777772E676F6F676C652E636F6D2F7365617263683F713D7B7365617263685465726D737D26726C733D636F6D2E6D6963726F736F66743A7B6C616E67756167657D3A7B72656665727265723A736F757263653F7D2669653D7B696E707574456E636F64696E677D266F653D7B6F7574707574456E636F64696E677D26736F7572636569643D696537&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&k=0
SearchScopes: HKCU - {7A33B853-20BD-44F1-8EA3-4C4F0DAEDF61} URL = hxxp://go.mail.com/tb/en-us/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKCU - {8246A879-D4B8-4767-A85B-3E1C7CE09E0F} URL = hxxp://www.otto.de.anonymize-me.de/?to=6F74746F2E6465&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0
SearchScopes: HKCU - {A77A1A9D-84E7-4CFC-B52C-856B0FDC714B} URL = hxxp://go.gmx.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKCU - {B7346A11-27AB-450F-8B41-857F3FA50296} URL = hxxp://www.myvideo.de.anonymize-me.de/?to=6D79766964656F2E6465&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0
SearchScopes: HKCU - {D3381FF7-E6DD-4B70-992E-B66611B65949} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKCU - {FA3102A5-D4D7-446A-877C-4EBFCF469E71} URL = hxxp://de.wikipedia.org.anonymize-me.de/?to=64652E77696B6970656469612E6F7267&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0
BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - No Name - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - No File
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {902CCC37-E74D-49F0-8C10-5F10151BE923} hxxp://www.flexwatch.com/app_link/download/SmartViewer.cab
DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx
DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default
FF SearchEngineOrder.1: Google
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.google.com/firefox
FF Keyword.URL: hxxp://www.google.com/search?ie=UTF-8&oe=utf-8&q=
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\windows\system32\Adobe\Director\np32dsw_1203133.dll (Adobe Systems, Inc.)
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @oberon-media.com/ONCAdapter - C:\Program Files\Common Files\Oberon Media\NCAdapter\1.0.0.8\npapicomadapter.dll (Oberon-Media )
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @veetle.com/veetleCorePlugin,version=0.9.18 - C:\Program Files\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF Plugin: @veetle.com/veetlePlayerPlugin,version=0.9.18 - C:\Program Files\Veetle\Player\npvlc.dll (Veetle Inc)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Anke\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: @yahoo.com/BrowserPlus,version=2.9.8 - C:\Users\Anke\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll (Yahoo! Inc.)
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\searchplugins-backup
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\{815A4F63-B897-442D-9F2D-90F99FF6FE0A}.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\{96FD8767-6827-4D9B-AC7B-3CA21566B5B2}.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\{D644E5AF-3CEF-46E9-8330-BDF49F489C9C}.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: YouTube Unblocker - C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\Extensions\youtubeunblocker@unblocker.yt [2014-06-12]
FF Extension: Google Search by Image - C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\Extensions\google@hitachi.com.xpi [2012-08-10]
FF Extension: Adblock Plus - C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-01-27]
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-06-10]
FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2014-02-23]
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-06-10]
FF HKCU\...\Firefox\Extensions: [finder@meingutscheincode.de] - C:\Program Files\Mein Gutscheincode Finder\Firefox
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2014-02-23]
Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR StartupUrls: "hxxp://www.google.com/"
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\35.0.1916.114\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\35.0.1916.114\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\35.0.1916.114\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.300.12) - C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll (Sun Microsystems, Inc.)
CHR Plugin: (Java(TM) Platform SE 6 U30) - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (Oberon com adapter) - C:\Program Files\Common Files\Oberon Media\NCAdapter\1.0.0.8\npapicomadapter.dll (Oberon-Media )
CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (Veetle TV Player) - C:\Program Files\Veetle\Player\npvlc.dll (Veetle Inc)
CHR Plugin: (Veetle TV Core) - C:\Program Files\Veetle\plugins\npVeetle.dll (Veetle Inc)
CHR Plugin: (Windows Live® Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Facebook Video Calling Plugin) - C:\Users\Anke\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
CHR Plugin: (BrowserPlus (from Yahoo!) v2.9.8) - C:\Users\Anke\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll (Yahoo! Inc.)
