| |
| |||||||
Log-Analyse und Auswertung: Interpol Trojaner von Rechner entfernenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
21.11.2013, 23:28
| #1 |
| |  Interpol Trojaner von Rechner entfernen Hallo zusammen, ich habe mir den "Interpol Trojaner" eingefangen. Ich konnte dann durch deaktivieren aller startup Anwendungen in der ms config im abgesicherten Modus wieder auf meinen Rechner zugreifen. Ich bin mir jedoch nicht sicher, wie ich den Schädling von meinem Rechner entfernen kann. Anbei meine Log Files: defogger: Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 22:35 on 21/11/2013 (*****)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 18-11-2013
Ran by ***** (administrator) on *****-PC on 21-11-2013 22:37:41
Running from C:\Users\*****\Desktop
Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal
==================== Processes (Whitelisted) ===================
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(Stardock Corporation) C:\Program Files\Dell\DellDock\DockLogin.exe
() C:\Windows\System32\WLTRYSVC.EXE
(Dell Inc.) C:\Windows\System32\bcmwltry.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
() C:\Program Files\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
(Andrea Electronics Corporation) C:\Windows\system32\aestsrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(B.H.A Corporation) C:\Windows\System32\bgsvcgen.exe
(Microsoft Corp.) C:\Program Files\Microsoft\BingDesktop\BingDesktopUpdater.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50ST7.EXE
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RP7.EXE
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
() C:\Program Files\CDBurnerXP\NMSAccessU.exe
(Microsoft Corporation) C:\Program Files\Microsoft\BingBar\SeaPort.EXE
(IDT, Inc.) C:\Windows\system32\STacSV.exe
(SEIKO EPSON CORPORATION) C:\Windows\system32\SAgent4.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Conexant Systems, Inc.) C:\Windows\system32\DRIVERS\xaudio.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\system32\wbem\unsecapp.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
(SupportSoft, Inc.) C:\Program Files\Dell Support Center\bin\sprtsvc.exe
(Microsoft Corporation) C:\Windows\system32\wuauclt.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Windows Mail\WinMail.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-05] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\GoToAssist: C:\Program Files\Citrix\GoToAssist\514\g2awinlogon.dll (Citrix Online, a division of Citrix Systems, Inc.)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk
ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk
ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
SearchScopes: HKCU - DefaultScope {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-W1&o=100000080&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=JM&apn_dtid=YYYYYYYYDE&apn_uid=67c7f194-2929-4335-a73f-72d0e556a3e8&apn_sauid=BAE2E82F-6219-4DE8-B03E-CCAC77F2F879
SearchScopes: HKCU - {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-W1&o=100000080&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=JM&apn_dtid=YYYYYYYYDE&apn_uid=67c7f194-2929-4335-a73f-72d0e556a3e8&apn_sauid=BAE2E82F-6219-4DE8-B03E-CCAC77F2F879
BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\Snagit 10\SnagitBHO.dll (TechSmith Corporation)
BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
Toolbar: HKLM - Snagit - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\Snagit 10\SnagitIEAddin.dll (TechSmith Corporation)
Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\fnp1jt9w.default
FF DefaultSearchEngine: Ask.com
FF SearchEngineOrder.1: Ask.com
FF SelectedSearchEngine: Ask.com
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf - C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf - C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.21.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll No File
FF Plugin: @java.com/JavaPlugin,version=10.21.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\fnp1jt9w.default\searchplugins\askcom.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: defaults - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\fnp1jt9w.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b}.xpi
FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{D6D05E6F-D5C1-4e03-8E33-73F92B05E262}
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF HKLM\...\Firefox\Extensions: [ff-bmboc@bytemobile.com] - C:\Program Files\congstar\Internet-Manager\Bin\addon
FF Extension: Bytemobile Optimization Client - C:\Program Files\congstar\Internet-Manager\Bin\addon
========================== Services (Whitelisted) =================
R2 AAV UpdateService; C:\Program Files\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 bgsvcgen; C:\Windows\System32\bgsvcgen.exe [145504 2007-06-15] (B.H.A Corporation)
R2 BingDesktopUpdate; C:\Program Files\Microsoft\BingDesktop\BingDesktopUpdater.exe [173192 2013-06-20] (Microsoft Corp.)
R2 DockLoginService; C:\Program Files\Dell\DellDock\DockLogin.exe [155648 2008-09-23] (Stardock Corporation)
R2 EpsonBidirectionalService; C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe [94208 2006-12-19] (SEIKO EPSON CORPORATION)
R2 EPSON_EB_RPCV4_04; C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50ST7.EXE [153600 2009-09-14] (SEIKO EPSON CORPORATION)
R2 EPSON_PM_RPCV4_04; C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RP7.EXE [121856 2009-09-14] (SEIKO EPSON CORPORATION)
R2 NMSAccessU; C:\Program Files\CDBurnerXP\NMSAccessU.exe [71096 2008-10-20] ()
R2 sprtsvc_DellSupportCenter; C:\Program Files\Dell Support Center\bin\sprtsvc.exe [201968 2008-10-04] (SupportSoft, Inc.)
R2 StatusAgent4; C:\Windows\system32\SAgent4.exe [131072 2006-12-20] (SEIKO EPSON CORPORATION)
R2 wltrysvc; C:\Windows\System32\bcmwltry.exe [2654208 2008-10-27] (Dell Inc.)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [88840 2013-09-05] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136672 2013-09-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-04-03] (Avira Operations GmbH & Co. KG)
R3 BCM42RLY; C:\Windows\System32\drivers\BCM42RLY.sys [18424 2008-10-27] (Broadcom Corporation)
S3 BthAvrcp; C:\Windows\System32\DRIVERS\BthAvrcp.sys [28048 2010-02-05] (CSR, plc)
R1 cdrbsdrv; C:\Windows\System32\Drivers\cdrbsdrv.sys [33408 2006-02-20] (B.H.A Corporation)
S3 HSPADataCardusbmdm; C:\Windows\System32\DRIVERS\HSPADataCardusbmdm.sys [106880 2011-08-19] (HSPADataCard Incorporated)
S3 HSPADataCardusbnmea; C:\Windows\System32\DRIVERS\HSPADataCardusbnmea.sys [106880 2011-08-19] (HSPADataCard Incorporated)
S3 HSPADataCardusbser; C:\Windows\System32\DRIVERS\HSPADataCardusbser.sys [106880 2011-08-19] (HSPADataCard Incorporated)
S3 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [31560 2013-06-01] ()
S3 MBAMSwissArmy; C:\Windows\system32\drivers\mbamswissarmy.sys [146648 2013-06-01] (Malwarebytes Corporation)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
R1 StarOpen; C:\Windows\System32\Drivers\StarOpen.sys [5632 2006-07-24] ()
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)
S3 AVFSFilter; system32\DRIVERS\avfsfilter.sys [x]
S3 BlueletAudio; system32\DRIVERS\blueletaudio.sys [x]
S3 BlueletSCOAudio; system32\DRIVERS\BlueletSCOAudio.sys [x]
S3 BT; system32\DRIVERS\btnetdrv.sys [x]
S3 Btcsrusb; System32\Drivers\btcusb.sys [x]
S0 BTHidEnum; System32\Drivers\vbtenum.sys [x]
S0 BTHidMgr; System32\Drivers\BTHidMgr.sys [x]
S3 catchme; \??\C:\Users\*****\AppData\Local\Temp\catchmedhhp.sys [x]
S3 EverestDriver; \??\F:\EVEREST Ultimate Edition_Praktikant\kerneld.wnt [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
S3 SMARTMouseFilterx86; system32\DRIVERS\SMARTMouseFilterx86.sys [x]
S3 SMARTVHidMini2000x86; system32\DRIVERS\SMARTVHidMini2000x86.sys [x]
S3 SMARTVTabletPCx86; system32\DRIVERS\SMARTVTabletPCx86.sys [x]
S3 VComm; system32\DRIVERS\VComm.sys [x]
S3 VcommMgr; System32\Drivers\VcommMgr.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-11-21 22:37 - 2013-11-21 22:38 - 00013950 _____ C:\Users\*****\Desktop\FRST.txt
2013-11-21 22:37 - 2013-11-21 22:37 - 00000000 ____D C:\FRST
2013-11-21 22:36 - 2013-11-21 22:36 - 01090881 _____ (Farbar) C:\Users\*****\Desktop\FRST.exe
2013-11-21 22:35 - 2013-11-21 22:35 - 00000486 _____ C:\Users\*****\Desktop\defogger_disable.log
2013-11-21 22:34 - 2013-11-21 22:34 - 00050477 _____ C:\Users\*****\Desktop\Defogger.exe
2013-11-21 22:14 - 2013-11-21 22:15 - 00000303 _____ C:\ProgramData\j67tfr8z2j6.reg
2013-11-21 22:13 - 2013-11-21 22:14 - 95025368 ____T C:\ProgramData\j67tfr8z2j6.bxx
2013-11-21 22:13 - 2013-11-21 22:13 - 00208896 _____ (Корпорация Майкрософт) C:\ProgramData\6j2z8rft76j.dss
2013-11-21 22:13 - 2013-11-21 22:13 - 00000000 _____ C:\ProgramData\j67tfr8z2j6.fvv
2013-11-21 20:38 - 2013-11-21 20:38 - 105531440 _____ C:\Windows\system32\䁋ᴼ‹
2013-11-17 20:04 - 2013-10-13 11:42 - 12344832 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-17 20:04 - 2013-10-13 11:08 - 09739264 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-17 20:04 - 2013-10-13 10:48 - 01806848 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-17 20:04 - 2013-10-13 10:37 - 01104896 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-17 20:04 - 2013-10-13 10:35 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-11-17 20:04 - 2013-10-13 10:35 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-17 20:04 - 2013-10-13 10:33 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-11-17 20:04 - 2013-10-13 10:32 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-17 20:04 - 2013-10-13 10:30 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-17 20:04 - 2013-10-13 10:30 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-11-17 20:04 - 2013-10-13 10:29 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-11-17 20:04 - 2013-10-13 10:27 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-17 20:04 - 2013-10-13 10:27 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-17 20:04 - 2013-10-13 10:26 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-11-17 20:04 - 2013-10-13 10:25 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-17 20:04 - 2013-10-13 10:20 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-17 14:13 - 2013-10-03 13:45 - 00297984 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2013-11-17 14:12 - 2013-10-11 03:08 - 00444928 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2013-11-17 14:12 - 2013-10-11 03:07 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2013-11-17 14:12 - 2013-10-11 01:39 - 00218228 _____ C:\Windows\system32\WFP.TMF
2013-11-17 14:12 - 2013-10-03 13:45 - 00993792 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-11-03 10:55 - 2013-11-09 19:31 - 00000000 ____D C:\Users\*****\AppData\Local\Spotify
2013-11-03 10:55 - 2013-11-03 10:55 - 00001748 _____ C:\Users\*****\Desktop\Spotify.lnk
2013-11-03 10:55 - 2013-11-03 10:55 - 00001734 _____ C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
2013-11-03 10:54 - 2013-11-10 01:35 - 00000000 ____D C:\Users\*****\AppData\Roaming\Spotify
2013-11-03 10:29 - 2013-11-03 10:29 - 104684788 _____ C:\Windows\system32\朌ᴼš
==================== One Month Modified Files and Folders =======
2013-11-21 22:38 - 2013-11-21 22:37 - 00013950 _____ C:\Users\*****\Desktop\FRST.txt
2013-11-21 22:37 - 2013-11-21 22:37 - 00000000 ____D C:\FRST
2013-11-21 22:37 - 2006-11-02 13:47 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-21 22:37 - 2006-11-02 13:47 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-21 22:36 - 2013-11-21 22:36 - 01090881 _____ (Farbar) C:\Users\*****\Desktop\FRST.exe
2013-11-21 22:35 - 2013-11-21 22:35 - 00000486 _____ C:\Users\*****\Desktop\defogger_disable.log
2013-11-21 22:34 - 2013-11-21 22:34 - 00050477 _____ C:\Users\*****\Desktop\Defogger.exe
