| |
| |||||||
Log-Analyse und Auswertung: Telekom Abuse BriefWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
| |
31.08.2013, 22:21
| #1 | |
 |  Telekom Abuse Brief Guten Abend, ich habe heute von der telekom einen brief erhalten mit folgendem Betreff: Sicherheitswarnung zu Ihrem Internetzugang "Hacking" Ich wäre sehr dankbar wenn mir jmd helfen könnte das problem zusuchen und zubereinigen. Danke im Vorraus!! mfg blobber edit: suchlauf mit Malwarebytes komplett Zitat:
Geändert von blobber (31.08.2013 um 23:09 Uhr) |
|
01.09.2013, 06:52
| #2 |
| /// the machine /// TB-Ausbilder    | Telekom Abuse Brief hi,
__________________Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ |
|
01.09.2013, 10:00
| #3 | |
| | Telekom Abuse Brief Hier sind die Beiden Logs
__________________ FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-09-2013
Ran by Blobber (administrator) on BLOBBER-PC on 01-09-2013 10:57:31
Running from C:\Users\Blobber\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
( ) C:\Windows\system32\lxczcoms.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(DT Soft Ltd) C:\Program Files (x86)\DAEMON Tools Pro\DTShellHlp.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliType Pro\itype.exe
(Lexmark International, Inc.) C:\Program Files (x86)\Lexmark 1200 Series\LXCZbmgr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe
(Lexmark International, Inc.) C:\Program Files (x86)\Lexmark 1200 Series\lxczbmon.exe
(The Eraser Project) C:\Program Files\Eraser\Eraser.exe
(DT Soft Ltd) C:\Program Files (x86)\DAEMON Tools Pro\DTAgent.exe
(ROCCAT) C:\Program Files (x86)\ROCCAT\Arvo Keyboard\ArvoHID.EXE
(Spotify Ltd) C:\Users\Blobber\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Microsoft Corporation) C:\Windows\System32\WScript.exe
(ROCCAT) C:\Program Files (x86)\ROCCAT\Pyra Mouse\PyraMonitor.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Comvigo, Inc.) C:\Windows\SysWOW64\qimlsrv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Comvigo, Inc.) C:\Windows\SysWOW64\dsrviml.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11860072 2011-06-09] (Realtek Semiconductor)
HKLM\...\Run: [itype] - c:\Program Files\Microsoft IntelliType Pro\itype.exe [1873256 2011-08-10] (Microsoft Corporation)
HKLM\...\Run: [lxczbmgr.exe] - C:\Program Files (x86)\Lexmark 1200 Series\lxczbmgr.exe [74408 2009-04-27] (Lexmark International, Inc.)
HKLM\...\Run: [XboxStat] - C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe [825184 2009-10-01] (Microsoft Corporation)
HKLM\...\Run: [Eraser] - C:\PROGRA~1\Eraser\Eraser.exe [980920 2012-05-22] (The Eraser Project)
HKLM\...\Policies\Explorer: [NoDriveTypeAutoRun] 28
HKLM\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKCU\...\Run: [DAEMON Tools Pro Agent] - C:\Program Files (x86)\DAEMON Tools Pro\DTAgent.exe [4527424 2011-08-17] (DT Soft Ltd)
HKCU\...\Run: [Arvo] - C:\Program Files (x86)\ROCCAT\Arvo Keyboard\ArvoHID.EXE [582144 2010-04-01] (ROCCAT)
HKCU\...\Run: [KiesAirMessage] - C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup [x]
HKCU\...\Run: [KiesPreload] - C:\Program Files (x86)\Samsung\Kies\Kies.exe /preload [x]
HKCU\...\Run: [] - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [x]
HKCU\...\Run: [Spotify Web Helper] - C:\Users\Blobber\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1104384 2013-07-13] (Spotify Ltd)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [37960 2013-05-10] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-05-30] (Apple Inc.)
HKLM-x32\...\Run: [ROCCAT Pyra Mouse] - C:\Program Files (x86)\ROCCAT\Pyra Mouse\PyraMonitor.EXE [532480 2010-09-07] (ROCCAT)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [421776 2012-06-07] (Apple Inc.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-08-20] (Avira Operations GmbH & Co. KG)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IML.lnk
ShortcutTarget: IML.lnk -> C:\Windows\System32\iml.vbs ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IML64.lnk
ShortcutTarget: IML64.lnk -> C:\Windows\SysWOW64\iml.vbs ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://nmd.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.hyrican.de
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - DefaultScope {36F75D26-9879-4801-B461-C0BADA56640E} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=OSJ000&apn_uid=2E53ED22-FD3C-4710-89C0-9837C9067A48&apn_sauid=CC6D340C-9610-460B-ABC7-BB513ABF28C8
SearchScopes: HKCU - {36F75D26-9879-4801-B461-C0BADA56640E} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=OSJ000&apn_uid=2E53ED22-FD3C-4710-89C0-9837C9067A48&apn_sauid=CC6D340C-9610-460B-ABC7-BB513ABF28C8
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Blobber\AppData\Roaming\Mozilla\Firefox\Profiles\935xfpfe.default
FF Homepage: google.de
FF NetworkProxy: "http", "218.241.153.43"
FF NetworkProxy: "http_port", 8080
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=1.6.0_37 - C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Blobber\AppData\Roaming\Mozilla\Firefox\Profiles\935xfpfe.default\searchplugins\11-suche.xml
FF SearchPlugin: C:\Users\Blobber\AppData\Roaming\Mozilla\Firefox\Profiles\935xfpfe.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\Blobber\AppData\Roaming\Mozilla\Firefox\Profiles\935xfpfe.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\Blobber\AppData\Roaming\Mozilla\Firefox\Profiles\935xfpfe.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\Blobber\AppData\Roaming\Mozilla\Firefox\Profiles\935xfpfe.default\searchplugins\webde-suche.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: toolbar - C:\Users\Blobber\AppData\Roaming\Mozilla\Firefox\Profiles\935xfpfe.default\Extensions\toolbar@web.de.xpi
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR RestoreOnStartup: "hxxp://www.google.com/"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.72\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.72\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.72\pdf.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft\u00AE Windows Media Player Firefox Plugin) - C:\Program Files (x86)\Mozilla Firefox\plugins\np-mswmp.dll (Microsoft Corporation)
CHR Plugin: (Winamp Application Detector) - C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll (Nullsoft, Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U37) - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_149.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.370.6) - C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)
CHR Plugin: (Windows Activation Technologies) - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File
CHR Extension: (YouTube) - C:\Users\Blobber\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\Blobber\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Gmail) - C:\Users\Blobber\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-08-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-08-20] (Avira Operations GmbH & Co. KG)
R2 lxcz_device; C:\Windows\system32\lxczcoms.exe [566192 2007-04-19] ( )
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S2 HitmanPro37CrusaderBoot; "C:\Users\Blobber\Desktop\hitmanpro_x64.exe" /crusader:boot [x]
==================== Drivers (Whitelisted) ====================
R3 ArvoFltr; C:\Windows\System32\drivers\ArvoFltr.sys [15872 2009-05-06] (ROCCAT Development, Inc.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-08-20] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-08-20] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-03-31] (Avira Operations GmbH & Co. KG)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [271424 2011-12-17] (DT Soft Ltd)