CHR Plugin: (Shockwave Flash) - C:\windows\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File
CHR Extension: (YouTube) - C:\Users\Anke\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-12-02]
CHR Extension: (Google-Suche) - C:\Users\Anke\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-12-02]
CHR Extension: (preisspion.de) - C:\Users\Anke\AppData\Local\Google\Chrome\User Data\Default\Extensions\jgfpelakfkbbkkdchaaaknckhoadkcbo [2012-12-02]
CHR Extension: (Google Wallet) - C:\Users\Anke\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-22]
CHR Extension: (Google Mail) - C:\Users\Anke\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-12-02]
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-06-10]
CHR HKLM\...\Chrome\Extension: [jgfpelakfkbbkkdchaaaknckhoadkcbo] - C:\Program Files\Mein Gutscheincode Finder\Chrome\chrome-extension.crx [2014-06-10]
========================== Services (Whitelisted) =================
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-06-10] (AVAST Software)
S2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22216 2014-03-11] (Microsoft Corporation)
S2 Net Driver HPZ12; C:\windows\system32\HPZinw12.dll [44032 2010-08-06] (Hewlett-Packard) [File not signed]
S2 Netzmanager Service; C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe [2635776 2012-07-20] (Deutsche Telekom AG) [File not signed]
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [279776 2014-03-11] (Microsoft Corporation)
R2 OberonGameConsoleService; C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe [44312 2009-08-13] ()
S2 Pml Driver HPZ12; C:\windows\system32\HPZipm12.dll [53760 2010-08-06] (Hewlett-Packard) [File not signed]
R2 RalinkRegistryWriter; C:\Program Files\Ralink\Common\RaRegistry.exe [374112 2010-11-11] (Ralink Technology, Corp.)
S3 RaMediaServer; C:\Program Files\Ralink\Common\RaMediaServer.exe [619872 2010-12-31] ()
R2 RichVideo; C:\Program Files\CyberLink\Shared files\RichVideo.exe [247152 2009-07-07] ()
==================== Drivers (Whitelisted) ====================
R2 aswHwid; C:\windows\system32\drivers\aswHwid.sys [24184 2014-06-10] ()
R2 aswMonFlt; C:\windows\system32\drivers\aswMonFlt.sys [67824 2014-06-10] (AVAST Software)
R1 aswRdr; C:\windows\system32\drivers\aswRdr2.sys [81768 2014-06-10] (AVAST Software)
R0 aswRvrt; C:\windows\system32\Drivers\aswRvrt.sys [49944 2014-06-10] ()
R1 aswSnx; C:\windows\system32\drivers\aswSnx.sys [777488 2014-06-10] (AVAST Software)
R1 aswSP; C:\windows\system32\drivers\aswSP.sys [411680 2014-06-10] (AVAST Software)
R2 aswStm; C:\windows\system32\drivers\aswStm.sys [68312 2014-06-10] (AVAST Software)
R0 aswVmm; C:\windows\system32\Drivers\aswVmm.sys [180632 2014-06-10] ()
R1 dtsoftbus01; C:\windows\System32\DRIVERS\dtsoftbus01.sys [243128 2014-01-02] (Disc Soft Ltd)
R3 FsUsbExDisk; C:\windows\system32\FsUsbExDisk.SYS [36608 2010-06-14] () [File not signed]
S3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [51928 2014-05-12] (Malwarebytes Corporation)
R0 MpFilter; C:\windows\System32\DRIVERS\MpFilter.sys [231960 2014-01-25] (Microsoft Corporation)
S3 netr28u; C:\windows\System32\DRIVERS\netr28u.sys [1174880 2010-12-28] (Ralink Technology Corp.)
