Win7: Webseiten werden mit Werbung verlinkt; Suchmaschinen-ergebnisse sind infiziert (monstermarketplace.com)

Sue.vivoR · 01.09.2013, 16:10

Hallo liebes Trojaner-board-Team!!

ich habe seit ca. 3-6 Tagen Probleme mit meinem PC. Auf diversen Websites werden die unterschiedlichsten Wörter als Verlinkung angezeigt (auch total Absurdes, Satzfetzen wie "auf den": Sie suchen nach auf den? monstermarketplace.com! ) und ich vermute auch, dass meine Suchmaschine infiziert wurde.
Es ist sehr nervig, denn wenn ich nur mit der Maus über eine dieser Verlinkungen komme (teilweise 10 auf einer Seite) öffnet sich ein kleiner Reiter, der erst durch Schließen wieder verschwindet. Ausserdem ist mein PC langsamer und die Maus hängt gelegentlich.

Google-suchen zu diesem Problem kamen mir komisch vor, ich habe in den Suchergebnissen mehrere unterschiedliche Websites gefunden, alle mit dem fast identischen, grammatikalisch fürchterlich schlecht übersetzten Text, einem ähnlichen Aufbau, einer vermeindlichen Problembeschreibung von monstermarketplace.com, sowie eine Anleitung zum Entfernen im Browser mit anschließendem Downloadbutton für ein Programm, dass das Problem behebt. Wie gesagt, alles ähnlich.
Auch hatte ich auf Online-Store-seiten kleine ähnliche Popups mit "Deal" oder "Deal des Tages" und Werbung.

AVIRA meldet keinen Fund, Spybot S&D habe ich heute morgen drüberlaufen lassen, auch ohne erkennbare Funde und das Problem besteht weiterhin.

CD/DVD-Emulatoren habe ich nicht installiert.
Den Scan mit GMER konnte ich nur mit aktivem AvIRA Antivir ausführen, es ließ sich nicht beenden (Sie haben keine Berechtigung etc..)

Da ich gehört habe, dass mit diesem Trojaner nicht zu spassen ist, bitte ich um Eure Hilfe! Vielen Lieben Dank!

cosinus · 01.09.2013, 16:25

Hallo und

Zitat:

Adobe Acrobat X Pro - English, Français, Deutsch (x32 Version: 10.1.1)
Adobe Creative Suite 6 Master Collection (x32 Version: 6)

Du hast da sehr teure Software installiert. Ist das ein gewerblich genutztes System? Wenn nein wieso benötigst du privat derartige Software?

Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die mal fündig geworden?

Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520

Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs in CODE-Tags posten!
Relevant sind nur Logs der letzten 7 Tage bzw. seitdem das Problem besteht!

Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Sue.vivoR · 01.09.2013, 16:59

Hallo, danke für die rasche Antwort.

Nein, es ist kein gewerblich genutztes System. Ich bin Student.

Wie oben geschrieben, hat AVira keinen Fund gemeldet. Spybot hat einige Zugriffe gefunden, hier der Logfile:

Code:

ATTFilter

Search results from Spybot - Search & Destroy

01.09.2013 11:07:29
Scan took 00:17:05.
34 items found.

ProDe.DownloadGuide: [SBI $48835C16] Program directory (Directory, nothing done)
  C:\Users\Sue\AppData\Local\DownloadGuide\
  Directory.subfile=C:\Users\Sue\AppData\Local\DownloadGuide\amazon.ico
  Directory.subfile.size=20463
  Directory.subfile.md5=392C1B3CA4C53FE772E463360EECDA5A
  Directory.subfile.filedate=1377296056
  Directory.subfile.filedatetext=2013-08-24 00:14:15
  Directory.subfile=C:\Users\Sue\AppData\Local\DownloadGuide\pdsetup.exe
  Directory.subfile.size=3330768
  Directory.subfile.md5=76455181B77312831D7FDB85B6DC1C18
  Directory.subfile.filedate=1377296058
  Directory.subfile.filedatetext=2013-08-24 00:14:17
  Directory.subfile=C:\Users\Sue\AppData\Local\DownloadGuide\pdsetup.exe_date
  Directory.subfile.size=10
  Directory.subfile.md5=6C556D266D2FD4AD41B10B1500F37249
  Directory.subfile.filedate=1377299084
  Directory.subfile.filedatetext=2013-08-24 01:04:43
  Directory.subfile=C:\Users\Sue\AppData\Local\DownloadGuide\Offers\foxydeal.exe
  Directory.subfile.size=620624
  Directory.subfile.md5=3AA66CA1C1E2087381FE88659F3FE8AB
  Directory.subfile.filedate=1377296067
  Directory.subfile.filedatetext=2013-08-24 00:14:27
  Directory.subfile=C:\Users\Sue\AppData\Local\DownloadGuide\Offers\plus-hd-3-8.exe
  Directory.subfile.size=5013808
  Directory.subfile.md5=790E820CCDBEC26307BA327797DCA1C0
  Directory.subfile.filedate=1377295558
  Directory.subfile.filedatetext=2013-08-24 00:05:58
  Directory.subfile=C:\Users\Sue\AppData\Local\DownloadGuide\Offers\pricealarm.exe
  Directory.subfile.size=516096
  Directory.subfile.md5=58D9E290C42B8BC515F0FE3146E87166
  Directory.subfile.filedate=1377296065
  Directory.subfile.filedatetext=2013-08-24 00:14:24

ProDe.DownloadGuide: [SBI $03713CD0] Program directory (Directory, nothing done)
  C:\Users\Sue\AppData\Local\DownloadGuide\Offers\
  Directory.subfile=C:\Users\Sue\AppData\Local\DownloadGuide\Offers\foxydeal.exe
  Directory.subfile.size=620624
  Directory.subfile.md5=3AA66CA1C1E2087381FE88659F3FE8AB
  Directory.subfile.filedate=1377296067
  Directory.subfile.filedatetext=2013-08-24 00:14:27
  Directory.subfile=C:\Users\Sue\AppData\Local\DownloadGuide\Offers\plus-hd-3-8.exe
  Directory.subfile.size=5013808
  Directory.subfile.md5=790E820CCDBEC26307BA327797DCA1C0
  Directory.subfile.filedate=1377295558
  Directory.subfile.filedatetext=2013-08-24 00:05:58
  Directory.subfile=C:\Users\Sue\AppData\Local\DownloadGuide\Offers\pricealarm.exe
  Directory.subfile.size=516096
  Directory.subfile.md5=58D9E290C42B8BC515F0FE3146E87166
  Directory.subfile.filedate=1377296065
  Directory.subfile.filedatetext=2013-08-24 00:14:24

Macromedia.FlashPlayer.Cookies: [SBI $1EF45977]  Text file (File, nothing done)
  C:\Users\Sue\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\U638HT88\skype.com\#ui\preferences.sol
  Properties.size=253
  Properties.md5=4CCD753F193E60E0B130B7B1269D35D9
  Properties.filedate=1377460822
  Properties.filedatetext=2013-08-25 22:00:22

MediaPlex: [SBI $8E73A7FB] Tracking cookie (Internet Explorer (Benutzer): Sue) (Browser: Cookie, nothing done)
  

MediaPlex: [SBI $8E73A7FB] Tracking cookie (Internet Explorer (Benutzer): Sue) (Browser: Cookie, nothing done)
  

FastClick: [SBI $8E73A7FB] Tracking cookie (Internet Explorer (Benutzer): Sue) (Browser: Cookie, nothing done)
  

Internet Explorer: [SBI $1E8157BE] Typed URL list (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-35786612-3109689924-1545787599-1000\Software\Microsoft\Internet Explorer\TypedURLs

Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
  HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-35786612-3109689924-1545787599-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
  HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

MS Management Console: [SBI $ECD50EAD] Recent command list (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-35786612-3109689924-1545787599-1000\Software\Microsoft\Microsoft Management Console\Recent File List

MS Media Player: [SBI $5C51E349] Client ID (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-35786612-3109689924-1545787599-1000\Software\Microsoft\MediaPlayer\Player\Settings\Client ID

MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
  HKEY_USERS\.DEFAULT\Software\Microsoft\Direct3D\MostRecentApplication\Name

MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-35786612-3109689924-1545787599-1000\Software\Microsoft\Direct3D\MostRecentApplication\Name

MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
  HKEY_USERS\S-1-5-18\Software\Microsoft\Direct3D\MostRecentApplication\Name

MS DirectDraw: [SBI $EB49D5AF] Most recent application (Registry Change, nothing done)
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication\Name

MS DirectInput: [SBI $9A063C91] Most recent application (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-35786612-3109689924-1545787599-1000\Software\Microsoft\DirectInput\MostRecentApplication\Name

MS DirectInput: [SBI $7B184199] Most recent application ID (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-35786612-3109689924-1545787599-1000\Software\Microsoft\DirectInput\MostRecentApplication\Id

MS Paint: [SBI $07867C39] Recent file list (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-35786612-3109689924-1545787599-1000\Software\Microsoft\Windows\CurrentVersion\Applets\Paint\Recent File List

Windows: [SBI $1E4E2003] Drivers installation paths (Registry Change, nothing done)
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\Installation Sources

Windows: [SBI $1E4E2003] Drivers installation paths (Registry Change, nothing done)
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\Installation Sources

Windows.OpenWith: [SBI $F7204896] Open with list - .AVI extension (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-35786612-3109689924-1545787599-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AVI\OpenWithList

Windows.OpenWith: [SBI $A1C94E79] Open with list - .BMP extension (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-35786612-3109689924-1545787599-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.BMP\OpenWithList

Windows Explorer: [SBI $AA0766B5] Stream history (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-35786612-3109689924-1545787599-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU

Windows Explorer: [SBI $D20DA0AD] Recent file global history (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-35786612-3109689924-1545787599-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

Windows Media SDK: [SBI $37AAEDE6] Computer name (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-35786612-3109689924-1545787599-1000\Software\Microsoft\Windows Media\WMSDK\General\ComputerName

Windows Media SDK: [SBI $CAA58B6E] Unique ID (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-35786612-3109689924-1545787599-1000\Software\Microsoft\Windows Media\WMSDK\General\UniqueID

Windows Media SDK: [SBI $BACCD0DA] Volume serial number (Registry Value, nothing done)
  HKEY_USERS\S-1-5-21-35786612-3109689924-1545787599-1000\Software\Microsoft\Windows Media\WMSDK\General\VolumeSerialNumber

WinRAR: [SBI $0B56E92B] Recent file list (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-35786612-3109689924-1545787599-1000\Software\WinRAR\ArcHistory

WinRAR: [SBI $B84F9965] Last used directory (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-35786612-3109689924-1545787599-1000\Software\WinRAR\General\LastFolder

WinRAR: [SBI $B510882E] Extraction directory history (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-35786612-3109689924-1545787599-1000\Software\WinRAR\DialogEditHistory\ExtrPath

Cookie: [SBI $49804B54] Browser: Cookie (27) (Browser: Cookie, nothing done)
  

Cache: [SBI $49804B54] Browser: Cache (1607) (Browser: Cache, nothing done)
  

Verlauf: [SBI $49804B54] Browser: History (199) (Browser: History, nothing done)
  


--- Spybot - Search & Destroy version: 2.1.18.131  DLL (build: 20130516) ---

2013-05-16 blindman.exe (2.1.18.151)
2013-05-16 explorer.exe (2.1.18.177)
2013-05-16 SDBootCD.exe (2.1.18.109)
2013-05-16 SDCleaner.exe (2.1.18.110)
2013-05-16 SDDelFile.exe (2.1.18.94)
2013-06-18 SDDisableProxy.exe
2013-05-16 SDFiles.exe (2.1.18.135)
2013-03-20 SDFileScanHelper.exe (2.1.16.1)
2013-05-16 SDFSSvc.exe (2.1.18.208)
2013-05-16 SDHookHelper.exe (2.1.18.2)
2013-05-16 SDHookInst32.exe (2.1.18.2)
2013-05-16 SDHookInst64.exe (2.1.18.2)
2013-05-16 SDImmunize.exe (2.1.18.130)
2013-05-16 SDLogReport.exe (2.1.18.107)
2013-05-16 SDOnAccess.exe (2.1.18.4)
2013-05-16 SDPESetup.exe (2.1.18.3)
2013-05-16 SDPEStart.exe (2.1.18.86)
2013-05-16 SDPhoneScan.exe (2.1.18.28)
2013-05-16 SDPRE.exe (2.1.18.22)
2013-05-16 SDPrepPos.exe (2.1.18.10)
2013-05-16 SDQuarantine.exe (2.1.18.103)
2013-05-16 SDRootAlyzer.exe (2.1.18.116)
2013-05-16 SDSBIEdit.exe (2.1.18.39)
2013-05-16 SDScan.exe (2.1.18.177)
2013-05-16 SDScript.exe (2.1.18.53)
2013-05-16 SDSettings.exe (2.1.18.136)
2013-05-16 SDShell.exe (2.1.18.2)
2013-05-16 SDShred.exe (2.1.18.107)
2013-05-16 SDSysRepair.exe (2.1.18.101)
2013-05-16 SDTools.exe (2.1.18.150)
2013-07-25 SDTray.exe (2.1.21.129)
2013-05-16 SDUpdate.exe (2.1.18.91)
2013-05-16 SDUpdSvc.exe (2.1.18.76)
2013-07-10 SDWelcome.exe (2.1.21.129)
2013-05-15 SDWSCSvc.exe (2.1.18.2)
2013-06-19 spybotsd2-translation-frx.exe
2013-09-01 unins000.exe (51.1052.0.0)
1999-12-02 xcacls.exe
2012-08-23 borlndmm.dll (10.0.2288.42451)
2012-09-05 DelZip190.dll (1.9.0.107)
2012-09-10 libeay32.dll (1.0.0.4)
2012-09-10 libssl32.dll (1.0.0.4)
2013-05-16 SDAdvancedCheckLibrary.dll (2.1.18.98)
2013-05-16 SDAV.dll
2013-05-16 SDECon32.dll (2.1.18.113)
2013-05-16 SDECon64.dll (2.1.18.113)
2013-04-05 SDEvents.dll (2.1.16.2)
2013-05-16 SDFileScanLibrary.dll (2.1.18.12)
2013-05-16 SDHook32.dll (2.1.18.2)
2013-05-16 SDHook64.dll (2.1.18.2)
2013-05-16 SDImmunizeLibrary.dll (2.1.18.2)
2013-05-16 SDLicense.dll (2.1.18.0)
2013-05-16 SDLists.dll (2.1.18.4)
2013-05-16 SDResources.dll (2.1.18.7)
2013-05-16 SDScanLibrary.dll (2.1.18.131)
2013-05-16 SDTasks.dll (2.1.18.15)
2013-05-16 SDWinLogon.dll (2.1.18.0)
2012-08-23 sqlite3.dll
2012-09-10 ssleay32.dll (1.0.0.4)
2013-05-16 Tools.dll (2.1.18.36)
2012-12-18 Includes\Adware.sbi (*)
2013-08-28 Includes\AdwareC.sbi (*)
2010-08-13 Includes\Cookies.sbi (*)
2012-11-14 Includes\Dialer.sbi (*)
2012-11-14 Includes\DialerC.sbi (*)
2012-11-14 Includes\HeavyDuty.sbi (*)
2012-11-14 Includes\Hijackers.sbi (*)
2012-11-14 Includes\HijackersC.sbi (*)
2013-08-22 Includes\iPhone.sbi (*)
2013-06-25 Includes\Keyloggers.sbi (*)
2012-12-18 Includes\KeyloggersC.sbi (*)
2013-05-29 Includes\Malware.sbi (*)
2013-08-28 Includes\MalwareC.sbi (*)
2012-11-14 Includes\PUPS.sbi (*)
2013-08-06 Includes\PUPSC.sbi (*)
2012-11-14 Includes\Security.sbi (*)
2012-11-14 Includes\SecurityC.sbi (*)
2013-05-22 Includes\Spyware.sbi (*)
2013-08-06 Includes\SpywareC.sbi (*)
2011-06-07 Includes\Tracks.sbi (*)
2012-11-19 Includes\Tracks.uti (*)
2013-01-16 Includes\Trojans.sbi (*)
2013-05-13 Includes\TrojansC-02.sbi (*)
2013-07-31 Includes\TrojansC-03.sbi (*)
2013-08-28 Includes\TrojansC-04.sbi (*)
2013-05-08 Includes\TrojansC-05.sbi (*)
2013-08-06 Includes\TrojansC.sbi (*)

Code:

ATTFilter

Search results from Spybot - Search & Destroy

01.09.2013 12:37:42
Scan took 00:16:32.
10 items found.

Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
  HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
  HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
  HKEY_USERS\.DEFAULT\Software\Microsoft\Direct3D\MostRecentApplication\Name

MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
  HKEY_USERS\S-1-5-18\Software\Microsoft\Direct3D\MostRecentApplication\Name

MS DirectDraw: [SBI $EB49D5AF] Most recent application (Registry Change, nothing done)
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication\Name

MS DirectInput: [SBI $9A063C91] Most recent application (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-35786612-3109689924-1545787599-1000\Software\Microsoft\DirectInput\MostRecentApplication\Name

MS DirectInput: [SBI $7B184199] Most recent application ID (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-35786612-3109689924-1545787599-1000\Software\Microsoft\DirectInput\MostRecentApplication\Id

Windows: [SBI $1E4E2003] Drivers installation paths (Registry Change, nothing done)
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\Installation Sources

Windows: [SBI $1E4E2003] Drivers installation paths (Registry Change, nothing done)
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\Installation Sources

Cache: [SBI $49804B54] Browser: Cache (2) (Browser: Cache, nothing done)
  


--- Spybot - Search & Destroy version: 2.1.18.131  DLL (build: 20130516) ---

2013-05-16 blindman.exe (2.1.18.151)
2013-05-16 explorer.exe (2.1.18.177)
2013-05-16 SDBootCD.exe (2.1.18.109)
2013-05-16 SDCleaner.exe (2.1.18.110)
2013-05-16 SDDelFile.exe (2.1.18.94)
2013-06-18 SDDisableProxy.exe
2013-05-16 SDFiles.exe (2.1.18.135)
2013-03-20 SDFileScanHelper.exe (2.1.16.1)
2013-05-16 SDFSSvc.exe (2.1.18.208)
2013-05-16 SDHookHelper.exe (2.1.18.2)
2013-05-16 SDHookInst32.exe (2.1.18.2)
2013-05-16 SDHookInst64.exe (2.1.18.2)
2013-05-16 SDImmunize.exe (2.1.18.130)
2013-05-16 SDLogReport.exe (2.1.18.107)
2013-05-16 SDOnAccess.exe (2.1.18.4)
2013-05-16 SDPESetup.exe (2.1.18.3)
2013-05-16 SDPEStart.exe (2.1.18.86)
2013-05-16 SDPhoneScan.exe (2.1.18.28)
2013-05-16 SDPRE.exe (2.1.18.22)
2013-05-16 SDPrepPos.exe (2.1.18.10)
2013-05-16 SDQuarantine.exe (2.1.18.103)
2013-05-16 SDRootAlyzer.exe (2.1.18.116)
2013-05-16 SDSBIEdit.exe (2.1.18.39)
2013-05-16 SDScan.exe (2.1.18.177)
2013-05-16 SDScript.exe (2.1.18.53)
2013-05-16 SDSettings.exe (2.1.18.136)
2013-05-16 SDShell.exe (2.1.18.2)
2013-05-16 SDShred.exe (2.1.18.107)
2013-05-16 SDSysRepair.exe (2.1.18.101)
2013-05-16 SDTools.exe (2.1.18.150)
2013-07-25 SDTray.exe (2.1.21.129)
2013-05-16 SDUpdate.exe (2.1.18.91)
2013-05-16 SDUpdSvc.exe (2.1.18.76)
2013-07-10 SDWelcome.exe (2.1.21.129)
2013-05-15 SDWSCSvc.exe (2.1.18.2)
2013-06-19 spybotsd2-translation-frx.exe
2013-09-01 unins000.exe (51.1052.0.0)
1999-12-02 xcacls.exe
2012-08-23 borlndmm.dll (10.0.2288.42451)
2012-09-05 DelZip190.dll (1.9.0.107)
2012-09-10 libeay32.dll (1.0.0.4)
2012-09-10 libssl32.dll (1.0.0.4)
2013-05-16 SDAdvancedCheckLibrary.dll (2.1.18.98)
2013-05-16 SDAV.dll
2013-05-16 SDECon32.dll (2.1.18.113)
2013-05-16 SDECon64.dll (2.1.18.113)
2013-04-05 SDEvents.dll (2.1.16.2)
2013-05-16 SDFileScanLibrary.dll (2.1.18.12)
2013-05-16 SDHook32.dll (2.1.18.2)
2013-05-16 SDHook64.dll (2.1.18.2)
2013-05-16 SDImmunizeLibrary.dll (2.1.18.2)
2013-05-16 SDLicense.dll (2.1.18.0)
2013-05-16 SDLists.dll (2.1.18.4)
2013-05-16 SDResources.dll (2.1.18.7)
2013-05-16 SDScanLibrary.dll (2.1.18.131)
2013-05-16 SDTasks.dll (2.1.18.15)
2013-05-16 SDWinLogon.dll (2.1.18.0)
2012-08-23 sqlite3.dll
2012-09-10 ssleay32.dll (1.0.0.4)
2013-05-16 Tools.dll (2.1.18.36)
2012-12-18 Includes\Adware.sbi (*)
2013-08-28 Includes\AdwareC.sbi (*)
2010-08-13 Includes\Cookies.sbi (*)
2012-11-14 Includes\Dialer.sbi (*)
2012-11-14 Includes\DialerC.sbi (*)
2012-11-14 Includes\HeavyDuty.sbi (*)
2012-11-14 Includes\Hijackers.sbi (*)
2012-11-14 Includes\HijackersC.sbi (*)
2013-08-22 Includes\iPhone.sbi (*)
2013-06-25 Includes\Keyloggers.sbi (*)
2012-12-18 Includes\KeyloggersC.sbi (*)
2013-05-29 Includes\Malware.sbi (*)
2013-08-28 Includes\MalwareC.sbi (*)
2012-11-14 Includes\PUPS.sbi (*)
2013-08-06 Includes\PUPSC.sbi (*)
2012-11-14 Includes\Security.sbi (*)
2012-11-14 Includes\SecurityC.sbi (*)
2013-05-22 Includes\Spyware.sbi (*)
2013-08-06 Includes\SpywareC.sbi (*)
2011-06-07 Includes\Tracks.sbi (*)
2012-11-19 Includes\Tracks.uti (*)
2013-01-16 Includes\Trojans.sbi (*)
2013-05-13 Includes\TrojansC-02.sbi (*)
2013-07-31 Includes\TrojansC-03.sbi (*)
2013-08-28 Includes\TrojansC-04.sbi (*)
2013-05-08 Includes\TrojansC-05.sbi (*)
2013-08-06 Includes\TrojansC.sbi (*)

cosinus · 01.09.2013, 17:09

Adware/Junkware/Toolbars entfernen

1. Schritt: adwCleaner

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

2. Schritt: JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

3. Schritt: Frisches Log mit FRST

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Sue.vivoR · 01.09.2013, 21:38

vielen Dank, hier die logs:

Code:

ATTFilter

# AdwCleaner v3.001 - Report created 01/09/2013 at 18:53:15
# Updated 24/08/2013 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Sue - SUE-PC
# Running from : C:\Users\Sue\Downloads\adwcleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\Users\Sue\AppData\Roaming\Windows Net Data