S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-03-20] ()
S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-03-20] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 netr28ux; system32\DRIVERS\netr28ux.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-09-01 10:56 - 2013-09-01 10:57 - 01590206 _____ (Farbar) C:\Users\Blobber\Desktop\FRST64.exe
2013-09-01 00:09 - 2013-08-21 20:10 - 00000000 ____D C:\Users\Blobber\Desktop\Megaloh - Auf Ewig 2 Mixtape (DE, 2013)
2013-08-31 21:39 - 2013-08-31 21:39 - 00000000 ____D C:\Users\Blobber\Downloads\Category.7.Das.Ende.der.Welt.2005.German.DL.BluRayRip.XViD
2013-08-31 20:00 - 2013-08-31 21:23 - 00000000 ____D C:\Users\Blobber\Desktop\Patrice - 2013
2013-08-30 15:16 - 2013-08-30 15:18 - 00000000 ____D C:\Users\Blobber\Desktop\Separate-El_Mariachi-DE-2013-NOiR
2013-08-30 11:33 - 2013-08-30 01:39 - 00000000 ____D C:\Users\Blobber\Desktop\Sadi Gent - Bis Dato (2013)
2013-08-30 11:31 - 2013-08-30 11:32 - 00000000 ____D C:\Users\Blobber\Desktop\Tone - T.O.N.E. (Deluxe Version) (2013)
2013-08-30 11:16 - 2013-08-30 11:16 - 00000000 ____D C:\Users\Blobber\Desktop\Bewerbungen
2013-08-29 19:05 - 2013-08-29 10:43 - 00000000 ____D C:\Users\Blobber\Desktop\Weekend - Am Wochenende Rapper
2013-08-27 14:32 - 2013-08-29 21:03 - 00000000 ____D C:\Users\Blobber\Desktop\German Top 100 Single Charts 02.09.2013
2013-08-25 19:51 - 2013-08-25 19:51 - 00000000 ____D C:\Users\Blobber\Downloads\Wunderbare Jahre
2013-08-25 19:27 - 2013-08-25 20:35 - 00000000 ____D C:\Users\Blobber\Desktop\Neuer Ordner (2)
2013-08-23 12:00 - 2013-08-23 10:27 - 00000000 ____D C:\Users\Blobber\Desktop\Eko Fresh - Eksodus [Deluxe Edition 2CD] (2013)
2013-08-18 13:00 - 2013-08-18 13:01 - 00000000 ____D C:\Users\Blobber\Desktop\Shaggy - Hot Shot (2001)
2013-08-17 21:36 - 2013-08-17 09:47 - 00000000 ____D C:\Users\Blobber\Downloads\BLUS30780-[The Bureau XCOM Declassified]
2013-08-17 21:07 - 2013-08-17 21:07 - 00000000 ____D C:\Users\Blobber\Desktop\VA-Die_Ultimative_Chartshow_Die_Erfolgreichsten_Saenger_Des_Neuen_Jahrtausends_-2CD-2013-VOiCE
2013-08-17 19:53 - 2013-08-18 10:57 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-17 11:30 - 2013-08-17 00:52 - 00000000 ____D C:\Users\Blobber\Downloads\Saints.Row.IV.PS3-iMARS
2013-08-15 19:10 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-15 19:10 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-15 19:10 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-15 19:10 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-15 19:10 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-15 19:10 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-15 19:10 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-15 19:10 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-15 19:10 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-15 19:10 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-15 19:10 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-15 19:10 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-15 19:10 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-15 19:10 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-15 19:10 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-15 19:10 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-15 19:10 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-15 19:10 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-15 19:10 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-15 19:10 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-15 19:10 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-15 19:10 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-15 19:10 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-15 19:10 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-15 19:10 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-15 19:10 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-15 19:10 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-15 19:10 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-15 19:10 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-15 19:10 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-15 19:10 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-15 19:05 - 2013-08-15 19:06 - 00000000 ____D C:\Windows\system32\MRT
2013-08-15 18:39 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-15 18:39 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-15 18:39 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-15 18:39 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-15 18:39 - 2013-07-09 08:03 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-15 18:39 - 2013-07-09 07:54 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-15 18:39 - 2013-07-09 07:53 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-08-15 18:39 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-15 18:39 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-15 18:39 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-15 18:39 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-15 18:39 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-15 18:39 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-08-15 18:39 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-08-15 18:39 - 2013-07-09 06:53 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-08-15 18:39 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-15 18:39 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-15 18:39 - 2013-07-09 06:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-08-15 18:39 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-15 18:39 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-15 18:39 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-15 18:39 - 2013-07-09 04:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-08-15 18:39 - 2013-07-09 04:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-08-15 18:39 - 2013-07-09 04:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-08-15 18:39 - 2013-07-09 04:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-08-15 18:39 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-15 18:39 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-14 13:39 - 2013-08-14 13:39 - 00000000 ____D C:\Users\Blobber\Downloads\Mademoiselle.Populaire.2012.German.AC3.BDRip.XviD-Awesome
2013-08-14 12:38 - 2013-09-01 10:55 - 00001736 _____ C:\Windows\setupact.log
2013-08-14 12:38 - 2013-08-14 12:38 - 00000000 _____ C:\Windows\setuperr.log
2013-08-10 19:45 - 2013-08-08 21:08 - 00000000 ____D C:\Users\Blobber\Downloads\Trance.2013.UNZENSIERT.German.AC3.BDRip.XviD-GRC
2013-08-10 11:17 - 2013-08-21 13:34 - 00000000 ____D C:\Users\Blobber\Desktop\Neuer Ordner
==================== One Month Modified Files and Folders =======
2013-09-01 10:57 - 2013-09-01 10:57 - 00000000 ____D C:\FRST
2013-09-01 10:57 - 2013-09-01 10:56 - 01590206 _____ (Farbar) C:\Users\Blobber\Desktop\FRST64.exe
2013-09-01 10:55 - 2013-08-14 12:38 - 00001736 _____ C:\Windows\setupact.log
2013-09-01 10:55 - 2013-02-02 20:17 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-01 10:55 - 2012-11-03 18:08 - 00000416 ____H C:\Windows\Tasks\OptimizerPro1UpdaterTask{C6769FBF-42FD-4A4F-A88F-D4EE03FD9F7A}.job
2013-09-01 10:55 - 2011-07-21 12:14 - 00000000 ____D C:\ProgramData\NVIDIA
2013-09-01 10:55 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-01 00:10 - 2011-12-17 01:01 - 01432608 _____ C:\Windows\WindowsUpdate.log