2013-11-21 22:29 - 2013-06-01 21:37 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-21 22:26 - 2009-01-09 18:45 - 02048868 _____ C:\Windows\WindowsUpdate.log
2013-11-21 22:21 - 2011-11-12 21:20 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-21 22:21 - 2006-11-02 14:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-21 22:20 - 2012-01-14 17:04 - 00000000 ____D C:\Windows\pss
2013-11-21 22:15 - 2013-11-21 22:14 - 00000303 _____ C:\ProgramData\j67tfr8z2j6.reg
2013-11-21 22:14 - 2013-11-21 22:13 - 95025368 ____T C:\ProgramData\j67tfr8z2j6.bxx
2013-11-21 22:13 - 2013-11-21 22:13 - 00208896 _____ (Корпорация Майкрософт) C:\ProgramData\6j2z8rft76j.dss
2013-11-21 22:13 - 2013-11-21 22:13 - 00000000 _____ C:\ProgramData\j67tfr8z2j6.fvv
2013-11-21 21:16 - 2011-11-12 21:20 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-21 20:39 - 2011-06-28 18:44 - 00000000 ___RD C:\Users\*****\Dropbox
2013-11-21 20:39 - 2011-06-28 18:37 - 00000000 ____D C:\Users\*****\AppData\Roaming\Dropbox
2013-11-21 20:38 - 2013-11-21 20:38 - 105531440 _____ C:\Windows\system32\䁋ᴼ‹
2013-11-19 23:55 - 2009-11-12 22:33 - 00000012 _____ C:\Windows\bthservsdp.dat
2013-11-19 23:55 - 2006-11-02 14:01 - 00032536 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-11-19 23:42 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\rescache
2013-11-17 20:04 - 2009-01-09 18:16 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-11-17 20:04 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\system32\de-DE
2013-11-17 13:58 - 2008-01-21 08:16 - 01432888 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-10 01:35 - 2013-11-03 10:54 - 00000000 ____D C:\Users\*****\AppData\Roaming\Spotify
2013-11-09 19:31 - 2013-11-03 10:55 - 00000000 ____D C:\Users\*****\AppData\Local\Spotify
2013-11-03 10:55 - 2013-11-03 10:55 - 00001748 _____ C:\Users\*****\Desktop\Spotify.lnk
2013-11-03 10:55 - 2013-11-03 10:55 - 00001734 _____ C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
2013-11-03 10:29 - 2013-11-03 10:29 - 104684788 _____ C:\Windows\system32\朌ᴼš
Files to move or delete:
====================
C:\ProgramData\6j2z8rft76j.dss
C:\ProgramData\j67tfr8z2j6.bxx
C:\ProgramData\j67tfr8z2j6.fvv
C:\ProgramData\j67tfr8z2j6.reg
Some content of TEMP:
====================
C:\Users\*****\AppData\Local\Temp\0527.dll
C:\Users\*****\AppData\Local\Temp\Foxit Reader Updater.exe
C:\Users\*****\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\*****\AppData\Local\Temp\FreemakeVideoConverter_4.0.2.20.exe
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-11-21 22:28
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 18-11-2013
Ran by ***** at 2013-11-21 22:39:10
Running from C:\Users\*****\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
Update for Microsoft Office 2007 (KB2508958)
AAVUpdateManager (Version: 18.00.0000)
Adobe Flash Player 11 ActiveX (Version: 11.9.900.117)
Advanced Audio FX Engine
Advanced Video FX Engine
Amazon MP3-Downloader 1.0.9
Avira Free Antivirus (Version: 13.0.0.4052)
Bing Bar (Version: 7.0.619.0)
Bing-Desktop (Version: 1.3.171.0)
CANON iMAGE GATEWAY Task for ZoomBrowser EX (Version: 1.5.0.3)
Canon Internet Library for ZoomBrowser EX (Version: 1.6.1.6)
Canon MovieEdit Task for ZoomBrowser EX (Version: 1.3.0.19)
Canon PhotoRecord (Version: 02.02.01000)
Canon RAW Image Task for ZoomBrowser EX (Version: 3.3.0.5)
Canon RemoteCapture Task for ZoomBrowser EX (Version: 1.1)
Canon Utilities CameraWindow (Version: 7.1.0.2)
Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX (Version: 6.4.2.16)
Canon Utilities Digital Photo Professional 3.4 (Version: 3.4.0.0)
Canon Utilities EOS Utility (Version: 2.4.0.1)
Canon Utilities MyCamera (Version: 6.4.0.5)
Canon Utilities Original Data Security Tools (Version: 1.4.0.1)
Canon Utilities PhotoStitch (Version: 3.1.21.45)
Canon Utilities Picture Style Editor (Version: 1.3.0.0)
Canon Utilities RemoteCapture Task for ZoomBrowser EX (Version: 1.7.1.9)
Canon Utilities WFT-E1/E2/E3 Utility (Version: 3.2.1.1)
Canon Utilities ZoomBrowser EX (Version: 6.1.1.21)
Canon ZoomBrowser EX Memory Card Utility (Version: 1.1.0.8)
CDBurnerXP (Version: 4.2.3.1110)
Cisco EAP-FAST Module (Version: 2.1.3)
Cisco LEAP Module (Version: 1.0.12)
Cisco PEAP Module (Version: 1.0.13)
Coco6 PhotoComposer 1.81
Conexant HDA D330 MDC V.92 Modem (Version: 7.74.00)
congstar Internet-Manager (Version: 1.0.0.3)
D3DX10 (Version: 15.4.2368.0902)
DDBAC (Version: 4.3.42)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition
Dell DataSafe Online (Version: 1.2.0009)
Dell Dock (Version: 1.0.0)
Dell Getting Started Guide (Version: 1.00.0000)
Dell Support Center (Support Software) (Version: 2.2.08267)
Dell Touchpad (Version: 7.1.103.4)
Dell Webcam Center
Dell Webcam Manager
Dell-eBay (Version: 1.00.0000)
DesignPro Ordner Software (Version: 5.0.1056)
Dienstprogramm für Dell Wireless WLAN Karte (Version: 4.170.77.17)
Digital Line Detect (Version: 1.21)
DirSync 2.92
dm Fotowelt
dm-Fotowelt
Dropbox (HKCU Version: 2.0.22)
EDocs
EOS USB WIA Driver (Version: 6.0.1.5)
EPSON BX620FWD Series Handbuch
EPSON BX620FWD Series Netzwerk-Handbuch
EPSON BX620FWD Series Printer Uninstall
Epson Easy Photo Print 2 (Version: 2.2.0.0)
Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser) (Version: 1.00.0000)
Epson Event Manager (Version: 2.40.0001)
Epson FAX Utility (Version: 1.10.00)
Epson PC-FAX Driver
EPSON Scan
EPSON TWAIN 5 (Version: 5.71.0000)
EpsonNet Print (Version: 2.4i)
EpsonNet Setup 3.3 (Version: 3.3a)
Flash Saving Plugin (Version: 1.2)
FLV-Media-Player (Version: 2.0.3.2481)
Foxit Reader (Version: 6.0.3.524)
Free FLV Converter V 7.6.0 (Version: 7.6.0.0)
Free Video Converter V 3.2 (Version: 3.2.0.0)
FreePDF XP (Remove only)
Google Earth Plug-in (Version: 7.1.1.1888)
Google Update Helper (Version: 1.3.21.165)
GoToAssist 8.0.0.514
GPL Ghostscript 8.64
HD Writer AE 1.0 for HDC (Version: 1.00.051.1031)
HotPotatoes v 6.2.5.4
Intel(R) Matrix Storage Manager
Java 7 Update 21 (Version: 7.0.210)
Java Auto Updater (Version: 2.1.9.5)
Junk Mail filter update (Version: 15.4.3502.0922)
Klett Service-CD Schnittpunkt
Kompetenztest Biologie 5-10 (Version: 1.00)
Laptop Integrated Webcam Driver (1.04.01.1011)
Lexware Info Service (Version: 2.61.00.0033)
Lexware online banking (Version: 8.00.00.0067)
Live! Cam Avatar (Version: 1.0)
Live! Cam Avatar Creator (Version: 4.6.0817.1)
Malwarebytes Anti-Malware Version 1.75.0.1300 (Version: 1.75.0.1300)
MediaDirect (Version: 3.5)
Mesh Runtime (Version: 15.4.5722.2)
Messenger Companion (Version: 15.4.3502.0922)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729)
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft Access Runtime 2010 (Version: 14.0.7015.1000)
Microsoft Application Error Reporting (Version: 12.0.6012.5000)
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Access Runtime 2010 (Version: 14.0.7015.1000)
Microsoft Office Access Runtime MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003)
Microsoft Office Home and Student 2007 (Version: 12.0.6612.1000)
Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1)
Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office PowerPoint Viewer 2007 (English) (Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office XP Professional mit FrontPage (Version: 10.0.6626.0)
Microsoft Silverlight (Version: 5.1.10411.0)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Modem Diagnostic Tool (Version: 1.0.24.0)
Movavi Video Converter 12 (Version: 12.3.0)
MovieEdit Task (Version: 1.3.0.19)
Mozilla Firefox 22.0 (x86 de) (Version: 22.0)
Mozilla Maintenance Service (Version: 22.0)
MSVC80_x86 (Version: 1.0.1.0)
MSVCRT (Version: 15.4.2862.0708)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
MyScript HWR (German) (Version: 4.4.5.1)
NetWaiting (Version: 2.5.53)
OpenOffice.org 3.2 (Version: 3.2.9502)
OutlookAddinSetup (Version: 1.0.0)
PC Connectivity Solution (Version: 9.23.3.0)
Picture Collage Maker (Version: 2.0.7)
Prisma Arbeitsblätter Biologie 1 (Version: 1.00)
QuickSet (Version: 8.2.20)
RedMon - Redirection Port Monitor
RemoteCapture Task 1.1 (Version: 1.1)
Roxio Creator Audio (Version: 3.7.0)
Roxio Creator Copy (Version: 3.7.0)
Roxio Creator Data (Version: 3.7.0)
Roxio Creator DE (Version: 10.1)
Roxio Creator DE (Version: 3.7.0)
Roxio Creator Tools (Version: 3.7.0)
Roxio Express Labeler 3 (Version: 3.2.1)
Roxio Update Manager (Version: 6.0.0)
SAMSUNG Mobile Composite Device Software
SAMSUNG Mobile Modem Driver Set
Samsung Mobile phone USB driver Software
SAMSUNG Mobile USB Modem 1.0 Software
SAMSUNG Mobile USB Modem Software
Samsung PC Studio 3 (Version: 3.0.0.80601)
Samsung PC Studio 3 (Version: 3.2.2.80601)
ScanToWeb
SDP Downloader (Version: 2.3.0)
Segoe UI (Version: 15.4.2271.0615)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition
Servicepack Datumsaktualisierung (Version: 1.00.00.0005)
Snagit 10 (Version: 10.0.0)
Spotify (HKCU Version: 0.9.4.185.g7545a404)
Steuer-Spar-Erklärung 2011 (Version: 16.14)
Steuer-Spar-Erklärung 2012 (Version: 17.05)
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
Update for Microsoft Office 2010 (KB2494150)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition
Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition
Update für Microsoft Office Excel 2007 Help (KB963678)
Update für Microsoft Office Powerpoint 2007 Help (KB963669)
Update für Microsoft Office Word 2007 Help (KB963665)
Windows Live Communications Platform (Version: 15.4.3502.0922)
Windows Live Essentials (Version: 15.4.3502.0922)
Windows Live Essentials (Version: 15.4.3555.0308)
Windows Live Family Safety (Version: 15.4.3555.0308)
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0)
Windows Live Installer (Version: 15.4.3502.0922)
Windows Live Mail (Version: 15.4.3502.0922)
Windows Live Mesh (Version: 15.4.3502.0922)
Windows Live Mesh ActiveX control for remote connections (Version: 15.4.5722.2)
Windows Live Messenger (Version: 15.4.3538.0513)
Windows Live Messenger Companion Core (Version: 15.4.3502.0922)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Photo Common (Version: 15.4.3502.0922)
Windows Live PIMT Platform (Version: 15.4.3508.1109)
Windows Live Remote Client (Version: 15.4.5722.2)
Windows Live Remote Client Resources (Version: 15.4.5722.2)
Windows Live Remote Service (Version: 15.4.5722.2)
Windows Live Remote Service Resources (Version: 15.4.5722.2)
Windows Live SOXE (Version: 15.4.3502.0922)
Windows Live SOXE Definitions (Version: 15.4.3502.0922)
Windows Live UX Platform (Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (Version: 15.4.3508.1109)
Windows Live Writer (Version: 15.4.3502.0922)
Windows Live Writer Resources (Version: 15.4.3502.0922)
Windows-Treiberpaket - Nokia pccsmcfd (08/22/2008 7.0.0.0) (Version: 08/22/2008 7.0.0.0)
==================== Restore Points =========================
13-10-2013 10:54:53 Windows Update
15-10-2013 16:36:50 Windows Update
15-10-2013 18:00:13 Windows Update
21-10-2013 17:27:49 Windows Update
21-10-2013 18:00:13 Windows Update
22-10-2013 20:51:20 Windows Update
23-10-2013 17:04:32 Geplanter Prüfpunkt
23-10-2013 18:00:11 Windows Update
24-10-2013 18:48:31 Windows Update
27-10-2013 16:59:12 Windows Update
27-10-2013 19:00:11 Windows Update
30-10-2013 17:35:28 Windows Update
30-10-2013 19:00:12 Windows Update
02-11-2013 13:26:59 Windows Update
03-11-2013 09:34:46 Windows Update
04-11-2013 18:05:22 Windows Update
04-11-2013 19:00:11 Windows Update
09-11-2013 18:30:40 Windows Update
09-11-2013 19:00:11 Windows Update
10-11-2013 01:41:20 Windows Update
17-11-2013 12:58:30 Windows Update
17-11-2013 19:00:16 Windows Update
21-11-2013 19:41:58 Windows Update
==================== Hosts content: ==========================
2006-11-02 11:23 - 2013-05-30 19:21 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {25F7AC1A-1D69-4B80-A61E-99391BC38AD6} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2011-11-12] (Google Inc.)