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Key Deleted : HKLM\SOFTWARE\Classes\CrossriderApp0039030.BHO
Key Deleted : HKLM\SOFTWARE\Classes\CrossriderApp0039030.BHO.1
Key Deleted : HKLM\SOFTWARE\Classes\CrossriderApp0039030.Sandbox
Key Deleted : HKLM\SOFTWARE\Classes\CrossriderApp0039030.Sandbox.1
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110311901130}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220322902230}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550355905530}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660366906630}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440344904430}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110311901130}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110311901130}
Key Deleted : HKCU\Software\FoxyDeal
Key Deleted : HKCU\Software\InstalledBrowserExtensions
Key Deleted : HKCU\Software\AppDataLow\Software\Crossrider

***** [ Browsers ] *****

-\\ Internet Explorer v10.0.9200.16660


-\\ Google Chrome v29.0.1547.57

[ File : C:\Users\Sue\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [2098 octets] - [01/09/2013 18:47:01]
AdwCleaner[S0].txt - [1953 octets] - [01/09/2013 18:53:15]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2013 octets] ##########

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.5.6 (08.30.2013:1)
OS: Windows 7 Home Premium x64
Ran by Sue on 01.09.2013 at 18:58:22,50
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{2CE4D4CF-B278-4126-AD1E-B622DA2E8339}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110311901130}



~~~ Files

Successfully deleted: [File] C:\Windows\Tasks\Plus-HD-3.8-chromeinstaller.job
Successfully deleted: [File] C:\Windows\Tasks\Plus-HD-3.8-codedownloader.job
Successfully deleted: [File] C:\Windows\Tasks\Plus-HD-3.8-enabler.job
Successfully deleted: [File] C:\Windows\Tasks\Plus-HD-3.8-updater.job



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 01.09.2013 at 19:07:29,88
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-09-2013
Ran by Sue (administrator) on SUE-PC on 01-09-2013 19:10:55
Running from C:\Users\Sue\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
() C:\Program Files\Plantronics\GameCom780\GameCom780.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Thisisu) C:\Users\Sue\Downloads\JRT.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [GamecomSound] - C:\Program Files\Plantronics\GameCom780\GameCom780.exe [777448 2011-12-01] ()
HKCU\...\Run: [AdobeBridge] -  [x]
HKLM-x32\...\Run: [] -  [x]
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-08-20] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SDTray] - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=horus
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 212.186.211.21 195.34.133.21

Chrome: 
=======
CHR HomePage: hxxp://www.google.de/
CHR RestoreOnStartup: "https://www.facebook.com/"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.57\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.57\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.57\pdf.dll ()
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll No File
CHR Extension: (Google Docs) - C:\Users\Sue\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
CHR Extension: (Google Drive) - C:\Users\Sue\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (YouTube) - C:\Users\Sue\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\Sue\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (AdBlock) - C:\Users\Sue\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.6.6_0
CHR Extension: (Akira Isogawa) - C:\Users\Sue\AppData\Local\Google\Chrome\User Data\Default\Extensions\igmggajponoffjmhekbonemlgidfgdao\3_0
CHR Extension: (Chrome In-App Payments service) - C:\Users\Sue\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.10_0
CHR Extension: (Plus-HD-3.8) - C:\Users\Sue\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.23.19_0
CHR Extension: (Gmail) - C:\Users\Sue\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-08-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-08-20] (Avira Operations GmbH & Co. KG)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1817560 2013-05-16] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1033688 2013-05-16] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2013-05-15] (Safer-Networking Ltd.)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-08-20] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-08-20] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-06-02] (Avira Operations GmbH & Co. KG)
R3 PlantronicsGC; C:\Windows\System32\drivers\PLTGC.sys [1327104 2011-11-05] (C-Media Electronics Inc)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-01 18:58 - 2013-09-01 18:58 - 00000000 ____D C:\Windows\ERUNT
2013-09-01 18:56 - 2013-09-01 18:56 - 01027511 _____ (Thisisu) C:\Users\Sue\Downloads\JRT.exe
2013-09-01 18:55 - 2013-09-01 18:55 - 00002093 _____ C:\Users\Sue\Desktop\AdwCleaner[S0].txt
2013-09-01 18:46 - 2013-09-01 18:53 - 00000000 ____D C:\AdwCleaner
2013-09-01 18:44 - 2013-09-01 18:45 - 00994642 _____ C:\Users\Sue\Downloads\adwcleaner.exe
2013-09-01 17:56 - 2013-09-01 17:56 - 01078431 _____ C:\Users\Sue\Desktop\TeamSpybot-20130901-175654.cab
2013-09-01 16:22 - 2013-09-01 16:22 - 95198291 _____ C:\Windows\SysWOW64\�E
2013-09-01 16:19 - 2013-09-01 16:19 - 00001319 _____ C:\Users\Sue\Downloads\.txt
2013-09-01 16:19 - 2013-09-01 16:19 - 00001319 _____ C:\Users\Sue\Desktop\gmer.txt
2013-09-01 16:08 - 2013-09-01 16:08 - 00377856 _____ C:\Users\Sue\Downloads\m5v28o55.exe
2013-09-01 16:08 - 2013-09-01 16:08 - 00377856 _____ C:\Users\Sue\Downloads\gmer_2.1.19163.exe
2013-09-01 16:07 - 2013-09-01 16:07 - 00029951 _____ C:\Users\Sue\Desktop\FRST.txt
2013-09-01 16:07 - 2013-09-01 16:07 - 00018323 _____ C:\Users\Sue\Desktop\Addition.txt
2013-09-01 16:06 - 2013-09-01 16:06 - 00018323 _____ C:\Users\Sue\Downloads\Addition.txt
2013-09-01 16:06 - 2013-09-01 16:06 - 00000000 ____D C:\FRST
2013-09-01 16:05 - 2013-09-01 16:05 - 01590206 _____ (Farbar) C:\Users\Sue\Downloads\FRST64.exe
2013-09-01 16:03 - 2013-09-01 16:04 - 00000468 _____ C:\Users\Sue\Downloads\defogger_disable.log
2013-09-01 16:03 - 2013-09-01 16:03 - 00050477 _____ C:\Users\Sue\Downloads\Defogger.exe
2013-09-01 16:03 - 2013-09-01 16:03 - 00000000 _____ C:\Users\Sue\defogger_reenable
2013-09-01 10:44 - 2013-09-01 11:19 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-09-01 10:44 - 2013-09-01 10:46 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2013-09-01 10:44 - 2013-09-01 10:44 - 00001379 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2013-09-01 10:44 - 2009-01-25 13:14 - 00017272 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2013-09-01 10:41 - 2013-09-01 10:44 - 37672592 _____ (Safer-Networking Ltd.                                       ) C:\Users\Sue\Downloads\spybotsd-2.1.21-SR2.exe
2013-08-28 21:17 - 2013-08-28 21:17 - 68782207 _____ C:\Users\Sue\Desktop\facebooktrader alpin.psd
2013-08-25 19:16 - 2013-08-25 19:16 - 00000000 ____D C:\Windows\pss
2013-08-25 18:47 - 2013-08-25 18:47 - 00001317 _____ C:\Users\Public\Desktop\Firestorm-Release.lnk