2013-08-31 23:42 - 2013-02-02 20:17 - 00001112 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-31 23:16 - 2009-07-14 06:45 - 00019904 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-31 23:16 - 2009-07-14 06:45 - 00019904 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-31 21:42 - 2013-05-13 21:08 - 00000000 ____D C:\Program Files (x86)\JDownloader 2
2013-08-31 21:39 - 2013-08-31 21:39 - 00000000 ____D C:\Users\Blobber\Downloads\Category.7.Das.Ende.der.Welt.2005.German.DL.BluRayRip.XViD
2013-08-31 21:23 - 2013-08-31 20:00 - 00000000 ____D C:\Users\Blobber\Desktop\Patrice - 2013
2013-08-31 20:42 - 2013-02-02 20:17 - 00002190 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-08-30 15:18 - 2013-08-30 15:16 - 00000000 ____D C:\Users\Blobber\Desktop\Separate-El_Mariachi-DE-2013-NOiR
2013-08-30 11:32 - 2013-08-30 11:31 - 00000000 ____D C:\Users\Blobber\Desktop\Tone - T.O.N.E. (Deluxe Version) (2013)
2013-08-30 11:16 - 2013-08-30 11:16 - 00000000 ____D C:\Users\Blobber\Desktop\Bewerbungen
2013-08-30 01:39 - 2013-08-30 11:33 - 00000000 ____D C:\Users\Blobber\Desktop\Sadi Gent - Bis Dato (2013)
2013-08-29 21:04 - 2011-12-17 01:04 - 00000000 ____D C:\Users\Blobber
2013-08-29 21:03 - 2013-08-27 14:32 - 00000000 ____D C:\Users\Blobber\Desktop\German Top 100 Single Charts 02.09.2013
2013-08-29 21:03 - 2013-06-13 16:52 - 00000000 ____D C:\Users\Blobber\Documents\New Star Soccer 5
2013-08-29 21:03 - 2013-04-03 12:28 - 00000000 ____D C:\Users\Blobber\AppData\Roaming\Malwarebytes
2013-08-29 21:03 - 2013-02-02 20:17 - 00000000 ____D C:\Program Files (x86)\Google
2013-08-29 21:03 - 2012-11-01 14:17 - 00000000 ____D C:\Users\Blobber\Documents\FUSSBALL MANAGER 13
2013-08-29 21:03 - 2012-09-11 22:25 - 00000000 ____D C:\Users\Blobber\Documents\FIFA 13
2013-08-29 21:03 - 2012-05-17 23:16 - 00000000 ____D C:\Users\Blobber\Documents\FIFA 12
2013-08-29 21:03 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-08-29 21:03 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration
2013-08-29 10:43 - 2013-08-29 19:05 - 00000000 ____D C:\Users\Blobber\Desktop\Weekend - Am Wochenende Rapper
2013-08-25 20:35 - 2013-08-25 19:27 - 00000000 ____D C:\Users\Blobber\Desktop\Neuer Ordner (2)
2013-08-25 19:51 - 2013-08-25 19:51 - 00000000 ____D C:\Users\Blobber\Downloads\Wunderbare Jahre
2013-08-23 10:27 - 2013-08-23 12:00 - 00000000 ____D C:\Users\Blobber\Desktop\Eko Fresh - Eksodus [Deluxe Edition 2CD] (2013)
2013-08-21 20:10 - 2013-09-01 00:09 - 00000000 ____D C:\Users\Blobber\Desktop\Megaloh - Auf Ewig 2 Mixtape (DE, 2013)
2013-08-21 13:34 - 2013-08-10 11:17 - 00000000 ____D C:\Users\Blobber\Desktop\Neuer Ordner
2013-08-20 12:28 - 2013-02-14 16:43 - 00000000 ____D C:\Users\Blobber\AppData\Roaming\vlc
2013-08-20 11:08 - 2013-05-06 11:30 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-08-20 11:08 - 2013-03-31 11:21 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-08-20 11:08 - 2013-03-31 11:21 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-08-19 11:52 - 2012-04-25 14:45 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-18 20:31 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-08-18 13:01 - 2013-08-18 13:00 - 00000000 ____D C:\Users\Blobber\Desktop\Shaggy - Hot Shot (2001)
2013-08-18 10:57 - 2013-08-17 19:53 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-17 21:07 - 2013-08-17 21:07 - 00000000 ____D C:\Users\Blobber\Desktop\VA-Die_Ultimative_Chartshow_Die_Erfolgreichsten_Saenger_Des_Neuen_Jahrtausends_-2CD-2013-VOiCE
2013-08-17 11:03 - 2011-12-29 15:08 - 00000290 _____ C:\Windows\Lexstat.ini
2013-08-17 09:47 - 2013-08-17 21:36 - 00000000 ____D C:\Users\Blobber\Downloads\BLUS30780-[The Bureau XCOM Declassified]
2013-08-17 00:52 - 2013-08-17 11:30 - 00000000 ____D C:\Users\Blobber\Downloads\Saints.Row.IV.PS3-iMARS
2013-08-16 11:30 - 2011-07-20 16:06 - 00000000 ____D C:\Windows\Panther
2013-08-15 19:08 - 2011-04-12 09:43 - 00654150 _____ C:\Windows\system32\perfh007.dat
2013-08-15 19:08 - 2011-04-12 09:43 - 00130022 _____ C:\Windows\system32\perfc007.dat
2013-08-15 19:08 - 2009-07-14 07:13 - 01519798 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-15 19:06 - 2013-08-15 19:05 - 00000000 ____D C:\Windows\system32\MRT
2013-08-15 19:05 - 2011-07-21 08:47 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-14 13:39 - 2013-08-14 13:39 - 00000000 ____D C:\Users\Blobber\Downloads\Mademoiselle.Populaire.2012.German.AC3.BDRip.XviD-Awesome
2013-08-14 12:38 - 2013-08-14 12:38 - 00000000 _____ C:\Windows\setuperr.log
2013-08-13 22:27 - 2013-06-08 12:25 - 00000000 ____D C:\Users\Blobber\AppData\Roaming\FileZilla
2013-08-13 22:27 - 2012-04-09 12:24 - 00000000 ____D C:\Users\Blobber\AppData\Roaming\Winamp
2013-08-10 11:01 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-08-08 21:08 - 2013-08-10 19:45 - 00000000 ____D C:\Users\Blobber\Downloads\Trance.2013.UNZENSIERT.German.AC3.BDRip.XviD-GRC
2013-08-07 04:22 - 2010-11-21 05:27 - 00278800 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
Files to move or delete:
====================
ZeroAccess:
C:\Users\Blobber\AppData\Local\Google\Desktop\Install\{8db42b93-ae15-dbdf-807d-363e71fb59e0}
ZeroAccess:
C:\Program Files (x86)\Google\Desktop\Install\{8db42b93-ae15-dbdf-807d-363e71fb59e0}
C:\ProgramData\winiml.dat
C:\Users\Blobber\AppData\Local\Temp\rtdrvmon.exe
C:\Users\Blobber\AppData\Local\Temp\jna-Blobber\jna6906454972334313066.dll
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
C:\Program Files\Windows Defender\de-DE => ATTENTION: ZeroAccess. Use DeleteJunctionsIndirectory: C:\Program Files\Windows Defender
LastRegBack: 2013-08-18 20:23
==================== End Of Log ============================
Zitat:
|
|
01.09.2013, 12:48
| #4 | |
| /// the machine /// TB-Ausbilder | Telekom Abuse Brief So funktioniert es:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!Downloade dir bitte Combofix vom folgenden Downloadspiegel Link 1 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
01.09.2013, 16:31
| #5 |
| | Telekom Abuse BriefCode:
ATTFilter ComboFix 13-08-31.01 - Blobber 01.09.2013 17:18:30.1.4 - x64
ausgeführt von:: c:\users\Blobber\Desktop\ComboFix.exe
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\Install.exe
c:\program files (x86)\Google\Desktop\Install
c:\program files (x86)\Google\Desktop\Install\{8db42b93-ae15-dbdf-807d-363e71fb59e0}\9519~1\A535~1\E628~1\{8db42b93-ae15-dbdf-807d-363e71fb59e0}\@
c:\program files (x86)\Google\Desktop\Install\{8db42b93-ae15-dbdf-807d-363e71fb59e0}\9519~1\A535~1\E628~1\{8db42b93-ae15-dbdf-807d-363e71fb59e0}\U\00000001.@
c:\program files (x86)\Google\Desktop\Install\{8db42b93-ae15-dbdf-807d-363e71fb59e0}\9519~1\A535~1\E628~1\{8db42b93-ae15-dbdf-807d-363e71fb59e0}\U\00000002.@
c:\program files (x86)\Google\Desktop\Install\{8db42b93-ae15-dbdf-807d-363e71fb59e0}\9519~1\A535~1\E628~1\{8db42b93-ae15-dbdf-807d-363e71fb59e0}\U\80000000.@
c:\program files (x86)\Google\Desktop\Install\{8db42b93-ae15-dbdf-807d-363e71fb59e0}\9519~1\A535~1\E628~1\{8db42b93-ae15-dbdf-807d-363e71fb59e0}\U\80000001.@
c:\program files (x86)\Google\Desktop\Install\{8db42b93-ae15-dbdf-807d-363e71fb59e0}\9519~1\A535~1\E628~1\{8db42b93-ae15-dbdf-807d-363e71fb59e0}\U\800000cb.@
c:\users\Blobber\AppData\Local\Google\Desktop\Install
c:\users\Blobber\AppData\Local\Google\Desktop\Install\{8db42b93-ae15-dbdf-807d-363e71fb59e0}\2E2F~1\28F0~1\E628~1\{8db42b93-ae15-dbdf-807d-363e71fb59e0}\@
c:\windows\jestertb.dll
c:\windows\SysWow64\ChilkatMail_v7_9.dll
c:\windows\SysWow64\SETBD94.tmp
c:\windows\SysWow64\SETE111.tmp
c:\windows\SysWow64\SETF772.tmp
c:\windows\SysWow64\tmp351D.tmp
c:\windows\SysWow64\tmp351E.tmp
c:\windows\SysWow64\tmp8A36.tmp
c:\windows\SysWow64\tmp8B9D.tmp
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-08-01 bis 2013-09-01 ))))))))))))))))))))))))))))))
.