Task: {320124A7-D70F-41DE-A9D1-D5E8E19D5D91} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\System32\RacAgent.exe [2008-01-21] (Microsoft Corporation)
Task: {8A5C8F5F-9152-454D-AB37-193B367412A8} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-09] (Adobe Systems Incorporated)
Task: {CD074EAD-5FA0-453A-AB20-7DB3863D267E} - System32\Tasks\Microsoft\Windows\WindowsCalendar\Reminders - ***** => C:\Program Files\Windows Calendar\WinCal.exe [2009-04-10] (Microsoft Corporation)
Task: {D210AD1F-C670-478A-914D-863261D46877} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {DC7E38E7-7DC7-4A7C-8EB2-EC256A18606E} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2011-11-12] (Google Inc.)
Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\System32\gatherWirelessInfo.vbs [2008-01-21] ()
Task: {E5BEE256-3F1F-4ADA-9318-13836A1CA9BF} - System32\Tasks\Microsoft\Windows\TabletPC\InputPersonalization => C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe [2008-01-21] (Microsoft Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\GoToAssist => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (11/21/2013 10:22:51 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (11/21/2013 10:18:54 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (11/21/2013 10:18:21 PM) (Source: EventSystem) (User: )
Description: d:\longhorn\com\complus\src\events\tier1\eventsystemobj.cpp458007043c
Error: (11/21/2013 08:36:36 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (11/19/2013 11:25:31 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (11/17/2013 08:02:33 PM) (Source: EventSystem) (User: )
Description: 80070005EventSystem.EventSubscription{AA44355E-6911-4447-BA5D-6720480579AF}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}
Error: (11/17/2013 07:09:12 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (11/17/2013 04:16:06 PM) (Source: EventSystem) (User: )
Description: 80070005EventSystem.EventSubscription{AA44355E-6911-4447-BA5D-6720480579AF}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}
Error: (11/17/2013 01:51:45 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (11/11/2013 08:32:33 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (11/21/2013 10:22:55 PM) (Source: Service Control Manager) (User: )
Description: BTHidMgr
Error: (11/21/2013 10:22:55 PM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058
Error: (11/21/2013 10:19:44 PM) (Source: Service Control Manager) (User: )
Description: NetzwerklistendienstNLA (Network Location Awareness)%%1068
Error: (11/21/2013 10:19:10 PM) (Source: DCOM) (User: )
Description: 1084WSearch{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
Error: (11/21/2013 10:19:09 PM) (Source: DCOM) (User: )
Description: 1084WSearch{9E175B6D-F52A-11D8-B9A5-505054503030}
Error: (11/21/2013 10:19:04 PM) (Source: Service Control Manager) (User: )
Description: NetzwerklistendienstNLA (Network Location Awareness)%%1068
Error: (11/21/2013 10:18:55 PM) (Source: Service Control Manager) (User: )
Description: NetzwerklistendienstNLA (Network Location Awareness)%%1068
Error: (11/21/2013 10:18:55 PM) (Source: Service Control Manager) (User: )
Description: NetzwerklistendienstNLA (Network Location Awareness)%%1068
Error: (11/21/2013 10:18:55 PM) (Source: Service Control Manager) (User: )
Description: AFD
avipbb
avkmgr
BTHidMgr
DfsC
NetBIOS
netbt
nsiproxy
PSched
RasAcd
rdbss
Smb
spldr
ssmdrv
StarOpen
tcpipBM
tdx
Wanarpv6
ws2ifsl
Error: (11/21/2013 10:18:55 PM) (Source: Service Control Manager) (User: )
Description: NetzwerklistendienstNLA (Network Location Awareness)%%1068
Microsoft Office Sessions:
=========================
Error: (10/04/2011 08:51:00 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 245 seconds with 0 seconds of active time. This session ended with a crash.
Error: (06/21/2011 06:55:03 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 460 seconds with 420 seconds of active time. This session ended with a crash.
Error: (06/12/2009 00:10:56 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6504.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 5871 seconds with 4560 seconds of active time. This session ended with a crash.
Error: (06/11/2009 08:59:00 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6504.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 7458 seconds with 5580 seconds of active time. This session ended with a crash.
CodeIntegrity Errors:
===================================
Date: 2013-11-21 22:38:50.028
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-11-21 22:38:49.716
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-09-18 19:17:52.526
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-09-18 19:17:52.214
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-09-18 19:17:31.263
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-09-18 19:17:30.780
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-09-09 21:12:30.154
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\igdumd32.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-09-09 21:12:29.837
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\igdumd32.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-08-17 15:36:29.624
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\igdumd32.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-08-17 15:36:29.321
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\igdumd32.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Percentage of memory in use: 46%
Total physical RAM: 3061.31 MB
Available physical RAM: 1628.33 MB
Total Pagefile: 6326.88 MB
Available Pagefile: 4745.96 MB
Total Virtual: 2047.88 MB
Available Virtual: 1897.09 MB
==================== Drives ================================
Drive c: (OS) (Fixed) (Total:285.5 GB) (Free:90.74 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (RECOVERY) (Fixed) (Total:10 GB) (Free:3.91 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 298 GB) (Disk ID: 2BF8CD49)
Partition 1: (Not Active) - (Size=110 MB) - (Type=DE)
Partition 2: (Not Active) - (Size=10 GB) - (Type=07 NTFS)
Partition 3: (Active) - (Size=285 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=2 GB) - (Type=05)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-11-21 23:09:58
Windows 6.0.6002 Service Pack 2 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 SAMSUNG_ rev.2AR1 298,09GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\*****\AppData\Local\Temp\kwdcapow.sys
---- System - GMER 2.1 ----
SSDT 8CFE4556 ZwCreateSection
SSDT 8CFE4560 ZwRequestWaitReplyPort
SSDT 8CFE455B ZwSetContextThread
SSDT 8CFE4565 ZwSetSecurityObject
SSDT 8CFE456A ZwSystemDebugControl
SSDT 8CFE44F7 ZwTerminateProcess
---- Kernel code sections - GMER 2.1 ----
.text ntkrnlpa.exe!KeSetEvent + 215 82AB3860 4 Bytes [56, 45, FE, 8C]
.text ntkrnlpa.exe!KeSetEvent + 539 82AB3B84 4 Bytes [60, 45, FE, 8C]
.text ntkrnlpa.exe!KeSetEvent + 56D 82AB3BB8 4 Bytes [5B, 45, FE, 8C]
.text ntkrnlpa.exe!KeSetEvent + 5D1 82AB3C1C 4 Bytes [65, 45, FE, 8C]
.text ntkrnlpa.exe!KeSetEvent + 619 82AB3C64 4 Bytes [6A, 45, FE, 8C]
.text ...