2013-08-25 18:37 - 2013-08-25 18:37 - 46451408 _____ C:\Users\Sue\Downloads\Phoenix_Firestorm-Release_4-4-2-34167_SetupSL.exe
2013-08-25 13:06 - 2013-08-25 13:06 - 00000000 ____D C:\Users\Sue\Desktop\Fotos neu bearbeitet und einsortiert
2013-08-25 12:55 - 2013-08-25 12:55 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2013-08-24 00:14 - 2013-08-24 00:25 - 00000000 ____D C:\Recovered
2013-08-24 00:14 - 2013-08-24 00:14 - 00000998 _____ C:\Users\Sue\Desktop\Picture Doctor.lnk
2013-08-24 00:14 - 2013-08-24 00:14 - 00000000 ____D C:\Program Files (x86)\Picture Doctor
2013-08-24 00:13 - 2013-08-24 00:14 - 00000000 ____D C:\Program Files (x86)\Plus-HD-3.8
2013-08-24 00:07 - 2013-08-24 00:07 - 01900624 _____ (InstallX, LLC) C:\Users\Sue\Downloads\FinalMediaPlayer2012Setup.exe
2013-08-24 00:00 - 2013-08-24 00:00 - 00478536 _____ C:\Users\Sue\Downloads\pdsetup-Downloader.exe
2013-08-22 23:31 - 1998-06-18 00:00 - 00089360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VB5DB.DLL
2013-08-22 23:29 - 2013-08-22 23:30 - 06415389 _____ (InstallShield Software Corporation) C:\Users\Sue\Downloads\pci_de_smartrecovery45.exe
2013-08-22 21:27 - 2013-08-22 21:28 - 00000000 ____D C:\Users\Sue\Desktop\HANDY
2013-08-22 20:57 - 2013-08-22 20:58 - 03736125 _____ C:\Users\Sue\Downloads\testdisk-6.14.win.zip
2013-08-22 20:06 - 2013-08-22 20:49 - 00604815 _____ C:\Users\Sue\Downloads\9B35.tmp
2013-08-14 01:45 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-14 01:45 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-14 01:45 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-14 01:45 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-14 01:45 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-14 01:45 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-14 01:45 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-14 01:45 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-14 01:45 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-14 01:45 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-14 01:45 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-14 01:45 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-14 01:45 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-14 01:45 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-14 01:45 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-14 01:45 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-14 01:45 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-14 01:45 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-14 01:45 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-14 01:45 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-14 01:45 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-14 01:45 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-14 01:45 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-14 01:45 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-14 01:45 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-14 01:45 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-14 01:45 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-14 01:45 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-14 01:45 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-14 01:45 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-14 01:45 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-13 21:29 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-13 21:29 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-13 21:29 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-13 21:29 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-13 21:29 - 2013-07-09 08:03 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-13 21:29 - 2013-07-09 07:54 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-13 21:29 - 2013-07-09 07:53 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-08-13 21:29 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-13 21:29 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-13 21:29 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-13 21:29 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-13 21:29 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-13 21:29 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-08-13 21:29 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-08-13 21:29 - 2013-07-09 06:53 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-08-13 21:29 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-13 21:29 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-13 21:29 - 2013-07-09 06:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-08-13 21:29 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-13 21:29 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-13 21:29 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-13 21:29 - 2013-07-09 04:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-08-13 21:29 - 2013-07-09 04:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-08-13 21:29 - 2013-07-09 04:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-08-13 21:29 - 2013-07-09 04:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-08-13 21:29 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-13 21:29 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-11 21:16 - 2013-08-11 22:02 - 00000000 ____D C:\Users\Sue\Desktop\dayz arma 3
2013-08-11 21:15 - 2013-08-11 21:15 - 00410446 _____ C:\Users\Sue\Downloads\Zoombies-Launcher-1.4.1.zip
2013-08-11 21:14 - 2013-08-11 21:14 - 00322761 _____ C:\Users\Sue\Downloads\DayZA3 Lite.rar
2013-08-11 10:42 - 2013-08-11 10:42 - 01281813 _____ C:\Users\Sue\Downloads\Facebook.htm
2013-08-11 10:42 - 2013-08-11 10:42 - 00000000 ____D C:\Users\Sue\Downloads\Facebook_files
2013-08-10 19:49 - 2013-08-20 19:40 - 00000000 ____D C:\Users\Sue\AppData\Local\Arma 3
2013-08-10 19:49 - 2013-08-16 21:57 - 00000000 ____D C:\Users\Sue\Documents\Arma 3
2013-08-10 19:49 - 2013-08-10 19:49 - 00000000 ____D C:\ProgramData\Bohemia Interactive
2013-08-09 22:28 - 2013-08-09 22:28 - 00000221 _____ C:\Users\Sue\Desktop\Risen 2 - Dark Waters.url
2013-08-09 20:41 - 2013-08-09 20:41 - 00000222 _____ C:\Users\Sue\Desktop\Arma 3 Beta.url
2013-08-04 19:11 - 2013-08-25 12:49 - 00000000 ____D C:\Users\Sue\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon
2013-08-04 19:11 - 2013-08-25 12:49 - 00000000 ____D C:\Users\Sue\AppData\Roaming\Amazon
2013-08-04 19:11 - 2013-08-04 19:11 - 02328864 _____ C:\Users\Sue\Downloads\AmazonMP3DownloaderInstall._V383688031_.exe
2013-08-04 19:11 - 2013-08-04 19:11 - 00000000 ____D C:\Users\Sue\Documents\Amazon MP3
2013-08-04 19:10 - 2013-08-04 19:11 - 09629432 _____ C:\Users\Sue\Downloads\AmazonMusicImporterInstaller-2.1.0._V371017662_.exe
2013-08-04 03:00 - 2013-08-14 01:42 - 00000000 ____D C:\Windows\system32\MRT
2013-08-03 13:19 - 2013-08-14 01:41 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-03 03:06 - 2013-08-03 03:06 - 00000000 ____D C:\Users\Sue\Documents\BIS Core Engine
2013-08-02 23:12 - 2013-08-02 23:12 - 00003128 _____ C:\Windows\System32\Tasks\{B22E7272-88BD-4C37-9A3D-625E82E7B37F}
2013-08-02 23:12 - 2013-08-02 23:12 - 00000000 ____D C:\Program Files (x86)\Screaming Bee