.
2013-09-01 15:22 . 2013-09-01 15:22 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2013-09-01 15:22 . 2013-09-01 15:22 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-09-01 08:57 . 2013-09-01 08:57 -------- d-----w- C:\FRST
2013-08-31 05:50 . 2013-08-19 22:46 9515512 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{7F6641C7-D43D-42EE-8F4B-DBD35370594B}\mpengine.dll
2013-08-15 17:05 . 2013-08-15 17:06 -------- d-----w- c:\windows\system32\MRT
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-08-20 09:08 . 2013-05-06 09:30 81112 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2013-08-20 09:08 . 2013-03-31 09:21 132088 ----a-w- c:\windows\system32\drivers\avipbb.sys
2013-08-20 09:08 . 2013-03-31 09:21 105344 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2013-08-15 17:05 . 2011-07-21 06:47 78161360 ----a-w- c:\windows\system32\MRT.exe
2013-08-07 02:22 . 2010-11-21 03:27 278800 ------w- c:\windows\system32\MpSigStub.exe
2013-07-12 09:32 . 2012-04-04 13:57 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-07-12 09:32 . 2011-12-16 23:29 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-07-09 04:45 . 2013-08-15 16:39 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2013-06-05 03:34 . 2013-07-11 11:55 3153920 ----a-w- c:\windows\system32\win32k.sys
2013-06-04 06:00 . 2013-07-11 11:55 624128 ----a-w- c:\windows\system32\qedit.dll
2013-06-04 04:53 . 2013-07-11 11:55 509440 ----a-w- c:\windows\SysWow64\qedit.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Pro Agent"="c:\program files (x86)\DAEMON Tools Pro\DTAgent.exe" [2011-08-17 4527424]
"Arvo"="c:\program files (x86)\ROCCAT\Arvo Keyboard\ArvoHID.EXE" [2010-04-01 582144]
"Spotify Web Helper"="c:\users\Blobber\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2013-07-13 1104384]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2013-05-10 37960]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-30 59280]
"ROCCAT Pyra Mouse"="c:\program files (x86)\ROCCAT\Pyra Mouse\PyraMonitor.EXE" [2010-09-07 532480]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-06-07 421776]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-08-20 347192]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
IML.lnk - c:\windows\System32\iml.vbs [2010-5-21 4472]
IML64.lnk - c:\windows\SysWOW64\iml.vbs [2010-5-21 4472]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37Crusader]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37CrusaderBoot]
@=""
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 HitmanPro37CrusaderBoot;HitmanPro 3.7 Crusader (Boot);c:\users\Blobber\Desktop\hitmanpro_x64.exe;c:\users\Blobber\Desktop\hitmanpro_x64.exe [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 FsUsbExDisk;FsUsbExDisk;c:\windows\SysWOW64\FsUsbExDisk.SYS;c:\windows\SysWOW64\FsUsbExDisk.SYS [x]
R3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
R3 NvStUSB;NVIDIA Stereoscopic 3D USB driver;c:\windows\system32\drivers\nvstusb.sys;c:\windows\SYSNATIVE\drivers\nvstusb.sys [x]
R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;%TsUsbGD.DeviceDesc.Generic%;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S3 ArvoFltr;ROCCAT Arvo;c:\windows\system32\drivers\ArvoFltr.sys;c:\windows\SYSNATIVE\drivers\ArvoFltr.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
S3 MBfilt;MBfilt;c:\windows\system32\drivers\MBfilt64.sys;c:\windows\SYSNATIVE\drivers\MBfilt64.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-08-31 18:42 1177552 ----a-w- c:\program files (x86)\Google\Chrome\Application\29.0.1547.62\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2013-06-13 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-04 09:32]
.
2013-09-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-02-02 18:17]
.
2013-09-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-02-02 18:17]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-06-09 11860072]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-03-25 167960]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-03-25 391704]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-03-25 418840]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2011-08-10 1873256]
"lxczbmgr.exe"="c:\program files (x86)\Lexmark 1200 Series\lxczbmgr.exe" [2009-04-27 74408]
"XboxStat"="c:\program files\Microsoft Xbox 360 Accessories\XboxStat.exe" [2009-10-01 825184]
"Eraser"="c:\progra~1\Eraser\Eraser.exe" [2012-05-22 980920]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://google.de/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
mSearchAssistant = hxxp://www.google.com
TCP: DhcpNameServer = 192.168.2.1 192.168.2.1
FF - ProfilePath - c:\users\Blobber\AppData\Roaming\Mozilla\Firefox\Profiles\935xfpfe.default\
FF - prefs.js: browser.startup.homepage - google.de
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKCU-Run-KiesAirMessage - c:\program files (x86)\Samsung\Kies\KiesAirMessage.exe
Wow6432Node-HKCU-Run-KiesPreload - c:\program files (x86)\Samsung\Kies\Kies.exe
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
AddRemove-IMLock - c:\windows\System32\tnblf.exe
AddRemove-JNLP - c:\windows\system32\javaws.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HitmanPro37CrusaderBoot]
"ImagePath"="\"c:\users\Blobber\Desktop\hitmanpro_x64.exe\" /crusader:boot"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
c:\program files (x86)\Lexmark 1200 Series\lxczbmon.exe
c:\program files (x86)\DAEMON Tools Pro\DTShellHlp.exe
c:\windows\SysWOW64\qimlsrv.exe
c:\windows\SysWOW64\dsrviml.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2013-09-01 17:30:44 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2013-09-01 15:30
.
Vor Suchlauf: 16 Verzeichnis(se), 758.988.091.392 Bytes frei
Nach Suchlauf: 20 Verzeichnis(se), 758.413.012.992 Bytes frei
.