---- User code sections - GMER 2.1 ----
.text C:\Program Files\Internet Explorer\iexplore.exe[1024] kernel32.dll!CreateThread 7664CB0E 5 Bytes JMP 6C7975DB C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1024] USER32.dll!SetWindowsHookExW 776087AD 5 Bytes JMP 6C7D25C4 C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1024] USER32.dll!CallNextHookEx 77608E3B 5 Bytes JMP 6C7F7FFF C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1024] USER32.dll!UnhookWindowsHookEx 776098DB 5 Bytes JMP 6C81ED20 C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1024] USER32.dll!EnableWindow 7760CD8B 5 Bytes JMP 6C7D9ECC C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1024] USER32.dll!DefWindowProcA 7760DB88 7 Bytes JMP 6C799805 C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1024] USER32.dll!CreateWindowExA 7760DC2A 5 Bytes JMP 6C7A363B C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1024] USER32.dll!CreateWindowExW 77611305 5 Bytes JMP 6C8003EF C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1024] USER32.dll!DefWindowProcW 776203B4 7 Bytes JMP 6C7F8062 C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1024] USER32.dll!DialogBoxParamW 776310B0 5 Bytes JMP 6C73189B C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1024] USER32.dll!DialogBoxIndirectParamW 77632EF5 5 Bytes JMP 6C929266 C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1024] USER32.dll!DialogBoxParamA 77648152 5 Bytes JMP 6C929201 C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1024] USER32.dll!DialogBoxIndirectParamA 7764847D 5 Bytes JMP 6C9292CB C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1024] USER32.dll!MessageBoxIndirectA 7765D4D9 5 Bytes JMP 6C929188 C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1024] USER32.dll!MessageBoxIndirectW 7765D5D3 5 Bytes JMP 6C92910F C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1024] USER32.dll!MessageBoxExA 7765D639 5 Bytes JMP 6C9290AB C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1024] USER32.dll!MessageBoxExW 7765D65D 5 Bytes JMP 6C929047 C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1024] ole32.dll!OleLoadFromStream 76701E80 5 Bytes JMP 6C929A34 C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1452] kernel32.dll!CreateThread 7664CB0E 5 Bytes JMP 6C7975DB C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1452] USER32.dll!SetWindowsHookExW 776087AD 5 Bytes JMP 6C7D25C4 C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1452] USER32.dll!CallNextHookEx 77608E3B 5 Bytes JMP 6C7F7FFF C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1452] USER32.dll!UnhookWindowsHookEx 776098DB 5 Bytes JMP 6C81ED20 C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1452] USER32.dll!EnableWindow 7760CD8B 5 Bytes JMP 6C7D9ECC C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1452] USER32.dll!DefWindowProcA 7760DB88 7 Bytes JMP 6C799805 C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1452] USER32.dll!CreateWindowExA 7760DC2A 5 Bytes JMP 6C7A363B C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1452] USER32.dll!CreateWindowExW 77611305 5 Bytes JMP 6C8003EF C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1452] USER32.dll!DefWindowProcW 776203B4 7 Bytes JMP 6C7F8062 C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1452] USER32.dll!DialogBoxParamW 776310B0 5 Bytes JMP 6C73189B C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1452] USER32.dll!DialogBoxIndirectParamW 77632EF5 5 Bytes JMP 6C929266 C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1452] USER32.dll!DialogBoxParamA 77648152 5 Bytes JMP 6C929201 C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1452] USER32.dll!DialogBoxIndirectParamA 7764847D 5 Bytes JMP 6C9292CB C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1452] USER32.dll!MessageBoxIndirectA 7765D4D9 5 Bytes JMP 6C929188 C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1452] USER32.dll!MessageBoxIndirectW 7765D5D3 5 Bytes JMP 6C92910F C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1452] USER32.dll!MessageBoxExA 7765D639 5 Bytes JMP 6C9290AB C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1452] USER32.dll!MessageBoxExW 7765D65D 5 Bytes JMP 6C929047 C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1452] ole32.dll!OleLoadFromStream 76701E80 5 Bytes JMP 6C929A34 C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3624] kernel32.dll!CreateThread 7664CB0E 5 Bytes JMP 6C7975DB C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3624] USER32.dll!SetWindowsHookExW 776087AD 5 Bytes JMP 6C7D25C4 C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3624] USER32.dll!CallNextHookEx 77608E3B 5 Bytes JMP 6C7F7FFF C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3624] USER32.dll!UnhookWindowsHookEx 776098DB 5 Bytes JMP 6C81ED20 C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3624] USER32.dll!EnableWindow 7760CD8B 5 Bytes JMP 6C7D9ECC C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3624] USER32.dll!DefWindowProcA 7760DB88 7 Bytes JMP 6C799805 C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3624] USER32.dll!CreateWindowExA 7760DC2A 5 Bytes JMP 6C7A363B C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3624] USER32.dll!CreateWindowExW 77611305 5 Bytes JMP 6C8003EF C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3624] USER32.dll!DefWindowProcW 776203B4 7 Bytes JMP 6C7F8062 C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3624] USER32.dll!DialogBoxParamW 776310B0 5 Bytes JMP 6C73189B C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3624] USER32.dll!DialogBoxIndirectParamW 77632EF5 5 Bytes JMP 6C929266 C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3624] USER32.dll!DialogBoxParamA 77648152 5 Bytes JMP 6C929201 C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3624] USER32.dll!DialogBoxIndirectParamA 7764847D 5 Bytes JMP 6C9292CB C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3624] USER32.dll!MessageBoxIndirectA 7765D4D9 5 Bytes JMP 6C929188 C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3624] USER32.dll!MessageBoxIndirectW 7765D5D3 5 Bytes JMP 6C92910F C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3624] USER32.dll!MessageBoxExA 7765D639 5 Bytes JMP 6C9290AB C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3624] USER32.dll!MessageBoxExW 7765D65D 5 Bytes JMP 6C929047 C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3624] ole32.dll!OleLoadFromStream 76701E80 5 Bytes JMP 6C929A34 C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3844] USER32.dll!EnableWindow 7760CD8B 5 Bytes JMP 6C7D9ECC C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3844] USER32.dll!DialogBoxParamW 776310B0 5 Bytes JMP 6C73189B C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3844] USER32.dll!DialogBoxIndirectParamW 77632EF5 5 Bytes JMP 6C929266 C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3844] USER32.dll!DialogBoxParamA 77648152 5 Bytes JMP 6C929201 C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3844] USER32.dll!DialogBoxIndirectParamA 7764847D 5 Bytes JMP 6C9292CB C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3844] USER32.dll!MessageBoxIndirectA 7765D4D9 5 Bytes JMP 6C929188 C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3844] USER32.dll!MessageBoxIndirectW 7765D5D3 5 Bytes JMP 6C92910F C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3844] USER32.dll!MessageBoxExA 7765D639 5 Bytes JMP 6C9290AB C:\Windows\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3844] USER32.dll!MessageBoxExW 7765D65D 5 Bytes JMP 6C929047 C:\Windows\system32\IEFRAME.dll
---- Devices - GMER 2.1 ----
AttachedDevice \Driver\tdx \Device\Tcp tcpipBM.sys
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\00158330c480
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\00158330c480@0014a7701037 0xB4 0x62 0x53 0xA8 ...
Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\00158330c480 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\00158330c480@0014a7701037 0xB4 0x62 0x53 0xA8 ...
---- EOF - GMER 2.1 ----
|
|
22.11.2013, 01:03
| #2 |
| Ruhe in Frieden † 2019     | Interpol Trojaner von Rechner entfernen Ich habe dein Thema in Arbeit und melde mich so schnell wie möglich mit weiteren Anweisungen. Bitte beachte, dass alle meine Antworten zuerst von einem Ausbilder freigegeben werden müssen, bevor ich diese hier posten darf. Dies garantiert, dass Du Hilfe von einem ausgebildeten Helfer bekommst. Ich bedanke mich für deine Geduld 
__________________ |
|
22.11.2013, 11:18
| #3 |
| Ruhe in Frieden † 2019 | Interpol Trojaner von Rechner entfernen Hallo stobias,
__________________führe diesen Fix durch (ersetze die Sternchen wieder mit dem Wort, welches dort ursprünglich stand), aktiviere die Startups wieder und starte deinen PC wieder neu, startet dieser nach diesem Fix wieder normal? Achtung, dies ist ein Entsperrversuch, bitte arbeite auch danach weiterhin mit, wir sind hier noch nicht fertig. Schritt 1 Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter C:\Users\*****\AppData\Local\Temp\0527.dll
C:\ProgramData\j67tfr8z2j6.reg
C:\ProgramData\j67tfr8z2j6.bxx
C:\ProgramData\6j2z8rft76j.dss
C:\ProgramData\j67tfr8z2j6.fvv
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
__________________ |
|
22.11.2013, 17:40
| #4 |
| | Interpol Trojaner von Rechner entfernen Hallo Sandra, vielen Dank schon mal vorab für Deine Hilfe. Ich habe den Schritt eins wie beschrieben durchegeführt. Mein Rechner startet wieder "normal". Hier ist das fixlog file: Code:
ATTFilter ix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 22-11-2013 01
Ran by ***** at 2013-11-22 17:26:04 Run:1
Running from C:\Users\*****\Desktop
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
C:\Users\*****\AppData\Local\Temp\0527.dll
C:\ProgramData\j67tfr8z2j6.reg
C:\ProgramData\j67tfr8z2j6.bxx
C:\ProgramData\6j2z8rft76j.dss
C:\ProgramData\j67tfr8z2j6.fvv
*****************
C:\Users\*****\AppData\Local\Temp\0527.dll => Moved successfully.
C:\ProgramData\j67tfr8z2j6.reg => Moved successfully.
C:\ProgramData\j67tfr8z2j6.bxx => Moved successfully.
C:\ProgramData\6j2z8rft76j.dss => Moved successfully.
C:\ProgramData\j67tfr8z2j6.fvv => Moved successfully.
==== End of Fixlog ====
|
|
23.11.2013, 08:41
| #5 |
| Ruhe in Frieden † 2019 | Interpol Trojaner von Rechner entfernen Hallo stobias, hat es eine Bedeutung, dass du das normal in Anführungsstriche gesetzt hast? Du hast alle startups wieder aktiviert? Dann mache nochmal einen Scan mit FRST Schritt 1 Starte noch einmal FRST.
|
|
23.11.2013, 10:11
| #6 |
| | Interpol Trojaner von Rechner entfernen Hallo Sandra, das "Normal" hat nur den Hintergrund, dass ich wohl mal vor Zeiten einige Anwendungen aus dem Autostart herausgenommen hatte. Ich habe es mir einfacg gemacht und alle wieder aktiviert, demzufolge dauerte das Laden etwas länger, da nun alle Programme wieder aufgerufen wurde. Es gab im Übrigen eine Fehlermeldung, dass eine Anwendung / Datei (Name sehr kryptisch) nicht gefunden bzw. geladen werden konnte. Anbei der neue Log: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 23-11-2013
Ran by ****** (administrator) on *****-PC on 23-11-2013 10:05:14
Running from C:\Users\******\Desktop
Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal
==================== Processes (Whitelisted) ===================
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Stardock Corporation) C:\Program Files\Dell\DellDock\DockLogin.exe
() C:\Windows\System32\WLTRYSVC.EXE
(Dell Inc.) C:\Windows\System32\BCMWLTRY.EXE
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EBAPI\eEBSvc.exe
() C:\Program Files\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
(Andrea Electronics Corporation) C:\Windows\System32\AEstSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(B.H.A Corporation) C:\Windows\System32\bgsvcgen.exe
(Microsoft Corp.) C:\Program Files\Microsoft\BingDesktop\BingDesktopUpdater.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50ST7.EXE
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RP7.EXE
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
() C:\Program Files\CDBurnerXP\NMSAccessU.exe
(Microsoft Corporation) C:\Program Files\Microsoft\BingBar\SeaPort.EXE
(IDT, Inc.) C:\Windows\System32\stacsv.exe
(SEIKO EPSON CORPORATION) C:\Windows\System32\SAgent4.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Conexant Systems, Inc.) C:\Windows\System32\drivers\XAudio.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Stardock Corporation) C:\Program Files\Dell\DellDock\DellDock.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(CyberLink Corp.) C:\Program Files\Dell\MediaDirect\PCMService.exe
(Creative Technology Ltd.) C:\Windows\OEM02Mon.exe
(Lexware GmbH & Co. KG) C:\Program Files\Common Files\Lexware\Update Manager\LxUpdateManager.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(shbox.de) C:\Program Files\FreePDF_XP\fpassist.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Epson Software\Event Manager\EEventManager.exe
(SupportSoft, Inc.) C:\Program Files\Dell Support Center\bin\sprtcmd.exe
() C:\Program Files\Dell DataSafe Online\DataSafeOnline.exe
(Dell Inc.) C:\Windows\System32\WLTRAY.EXE
(Microsoft Corp.) C:\Program Files\Microsoft\BingDesktop\BingDesktop.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Spotify Ltd) C:\Users\******\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\w32x86\3\E_FATIGBU.EXE
(Avanquest Software ) C:\Program Files\Digital Line Detect\DLG.exe
(Panasonic Corporation) C:\Program Files\Panasonic\HD Writer AE 1\HDWriterAutoStart.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(ZTE) C:\Program Files\congstar\Internet-Manager\Bin\mcserver.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe
(Dropbox, Inc.) C:\Users\******\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
(Microsoft Corporation) C:\Program Files\Windows Mail\WinMail.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\hidfind.exe
() C:\Program Files\congstar\Internet-Manager\Bin\dbus-daemon.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApntEx.exe
() C:\Program Files\congstar\Internet-Manager\Bin\db_daemon.exe
(Microsoft Corp.) C:\Program Files\Microsoft\BingDesktop\BDExtHost.exe
(Microsoft Corp.) C:\Program Files\Microsoft\BingDesktop\BDAppHost.exe
(SupportSoft, Inc.) C:\Program Files\Dell Support Center\bin\sprtsvc.exe
(Microsoft Corp.) C:\Program Files\Microsoft\BingDesktop\BDRuntimeHost.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-05] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [SunJavaUpdateSched] - "C:\Program Files\Java\jre7\bin\jusched.exe"
HKLM\...\Run: [SigmatelSysTrayApp] - C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe [405504 2007-11-12] (IDT, Inc.)