2013-08-02 23:11 - 2013-08-02 23:11 - 00911208 _____ C:\Users\Sue\Downloads\VP-Fantasy_Install.exe

==================== One Month Modified Files and Folders =======

2013-09-01 19:10 - 2013-09-01 19:07 - 00001185 _____ C:\Users\Sue\Desktop\JRT.txt
2013-09-01 19:02 - 2009-07-14 06:45 - 00021888 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-01 19:02 - 2009-07-14 06:45 - 00021888 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-01 18:58 - 2013-09-01 18:58 - 00000000 ____D C:\Windows\ERUNT
2013-09-01 18:56 - 2013-09-01 18:56 - 01027511 _____ (Thisisu) C:\Users\Sue\Downloads\JRT.exe
2013-09-01 18:55 - 2013-09-01 18:55 - 00002093 _____ C:\Users\Sue\Desktop\AdwCleaner[S0].txt
2013-09-01 18:55 - 2013-06-02 22:25 - 00001100 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-01 18:55 - 2013-06-02 22:10 - 00000000 _____ C:\Windows\system32\Drivers\lvuvc.hs
2013-09-01 18:55 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-01 18:55 - 2009-07-14 06:51 - 00033983 _____ C:\Windows\setupact.log
2013-09-01 18:53 - 2013-09-01 18:46 - 00000000 ____D C:\AdwCleaner
2013-09-01 18:53 - 2013-06-02 20:58 - 01790692 _____ C:\Windows\WindowsUpdate.log
2013-09-01 18:45 - 2013-09-01 18:44 - 00994642 _____ C:\Users\Sue\Downloads\adwcleaner.exe
2013-09-01 18:44 - 2013-06-03 00:31 - 00000000 ____D C:\Users\Sue\AppData\Local\Firestorm
2013-09-01 18:40 - 2013-06-02 22:25 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-01 17:56 - 2013-09-01 17:56 - 01078431 _____ C:\Users\Sue\Desktop\TeamSpybot-20130901-175654.cab
2013-09-01 16:22 - 2013-09-01 16:22 - 95198291 _____ C:\Windows\SysWOW64\�E
2013-09-01 16:19 - 2013-09-01 16:19 - 00001319 _____ C:\Users\Sue\Downloads\.txt
2013-09-01 16:19 - 2013-09-01 16:19 - 00001319 _____ C:\Users\Sue\Desktop\gmer.txt
2013-09-01 16:08 - 2013-09-01 16:08 - 00377856 _____ C:\Users\Sue\Downloads\m5v28o55.exe
2013-09-01 16:08 - 2013-09-01 16:08 - 00377856 _____ C:\Users\Sue\Downloads\gmer_2.1.19163.exe
2013-09-01 16:07 - 2013-09-01 16:07 - 00029951 _____ C:\Users\Sue\Desktop\FRST.txt
2013-09-01 16:07 - 2013-09-01 16:07 - 00018323 _____ C:\Users\Sue\Desktop\Addition.txt
2013-09-01 16:06 - 2013-09-01 16:06 - 00018323 _____ C:\Users\Sue\Downloads\Addition.txt
2013-09-01 16:06 - 2013-09-01 16:06 - 00000000 ____D C:\FRST
2013-09-01 16:05 - 2013-09-01 16:05 - 01590206 _____ (Farbar) C:\Users\Sue\Downloads\FRST64.exe
2013-09-01 16:04 - 2013-09-01 16:03 - 00000468 _____ C:\Users\Sue\Downloads\defogger_disable.log
2013-09-01 16:03 - 2013-09-01 16:03 - 00050477 _____ C:\Users\Sue\Downloads\Defogger.exe
2013-09-01 16:03 - 2013-09-01 16:03 - 00000000 _____ C:\Users\Sue\defogger_reenable
2013-09-01 16:03 - 2013-06-02 21:04 - 00000000 ____D C:\Users\Sue
2013-09-01 11:19 - 2013-09-01 10:44 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-09-01 10:46 - 2013-09-01 10:44 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2013-09-01 10:44 - 2013-09-01 10:44 - 00001379 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2013-09-01 10:44 - 2013-09-01 10:41 - 37672592 _____ (Safer-Networking Ltd.                                       ) C:\Users\Sue\Downloads\spybotsd-2.1.21-SR2.exe
2013-09-01 10:23 - 2013-06-09 09:51 - 00000000 ____D C:\Users\Sue\AppData\Local\Adobe
2013-08-28 21:17 - 2013-08-28 21:17 - 68782207 _____ C:\Users\Sue\Desktop\facebooktrader alpin.psd
2013-08-28 20:10 - 2013-06-16 19:29 - 00002017 _____ C:\Users\Sue\Desktop\Marco-Sue.lnk
2013-08-26 00:54 - 2013-06-02 23:35 - 00000000 ____D C:\Users\Sue\AppData\Roaming\Skype
2013-08-25 21:26 - 2013-06-03 00:31 - 00000000 ____D C:\Users\Sue\AppData\Roaming\Firestorm
2013-08-25 19:16 - 2013-08-25 19:16 - 00000000 ____D C:\Windows\pss
2013-08-25 19:16 - 2013-06-02 21:04 - 00000000 ___RD C:\Users\Sue\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-08-25 18:47 - 2013-08-25 18:47 - 00001317 _____ C:\Users\Public\Desktop\Firestorm-Release.lnk
2013-08-25 18:47 - 2013-06-02 23:28 - 00000000 ____D C:\Program Files (x86)\Firestorm-Release
2013-08-25 18:37 - 2013-08-25 18:37 - 46451408 _____ C:\Users\Sue\Downloads\Phoenix_Firestorm-Release_4-4-2-34167_SetupSL.exe
2013-08-25 13:06 - 2013-08-25 13:06 - 00000000 ____D C:\Users\Sue\Desktop\Fotos neu bearbeitet und einsortiert
2013-08-25 12:55 - 2013-08-25 12:55 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2013-08-25 12:54 - 2013-06-09 21:19 - 00079681 _____ C:\Windows\DirectX.log
2013-08-25 12:49 - 2013-08-04 19:11 - 00000000 ____D C:\Users\Sue\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon
2013-08-25 12:49 - 2013-08-04 19:11 - 00000000 ____D C:\Users\Sue\AppData\Roaming\Amazon
2013-08-25 12:48 - 2013-06-16 19:11 - 00000000 ____D C:\Program Files (x86)\Steam
2013-08-24 00:25 - 2013-08-24 00:14 - 00000000 ____D C:\Recovered
2013-08-24 00:14 - 2013-08-24 00:14 - 00000998 _____ C:\Users\Sue\Desktop\Picture Doctor.lnk
2013-08-24 00:14 - 2013-08-24 00:14 - 00000000 ____D C:\Program Files (x86)\Picture Doctor
2013-08-24 00:14 - 2013-08-24 00:13 - 00000000 ____D C:\Program Files (x86)\Plus-HD-3.8
2013-08-24 00:07 - 2013-08-24 00:07 - 01900624 _____ (InstallX, LLC) C:\Users\Sue\Downloads\FinalMediaPlayer2012Setup.exe
2013-08-24 00:00 - 2013-08-24 00:00 - 00478536 _____ C:\Users\Sue\Downloads\pdsetup-Downloader.exe
2013-08-22 23:31 - 2013-06-02 22:05 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-08-22 23:30 - 2013-08-22 23:29 - 06415389 _____ (InstallShield Software Corporation) C:\Users\Sue\Downloads\pci_de_smartrecovery45.exe
2013-08-22 21:28 - 2013-08-22 21:27 - 00000000 ____D C:\Users\Sue\Desktop\HANDY
2013-08-22 21:02 - 2013-06-05 15:28 - 00000000 ____D C:\Users\Sue\AppData\Roaming\Adobe
2013-08-22 20:58 - 2013-08-22 20:57 - 03736125 _____ C:\Users\Sue\Downloads\testdisk-6.14.win.zip
2013-08-22 20:49 - 2013-08-22 20:06 - 00604815 _____ C:\Users\Sue\Downloads\9B35.tmp
2013-08-21 21:39 - 2013-06-09 11:08 - 00000000 ____D C:\Users\Sue\Desktop\Sony PICS neu (9.6.13)
2013-08-20 19:40 - 2013-08-10 19:49 - 00000000 ____D C:\Users\Sue\AppData\Local\Arma 3
2013-08-20 10:20 - 2013-06-03 18:18 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-08-20 10:20 - 2013-06-02 22:11 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-08-20 10:20 - 2013-06-02 22:11 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-08-16 21:57 - 2013-08-10 19:49 - 00000000 ____D C:\Users\Sue\Documents\Arma 3
2013-08-14 21:50 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-08-14 01:43 - 2011-04-12 09:43 - 00696620 _____ C:\Windows\system32\perfh007.dat
2013-08-14 01:43 - 2011-04-12 09:43 - 00147916 _____ C:\Windows\system32\perfc007.dat
2013-08-14 01:43 - 2009-07-14 07:13 - 01633540 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-14 01:42 - 2013-08-04 03:00 - 00000000 ____D C:\Windows\system32\MRT
2013-08-14 01:41 - 2013-08-03 13:19 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-11 22:02 - 2013-08-11 21:16 - 00000000 ____D C:\Users\Sue\Desktop\dayz arma 3
2013-08-11 21:15 - 2013-08-11 21:15 - 00410446 _____ C:\Users\Sue\Downloads\Zoombies-Launcher-1.4.1.zip
2013-08-11 21:14 - 2013-08-11 21:14 - 00322761 _____ C:\Users\Sue\Downloads\DayZA3 Lite.rar