S3 TelekomNM3; C:\Program Files\Netzmanager\NMInfraIS2\Driver\TelekomNM3.sys [35040 2010-09-16] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH)
R3 yukonw7; C:\windows\System32\DRIVERS\yk62x86.sys [315392 2009-09-28] ()
U5 AppMgmt; C:\windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Anke\AppData\Local\Temp\catchme.sys [X]
S3 dg_ssudbus; system32\DRIVERS\ssudbus.sys [X]
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [X]
S3 ew_usbenumfilter; system32\DRIVERS\ew_usbenumfilter.sys [X]
S3 huawei_cdcacm; system32\DRIVERS\ew_jucdcacm.sys [X]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X]
S3 huawei_ext_ctrl; system32\DRIVERS\ew_juextctrl.sys [X]
S3 huawei_wwanecm; system32\DRIVERS\ew_juwwanecm.sys [X]
S3 massfilter; system32\drivers\massfilter.sys [X]
S1 MpKsl80f46909; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{18B604BB-4DC4-400F-B83B-F427DB61300C}\MpKsl80f46909.sys [X]
S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [X]
S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [X]
S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-06-13 16:30 - 2014-06-13 16:30 - 00000000 ____D () C:\Users\Anke\Downloads\FRST-OlderVersion
2014-06-13 16:22 - 2014-06-13 16:22 - 00854367 _____ () C:\Users\Anke\Downloads\SecurityCheck.exe
2014-06-12 15:19 - 2014-06-13 16:23 - 00000000 ____D () C:\Program Files\ESET
2014-06-12 15:19 - 2014-06-12 15:19 - 02347384 _____ (ESET) C:\Users\Anke\Desktop\esetsmartinstaller_deu.exe
2014-06-11 16:31 - 2014-06-11 16:31 - 00001622 _____ () C:\Users\Anke\Desktop\JRT.txt
2014-06-11 16:20 - 2014-06-11 16:20 - 00000000 ____D () C:\windows\ERUNT
2014-06-11 16:19 - 2014-06-11 16:19 - 00018868 _____ () C:\Users\Anke\Desktop\AdwCleaner[S0].txt
2014-06-11 16:15 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\windows\system32\sqlite3.dll
2014-06-11 16:14 - 2014-06-11 16:16 - 00000000 ____D () C:\AdwCleaner
2014-06-11 16:13 - 2014-06-11 16:13 - 01016261 _____ (Thisisu) C:\Users\Anke\Desktop\JRT.exe
2014-06-11 16:09 - 2014-06-11 16:09 - 01333465 _____ () C:\Users\Anke\Desktop\adwcleaner_3.212.exe
2014-06-11 16:08 - 2014-06-11 16:08 - 00001427 _____ () C:\Users\Anke\Desktop\mbam.txt
2014-06-10 16:45 - 2014-06-10 16:45 - 00000000 ____D () C:\Users\Anke\AppData\Roaming\AVAST Software
2014-06-10 16:41 - 2014-06-10 16:41 - 00002083 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-06-10 16:41 - 2014-06-10 16:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast
2014-06-10 16:40 - 2014-06-10 16:40 - 00777488 _____ (AVAST Software) C:\windows\system32\Drivers\aswsnx.sys
2014-06-10 16:40 - 2014-06-10 16:40 - 00776976 _____ (AVAST Software) C:\windows\system32\Drivers\aswsnx.sys.1402411253300
2014-06-10 16:40 - 2014-06-10 16:40 - 00411680 _____ (AVAST Software) C:\windows\system32\Drivers\aswsp.sys
2014-06-10 16:40 - 2014-06-10 16:40 - 00411552 _____ (AVAST Software) C:\windows\system32\Drivers\aswsp.sys.1402411253300
2014-06-10 16:40 - 2014-06-10 16:40 - 00271264 _____ (AVAST Software) C:\windows\system32\aswBoot.exe
2014-06-10 16:40 - 2014-06-10 16:40 - 00180632 _____ () C:\windows\system32\Drivers\aswVmm.sys