HKLM\...\Run: [PCMService] - C:\Program Files\Dell\MediaDirect\PCMService.exe [184320 2007-12-21] (CyberLink Corp.)
HKLM\...\Run: [OEM02Mon.exe] - C:\Windows\OEM02Mon.exe [36864 2008-03-04] (Creative Technology Ltd.)
HKLM\...\Run: [LexwareInfoService] - C:\Program Files\Common Files\Lexware\Update Manager\LxUpdateManager.exe [339240 2008-11-03] (Lexware GmbH & Co. KG)
HKLM\...\Run: [IAAnotif] - C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe [174872 2007-03-21] (Intel Corporation)
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [FUFAXSTM] - C:\Program Files\Epson Software\FAX Utility\FUFAXSTM.exe [847872 2009-12-03] (SEIKO EPSON CORPORATION)
HKLM\...\Run: [FreePDF Assistant] - C:\Program Files\FreePDF_XP\fpassist.exe [357376 2008-07-22] (shbox.de)
HKLM\...\Run: [EEventManager] - C:\Program Files\Epson Software\Event Manager\EEventManager.exe [976320 2009-12-03] (SEIKO EPSON CORPORATION)
HKLM\...\Run: [dellsupportcenter] - "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P dellsupportcenter
HKLM\...\Run: [Dell DataSafe Online] - C:\Program Files\Dell DataSafe Online\DataSafeOnline.exe [1807600 2009-11-13] ()
HKLM\...\Run: [Broadcom Wireless Manager UI] - C:\Windows\System32\WLTRAY.EXE [3563520 2008-10-27] (Dell Inc.)
HKLM\...\Run: [BingDesktop] - C:\Program Files\Microsoft\BingDesktop\BingDesktop.exe [2249352 2013-06-20] (Microsoft Corp.)
HKLM\...\Run: [Apoint] - C:\Program Files\DellTPad\Apoint.exe [167936 2008-05-04] (Alps Electric Co., Ltd.)
HKLM\...\Run: [Adobe Reader Speed Launcher] - "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
HKLM\...\Run: [Adobe ARM] - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
Winlogon\Notify\GoToAssist: C:\Program Files\Citrix\GoToAssist\514\g2awinlogon.dll (Citrix Online, a division of Citrix Systems, Inc.)
HKCU\...\Run: [WMPNSCFG] - C:\Program Files\Windows Media Player\wmpnscfg.exe [202240 2008-01-21] (Microsoft Corporation)
HKCU\...\Run: [Spotify Web Helper] - C:\Users\******\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1140736 2013-11-03] (Spotify Ltd)
HKCU\...\Run: [Epson Stylus Office BX620FWD(Netzwerk)] - C:\Users\******\AppData\Local\Temp\E_SFDB5.tmp [242 2013-06-01] ()
Startup: C:\Users\******\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk
ShortcutTarget: Dell Dock.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
Startup: C:\Users\******\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\******\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\******\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\j67tfr8z2j6.lnk
ShortcutTarget: j67tfr8z2j6.lnk -> C:\PROGRA~2\6j2z8rft76j.dss (No File)
Startup: C:\Users\******\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\******\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\regmonstd.lnk
ShortcutTarget: regmonstd.lnk -> C:\PROGRA~2\ggwia.dat (No File)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk
ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk
ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
SearchScopes: HKCU - DefaultScope {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-W1&o=100000080&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=JM&apn_dtid=YYYYYYYYDE&apn_uid=67c7f194-2929-4335-a73f-72d0e556a3e8&apn_sauid=BAE2E82F-6219-4DE8-B03E-CCAC77F2F879
SearchScopes: HKCU - {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-W1&o=100000080&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=JM&apn_dtid=YYYYYYYYDE&apn_uid=67c7f194-2929-4335-a73f-72d0e556a3e8&apn_sauid=BAE2E82F-6219-4DE8-B03E-CCAC77F2F879
BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\Snagit 10\SnagitBHO.dll (TechSmith Corporation)
BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
Toolbar: HKLM - Snagit - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\Snagit 10\SnagitIEAddin.dll (TechSmith Corporation)
Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\******\AppData\Roaming\Mozilla\Firefox\Profiles\fnp1jt9w.default
FF DefaultSearchEngine: Ask.com
FF SearchEngineOrder.1: Ask.com
FF SelectedSearchEngine: Ask.com
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf - C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf - C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.21.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll No File
FF Plugin: @java.com/JavaPlugin,version=10.21.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Users\******\AppData\Roaming\Mozilla\Firefox\Profiles\fnp1jt9w.default\searchplugins\askcom.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: defaults - C:\Users\******\AppData\Roaming\Mozilla\Firefox\Profiles\fnp1jt9w.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b}.xpi
FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{D6D05E6F-D5C1-4e03-8E33-73F92B05E262}
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF HKLM\...\Firefox\Extensions: [ff-bmboc@bytemobile.com] - C:\Program Files\congstar\Internet-Manager\Bin\addon
FF Extension: Bytemobile Optimization Client - C:\Program Files\congstar\Internet-Manager\Bin\addon
========================== Services (Whitelisted) =================
R2 AAV UpdateService; C:\Program Files\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 bgsvcgen; C:\Windows\System32\bgsvcgen.exe [145504 2007-06-15] (B.H.A Corporation)
R2 BingDesktopUpdate; C:\Program Files\Microsoft\BingDesktop\BingDesktopUpdater.exe [173192 2013-06-20] (Microsoft Corp.)
R2 DockLoginService; C:\Program Files\Dell\DellDock\DockLogin.exe [155648 2008-09-23] (Stardock Corporation)
R2 EpsonBidirectionalService; C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe [94208 2006-12-19] (SEIKO EPSON CORPORATION)
R2 EPSON_EB_RPCV4_04; C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50ST7.EXE [153600 2009-09-14] (SEIKO EPSON CORPORATION)
R2 EPSON_PM_RPCV4_04; C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RP7.EXE [121856 2009-09-14] (SEIKO EPSON CORPORATION)
R2 NMSAccessU; C:\Program Files\CDBurnerXP\NMSAccessU.exe [71096 2008-10-20] ()
R2 sprtsvc_DellSupportCenter; C:\Program Files\Dell Support Center\bin\sprtsvc.exe [201968 2008-10-04] (SupportSoft, Inc.)
R2 StatusAgent4; C:\Windows\system32\SAgent4.exe [131072 2006-12-20] (SEIKO EPSON CORPORATION)
R2 wltrysvc; C:\Windows\System32\bcmwltry.exe [2654208 2008-10-27] (Dell Inc.)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [88840 2013-09-05] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136672 2013-09-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-04-03] (Avira Operations GmbH & Co. KG)
R3 BCM42RLY; C:\Windows\System32\drivers\BCM42RLY.sys [18424 2008-10-27] (Broadcom Corporation)
S3 BthAvrcp; C:\Windows\System32\DRIVERS\BthAvrcp.sys [28048 2010-02-05] (CSR, plc)
R1 cdrbsdrv; C:\Windows\System32\Drivers\cdrbsdrv.sys [33408 2006-02-20] (B.H.A Corporation)
S3 HSPADataCardusbmdm; C:\Windows\System32\DRIVERS\HSPADataCardusbmdm.sys [106880 2011-08-19] (HSPADataCard Incorporated)
S3 HSPADataCardusbnmea; C:\Windows\System32\DRIVERS\HSPADataCardusbnmea.sys [106880 2011-08-19] (HSPADataCard Incorporated)
S3 HSPADataCardusbser; C:\Windows\System32\DRIVERS\HSPADataCardusbser.sys [106880 2011-08-19] (HSPADataCard Incorporated)
S3 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [31560 2013-06-01] ()
S3 MBAMSwissArmy; C:\Windows\system32\drivers\mbamswissarmy.sys [146648 2013-06-01] (Malwarebytes Corporation)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
R1 StarOpen; C:\Windows\System32\Drivers\StarOpen.sys [5632 2006-07-24] ()
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)
S3 AVFSFilter; system32\DRIVERS\avfsfilter.sys [x]
S3 BlueletAudio; system32\DRIVERS\blueletaudio.sys [x]
S3 BlueletSCOAudio; system32\DRIVERS\BlueletSCOAudio.sys [x]
S3 BT; system32\DRIVERS\btnetdrv.sys [x]
S3 Btcsrusb; System32\Drivers\btcusb.sys [x]
S0 BTHidEnum; System32\Drivers\vbtenum.sys [x]
S0 BTHidMgr; System32\Drivers\BTHidMgr.sys [x]
S3 catchme; \??\C:\Users\BEATEH~1\AppData\Local\Temp\catchmedhhp.sys [x]
S3 EverestDriver; \??\F:\EVEREST Ultimate Edition_Praktikant\kerneld.wnt [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
S3 SMARTMouseFilterx86; system32\DRIVERS\SMARTMouseFilterx86.sys [x]
S3 SMARTVHidMini2000x86; system32\DRIVERS\SMARTVHidMini2000x86.sys [x]
S3 SMARTVTabletPCx86; system32\DRIVERS\SMARTVTabletPCx86.sys [x]
S3 VComm; system32\DRIVERS\VComm.sys [x]
S3 VcommMgr; System32\Drivers\VcommMgr.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-11-23 10:04 - 2013-11-23 10:04 - 01091049 _____ (Farbar) C:\Users\******\Desktop\FRST.exe
2013-11-23 08:17 - 2013-11-23 08:17 - 105792079 _____ C:\Windows\system32\쐱磏ᴼ‹
2013-11-21 23:09 - 2013-11-21 23:18 - 00014192 _____ C:\Users\******\Desktop\gmer.log
2013-11-21 22:42 - 2013-11-21 22:42 - 00377856 _____ C:\Users\******\Desktop\gmer_2.1.19163.exe
2013-11-21 22:39 - 2013-11-21 23:18 - 00023875 _____ C:\Users\******\Desktop\Addition.txt
2013-11-21 22:37 - 2013-11-23 10:05 - 00020065 _____ C:\Users\******\Desktop\FRST.txt
2013-11-21 22:37 - 2013-11-21 22:37 - 00000000 ____D C:\FRST
2013-11-21 22:35 - 2013-11-21 23:17 - 00000474 _____ C:\Users\******\Desktop\defogger_disable.log
2013-11-21 22:34 - 2013-11-21 22:34 - 00050477 _____ C:\Users\******\Desktop\Defogger.exe
2013-11-21 20:38 - 2013-11-21 20:38 - 105531440 _____ C:\Windows\system32\䁋ᴼ‹