2013-08-11 10:42 - 2013-08-11 10:42 - 01281813 _____ C:\Users\Sue\Downloads\Facebook.htm
2013-08-11 10:42 - 2013-08-11 10:42 - 00000000 ____D C:\Users\Sue\Downloads\Facebook_files
2013-08-10 19:49 - 2013-08-10 19:49 - 00000000 ____D C:\ProgramData\Bohemia Interactive
2013-08-09 22:28 - 2013-08-09 22:28 - 00000221 _____ C:\Users\Sue\Desktop\Risen 2 - Dark Waters.url
2013-08-09 22:28 - 2013-06-16 19:41 - 00000000 ____D C:\Users\Sue\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2013-08-09 20:41 - 2013-08-09 20:41 - 00000222 _____ C:\Users\Sue\Desktop\Arma 3 Beta.url
2013-08-04 22:14 - 2013-07-06 16:01 - 00000000 ____D C:\Users\Sue\AppData\Local\ArmA 2 OA
2013-08-04 19:11 - 2013-08-04 19:11 - 02328864 _____ C:\Users\Sue\Downloads\AmazonMP3DownloaderInstall._V383688031_.exe
2013-08-04 19:11 - 2013-08-04 19:11 - 00000000 ____D C:\Users\Sue\Documents\Amazon MP3
2013-08-04 19:11 - 2013-08-04 19:10 - 09629432 _____ C:\Users\Sue\Downloads\AmazonMusicImporterInstaller-2.1.0._V371017662_.exe
2013-08-03 17:17 - 2013-06-07 20:51 - 00000000 ____D C:\Users\Sue\AppData\Roaming\TS3Client
2013-08-03 14:08 - 2013-06-30 11:04 - 00000000 ____D C:\Users\Sue\Documents\arma 2
2013-08-03 03:06 - 2013-08-03 03:06 - 00000000 ____D C:\Users\Sue\Documents\BIS Core Engine
2013-08-02 23:12 - 2013-08-02 23:12 - 00003128 _____ C:\Windows\System32\Tasks\{B22E7272-88BD-4C37-9A3D-625E82E7B37F}
2013-08-02 23:12 - 2013-08-02 23:12 - 00000000 ____D C:\Program Files (x86)\Screaming Bee
2013-08-02 23:11 - 2013-08-02 23:11 - 00911208 _____ C:\Users\Sue\Downloads\VP-Fantasy_Install.exe

Files to move or delete:
====================
C:\Users\Sue\AppData\Local\Temp\Quarantine.exe
C:\Users\Sue\AppData\Local\Temp\jrt\erunt\ERUNT.EXE

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-01 10:22

==================== End Of Log ============================

--- --- ---

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-09-2013
Ran by Sue at 2013-09-01 19:14:07
Running from C:\Users\Sue\Downloads
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

   
Adobe Acrobat X Pro - English, Français, Deutsch (x32 Version: 10.1.1)
Adobe AIR (x32 Version: 3.7.0.1860)
Adobe Creative Suite 6 Master Collection (x32 Version: 6)
Adobe Download Assistant (x32 Version: 1.2)
Adobe Help Manager (x32 Version: 4.0.244)
Adobe Widget Browser (x32 Version: 2.0 Build 348)
Adobe Widget Browser (x32 Version: 2.0.348)
AMD Accelerated Video Transcoding (Version: 12.10.100.30328)
AMD Catalyst Install Manager (Version: 8.0.911.0)
AMD Drag and Drop Transcoding (Version: 2.00.0000)
AMD Media Foundation Decoders (Version: 1.0.80328.2204)
ANNO 2070 (x32 Version: 1.0.0.0)
Arma 2 (x32)
Arma 2: DayZ Mod (x32)
Arma 2: Operation Arrowhead (x32)
Arma 3 Beta (x32)
Asmedia ASM104x USB 3.0 Host Controller Driver (x32 Version: 1.14.8.0)
Avira Free Antivirus (x32 Version: 13.0.0.4045)
BattlEye for OA Uninstall (x32)
BattlEye Uninstall (x32)
bl (x32 Version: 1.0.0)
CameraHelperMsi (x32 Version: 13.51.815.0)
Catalyst Control Center - Branding (x32 Version: 1.00.0000)
Catalyst Control Center (x32 Version: 2013.0328.2218.38225)
Catalyst Control Center Graphics Previews Common (x32 Version: 2013.0328.2218.38225)
Catalyst Control Center InstallProxy (x32 Version: 2013.0328.2218.38225)
Catalyst Control Center Localization All (x32 Version: 2013.0328.2218.38225)
CCC Help Chinese Standard (x32 Version: 2013.0328.2217.38225)
CCC Help Chinese Traditional (x32 Version: 2013.0328.2217.38225)
CCC Help Czech (x32 Version: 2013.0328.2217.38225)
CCC Help Danish (x32 Version: 2013.0328.2217.38225)
CCC Help Dutch (x32 Version: 2013.0328.2217.38225)
CCC Help English (x32 Version: 2013.0328.2217.38225)
CCC Help Finnish (x32 Version: 2013.0328.2217.38225)
CCC Help French (x32 Version: 2013.0328.2217.38225)
CCC Help German (x32 Version: 2013.0328.2217.38225)
CCC Help Greek (x32 Version: 2013.0328.2217.38225)
CCC Help Hungarian (x32 Version: 2013.0328.2217.38225)
CCC Help Italian (x32 Version: 2013.0328.2217.38225)
CCC Help Japanese (x32 Version: 2013.0328.2217.38225)
CCC Help Korean (x32 Version: 2013.0328.2217.38225)
CCC Help Norwegian (x32 Version: 2013.0328.2217.38225)
CCC Help Polish (x32 Version: 2013.0328.2217.38225)
CCC Help Portuguese (x32 Version: 2013.0328.2217.38225)
CCC Help Russian (x32 Version: 2013.0328.2217.38225)
CCC Help Spanish (x32 Version: 2013.0328.2217.38225)
CCC Help Swedish (x32 Version: 2013.0328.2217.38225)
CCC Help Thai (x32 Version: 2013.0328.2217.38225)
CCC Help Turkish (x32 Version: 2013.0328.2217.38225)
ccc-utility64 (Version: 2013.0328.2218.38225)
erLT (x32 Version: 1.20.138.34)
Firestorm-Release (remove only) (x32 Version: 4.4.2.34167)
Google Chrome (x32 Version: 29.0.1547.57)
Google Update Helper (x32 Version: 1.3.21.153)
Java 7 Update 25 (x32 Version: 7.0.250)
Java Auto Updater (x32 Version: 2.1.9.5)
Logitech Webcam-Software (x32 Version: 2.51)
LWS Facebook (x32 Version: 13.50.854.0)
LWS Gallery (x32 Version: 13.51.827.0)
LWS Help_main (x32 Version: 13.51.828.0)
LWS Launcher (x32 Version: 13.51.828.0)
LWS Motion Detection (x32 Version: 13.51.815.0)
LWS Pictures And Video (x32 Version: 13.51.815.0)
LWS Twitter (x32 Version: 13.30.1346.0)
LWS Webcam Software (x32 Version: 13.51.815.0)
LWS WLM Plugin (x32 Version: 1.30.1201.0)
LWS YouTube Plugin (x32 Version: 13.31.1038.0)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000)
Microsoft_VC90_MFC_x86 (x32 Version: 1.00.0000)
Microsoft_VC90_MFCLOC_x86 (x32 Version: 1.00.0000)
NVIDIA PhysX (x32 Version: 9.10.0513)
OpenOffice.org 3.2 (x32 Version: 3.2.9502)
PDF Settings CS6 (x32 Version: 11.0)
ph (x32 Version: 1.0.0)
Picture Doctor 2.0 (x32 Version: 2.0)
Plantronics® GameCom 780 Software for Dolby® Headphone (x32 Version: 1.00.0001)
Play withSIX (x32 Version: 1.30.0476)
Plus-HD-3.8 (x32 Version: 1.27.153.11)
Realtek Ethernet Controller Driver (x32 Version: 7.31.1025.2010)
Risen 2 - Dark Waters (x32)
rosoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Skype™ 6.6 (x32 Version: 6.6.106)
Spybot - Search & Destroy (x32 Version: 2.1.21)
Steam (x32 Version: 1.0.0.0)
TeamSpeak 3 Client (x32 Version: 3.0.11)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2836939) (x32 Version: 1)
Uplay (x32 Version: 3.0)
Windows Utils (x32)
WinRAR

==================== Restore Points  =========================

28-08-2013 19:09:43 Geplanter Prüfpunkt
31-08-2013 17:28:09 Windows Update

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {3BA058E2-FBAF-4F34-AFB2-A42B05C8D9D2} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-06-02] (Google Inc.)
Task: {4DD4EE3F-04EA-414E-805A-ADDFAAFE202A} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2009-07-14] (Microsoft Corporation)
Task: {9B279A73-FEA4-4890-AB1C-3591EE1350E7} - System32\Tasks\{CEAF1555-847C-4C61-B67A-AED2601BDBB7} => c:\program files (x86)\google\chrome\application\chrome.exe [2013-08-16] (Google Inc.)
Task: {A1DBAD09-48F2-4B2C-AAD5-75BFFEA544F5} - System32\Tasks\AdobeAAMUpdater-1.0-Sue-PC-Sue => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2013-03-21] (Adobe Systems Incorporated)