2014-06-10 16:40 - 2014-06-10 16:40 - 00081768 _____ (AVAST Software) C:\windows\system32\Drivers\aswRdr2.sys
2014-06-10 16:40 - 2014-06-10 16:40 - 00068312 _____ (AVAST Software) C:\windows\system32\Drivers\aswstm.sys
2014-06-10 16:40 - 2014-06-10 16:40 - 00067824 _____ (AVAST Software) C:\windows\system32\Drivers\aswMonFlt.sys
2014-06-10 16:40 - 2014-06-10 16:40 - 00049944 _____ () C:\windows\system32\Drivers\aswRvrt.sys
2014-06-10 16:40 - 2014-06-10 16:40 - 00043152 _____ (AVAST Software) C:\windows\avastSS.scr
2014-06-10 16:40 - 2014-06-10 16:40 - 00024184 _____ () C:\windows\system32\Drivers\aswHwid.sys
2014-06-10 16:38 - 2014-06-10 16:38 - 00000000 ____D () C:\Program Files\AVAST Software
2014-06-10 16:37 - 2014-06-10 16:37 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-06-10 16:36 - 2014-06-10 16:37 - 94714880 _____ (AVAST Software) C:\Users\Anke\Downloads\avast_free_antivirus_setup_21514.exe
2014-06-10 15:43 - 2014-06-13 16:30 - 00000000 ____D () C:\Users\Anke\AppData\Local\temp
2014-06-10 15:43 - 2014-06-10 15:43 - 00016404 _____ () C:\ComboFix.txt
2014-06-10 15:43 - 2014-06-10 15:43 - 00000000 ____D () C:\Users\Public\AppData\Local\temp
2014-06-10 15:43 - 2014-06-10 15:43 - 00000000 ____D () C:\Users\Default\AppData\Local\temp
2014-06-10 15:43 - 2014-06-10 15:43 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp
2014-06-10 15:21 - 2011-06-26 08:45 - 00256000 _____ () C:\windows\PEV.exe
2014-06-10 15:21 - 2010-11-07 19:20 - 00208896 _____ () C:\windows\MBR.exe
2014-06-10 15:21 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2014-06-10 15:21 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2014-06-10 15:21 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2014-06-10 15:21 - 2000-08-31 02:00 - 00098816 _____ () C:\windows\sed.exe
2014-06-10 15:21 - 2000-08-31 02:00 - 00080412 _____ () C:\windows\grep.exe
2014-06-10 15:21 - 2000-08-31 02:00 - 00068096 _____ () C:\windows\zip.exe
2014-06-10 15:14 - 2014-06-10 15:43 - 00000000 ____D () C:\Qoobox
2014-06-10 15:14 - 2014-06-10 15:41 - 00000000 ____D () C:\windows\erdnt
2014-06-10 15:11 - 2014-06-10 15:12 - 05205915 ____R (Swearware) C:\Users\Anke\Desktop\ComboFix.exe
2014-06-10 15:02 - 2014-06-10 15:02 - 00001186 _____ () C:\Users\Anke\Desktop\Revo Uninstaller.lnk
2014-06-10 15:02 - 2014-06-10 15:02 - 00000000 ____D () C:\Program Files\VS Revo Group
2014-06-10 15:01 - 2014-06-10 13:09 - 01177600 _____ (Farbar) C:\Users\Anke\Desktop\FRST.exe
2014-06-10 14:58 - 2014-06-10 14:58 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Anke\Downloads\revosetup95.exe
2014-06-10 14:57 - 2014-06-10 14:57 - 00000589 _____ () C:\Users\Anke\Desktop\fixlist.txt
2014-06-10 14:05 - 2014-06-12 15:31 - 00110296 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-10 14:05 - 2014-06-10 14:05 - 00001024 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-10 14:05 - 2014-06-10 14:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-06-10 14:05 - 2014-06-10 14:05 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-10 14:05 - 2014-06-10 14:05 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware
2014-06-10 14:05 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2014-06-10 14:05 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2014-06-10 14:05 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2014-06-10 14:04 - 2014-06-10 14:04 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Anke\Downloads\mbam-setup-2.0.2.1012.exe
2014-06-10 13:46 - 2014-06-10 13:46 - 00002951 _____ () C:\Users\Anke\Desktop\gmer.log
2014-06-10 13:23 - 2014-06-10 13:23 - 00000242 _____ () C:\Users\Anke\Downloads\defogger_enable.log
2014-06-10 13:19 - 2014-06-10 15:02 - 00047026 _____ () C:\Users\Anke\Desktop\FRST.txt
2014-06-10 13:19 - 2014-06-10 13:19 - 00051480 _____ () C:\Users\Anke\Desktop\Addition.txt
2014-06-10 13:17 - 2014-06-10 13:17 - 00380416 _____ () C:\Users\Anke\Downloads\nhmwyhxd.exe
2014-06-10 13:11 - 2014-06-10 13:12 - 00051480 _____ () C:\Users\Anke\Downloads\Addition.txt
2014-06-10 13:10 - 2014-06-13 16:30 - 00025594 _____ () C:\Users\Anke\Downloads\FRST.txt
2014-06-10 13:10 - 2014-06-13 16:30 - 00000000 ____D () C:\FRST
2014-06-10 13:09 - 2014-06-13 16:30 - 01073152 _____ (Farbar) C:\Users\Anke\Downloads\FRST.exe
2014-06-10 13:08 - 2014-06-10 13:23 - 00000470 _____ () C:\Users\Anke\Downloads\defogger_disable.log
2014-06-10 13:08 - 2014-06-10 13:08 - 00000156 _____ () C:\Users\Anke\Desktop\defogger_reenable
2014-06-10 13:07 - 2014-06-10 13:07 - 00050477 _____ () C:\Users\Anke\Downloads\Defogger (1).exe
2014-06-10 12:57 - 2014-06-10 15:58 - 00000000 ____D () C:\Users\Rolf
2014-05-16 11:08 - 2014-05-16 11:08 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER
==================== One Month Modified Files and Folders =======
2014-06-13 16:30 - 2014-06-13 16:30 - 00000000 ____D () C:\Users\Anke\Downloads\FRST-OlderVersion
2014-06-13 16:30 - 2014-06-10 15:43 - 00000000 ____D () C:\Users\Anke\AppData\Local\temp
2014-06-13 16:30 - 2014-06-10 13:10 - 00025594 _____ () C:\Users\Anke\Downloads\FRST.txt
2014-06-13 16:30 - 2014-06-10 13:10 - 00000000 ____D () C:\FRST
2014-06-13 16:30 - 2014-06-10 13:09 - 01073152 _____ (Farbar) C:\Users\Anke\Downloads\FRST.exe
2014-06-13 16:25 - 2010-04-24 16:55 - 00001098 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-13 16:23 - 2014-06-12 15:19 - 00000000 ____D () C:\Program Files\ESET
2014-06-13 16:22 - 2014-06-13 16:22 - 00854367 _____ () C:\Users\Anke\Downloads\SecurityCheck.exe
2014-06-13 16:05 - 2009-12-05 04:40 - 01598358 _____ () C:\windows\WindowsUpdate.log
2014-06-13 16:01 - 2012-05-03 13:10 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-06-13 15:18 - 2011-10-16 18:08 - 00001134 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1871111397-3539990770-1974983793-1000UA.job
2014-06-13 12:25 - 2010-04-24 16:55 - 00001094 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-13 12:18 - 2011-10-16 18:08 - 00001112 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1871111397-3539990770-1974983793-1000Core.job