- - End Of File - - 79EFE6893B7862735C063553BECD1B11
A36C5E4F47E84449FF07ED3517B43A31
|
|
01.09.2013, 17:39
| #6 |
| /// the machine /// TB-Ausbilder | Telekom Abuse Brief Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ --> Telekom Abuse Brief |
|
02.09.2013, 10:36
| #7 |
| | Telekom Abuse BriefCode:
ATTFilter
Code:
ATTFilter # AdwCleaner v3.002 - Bericht erstellt am 02/09/2013 um 11:19:07
# Updated 01/09/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Blobber - BLOBBER-PC
# Gestartet von : C:\Users\Blobber\Desktop\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Datei Gelöscht : C:\Windows\System32\roboot64.exe
Datei Gelöscht : C:\Users\Blobber\AppData\Roaming\Mozilla\Firefox\Profiles\935xfpfe.default\searchplugins\11-suche.xml
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_nero-multimedia-suite_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_nero-multimedia-suite_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{2CE4D4CF-B278-4126-AD1E-B622DA2E8339}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2CE4D4CF-B278-4126-AD1E-B622DA2E8339}
Schlüssel Gelöscht : HKLM\Software\systweak
***** [ Browser ] *****
-\\ Internet Explorer v10.0.9200.16660
-\\ Mozilla Firefox v23.0.1 (de)
[ Datei : C:\Users\Blobber\AppData\Roaming\Mozilla\Firefox\Profiles\935xfpfe.default\prefs.js ]
-\\ Google Chrome v29.0.1547.62
[ Datei : C:\Users\Blobber\AppData\Local\Google\Chrome\User Data\Default\preferences ]
*************************
AdwCleaner[R0].txt - [1849 octets] - [02/09/2013 11:18:17]
AdwCleaner[S0].txt - [1770 octets] - [02/09/2013 11:19:07]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1830 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.5.7 (09.01.2013:1)
OS: Windows 7 Home Premium x64
Ran by Blobber on 02.09.2013 at 11:21:52,36
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{36F75D26-9879-4801-B461-C0BADA56640E}
~~~ Files
~~~ Folders
Successfully deleted: [Empty Folder] C:\Users\Blobber\appdata\local\{2EBF3891-C7A8-49EF-AA76-3B9464D80B0A}
Successfully deleted: [Empty Folder] C:\Users\Blobber\appdata\local\{38A686F4-157B-4613-9EB9-D7784B7C1353}
Successfully deleted: [Empty Folder] C:\Users\Blobber\appdata\local\{6FA838CC-D41F-43FF-B66A-F46E2F14EC79}
Successfully deleted: [Empty Folder] C:\Users\Blobber\appdata\local\{7CFA2115-696E-438B-85F6-EBC4D1AA7CB0}
Successfully deleted: [Empty Folder] C:\Users\Blobber\appdata\local\{9155AD82-F0AF-4684-B37F-FD2DDEC3BA5C}
~~~ FireFox
Emptied folder: C:\Users\Blobber\AppData\Roaming\mozilla\firefox\profiles\935xfpfe.default\minidumps [129 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 02.09.2013 at 11:33:21,67
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
02.09.2013, 14:17
| #8 |
| /// the machine /// TB-Ausbilder | Telekom Abuse BriefESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
03.09.2013, 19:09
| #9 |
| | Telekom Abuse Brief hi, sry hat ein wenig gedauert, war leider nicht daheim.Danke das du mir die ganze zeit hilfst hier die logs: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=40b7f4e88d335546867ed453d9788201
# engine=14998
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-09-03 06:01:10
# local_time=2013-09-03 08:01:10 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 96 3746 243654560 0 0
# compatibility_mode=5893 16776573 100 94 31453 129861120 0 0
# scanned=175429
# found=6
# cleaned=0
# scan_time=3345
sh=A28C6EB61DAC34A6E1AB0FB06D8A36907545EB5E ft=1 fh=65a7422644c3d8e5 vn="a variant of Win64/Sirefef.AW trojan" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\Google\Desktop\Install\{8db42b93-ae15-dbdf-807d-363e71fb59e0}\9519~1\A535~1\E628~1\{8db42b93-ae15-dbdf-807d-363e71fb59e0}\U\80000000.@.vir"
sh=D9045FF79BAC32DCC44E8F1F43046D70BC766812 ft=1 fh=dbcc1443bc2918ce vn="Win64/Sirefef.BB trojan" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\Google\Desktop\Install\{8db42b93-ae15-dbdf-807d-363e71fb59e0}\9519~1\A535~1\E628~1\{8db42b93-ae15-dbdf-807d-363e71fb59e0}\U\80000001.@.vir"
sh=06E17A1686BC808E8DB4A72A0AED2FC59D09AED0 ft=1 fh=a645ebe46172e0bc vn="a variant of Win64/Sirefef.AV trojan" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\Google\Desktop\Install\{8db42b93-ae15-dbdf-807d-363e71fb59e0}\9519~1\A535~1\E628~1\{8db42b93-ae15-dbdf-807d-363e71fb59e0}\U\800000cb.@.vir"
sh=C86516F855D45A8169A51C8F855BFE4B3D70D96C ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\Blobber\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39\6afd5fa7-309e3ca6"
sh=756064B61E70C0780D2D412E97F83682F43DC925 ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\Blobber\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51\63ddf4b3-248ea0a1"
sh=5598835547830DAB63E916AB3DBF7C1FDB232A86 ft=0 fh=0000000000000000 vn="a variant of Java/Exploit.CVE-2013-1493.FY trojan" ac=I fn="C:\Users\Blobber\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54\469a3536-6eab636c"
Code:
ATTFilter Results of screen317's Security Check version 0.99.72 Windows 7 Service Pack 1 x64 (UAC is disabled!) Internet Explorer 10 ``````````````Antivirus/Firewall Check:`````````````` Avira Desktop Antivirus up to date! (On Access scanning disabled!) `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware Version 1.75.0.1300 Java(TM) 6 Update 22 Java(TM) 6 Update 37 Java version out of Date! Adobe Flash Player 11.8.800.94 Adobe Reader 10.1.7 Adobe Reader out of Date! Mozilla Firefox (23.0.1) Google Chrome 28.0.1500.95 Google Chrome 29.0.1547.62 ````````Process Check: objlist.exe by Laurent```````` Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbamgui.exe Avira Antivir avgnt.exe Avira Antivir avguard.exe Malwarebytes' Anti-Malware mbamscheduler.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03-09-2013 02
Ran by Blobber (administrator) on BLOBBER-PC on 03-09-2013 20:07:02
Running from C:\Users\Blobber\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
( ) C:\Windows\system32\lxczcoms.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(DT Soft Ltd) C:\Program Files (x86)\DAEMON Tools Pro\DTShellHlp.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliType Pro\itype.exe
(Lexmark International, Inc.) C:\Program Files (x86)\Lexmark 1200 Series\LXCZbmgr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe
(The Eraser Project) C:\Program Files\Eraser\Eraser.exe
(DT Soft Ltd) C:\Program Files (x86)\DAEMON Tools Pro\DTAgent.exe
(ROCCAT) C:\Program Files (x86)\ROCCAT\Arvo Keyboard\ArvoHID.EXE
(Spotify Ltd) C:\Users\Blobber\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Lexmark International, Inc.) C:\Program Files (x86)\Lexmark 1200 Series\lxczbmon.exe
(Microsoft Corporation) C:\Windows\System32\WScript.exe
(ROCCAT) C:\Program Files (x86)\ROCCAT\Pyra Mouse\PyraMonitor.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Comvigo, Inc.) C:\Windows\SysWOW64\qimlsrv.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Comvigo, Inc.) C:\Windows\SysWOW64\dsrviml.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11860072 2011-06-09] (Realtek Semiconductor)
HKLM\...\Run: [itype] - c:\Program Files\Microsoft IntelliType Pro\itype.exe [1873256 2011-08-10] (Microsoft Corporation)
HKLM\...\Run: [lxczbmgr.exe] - C:\Program Files (x86)\Lexmark 1200 Series\lxczbmgr.exe [74408 2009-04-27] (Lexmark International, Inc.)
HKLM\...\Run: [XboxStat] - C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe [825184 2009-10-01] (Microsoft Corporation)
HKLM\...\Run: [Eraser] - C:\PROGRA~1\Eraser\Eraser.exe [980920 2012-05-22] (The Eraser Project)
HKLM\...\Policies\Explorer: [NoDriveTypeAutoRun] 28
HKLM\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKLM\...\Policies\Explorer: [NoDrives] 0
HKCU\...\Run: [DAEMON Tools Pro Agent] - C:\Program Files (x86)\DAEMON Tools Pro\DTAgent.exe [4527424 2011-08-17] (DT Soft Ltd)
HKCU\...\Run: [Arvo] - C:\Program Files (x86)\ROCCAT\Arvo Keyboard\ArvoHID.EXE [582144 2010-04-01] (ROCCAT)
HKCU\...\Run: [Spotify Web Helper] - C:\Users\Blobber\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1104384 2013-07-13] (Spotify Ltd)
HKCU\...\Policies\Explorer: [NoDrives] 0
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [37960 2013-05-10] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-05-30] (Apple Inc.)