Task: {F136A15B-053F-497C-8184-EA562A5E5EB2} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-06-02] (Google Inc.)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-03-29 04:37 - 2013-03-29 04:37 - 00139696 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiuxp64.dll
2013-03-29 04:37 - 2013-03-29 04:37 - 01155264 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\aticfx64.dll
2013-03-29 04:36 - 2013-03-29 04:36 - 08272136 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atidxx64.dll
2012-03-28 20:10 - 2012-03-28 20:10 - 00159888 _____ (Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\Shell\CS6\idicon.dll
2011-02-19 22:51 - 2011-02-19 22:51 - 00608080 _____ (Microsoft Corporation) C:\Windows\system32\MSVCP100.dll
2011-02-19 00:52 - 2011-02-19 00:52 - 00829264 _____ (Microsoft Corporation) C:\Windows\system32\MSVCR100.dll
2009-07-14 01:35 - 2009-07-14 03:40 - 00194560 _____ (Microsoft Corporation) C:\Windows\system32\FunDisc.dll
2010-11-21 05:24 - 2010-11-21 05:24 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\fdproxy.dll
2009-07-14 02:17 - 2009-07-14 03:40 - 00024576 _____ (Microsoft Corporation) C:\Windows\System32\drprov.dll
2010-11-21 05:24 - 2010-11-21 05:24 - 00129536 _____ (Microsoft Corporation) C:\Windows\System32\ntlanman.dll
2010-11-21 05:24 - 2010-11-21 05:24 - 00100864 _____ (Microsoft Corporation) C:\Windows\System32\davclnt.dll

==================== Alternate Data Streams (whitelisted) ==========

AlternateDataStreams: C:\Users\Sue\AppData\Local\Temp:Rmz8BPUOA34HQyAcgqbOkm
AlternateDataStreams: C:\Users\Sue\Documents\Thumbs.db:encryptable


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============

Microsoft Office Sessions:
=========================

==================== Memory info =========================== 

Percentage of memory in use: 43%
Total physical RAM: 4073.91 MB
Available physical RAM: 2292.23 MB
Total Pagefile: 8146 MB
Available Pagefile: 5617.33 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:146.39 GB) (Free:49.01 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: () (Fixed) (Total:785.03 GB) (Free:706.14 GB) NTFS
Drive e: (06 Apr 2011) (CDROM) (Total:7.96 GB) (Free:0 GB) UDF

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: DF6CE9E1)
Partition 1: (Active) - (Size=146 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=785 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Ich glaube, das Problem besteht immer noch. Wenn ich auf websites gehe, habe ich immer noch diese nervige Verlinkung.

cosinus · 02.09.2013, 10:08

Lad mal die aktuelle Version vom adwCleaner => http://filepony.de/download-adwcleaner/

Nochmal ausführen, alles löschen und Log posten

Sue.vivoR · 02.09.2013, 11:14

Code:

ATTFilter

# AdwCleaner v3.002 - Bericht erstellt am 02/09/2013 um 11:52:47
# Updated 01/09/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Sue - SUE-PC
# Gestartet von : C:\Users\Sue\Downloads\adwcleaner (1).exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****


***** [ Browser ] *****

-\\ Internet Explorer v10.0.9200.16660


-\\ Google Chrome v29.0.1547.62

[ Datei : C:\Users\Sue\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [2098 octets] - [01/09/2013 18:47:01]
AdwCleaner[R1].txt - [908 octets] - [02/09/2013 11:51:24]
AdwCleaner[S0].txt - [2093 octets] - [01/09/2013 18:53:15]
AdwCleaner[S1].txt - [830 octets] - [02/09/2013 11:52:47]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [889 octets] ##########

cosinus · 02.09.2013, 11:28

Da wurde nix mehr gefunden.
Werbung immer noch da? Mit welchen Browsern?

Sue.vivoR · 02.09.2013, 11:55

ja leider immer noch. ich verwende google chrome

ich kann sie zwar vielleicht mit adblock entfernen oder deaktivieren, aber das wird ja das Problem ansich nicht beheben :/

cosinus · 02.09.2013, 12:06

AFAIK muss man den Googlebrowser manuell bereinigen. Schmeiß mal alle Addons aus dem Browser raus die da nicht hingehören

Sue.vivoR · 02.09.2013, 12:07

kann man das Ausmaß der (möglichen) Bedrohung abschätzen? Ich denke, wenn der Trojaner so hartnäckig ist und auf diese Weise nicht gefunden werden kann, spricht das wohl für ihn.
Internet Explorer (den ich sonst nicht verwende) meldet beim Start: "Ein Programm auf dem Computer hat die Einstellung für den Standardsuchanbieter für Internet Explorer beschädigt. Diese Einstellung wurde von Internet Explorer auf den ursprünglichen Suchanbieter zurückgesetzt: Bing.."
was ich bisher feststellen konnte, tritt das Problem mit Werbung im IE nicht auf.

cosinus · 02.09.2013, 12:08

edit: falsch gepostet

Sue.vivoR · 02.09.2013, 12:15

ich sehe gerade - "Plus-HD-3.8" ist als Addon wieder eingetragen.

Das habe ich schon zu Beginn mal entfernt, dachte zuvor, das gehört zu Youtube. Habe es aber nicht wieder installiert. Das war auch der "Übeltäter", der bei einem Scan zuvor mal gefunden wurde..

habe es jetzt wieder ausgeschalten, Werbung ist gerade weg.. mal schauen wie lange noch

cosinus · 02.09.2013, 12:16

edit: falsch gepostet

Sue.vivoR · 02.09.2013, 12:19

Zitat:

Zitat von cosinus

Also bitte, Werbung im Browser ist das geringste Problem wenn man mit ZeroAccess befallen ist

das hab ich damit auch nicht aussagen wollen, das war nur eine Feststellung

02.09.2013, 10:08	#6
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Win7: Webseiten werden mit Werbung verlinkt; Suchmaschinen-ergebnisse sind infiziert (monstermarketplace.com) Lad mal die aktuelle Version vom adwCleaner => http://filepony.de/download-adwcleaner/ Nochmal ausführen, alles löschen und Log posten __________________ --> Win7: Webseiten werden mit Werbung verlinkt; Suchmaschinen-ergebnisse sind infiziert (monstermarketplace.com)

02.09.2013, 11:28	#8
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Win7: Webseiten werden mit Werbung verlinkt; Suchmaschinen-ergebnisse sind infiziert (monstermarketplace.com) Da wurde nix mehr gefunden. Werbung immer noch da? Mit welchen Browsern? __________________ Logfiles bitte immer in CODE-Tags posten

02.09.2013, 12:06	#10
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Win7: Webseiten werden mit Werbung verlinkt; Suchmaschinen-ergebnisse sind infiziert (monstermarketplace.com) AFAIK muss man den Googlebrowser manuell bereinigen. Schmeiß mal alle Addons aus dem Browser raus die da nicht hingehören __________________ Logfiles bitte immer in CODE-Tags posten

02.09.2013, 12:08	#12
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Win7: Webseiten werden mit Werbung verlinkt; Suchmaschinen-ergebnisse sind infiziert (monstermarketplace.com) edit: falsch gepostet __________________ Logfiles bitte immer in CODE-Tags posten Geändert von cosinus (02.09.2013 um 12:31 Uhr)

02.09.2013, 12:16	#14
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Win7: Webseiten werden mit Werbung verlinkt; Suchmaschinen-ergebnisse sind infiziert (monstermarketplace.com) edit: falsch gepostet __________________ Logfiles bitte immer in CODE-Tags posten Geändert von cosinus (02.09.2013 um 12:24 Uhr)

Win7: Webseiten werden mit Werbung verlinkt; Suchmaschinen-ergebnisse sind infiziert (monstermarketplace.com)

Log-Analyse und Auswertung: Win7: Webseiten werden mit Werbung verlinkt; Suchmaschinen-ergebnisse sind infiziert (monstermarketplace.com)