2014-06-12 19:45 - 2012-10-25 21:27 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-06-12 15:31 - 2014-06-10 14:05 - 00110296 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-12 15:21 - 2009-07-14 06:34 - 00014512 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-12 15:21 - 2009-07-14 06:34 - 00014512 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-12 15:19 - 2014-06-12 15:19 - 02347384 _____ (ESET) C:\Users\Anke\Desktop\esetsmartinstaller_deu.exe
2014-06-12 15:13 - 2013-08-31 19:10 - 00000374 _____ () C:\windows\system32\Drivers\etc\hosts.ics
2014-06-12 15:11 - 2012-12-03 11:05 - 00018887 _____ () C:\windows\setupact.log
2014-06-12 15:11 - 2010-04-24 15:38 - 00000000 ____D () C:\Users\Anke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite
2014-06-12 15:11 - 2009-07-14 06:53 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-06-12 15:07 - 2010-04-24 15:45 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-06-12 15:06 - 2013-08-12 09:43 - 00000000 ____D () C:\windows\system32\MRT
2014-06-12 15:01 - 2010-04-27 20:46 - 92708840 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-06-11 16:31 - 2014-06-11 16:31 - 00001622 _____ () C:\Users\Anke\Desktop\JRT.txt
2014-06-11 16:20 - 2014-06-11 16:20 - 00000000 ____D () C:\windows\ERUNT
2014-06-11 16:19 - 2014-06-11 16:19 - 00018868 _____ () C:\Users\Anke\Desktop\AdwCleaner[S0].txt
2014-06-11 16:17 - 2012-12-16 11:56 - 04199370 _____ () C:\windows\PFRO.log
2014-06-11 16:16 - 2014-06-11 16:14 - 00000000 ____D () C:\AdwCleaner
2014-06-11 16:13 - 2014-06-11 16:13 - 01016261 _____ (Thisisu) C:\Users\Anke\Desktop\JRT.exe
2014-06-11 16:09 - 2014-06-11 16:09 - 01333465 _____ () C:\Users\Anke\Desktop\adwcleaner_3.212.exe
2014-06-11 16:08 - 2014-06-11 16:08 - 00001427 _____ () C:\Users\Anke\Desktop\mbam.txt
2014-06-11 16:05 - 2014-01-04 20:52 - 00001057 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-06-11 16:05 - 2014-01-04 20:52 - 00001057 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-06-11 16:05 - 2014-01-02 17:44 - 00001848 _____ () C:\Users\Anke\Desktop\Amazon.lnk
2014-06-11 16:05 - 2014-01-02 17:44 - 00001846 _____ () C:\Users\Anke\Desktop\WEB.DE.lnk
2014-06-11 16:05 - 2010-04-24 15:56 - 00001371 _____ () C:\Users\Anke\Desktop\Internet Explorer.lnk
2014-06-11 15:49 - 2012-10-16 21:09 - 00000000 ____D () C:\ProgramData\Avira
2014-06-10 17:40 - 2009-12-05 04:46 - 00000000 ____D () C:\ProgramData\Temp
2014-06-10 16:45 - 2014-06-10 16:45 - 00000000 ____D () C:\Users\Anke\AppData\Roaming\AVAST Software
2014-06-10 16:41 - 2014-06-10 16:41 - 00002083 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-06-10 16:41 - 2014-06-10 16:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast
2014-06-10 16:41 - 2014-03-23 12:24 - 00000000 ____D () C:\Program Files\Mozilla Thunderbird
2014-06-10 16:40 - 2014-06-10 16:40 - 00777488 _____ (AVAST Software) C:\windows\system32\Drivers\aswsnx.sys
2014-06-10 16:40 - 2014-06-10 16:40 - 00776976 _____ (AVAST Software) C:\windows\system32\Drivers\aswsnx.sys.1402411253300
2014-06-10 16:40 - 2014-06-10 16:40 - 00411680 _____ (AVAST Software) C:\windows\system32\Drivers\aswsp.sys
2014-06-10 16:40 - 2014-06-10 16:40 - 00411552 _____ (AVAST Software) C:\windows\system32\Drivers\aswsp.sys.1402411253300