HKLM-x32\...\Run: [ROCCAT Pyra Mouse] - C:\Program Files (x86)\ROCCAT\Pyra Mouse\PyraMonitor.EXE [532480 2010-09-07] (ROCCAT)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [421776 2012-06-07] (Apple Inc.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-08-20] (Avira Operations GmbH & Co. KG)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IML.lnk
ShortcutTarget: IML.lnk -> C:\Windows\System32\iml.vbs ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IML64.lnk
ShortcutTarget: IML64.lnk -> C:\Windows\SysWOW64\iml.vbs ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.hyrican.de
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Blobber\AppData\Roaming\Mozilla\Firefox\Profiles\935xfpfe.default
FF Homepage: google.de
FF NetworkProxy: "http", "218.241.153.43"
FF NetworkProxy: "http_port", 8080
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=1.6.0_37 - C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Blobber\AppData\Roaming\Mozilla\Firefox\Profiles\935xfpfe.default\searchplugins\11-suche.xml
FF SearchPlugin: C:\Users\Blobber\AppData\Roaming\Mozilla\Firefox\Profiles\935xfpfe.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\Blobber\AppData\Roaming\Mozilla\Firefox\Profiles\935xfpfe.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\Blobber\AppData\Roaming\Mozilla\Firefox\Profiles\935xfpfe.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\Blobber\AppData\Roaming\Mozilla\Firefox\Profiles\935xfpfe.default\searchplugins\webde-suche.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: toolbar - C:\Users\Blobber\AppData\Roaming\Mozilla\Firefox\Profiles\935xfpfe.default\Extensions\toolbar@web.de.xpi
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR RestoreOnStartup: "hxxp://www.google.com/"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.62\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.62\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.62\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft\u00AE Windows Media Player Firefox Plugin) - C:\Program Files (x86)\Mozilla Firefox\plugins\np-mswmp.dll (Microsoft Corporation)
CHR Plugin: (Winamp Application Detector) - C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll (Nullsoft, Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U37) - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_149.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.370.6) - C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)
CHR Plugin: (Windows Activation Technologies) - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File
CHR Extension: (YouTube) - C:\Users\Blobber\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\Blobber\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Gmail) - C:\Users\Blobber\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-08-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-08-20] (Avira Operations GmbH & Co. KG)
R2 lxcz_device; C:\Windows\system32\lxczcoms.exe [566192 2007-04-19] ( )
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S2 HitmanPro37CrusaderBoot; "C:\Users\Blobber\Desktop\hitmanpro_x64.exe" /crusader:boot [x]
==================== Drivers (Whitelisted) ====================
R3 ArvoFltr; C:\Windows\System32\drivers\ArvoFltr.sys [15872 2009-05-06] (ROCCAT Development, Inc.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-03] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-08-20] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-03-31] (Avira Operations GmbH & Co. KG)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [271424 2011-12-17] (DT Soft Ltd)
S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-03-20] ()
S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-03-20] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 netr28ux; system32\DRIVERS\netr28ux.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-09-03 19:38 - 2013-09-03 19:38 - 01950412 _____ (Farbar) C:\Users\Blobber\Desktop\FRST64.exe
2013-09-03 18:58 - 2013-09-03 18:58 - 95638383 _____ C:\Windows\SysWOW64\�쇌¡
2013-09-03 13:34 - 2013-09-03 13:35 - 00000000 ____D C:\Users\Blobber\Desktop\Funkverteidiger-FV-WEB-DE-2013-TPMF
2013-09-03 13:34 - 2013-09-03 13:34 - 00000000 _____ C:\Users\Blobber\Downloads\Funkverteidiger-FV-WEB-DE-2013-TPMF.rar.part
2013-09-03 11:23 - 2013-09-02 15:40 - 1181711357 _____ C:\Users\Blobber\Downloads\pso-fg_x264.mkv
2013-09-02 13:19 - 2007-11-19 23:21 - 733968384 _____ C:\Users\Blobber\Downloads\Leni Riefenstahl - Olympia 1, Fest Der Volker (1936).avi
2013-09-02 13:17 - 2007-11-19 21:55 - 729039872 _____ C:\Users\Blobber\Downloads\Leni Riefenstahl - Olympia 2, Fest Der Schonheit (1936).avi
2013-09-02 13:06 - 2013-09-02 13:14 - 00000000 ____D C:\Users\Blobber\Desktop\Propagandafilme
2013-09-02 11:21 - 2013-09-02 11:21 - 00000000 ____D C:\Windows\ERUNT
2013-09-02 11:18 - 2013-09-02 11:19 - 00000000 ____D C:\AdwCleaner
2013-09-01 17:30 - 2013-09-01 17:30 - 00017415 _____ C:\ComboFix.txt
2013-09-01 17:25 - 2013-09-01 17:25 - 00000546 _____ C:\Windows\PFRO.log
2013-09-01 17:00 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-09-01 17:00 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-09-01 17:00 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-09-01 17:00 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-09-01 17:00 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-09-01 17:00 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-09-01 17:00 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-09-01 17:00 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-09-01 16:59 - 2013-09-01 17:31 - 00000000 ____D C:\Qoobox
2013-09-01 16:59 - 2013-09-01 17:29 - 00000000 ____D C:\Windows\erdnt
2013-09-01 10:57 - 2013-09-01 10:57 - 00000000 ____D C:\FRST
2013-09-01 00:09 - 2013-09-01 11:05 - 00000000 ____D C:\Users\Blobber\Desktop\Megaloh - Auf Ewig 2 Mixtape (DE, 2013)
2013-08-31 21:39 - 2013-08-31 21:39 - 00000000 ____D C:\Users\Blobber\Downloads\Category.7.Das.Ende.der.Welt.2005.German.DL.BluRayRip.XViD
2013-08-31 20:00 - 2013-08-31 21:23 - 00000000 ____D C:\Users\Blobber\Desktop\Patrice - 2013
2013-08-30 15:16 - 2013-08-30 15:18 - 00000000 ____D C:\Users\Blobber\Desktop\Separate-El_Mariachi-DE-2013-NOiR
2013-08-30 11:31 - 2013-08-30 11:32 - 00000000 ____D C:\Users\Blobber\Desktop\Tone - T.O.N.E. (Deluxe Version) (2013)
2013-08-30 11:16 - 2013-08-30 11:16 - 00000000 ____D C:\Users\Blobber\Desktop\Bewerbungen
2013-08-29 19:05 - 2013-08-29 10:43 - 00000000 ____D C:\Users\Blobber\Desktop\Weekend - Am Wochenende Rapper
2013-08-27 14:32 - 2013-08-29 21:03 - 00000000 ____D C:\Users\Blobber\Desktop\German Top 100 Single Charts 02.09.2013
2013-08-25 19:51 - 2013-08-25 19:51 - 00000000 ____D C:\Users\Blobber\Downloads\Wunderbare Jahre
2013-08-25 19:27 - 2013-09-01 11:59 - 00000000 ____D C:\Users\Blobber\Desktop\Neuer Ordner (2)
2013-08-23 12:00 - 2013-08-23 10:27 - 00000000 ____D C:\Users\Blobber\Desktop\Eko Fresh - Eksodus [Deluxe Edition 2CD] (2013)
2013-08-18 13:00 - 2013-08-18 13:01 - 00000000 ____D C:\Users\Blobber\Desktop\Shaggy - Hot Shot (2001)
2013-08-17 21:36 - 2013-08-17 09:47 - 00000000 ____D C:\Users\Blobber\Downloads\BLUS30780-[The Bureau XCOM Declassified]
2013-08-17 21:07 - 2013-08-17 21:07 - 00000000 ____D C:\Users\Blobber\Desktop\VA-Die_Ultimative_Chartshow_Die_Erfolgreichsten_Saenger_Des_Neuen_Jahrtausends_-2CD-2013-VOiCE