2013-11-17 20:04 - 2013-10-13 11:42 - 12344832 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-17 20:04 - 2013-10-13 11:08 - 09739264 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-17 20:04 - 2013-10-13 10:48 - 01806848 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-17 20:04 - 2013-10-13 10:37 - 01104896 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-17 20:04 - 2013-10-13 10:35 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-11-17 20:04 - 2013-10-13 10:35 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-17 20:04 - 2013-10-13 10:33 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-11-17 20:04 - 2013-10-13 10:32 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-17 20:04 - 2013-10-13 10:30 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-17 20:04 - 2013-10-13 10:30 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-11-17 20:04 - 2013-10-13 10:29 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-11-17 20:04 - 2013-10-13 10:27 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-17 20:04 - 2013-10-13 10:27 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-17 20:04 - 2013-10-13 10:26 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-11-17 20:04 - 2013-10-13 10:25 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-17 20:04 - 2013-10-13 10:20 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-17 14:13 - 2013-10-03 13:45 - 00297984 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2013-11-17 14:12 - 2013-10-11 03:08 - 00444928 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2013-11-17 14:12 - 2013-10-11 03:07 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2013-11-17 14:12 - 2013-10-11 01:39 - 00218228 _____ C:\Windows\system32\WFP.TMF
2013-11-17 14:12 - 2013-10-03 13:45 - 00993792 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-11-03 10:55 - 2013-11-09 19:31 - 00000000 ____D C:\Users\******\AppData\Local\Spotify
2013-11-03 10:55 - 2013-11-03 10:55 - 00001748 _____ C:\Users\******\Desktop\Spotify.lnk
2013-11-03 10:55 - 2013-11-03 10:55 - 00001734 _____ C:\Users\******\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
2013-11-03 10:54 - 2013-11-10 01:35 - 00000000 ____D C:\Users\******\AppData\Roaming\Spotify
2013-11-03 10:29 - 2013-11-03 10:29 - 104684788 _____ C:\Windows\system32\朌ᴼš
==================== One Month Modified Files and Folders =======
2013-11-23 10:06 - 2013-11-21 22:37 - 00020065 _____ C:\Users\******\Desktop\FRST.txt
2013-11-23 10:04 - 2013-11-23 10:04 - 01091049 _____ (Farbar) C:\Users\******\Desktop\FRST.exe
2013-11-23 09:29 - 2013-06-01 21:37 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-23 09:16 - 2011-11-12 21:20 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-23 08:18 - 2009-01-09 18:45 - 02086668 _____ C:\Windows\WindowsUpdate.log
2013-11-23 08:17 - 2013-11-23 08:17 - 105792079 _____ C:\Windows\system32\쐱磏ᴼ‹
2013-11-23 08:16 - 2011-06-28 18:44 - 00000000 ___RD C:\Users\******\Dropbox
2013-11-23 08:16 - 2011-06-28 18:37 - 00000000 ____D C:\Users\******\AppData\Roaming\Dropbox
2013-11-23 08:12 - 2011-11-12 21:20 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-23 08:12 - 2006-11-02 14:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-23 08:12 - 2006-11-02 13:47 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-23 08:12 - 2006-11-02 13:47 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-22 22:34 - 2009-11-12 22:33 - 00000012 _____ C:\Windows\bthservsdp.dat
2013-11-22 22:34 - 2006-11-02 14:01 - 00032536 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-11-22 17:28 - 2012-01-14 17:04 - 00000000 ____D C:\Windows\pss
2013-11-21 23:18 - 2013-11-21 23:09 - 00014192 _____ C:\Users\******\Desktop\gmer.log
2013-11-21 23:18 - 2013-11-21 22:39 - 00023875 _____ C:\Users\******\Desktop\Addition.txt
2013-11-21 23:17 - 2013-11-21 22:35 - 00000474 _____ C:\Users\******\Desktop\defogger_disable.log
2013-11-21 22:42 - 2013-11-21 22:42 - 00377856 _____ C:\Users\******\Desktop\gmer_2.1.19163.exe
2013-11-21 22:37 - 2013-11-21 22:37 - 00000000 ____D C:\FRST
2013-11-21 22:34 - 2013-11-21 22:34 - 00050477 _____ C:\Users\******\Desktop\Defogger.exe
2013-11-21 20:38 - 2013-11-21 20:38 - 105531440 _____ C:\Windows\system32\䁋ᴼ‹
2013-11-19 23:42 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\rescache
2013-11-17 20:04 - 2009-01-09 18:16 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-11-17 20:04 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\system32\de-DE
2013-11-17 13:58 - 2008-01-21 08:16 - 01432888 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-10 01:35 - 2013-11-03 10:54 - 00000000 ____D C:\Users\******\AppData\Roaming\Spotify
2013-11-09 19:31 - 2013-11-03 10:55 - 00000000 ____D C:\Users\******\AppData\Local\Spotify
2013-11-03 10:55 - 2013-11-03 10:55 - 00001748 _____ C:\Users\******\Desktop\Spotify.lnk
2013-11-03 10:55 - 2013-11-03 10:55 - 00001734 _____ C:\Users\******\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
2013-11-03 10:29 - 2013-11-03 10:29 - 104684788 _____ C:\Windows\system32\朌ᴼš
Files to move or delete:
====================
C:\Users\******\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\regmonstd.lnk
Some content of TEMP:
====================
C:\Users\******\AppData\Local\Temp\Foxit Reader Updater.exe
C:\Users\******\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\******\AppData\Local\Temp\FreemakeVideoConverter_4.0.2.20.exe
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-11-23 08:19
==================== End Of Log ============================
Gruß Tobias |
|
24.11.2013, 14:16
| #7 | |
| Ruhe in Frieden † 2019 | Interpol Trojaner von Rechner entfernen Hallo stobias, danke für die Information, Zitat:
Schritt 1 Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter Startup: C:\Users\******\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\j67tfr8z2j6.lnk
ShortcutTarget: j67tfr8z2j6.lnk -> C:\PROGRA~2\6j2z8rft76j.dss (No File)
Startup: C:\Users\******\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\regmonstd.lnk
ShortcutTarget: regmonstd.lnk -> C:\PROGRA~2\ggwia.dat (No File)
SearchScopes: HKCU - DefaultScope {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-W1&o=100000080&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=JM&apn_dtid=YYYYYYYYDE&apn_uid=67c7f194-2929-4335-a73f-72d0e556a3e8&apn_sauid=BAE2E82F-6219-4DE8-B03E-CCAC77F2F879
SearchScopes: HKCU - {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-W1&o=100000080&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=JM&apn_dtid=YYYYYYYYDE&apn_uid=67c7f194-2929-4335-a73f-72d0e556a3e8&apn_sauid=BAE2E82F-6219-4DE8-B03E-CCAC77F2F879
FF DefaultSearchEngine: Ask.com
FF SearchEngineOrder.1: Ask.com
FF SelectedSearchEngine: Ask.com
FF SearchPlugin: C:\Users\******\AppData\Roaming\Mozilla\Firefox\Profiles\fnp1jt9w.default\searchplugins\askcom.xml
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Schritt 2 Downloade Dir bitte  Malwarebytes Anti-Malware
Schritt 3 Da der Scan mit Eset sehr gründlich ist, kann er unter Umständen mehrere Stunden dauern  ESET Online Scanner
Schritt 4 Starte noch einmal FRST.
|
|
24.11.2013, 20:46
| #8 |
| | Interpol Trojaner von Rechner entfernen Hallo bootsektor, ich habe die Schritte wie beschrieben durchgeführt. Hier sind meine Logs und Antworten: Schritt 1: Fixlog.txt: Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 24-11-2013
Ran by *** at 2013-11-24 18:14:52 Run:2
Running from C:\Users\***\Desktop
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
Startup: C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\j67tfr8z2j6.lnk
ShortcutTarget: j67tfr8z2j6.lnk -> C:\PROGRA~2\6j2z8rft76j.dss (No File)
Startup: C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\regmonstd.lnk
ShortcutTarget: regmonstd.lnk -> C:\PROGRA~2\ggwia.dat (No File)
SearchScopes: HKCU - DefaultScope {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-W1&o=100000080&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=JM&apn_dtid=YYYYYYYYDE&apn_uid=67c7f194-2929-4335-a73f-72d0e556a3e8&apn_sauid=BAE2E82F-6219-4DE8-B03E-CCAC77F2F879
SearchScopes: HKCU - {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-W1&o=100000080&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=JM&apn_dtid=YYYYYYYYDE&apn_uid=67c7f194-2929-4335-a73f-72d0e556a3e8&apn_sauid=BAE2E82F-6219-4DE8-B03E-CCAC77F2F879
FF DefaultSearchEngine: Ask.com
FF SearchEngineOrder.1: Ask.com
FF SelectedSearchEngine: Ask.com
FF SearchPlugin: C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\fnp1jt9w.default\searchplugins\askcom.xml
*****************
C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\j67tfr8z2j6.lnk => Moved successfully.
C:\PROGRA~2\6j2z8rft76j.dss not found.
C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\regmonstd.lnk => Moved successfully.
C:\PROGRA~2\ggwia.dat not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value deleted successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} => Key not found.
Firefox DefaultSearchEngine deleted successfully.
Firefox SearchEngineOrder.1 deleted successfully.
Firefox SelectedSearchEngine deleted successfully.
C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\fnp1jt9w.default\searchplugins\askcom.xml => Moved successfully.