2014-06-10 16:40 - 2014-06-10 16:40 - 00271264 _____ (AVAST Software) C:\windows\system32\aswBoot.exe
2014-06-10 16:40 - 2014-06-10 16:40 - 00180632 _____ () C:\windows\system32\Drivers\aswVmm.sys
2014-06-10 16:40 - 2014-06-10 16:40 - 00081768 _____ (AVAST Software) C:\windows\system32\Drivers\aswRdr2.sys
2014-06-10 16:40 - 2014-06-10 16:40 - 00068312 _____ (AVAST Software) C:\windows\system32\Drivers\aswstm.sys
2014-06-10 16:40 - 2014-06-10 16:40 - 00067824 _____ (AVAST Software) C:\windows\system32\Drivers\aswMonFlt.sys
2014-06-10 16:40 - 2014-06-10 16:40 - 00049944 _____ () C:\windows\system32\Drivers\aswRvrt.sys
2014-06-10 16:40 - 2014-06-10 16:40 - 00043152 _____ (AVAST Software) C:\windows\avastSS.scr
2014-06-10 16:40 - 2014-06-10 16:40 - 00024184 _____ () C:\windows\system32\Drivers\aswHwid.sys
2014-06-10 16:38 - 2014-06-10 16:38 - 00000000 ____D () C:\Program Files\AVAST Software
2014-06-10 16:37 - 2014-06-10 16:37 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-06-10 16:37 - 2014-06-10 16:36 - 94714880 _____ (AVAST Software) C:\Users\Anke\Downloads\avast_free_antivirus_setup_21514.exe
2014-06-10 15:58 - 2014-06-10 12:57 - 00000000 ____D () C:\Users\Rolf
2014-06-10 15:43 - 2014-06-10 15:43 - 00016404 _____ () C:\ComboFix.txt
2014-06-10 15:43 - 2014-06-10 15:43 - 00000000 ____D () C:\Users\Public\AppData\Local\temp
2014-06-10 15:43 - 2014-06-10 15:43 - 00000000 ____D () C:\Users\Default\AppData\Local\temp
2014-06-10 15:43 - 2014-06-10 15:43 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp
2014-06-10 15:43 - 2014-06-10 15:14 - 00000000 ____D () C:\Qoobox
2014-06-10 15:43 - 2009-07-14 04:37 - 00000000 __RHD () C:\Users\Default
2014-06-10 15:43 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public
2014-06-10 15:41 - 2014-06-10 15:14 - 00000000 ____D () C:\windows\erdnt
2014-06-10 15:40 - 2009-07-14 04:04 - 00000215 _____ () C:\windows\system.ini
2014-06-10 15:38 - 2010-04-24 15:38 - 00000000 ____D () C:\Users\Anke
2014-06-10 15:12 - 2014-06-10 15:11 - 05205915 ____R (Swearware) C:\Users\Anke\Desktop\ComboFix.exe
2014-06-10 15:02 - 2014-06-10 15:02 - 00001186 _____ () C:\Users\Anke\Desktop\Revo Uninstaller.lnk
2014-06-10 15:02 - 2014-06-10 15:02 - 00000000 ____D () C:\Program Files\VS Revo Group
2014-06-10 15:02 - 2014-06-10 13:19 - 00047026 _____ () C:\Users\Anke\Desktop\FRST.txt
2014-06-10 14:58 - 2014-06-10 14:58 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Anke\Downloads\revosetup95.exe
2014-06-10 14:57 - 2014-06-10 14:57 - 00000589 _____ () C:\Users\Anke\Desktop\fixlist.txt
2014-06-10 14:49 - 2009-07-14 04:37 - 00000000 ____D () C:\windows\IME
2014-06-10 14:05 - 2014-06-10 14:05 - 00001024 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-10 14:05 - 2014-06-10 14:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-06-10 14:05 - 2014-06-10 14:05 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-10 14:05 - 2014-06-10 14:05 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware
2014-06-10 14:04 - 2014-06-10 14:04 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Anke\Downloads\mbam-setup-2.0.2.1012.exe
2014-06-10 13:46 - 2014-06-10 13:46 - 00002951 _____ () C:\Users\Anke\Desktop\gmer.log
2014-06-10 13:23 - 2014-06-10 13:23 - 00000242 _____ () C:\Users\Anke\Downloads\defogger_enable.log
2014-06-10 13:23 - 2014-06-10 13:08 - 00000470 _____ () C:\Users\Anke\Downloads\defogger_disable.log
2014-06-10 13:19 - 2014-06-10 13:19 - 00051480 _____ () C:\Users\Anke\Desktop\Addition.txt
2014-06-10 13:17 - 2014-06-10 13:17 - 00380416 _____ () C:\Users\Anke\Downloads\nhmwyhxd.exe
2014-06-10 13:12 - 2014-06-10 13:11 - 00051480 _____ () C:\Users\Anke\Downloads\Addition.txt
2014-06-10 13:09 - 2014-06-10 15:01 - 01177600 _____ (Farbar) C:\Users\Anke\Desktop\FRST.exe
2014-06-10 13:08 - 2014-06-10 13:08 - 00000156 _____ () C:\Users\Anke\Desktop\defogger_reenable
2014-06-10 13:07 - 2014-06-10 13:07 - 00050477 _____ () C:\Users\Anke\Downloads\Defogger (1).exe
2014-06-10 12:58 - 2009-07-26 22:06 - 01498742 _____ () C:\windows\system32\PerfStringBackup.INI
2014-05-16 11:08 - 2014-05-16 11:08 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER
2014-05-15 12:01 - 2012-05-03 13:10 - 00692400 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerApp.exe
2014-05-15 12:01 - 2011-07-24 21:59 - 00070832 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerCPLApp.cpl
Some content of TEMP:
====================
C:\Users\Anke\AppData\Local\temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\windows\explorer.exe => File is digitally signed
C:\windows\system32\winlogon.exe => File is digitally signed
C:\windows\system32\wininit.exe => File is digitally signed
C:\windows\system32\svchost.exe => File is digitally signed
C:\windows\system32\services.exe => File is digitally signed
C:\windows\system32\User32.dll => File is digitally signed
C:\windows\system32\userinit.exe => File is digitally signed
C:\windows\system32\rpcss.dll => File is digitally signed
C:\windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-06-08 13:56
==================== End Of Log ============================
--- --- --- --- --- --- Und wie weiss ich jetzt das mein Lappi wieder ok ist? Bin extrem auf Online-Banking angewiesen |
|
14.06.2014, 15:26
| #8 | |
| /// the machine /// TB-Ausbilder | Bankdaten ausgespät, Trojaner entfernen Java und Adobe updaten. Zitat:
 .Mach die Updates jetzt, solange wiederholen bis keine mehr gefunden werden. Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter HKLM Group Policy restriction on software: C:\Program Files\Avira <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Microsoft Security Client <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Bankdaten ausgespät, Trojaner entfernen |
| antivirus, association, avira, bankdaten ausgespät, browser, defender, desktop, device driver, e-banking, entfernen, flash player, js/securitydisabler.a.gen, lightning, programm, scan, services.exe, software, svchost.exe, trojaner, updates, win32/downloadsponsor.a, win32/malavida.a, win32/toolbar.conduit.y, windows xp |
6A1EE83
Revo Uninstaller herunter.
dann auf 
und dann auf 
.