2013-08-17 19:53 - 2013-08-18 10:57 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-17 11:30 - 2013-08-17 00:52 - 00000000 ____D C:\Users\Blobber\Downloads\Saints.Row.IV.PS3-iMARS
2013-08-15 19:10 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-15 19:10 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-15 19:10 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-15 19:10 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-15 19:10 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-15 19:10 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-15 19:10 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-15 19:10 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-15 19:10 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-15 19:10 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-15 19:10 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-15 19:10 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-15 19:10 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-15 19:10 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-15 19:10 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-15 19:10 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-15 19:10 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-15 19:10 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-15 19:10 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-15 19:10 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-15 19:10 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-15 19:10 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-15 19:10 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-15 19:10 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-15 19:10 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-15 19:10 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-15 19:10 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-15 19:10 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-15 19:10 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-15 19:10 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-15 19:10 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-15 19:05 - 2013-08-15 19:06 - 00000000 ____D C:\Windows\system32\MRT
2013-08-15 18:39 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-15 18:39 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-15 18:39 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-15 18:39 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-15 18:39 - 2013-07-09 08:03 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-15 18:39 - 2013-07-09 07:54 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-15 18:39 - 2013-07-09 07:53 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-08-15 18:39 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-15 18:39 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-15 18:39 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-15 18:39 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-15 18:39 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-15 18:39 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-08-15 18:39 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-08-15 18:39 - 2013-07-09 06:53 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-08-15 18:39 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-15 18:39 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-15 18:39 - 2013-07-09 06:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-08-15 18:39 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-15 18:39 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-15 18:39 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-15 18:39 - 2013-07-09 04:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-08-15 18:39 - 2013-07-09 04:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-08-15 18:39 - 2013-07-09 04:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-08-15 18:39 - 2013-07-09 04:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-08-15 18:39 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-15 18:39 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-14 13:39 - 2013-08-14 13:39 - 00000000 ____D C:\Users\Blobber\Downloads\Mademoiselle.Populaire.2012.German.AC3.BDRip.XviD-Awesome
2013-08-14 12:38 - 2013-09-03 18:58 - 00002128 _____ C:\Windows\setupact.log
2013-08-14 12:38 - 2013-08-14 12:38 - 00000000 _____ C:\Windows\setuperr.log
2013-08-10 19:45 - 2013-08-08 21:08 - 00000000 ____D C:\Users\Blobber\Downloads\Trance.2013.UNZENSIERT.German.AC3.BDRip.XviD-GRC
2013-08-10 11:17 - 2013-08-21 13:34 - 00000000 ____D C:\Users\Blobber\Desktop\Neuer Ordner
==================== One Month Modified Files and Folders =======
2013-09-03 20:06 - 2013-09-03 20:03 - 00003392 _____ C:\Users\Blobber\Desktop\Neues Textdokument.txt
2013-09-03 19:42 - 2013-02-02 20:17 - 00001112 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-03 19:38 - 2013-09-03 19:38 - 01950412 _____ (Farbar) C:\Users\Blobber\Desktop\FRST64.exe
2013-09-03 19:07 - 2009-07-14 06:45 - 00019904 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-03 19:07 - 2009-07-14 06:45 - 00019904 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-03 19:01 - 2011-12-17 01:01 - 01565760 _____ C:\Windows\WindowsUpdate.log
2013-09-03 18:59 - 2013-02-02 20:17 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-03 18:58 - 2013-09-03 18:58 - 95638383 _____ C:\Windows\SysWOW64\�쇌¡
2013-09-03 18:58 - 2013-08-14 12:38 - 00002128 _____ C:\Windows\setupact.log
2013-09-03 18:58 - 2011-07-21 12:14 - 00000000 ____D C:\ProgramData\NVIDIA
2013-09-03 18:58 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-03 13:35 - 2013-09-03 13:34 - 00000000 ____D C:\Users\Blobber\Desktop\Funkverteidiger-FV-WEB-DE-2013-TPMF
2013-09-03 13:34 - 2013-09-03 13:34 - 00000000 _____ C:\Users\Blobber\Downloads\Funkverteidiger-FV-WEB-DE-2013-TPMF.rar.part
2013-09-03 13:34 - 2013-05-13 21:08 - 00000000 ____D C:\Program Files (x86)\JDownloader 2
2013-09-03 11:25 - 2013-02-14 16:43 - 00000000 ____D C:\Users\Blobber\AppData\Roaming\vlc
2013-09-03 11:13 - 2013-03-31 11:21 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-09-02 15:40 - 2013-09-03 11:23 - 1181711357 _____ C:\Users\Blobber\Downloads\pso-fg_x264.mkv
2013-09-02 13:18 - 2011-04-12 09:43 - 00654150 _____ C:\Windows\system32\perfh007.dat
2013-09-02 13:18 - 2011-04-12 09:43 - 00130022 _____ C:\Windows\system32\perfc007.dat
2013-09-02 13:18 - 2009-07-14 07:13 - 01498742 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-02 13:14 - 2013-09-02 13:06 - 00000000 ____D C:\Users\Blobber\Desktop\Propagandafilme
2013-09-02 11:21 - 2013-09-02 11:21 - 00000000 ____D C:\Windows\ERUNT
2013-09-02 11:19 - 2013-09-02 11:18 - 00000000 ____D C:\AdwCleaner
2013-09-01 17:31 - 2013-09-01 16:59 - 00000000 ____D C:\Qoobox
2013-09-01 17:31 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2013-09-01 17:30 - 2013-09-01 17:30 - 00017415 _____ C:\ComboFix.txt
2013-09-01 17:29 - 2013-09-01 16:59 - 00000000 ____D C:\Windows\erdnt
2013-09-01 17:26 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2013-09-01 17:25 - 2013-09-01 17:25 - 00000546 _____ C:\Windows\PFRO.log