==== End of Fixlog ====
Schritt 2: Beim ersten Durchführen des Scans stürzte der Rechner ab (blauer Bildschirm), beim zweiten Versuch war der Scan erfolgreich. log: Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.11.24.07 Windows Vista Service Pack 2 x86 NTFS Internet Explorer 9.0.8112.16421 *** :: ***-PC [Administrator] 24.11.2013 18:56:52 mbam-log-2013-11-24 (18-56-52).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 210301 Laufzeit: 9 Minute(n), 11 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 2 C:\Users\***\AppData\Local\Temp\6j2z8rft76j.dss (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\***\AppData\Local\Temp\FreemakeVideoConverter_4.0.2.20.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) Eset log: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=ce191f0b273fe74f8b54595549eb2bdf
# engine=16006
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-11-24 07:31:10
# local_time=2013-11-24 08:31:10 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=1799 16775165 100 97 13099 250744760 5858 0
# compatibility_mode=5892 16776574 100 100 15205111 222854198 0 0
# scanned=125058
# found=5
# cleaned=0
# scan_time=4068
sh=5BBA7DEE380F47BC88B8FF242867ED5C287EA481 ft=1 fh=b9adadcc0e442a1b vn="a variant of Win32/Kryptik.BPMP trojan" ac=I fn="C:\FRST\Quarantine\0527.dll"
sh=5BBA7DEE380F47BC88B8FF242867ED5C287EA481 ft=1 fh=b9adadcc0e442a1b vn="a variant of Win32/Kryptik.BPMP trojan" ac=I fn="C:\FRST\Quarantine\6j2z8rft76j.dss"
sh=00A89785ED0E79A646BBF122343FF08A04504F7F ft=0 fh=0000000000000000 vn="Win32/Reveton.M trojan" ac=I fn="C:\FRST\Quarantine\regmonstd.lnk"
sh=F676087B74C4FC34A0C88C80384348A85F0F470A ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\Beate Hennig\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46\3395722e-18fdb08b"
sh=00A89785ED0E79A646BBF122343FF08A04504F7F ft=0 fh=0000000000000000 vn="Win32/Reveton.M trojan" ac=I fn="C:\Users\Beate Hennig\Desktop\regmonstd.lnk"
FRST log: Code:
ATTFilter can result of Farbar Recovery Scan Tool (FRST) (x86) Version: 24-11-2013
Ran by *** (administrator) on ***-PC on 24-11-2013 20:42:04
Running from C:\Users\***\Desktop
Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal
==================== Processes (Whitelisted) ===================
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Stardock Corporation) C:\Program Files\Dell\DellDock\DockLogin.exe
() C:\Windows\System32\WLTRYSVC.EXE
(Dell Inc.) C:\Windows\System32\BCMWLTRY.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EBAPI\eEBSvc.exe
() C:\Program Files\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
(Andrea Electronics Corporation) C:\Windows\System32\AEstSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(B.H.A Corporation) C:\Windows\System32\bgsvcgen.exe
(Microsoft Corp.) C:\Program Files\Microsoft\BingDesktop\BingDesktopUpdater.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50ST7.EXE
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RP7.EXE
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
() C:\Program Files\CDBurnerXP\NMSAccessU.exe
(Microsoft Corporation) C:\Program Files\Microsoft\BingBar\SeaPort.EXE
(IDT, Inc.) C:\Windows\System32\stacsv.exe
(SEIKO EPSON CORPORATION) C:\Windows\System32\SAgent4.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Conexant Systems, Inc.) C:\Windows\System32\drivers\XAudio.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Stardock Corporation) C:\Program Files\Dell\DellDock\DellDock.exe
(CyberLink Corp.) C:\Program Files\Dell\MediaDirect\PCMService.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Creative Technology Ltd.) C:\Windows\OEM02Mon.exe
(Lexware GmbH & Co. KG) C:\Program Files\Common Files\Lexware\Update Manager\LxUpdateManager.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(shbox.de) C:\Program Files\FreePDF_XP\fpassist.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Epson Software\Event Manager\EEventManager.exe
(SupportSoft, Inc.) C:\Program Files\Dell Support Center\bin\sprtcmd.exe
() C:\Program Files\Dell DataSafe Online\DataSafeOnline.exe
(Dell Inc.) C:\Windows\System32\WLTRAY.EXE
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Spotify Ltd) C:\Users\***\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\w32x86\3\E_FATIGBU.EXE
(Avanquest Software ) C:\Program Files\Digital Line Detect\DLG.exe
(Panasonic Corporation) C:\Program Files\Panasonic\HD Writer AE 1\HDWriterAutoStart.exe
(ZTE) C:\Program Files\congstar\Internet-Manager\Bin\mcserver.exe
(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe
(Dropbox, Inc.) C:\Users\***\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
(Microsoft Corporation) C:\Windows\System32\conime.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
() C:\Program Files\congstar\Internet-Manager\Bin\dbus-daemon.exe
() C:\Program Files\congstar\Internet-Manager\Bin\db_daemon.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\hidfind.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApntEx.exe
(SupportSoft, Inc.) C:\Program Files\Dell Support Center\bin\sprtsvc.exe
(Microsoft Corporation) C:\Program Files\Windows Mail\WinMail.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-05] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [SunJavaUpdateSched] - "C:\Program Files\Java\jre7\bin\jusched.exe"
HKLM\...\Run: [SigmatelSysTrayApp] - C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe [405504 2007-11-12] (IDT, Inc.)
HKLM\...\Run: [PCMService] - C:\Program Files\Dell\MediaDirect\PCMService.exe [184320 2007-12-21] (CyberLink Corp.)
HKLM\...\Run: [OEM02Mon.exe] - C:\Windows\OEM02Mon.exe [36864 2008-03-04] (Creative Technology Ltd.)
HKLM\...\Run: [LexwareInfoService] - C:\Program Files\Common Files\Lexware\Update Manager\LxUpdateManager.exe [339240 2008-11-03] (Lexware GmbH & Co. KG)
HKLM\...\Run: [IAAnotif] - C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe [174872 2007-03-21] (Intel Corporation)
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [FreePDF Assistant] - C:\Program Files\FreePDF_XP\fpassist.exe [357376 2008-07-22] (shbox.de)
HKLM\...\Run: [EEventManager] - C:\Program Files\Epson Software\Event Manager\EEventManager.exe [976320 2009-12-03] (SEIKO EPSON CORPORATION)
HKLM\...\Run: [dellsupportcenter] - "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P dellsupportcenter
HKLM\...\Run: [Dell DataSafe Online] - C:\Program Files\Dell DataSafe Online\DataSafeOnline.exe [1807600 2009-11-13] ()
HKLM\...\Run: [Broadcom Wireless Manager UI] - C:\Windows\System32\WLTRAY.EXE [3563520 2008-10-27] (Dell Inc.)
HKLM\...\Run: [Apoint] - C:\Program Files\DellTPad\Apoint.exe [167936 2008-05-04] (Alps Electric Co., Ltd.)
HKLM\...\Run: [Adobe Reader Speed Launcher] - "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
HKLM\...\Run: [Adobe ARM] - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
Winlogon\Notify\GoToAssist: C:\Program Files\Citrix\GoToAssist\514\g2awinlogon.dll (Citrix Online, a division of Citrix Systems, Inc.)
HKCU\...\Run: [WMPNSCFG] - C:\Program Files\Windows Media Player\wmpnscfg.exe [202240 2008-01-21] (Microsoft Corporation)
HKCU\...\Run: [Spotify Web Helper] - C:\Users\***\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1140736 2013-11-03] (Spotify Ltd)
HKCU\...\Run: [Epson Stylus Office BX620FWD(Netzwerk)] - C:\Users\***\AppData\Local\Temp\E_SFDB5.tmp [242 2013-06-01] ()
Startup: C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk
ShortcutTarget: Dell Dock.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
Startup: C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\***\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk
ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk
ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\Snagit 10\SnagitBHO.dll (TechSmith Corporation)
BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
Toolbar: HKLM - Snagit - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\Snagit 10\SnagitIEAddin.dll (TechSmith Corporation)
Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\fnp1jt9w.default
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf - C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf - C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.21.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll No File
FF Plugin: @java.com/JavaPlugin,version=10.21.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: defaults - C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\fnp1jt9w.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b}.xpi
FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{D6D05E6F-D5C1-4e03-8E33-73F92B05E262}
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF HKLM\...\Firefox\Extensions: [ff-bmboc@bytemobile.com] - C:\Program Files\congstar\Internet-Manager\Bin\addon
FF Extension: Bytemobile Optimization Client - C:\Program Files\congstar\Internet-Manager\Bin\addon
========================== Services (Whitelisted) =================
R2 AAV UpdateService; C:\Program Files\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 bgsvcgen; C:\Windows\System32\bgsvcgen.exe [145504 2007-06-15] (B.H.A Corporation)
R2 BingDesktopUpdate; C:\Program Files\Microsoft\BingDesktop\BingDesktopUpdater.exe [173192 2013-06-20] (Microsoft Corp.)
R2 DockLoginService; C:\Program Files\Dell\DellDock\DockLogin.exe [155648 2008-09-23] (Stardock Corporation)
R2 EpsonBidirectionalService; C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe [94208 2006-12-19] (SEIKO EPSON CORPORATION)
R2 EPSON_EB_RPCV4_04; C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50ST7.EXE [153600 2009-09-14] (SEIKO EPSON CORPORATION)
R2 EPSON_PM_RPCV4_04; C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RP7.EXE [121856 2009-09-14] (SEIKO EPSON CORPORATION)
R2 NMSAccessU; C:\Program Files\CDBurnerXP\NMSAccessU.exe [71096 2008-10-20] ()
R2 sprtsvc_DellSupportCenter; C:\Program Files\Dell Support Center\bin\sprtsvc.exe [201968 2008-10-04] (SupportSoft, Inc.)
R2 StatusAgent4; C:\Windows\system32\SAgent4.exe [131072 2006-12-20] (SEIKO EPSON CORPORATION)
R2 wltrysvc; C:\Windows\System32\bcmwltry.exe [2654208 2008-10-27] (Dell Inc.)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [88840 2013-09-05] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136672 2013-09-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-04-03] (Avira Operations GmbH & Co. KG)
R3 BCM42RLY; C:\Windows\System32\drivers\BCM42RLY.sys [18424 2008-10-27] (Broadcom Corporation)
S3 BthAvrcp; C:\Windows\System32\DRIVERS\BthAvrcp.sys [28048 2010-02-05] (CSR, plc)
R1 cdrbsdrv; C:\Windows\System32\Drivers\cdrbsdrv.sys [33408 2006-02-20] (B.H.A Corporation)
S3 HSPADataCardusbmdm; C:\Windows\System32\DRIVERS\HSPADataCardusbmdm.sys [106880 2011-08-19] (HSPADataCard Incorporated)
S3 HSPADataCardusbnmea; C:\Windows\System32\DRIVERS\HSPADataCardusbnmea.sys [106880 2011-08-19] (HSPADataCard Incorporated)
S3 HSPADataCardusbser; C:\Windows\System32\DRIVERS\HSPADataCardusbser.sys [106880 2011-08-19] (HSPADataCard Incorporated)
S3 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [31560 2013-06-01] ()
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
R1 StarOpen; C:\Windows\System32\Drivers\StarOpen.sys [5632 2006-07-24] ()
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)
S3 AVFSFilter; system32\DRIVERS\avfsfilter.sys [x]
S3 BlueletAudio; system32\DRIVERS\blueletaudio.sys [x]
S3 BlueletSCOAudio; system32\DRIVERS\BlueletSCOAudio.sys [x]
S3 BT; system32\DRIVERS\btnetdrv.sys [x]
S3 Btcsrusb; System32\Drivers\btcusb.sys [x]
S0 BTHidEnum; System32\Drivers\vbtenum.sys [x]
S0 BTHidMgr; System32\Drivers\BTHidMgr.sys [x]
S3 catchme; \??\C:\Users\BEATEH~1\AppData\Local\Temp\catchmedhhp.sys [x]
S3 EverestDriver; \??\F:\EVEREST Ultimate Edition_Praktikant\kerneld.wnt [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