2013-09-01 16:59 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-09-01 11:59 - 2013-08-25 19:27 - 00000000 ____D C:\Users\Blobber\Desktop\Neuer Ordner (2)
2013-09-01 11:05 - 2013-09-01 00:09 - 00000000 ____D C:\Users\Blobber\Desktop\Megaloh - Auf Ewig 2 Mixtape (DE, 2013)
2013-09-01 10:57 - 2013-09-01 10:57 - 00000000 ____D C:\FRST
2013-08-31 21:39 - 2013-08-31 21:39 - 00000000 ____D C:\Users\Blobber\Downloads\Category.7.Das.Ende.der.Welt.2005.German.DL.BluRayRip.XViD
2013-08-31 21:23 - 2013-08-31 20:00 - 00000000 ____D C:\Users\Blobber\Desktop\Patrice - 2013
2013-08-31 20:42 - 2013-02-02 20:17 - 00002190 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-08-30 15:18 - 2013-08-30 15:16 - 00000000 ____D C:\Users\Blobber\Desktop\Separate-El_Mariachi-DE-2013-NOiR
2013-08-30 11:32 - 2013-08-30 11:31 - 00000000 ____D C:\Users\Blobber\Desktop\Tone - T.O.N.E. (Deluxe Version) (2013)
2013-08-30 11:16 - 2013-08-30 11:16 - 00000000 ____D C:\Users\Blobber\Desktop\Bewerbungen
2013-08-29 21:04 - 2011-12-17 01:04 - 00000000 ____D C:\Users\Blobber
2013-08-29 21:03 - 2013-08-27 14:32 - 00000000 ____D C:\Users\Blobber\Desktop\German Top 100 Single Charts 02.09.2013
2013-08-29 21:03 - 2013-06-13 16:52 - 00000000 ____D C:\Users\Blobber\Documents\New Star Soccer 5
2013-08-29 21:03 - 2013-04-03 12:28 - 00000000 ____D C:\Users\Blobber\AppData\Roaming\Malwarebytes
2013-08-29 21:03 - 2013-02-02 20:17 - 00000000 ____D C:\Program Files (x86)\Google
2013-08-29 21:03 - 2012-11-01 14:17 - 00000000 ____D C:\Users\Blobber\Documents\FUSSBALL MANAGER 13
2013-08-29 21:03 - 2012-09-11 22:25 - 00000000 ____D C:\Users\Blobber\Documents\FIFA 13
2013-08-29 21:03 - 2012-05-17 23:16 - 00000000 ____D C:\Users\Blobber\Documents\FIFA 12
2013-08-29 21:03 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-08-29 21:03 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration
2013-08-29 10:43 - 2013-08-29 19:05 - 00000000 ____D C:\Users\Blobber\Desktop\Weekend - Am Wochenende Rapper
2013-08-25 19:51 - 2013-08-25 19:51 - 00000000 ____D C:\Users\Blobber\Downloads\Wunderbare Jahre
2013-08-23 10:27 - 2013-08-23 12:00 - 00000000 ____D C:\Users\Blobber\Desktop\Eko Fresh - Eksodus [Deluxe Edition 2CD] (2013)
2013-08-21 13:34 - 2013-08-10 11:17 - 00000000 ____D C:\Users\Blobber\Desktop\Neuer Ordner
2013-08-20 11:08 - 2013-05-06 11:30 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-08-20 11:08 - 2013-03-31 11:21 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-08-19 11:52 - 2012-04-25 14:45 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-18 20:31 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-08-18 13:01 - 2013-08-18 13:00 - 00000000 ____D C:\Users\Blobber\Desktop\Shaggy - Hot Shot (2001)
2013-08-18 10:57 - 2013-08-17 19:53 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-17 21:07 - 2013-08-17 21:07 - 00000000 ____D C:\Users\Blobber\Desktop\VA-Die_Ultimative_Chartshow_Die_Erfolgreichsten_Saenger_Des_Neuen_Jahrtausends_-2CD-2013-VOiCE
2013-08-17 11:03 - 2011-12-29 15:08 - 00000290 _____ C:\Windows\Lexstat.ini
2013-08-17 09:47 - 2013-08-17 21:36 - 00000000 ____D C:\Users\Blobber\Downloads\BLUS30780-[The Bureau XCOM Declassified]
2013-08-17 00:52 - 2013-08-17 11:30 - 00000000 ____D C:\Users\Blobber\Downloads\Saints.Row.IV.PS3-iMARS
2013-08-16 11:30 - 2011-07-20 16:06 - 00000000 ____D C:\Windows\Panther
2013-08-15 19:06 - 2013-08-15 19:05 - 00000000 ____D C:\Windows\system32\MRT
2013-08-15 19:05 - 2011-07-21 08:47 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-14 13:39 - 2013-08-14 13:39 - 00000000 ____D C:\Users\Blobber\Downloads\Mademoiselle.Populaire.2012.German.AC3.BDRip.XviD-Awesome
2013-08-14 12:38 - 2013-08-14 12:38 - 00000000 _____ C:\Windows\setuperr.log
2013-08-13 22:27 - 2013-06-08 12:25 - 00000000 ____D C:\Users\Blobber\AppData\Roaming\FileZilla
2013-08-13 22:27 - 2012-04-09 12:24 - 00000000 ____D C:\Users\Blobber\AppData\Roaming\Winamp
2013-08-08 21:08 - 2013-08-10 19:45 - 00000000 ____D C:\Users\Blobber\Downloads\Trance.2013.UNZENSIERT.German.AC3.BDRip.XviD-GRC
2013-08-07 04:22 - 2010-11-21 05:27 - 00278800 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
Files to move or delete:
====================
C:\ProgramData\winiml.dat
C:\Users\Blobber\AppData\Local\Temp\Quarantine.exe
C:\Users\Blobber\AppData\Local\Temp\rtdrvmon.exe
C:\Users\Blobber\AppData\Local\Temp\jrt\erunt\ERUNT.EXE
C:\Users\Blobber\AppData\Local\Temp\jna-Blobber\jna3938411011577748972.dll
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-08-18 20:23
==================== End Of Log ============================
|
|
04.09.2013, 08:36
| #10 |
| /// the machine /// TB-Ausbilder | Telekom Abuse Brief Java und Adobe updaten. Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop. Schließe nun alle offenen Programme und trenne Dich von dem Internet. Doppelklick auf die TFC.exe und drücke auf Start. Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen. Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IML.lnk
ShortcutTarget: IML.lnk -> C:\Windows\System32\iml.vbs ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IML64.lnk
ShortcutTarget: IML64.lnk -> C:\Windows\SysWOW64\iml.vbs ()
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
04.09.2013, 10:35
| #11 |
| | Telekom Abuse Brief Hi, hier ist der fixlog.txt Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 03-09-2013 03
Ran by Blobber at 2013-09-04 11:34:05 Run:1
Running from C:\Users\Blobber\Desktop
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IML.lnk
ShortcutTarget: IML.lnk -> C:\Windows\System32\iml.vbs ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IML64.lnk
ShortcutTarget: IML64.lnk -> C:\Windows\SysWOW64\iml.vbs ()
*****************
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IML.lnk => Moved successfully.
C:\Windows\System32\iml.vbs => Moved successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IML64.lnk => Moved successfully.
C:\Windows\SysWOW64\iml.vbs => Moved successfully.
==== End of Fixlog ====
|
|
07.09.2013, 00:16
| #12 |
| | Telekom Abuse Brief ich habe die datei einfach gelöscht jetzt kommt keine fehlermeldung mehr  |
|
04.09.2013, 13:17
| #13 |
| /// the machine /// TB-Ausbilder | Telekom Abuse Brief Fertig Die Reihenfolge ist hier entscheidend.
Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
04.09.2013, 19:05
| #14 |
| | Telekom Abuse Brief hi, soweit alles supi aber jetzt erscheint beim hochfahren des pcs folgender fehler  Windows script host fehler skript: c windows syswow64 iml.vbs Zeile 1 zeichen 1 fehler: anweisung erwartet code: 800A0400 quelle: kompilierungsfehler in microsoft vbscript danke für die hilfe  [QUOTE=blobber;1147937]hi, soweit alles supi aber jetzt erscheint beim hochfahren des pcs folgender fehler edit: fehler behoben Vielen Vielen Dank nochmals für die professionelle hilfe Geändert von blobber (04.09.2013 um 15:50 Uhr) |
|
05.09.2013, 08:00
| #15 |
| /// the machine /// TB-Ausbilder | Telekom Abuse Brief poste nochmal ein frisches FRST log
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Telekom Abuse Brief |
| abend, abuse, betreff, brief, dankbar, erhalte, erhalten, folge, guten, hacking, heute, inter, interne, internetzugang, java/exploit.cve-2013-1493.fy, problem, telekom, win64/sirefef.av, win64/sirefef.aw, win64/sirefef.bb, zugang |
Hybrid-Darstellung