S3 SMARTMouseFilterx86; system32\DRIVERS\SMARTMouseFilterx86.sys [x]
S3 SMARTVHidMini2000x86; system32\DRIVERS\SMARTVHidMini2000x86.sys [x]
S3 SMARTVTabletPCx86; system32\DRIVERS\SMARTVTabletPCx86.sys [x]
S3 VComm; system32\DRIVERS\VComm.sys [x]
S3 VcommMgr; System32\Drivers\VcommMgr.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-11-24 19:18 - 2013-11-24 19:18 - 00000000 ____D C:\Program Files\ESET
2013-11-24 19:17 - 2013-11-24 19:17 - 02347384 _____ (ESET) C:\Users\***\Desktop\esetsmartinstaller_enu.exe
2013-11-24 18:47 - 2013-11-24 18:48 - 00143848 _____ C:\Windows\Minidump\Mini112413-02.dmp
2013-11-24 18:18 - 2013-11-24 18:18 - 00000908 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-11-24 18:16 - 2013-11-24 18:16 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\***\Desktop\mbam-setup-1.75.0.1300.exe
2013-11-24 18:14 - 2013-11-24 18:14 - 01091583 _____ (Farbar) C:\Users\***\Desktop\FRST.exe
2013-11-24 18:02 - 2013-11-24 18:02 - 00143848 _____ C:\Windows\Minidump\Mini112413-01.dmp
2013-11-24 17:53 - 2013-11-24 17:53 - 105952601 _____ C:\Windows\system32\䚏Ⴟᴼ¢
2013-11-23 14:55 - 2013-11-23 14:55 - 105835460 _____ C:\Windows\system32\쐱磏ᴼ‹
2013-11-23 10:07 - 2013-11-23 10:07 - 00027608 _____ C:\Users\***\Desktop\FRST_mod.txt
2013-11-21 23:09 - 2013-11-21 23:18 - 00014192 _____ C:\Users\***\Desktop\gmer.log
2013-11-21 22:42 - 2013-11-21 22:42 - 00377856 _____ C:\Users\***\Desktop\gmer_2.1.19163.exe
2013-11-21 22:39 - 2013-11-21 23:18 - 00023875 _____ C:\Users\***\Desktop\Addition.txt
2013-11-21 22:37 - 2013-11-24 20:42 - 00017854 _____ C:\Users\***\Desktop\FRST.txt
2013-11-21 22:37 - 2013-11-21 22:37 - 00000000 ____D C:\FRST
2013-11-21 22:35 - 2013-11-21 23:17 - 00000474 _____ C:\Users\***\Desktop\defogger_disable.log
2013-11-21 22:34 - 2013-11-21 22:34 - 00050477 _____ C:\Users\***\Desktop\Defogger.exe
2013-11-21 20:38 - 2013-11-21 20:38 - 105531440 _____ C:\Windows\system32\䁋ᴼ‹
2013-11-17 20:04 - 2013-10-13 11:42 - 12344832 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-17 20:04 - 2013-10-13 11:08 - 09739264 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-17 20:04 - 2013-10-13 10:48 - 01806848 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-17 20:04 - 2013-10-13 10:37 - 01104896 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-17 20:04 - 2013-10-13 10:35 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-11-17 20:04 - 2013-10-13 10:35 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-17 20:04 - 2013-10-13 10:33 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-11-17 20:04 - 2013-10-13 10:32 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-17 20:04 - 2013-10-13 10:30 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-17 20:04 - 2013-10-13 10:30 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-11-17 20:04 - 2013-10-13 10:29 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-11-17 20:04 - 2013-10-13 10:27 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-17 20:04 - 2013-10-13 10:27 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-17 20:04 - 2013-10-13 10:26 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-11-17 20:04 - 2013-10-13 10:25 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-17 20:04 - 2013-10-13 10:20 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-17 14:13 - 2013-10-03 13:45 - 00297984 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2013-11-17 14:12 - 2013-10-11 03:08 - 00444928 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2013-11-17 14:12 - 2013-10-11 03:07 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2013-11-17 14:12 - 2013-10-11 01:39 - 00218228 _____ C:\Windows\system32\WFP.TMF
2013-11-17 14:12 - 2013-10-03 13:45 - 00993792 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-11-03 10:55 - 2013-11-09 19:31 - 00000000 ____D C:\Users\***\AppData\Local\Spotify
2013-11-03 10:55 - 2013-11-03 10:55 - 00001748 _____ C:\Users\***\Desktop\Spotify.lnk
2013-11-03 10:55 - 2013-11-03 10:55 - 00001734 _____ C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
2013-11-03 10:54 - 2013-11-10 01:35 - 00000000 ____D C:\Users\***\AppData\Roaming\Spotify
2013-11-03 10:29 - 2013-11-03 10:29 - 104684788 _____ C:\Windows\system32\朌ᴼš
==================== One Month Modified Files and Folders =======
2013-11-24 20:43 - 2013-11-21 22:37 - 00017854 _____ C:\Users\***\Desktop\FRST.txt
2013-11-24 20:29 - 2013-06-01 21:37 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-24 20:16 - 2011-11-12 21:20 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-24 20:16 - 2011-11-12 21:20 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-24 20:01 - 2009-01-09 18:45 - 01100172 _____ C:\Windows\WindowsUpdate.log
2013-11-24 19:18 - 2013-11-24 19:18 - 00000000 ____D C:\Program Files\ESET
2013-11-24 19:17 - 2013-11-24 19:17 - 02347384 _____ (ESET) C:\Users\***\Desktop\esetsmartinstaller_enu.exe
2013-11-24 19:14 - 2011-06-28 18:44 - 00000000 ___RD C:\Users\***\Dropbox
2013-11-24 19:14 - 2011-06-28 18:37 - 00000000 ____D C:\Users\***\AppData\Roaming\Dropbox
2013-11-24 19:10 - 2012-01-14 17:06 - 00105356 _____ C:\Windows\PFRO.log
2013-11-24 19:10 - 2006-11-02 14:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-24 19:10 - 2006-11-02 13:47 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-24 19:10 - 2006-11-02 13:47 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-24 19:09 - 2009-11-12 22:33 - 00000012 _____ C:\Windows\bthservsdp.dat
2013-11-24 19:09 - 2006-11-02 14:01 - 00032536 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-11-24 18:48 - 2013-11-24 18:47 - 00143848 _____ C:\Windows\Minidump\Mini112413-02.dmp
2013-11-24 18:47 - 2013-05-30 18:29 - 280435430 _____ C:\Windows\MEMORY.DMP
2013-11-24 18:47 - 2009-10-25 11:44 - 00000000 ____D C:\Windows\Minidump
2013-11-24 18:18 - 2013-11-24 18:18 - 00000908 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-11-24 18:18 - 2013-05-30 20:04 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-11-24 18:16 - 2013-11-24 18:16 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\***\Desktop\mbam-setup-1.75.0.1300.exe
2013-11-24 18:14 - 2013-11-24 18:14 - 01091583 _____ (Farbar) C:\Users\***\Desktop\FRST.exe
2013-11-24 18:02 - 2013-11-24 18:02 - 00143848 _____ C:\Windows\Minidump\Mini112413-01.dmp
2013-11-24 17:53 - 2013-11-24 17:53 - 105952601 _____ C:\Windows\system32\䚏Ⴟᴼ¢
2013-11-23 14:55 - 2013-11-23 14:55 - 105835460 _____ C:\Windows\system32\쐱磏ᴼ‹
2013-11-23 10:07 - 2013-11-23 10:07 - 00027608 _____ C:\Users\***\Desktop\FRST_mod.txt
2013-11-22 17:28 - 2012-01-14 17:04 - 00000000 ____D C:\Windows\pss
2013-11-21 23:18 - 2013-11-21 23:09 - 00014192 _____ C:\Users\***\Desktop\gmer.log
2013-11-21 23:18 - 2013-11-21 22:39 - 00023875 _____ C:\Users\***\Desktop\Addition.txt
2013-11-21 23:17 - 2013-11-21 22:35 - 00000474 _____ C:\Users\***\Desktop\defogger_disable.log
2013-11-21 22:42 - 2013-11-21 22:42 - 00377856 _____ C:\Users\***\Desktop\gmer_2.1.19163.exe
2013-11-21 22:37 - 2013-11-21 22:37 - 00000000 ____D C:\FRST
2013-11-21 22:34 - 2013-11-21 22:34 - 00050477 _____ C:\Users\***\Desktop\Defogger.exe
2013-11-21 20:38 - 2013-11-21 20:38 - 105531440 _____ C:\Windows\system32\䁋ᴼ‹
2013-11-19 23:42 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\rescache
2013-11-17 20:04 - 2009-01-09 18:16 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-11-17 20:04 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\system32\de-DE
2013-11-17 13:58 - 2008-01-21 08:16 - 01432888 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-10 01:35 - 2013-11-03 10:54 - 00000000 ____D C:\Users\***\AppData\Roaming\Spotify
2013-11-09 19:31 - 2013-11-03 10:55 - 00000000 ____D C:\Users\***\AppData\Local\Spotify
2013-11-03 10:55 - 2013-11-03 10:55 - 00001748 _____ C:\Users\***\Desktop\Spotify.lnk
2013-11-03 10:55 - 2013-11-03 10:55 - 00001734 _____ C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
2013-11-03 10:29 - 2013-11-03 10:29 - 104684788 _____ C:\Windows\system32\朌ᴼš
Some content of TEMP:
====================
C:\Users\***\AppData\Local\Temp\Foxit Reader Updater.exe
C:\Users\***\AppData\Local\Temp\fp_pl_pfs_installer.exe
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-11-24 19:20
==================== End Of Log ==========================
|
|
25.11.2013, 11:16
| #9 |
| Ruhe in Frieden † 2019 | Interpol Trojaner von Rechner entfernen Hallo Tobias, die Funde von ESET sind in den temporären Verzeichnissen und im Java-Cache, die werden wir mit den nächsten Schritten entfernen. Schritt 1 Lade dir  TFC (TempFileCleaner von Oldtimer) herunter und speichere es auf den Desktop.
Schritt 2 Leere nach dieser Anleitung deinen Java Cache. OK So wie ich es sehe, haben wir damit alles Schadhafte entfernt. Deine Logs sind sauber. Abschließend räumen wir noch etwas auf, führen Updates durch und dann bekommst du noch etwas Lesestoff von mir. Schritt 1 Falls Du Malwarebytes-Antimalware und den ESET-Onlinescan nicht mehr benötigst, kannst Du beide Programme einfach über die Programmdeinstallation deinstallieren. Ich empfehle Dir aber zumindest Malwarebytes zu behalten, und damit einmal die Woche einen Kontrollscan zu machen. Schritt 2 Downloade dir bitte delfix auf deinen Desktop.
Updates / Programme aktualisieren
Stelle sicher, dass dein FlashPlayer nach Updates sucht. Den FlashPlayer kann man entweder direkt bei der Installation so konfigurieren, dass er nach Updates automatisch sucht, nachträglich kann man das über folgenden Link machen: Adobe - Flash Player: Einstellungsmanager - Globale Benachrichtigungseinstellungen
Nun zum Schluss noch ein paar Tipps zur Absicherung deines Systems. Aktualität des Systems Es ist extrem wichtig, dass sowohl dein System als auch die darauf installierte sicherheitsrelevante Software (Flash Player, PDF-Reader und besonders Java) aktuell sind.
Antivirensoftware
Zusätzlicher Schutz
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der Internet Explorer, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Systemleistung Lösche regelmäßig deine temporären Dateien. Ich empfehle hierzu TFC Halte dich fern von jeglichen Registry Cleanern. Diese schaden deinem System mehr als dass sie es schneller machen. Verhaltensregeln zum sichereren Surfen
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann. Falls Du Lob oder Kritik abgeben möchtest, kannst Du das sehr gerne hier tun. Wenn Du etwas für das Forum und unsere Arbeit spenden möchtest, so kannst Du das hier tun. |
|
25.11.2013, 20:26
| #10 |
| | Interpol Trojaner von Rechner entfernen Hallo Bootsektor, ich habe versucht TFC auszuführen, doch leider stürzt das Programm jedes mal ab. Gruß Tobias |
|
26.11.2013, 11:05
| #11 |
| Ruhe in Frieden † 2019 | Interpol Trojaner von Rechner entfernen Hallo Tobias, mache anstelle von TFC dann eine Datenträgerbereinigung mit Windows, hier findest du eine Anleitung dazu. Wichtig! Setze den Haken bei Temporäre Dateien |
|
26.11.2013, 23:19
| #12 |
| | Interpol Trojaner von Rechner entfernen Hallo Sandra, ich habe alle beschriebenen Schritte durchgeführt. Vielen Dank für Deine Hilfe! Viele Grüße Tobias |
|
27.11.2013, 13:59
| #13 |
| Ruhe in Frieden † 2019 | Interpol Trojaner von Rechner entfernen Bitte schön, gern geschehen. Dieses Thema scheint erledigt und wird aus meinen Abonnements gelöscht, somit bekomme ich keine Benachrichtigungen mehr über neue Antworten. Solltest Du noch Fragen oder Probleme haben, so schicke mir bitte eine PM |
|
| Themen zu Interpol Trojaner von Rechner entfernen |
| adobe, antivirus, avira, bingbar, cdburnerxp, defender, entfernen, excel, farbar recovery scan tool, flash player, karte, mozilla, plug-in, programm, pup.optional.opencandy, registry, schädling, security, services.exe, software, svchost.exe, trojan.ransom.ed, trojaner, win32/kryptik.bpmp, win32/reveton.m, windows, wsearch |
Linear-Darstellung
