Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 03-12-2013 02
Ran by Ich at 2013-12-03 20:05:49 Run:1
Running from C:\Users\Ich\Desktop
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
start
C:\Users\Ich\AppData\Roaming\speedtest4354
C:\Users\Ich\AppData\Roaming\freegames4357
end

*****************

C:\Users\Ich\AppData\Roaming\speedtest4354 => Moved successfully.
C:\Users\Ich\AppData\Roaming\freegames4357 => Moved successfully.

==== End of Fixlog ====

HitmanPro 3.7.8.208
www.hitmanpro.com

   Computer name . . . . : LENOVO
   Windows . . . . . . . : 6.1.1.7601.X86/4
   User name . . . . . . : Lenovo\Ich
   UAC . . . . . . . . . : Enabled
   License . . . . . . . : Trial (30 days left)

   Scan date . . . . . . : 2013-12-03 20:09:34
   Scan mode . . . . . . : Normal
   Scan duration . . . . : 4m 1s
   Disk access mode  . . : Direct disk access (SRB)
   Cloud . . . . . . . . : Internet
   Reboot  . . . . . . . : No

   Threats . . . . . . . : 2
   Traces  . . . . . . . : 9

   Objects scanned . . . : 916.913
   Files scanned . . . . : 26.585
   Remnants scanned  . . : 279.901 files / 610.427 keys

Malware _____________________________________________________________________

   C:\Users\Ich\Desktop\ultrasurf1203\U1207.exe -> Quarantined
      Size . . . . . . . : 1.914.472 bytes
      Age  . . . . . . . : 375.8 days (2012-11-22 23:52:17)
      Entropy  . . . . . : 7.9
      SHA-256  . . . . . : E0ACB24972F89A558A50CA41C515C21250C0EA3403D02DE4CD30A34F75BCB27C
      RSA Key Size . . . : 2048
      Authenticode . . . : Valid
    > Kaspersky  . . . . : not-a-virus:NetTool.Win32.UltraSurf.tk
      Fuzzy  . . . . . . : 107.0

   C:\Users\Ich\Desktop\ultrasurf1203\U1301.exe -> Quarantined
      Size . . . . . . . : 2.000.488 bytes
      Age  . . . . . . . : 224.1 days (2013-04-23 17:00:15)
      Entropy  . . . . . : 7.9
      SHA-256  . . . . . : 6AB19B62E029C988DF13B507347021EB8E7483B10B0664B2CAB30B1B85657F24
      RSA Key Size . . . : 2048
      Authenticode . . . : Valid
    > Kaspersky  . . . . : not-a-virus:NetTool.Win32.UltraSurf.cdm
      Fuzzy  . . . . . . : 107.0
      References
         HKU\S-1-5-21-920642279-2223160163-4085584906-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Users\Ich\Desktop\ultrasurf1203\U1301.exe


Suspicious files ____________________________________________________________

   C:\Users\Ich\AppData\Roaming\autobingooo\frlib.dll
      Size . . . . . . . : 1.215.488 bytes
      Age  . . . . . . . : 385.2 days (2012-11-13 14:20:15)
      Entropy  . . . . . : 8.0
      SHA-256  . . . . . : 822DCD971FF48EF07412C27178B3B628F58F1EEAE60DFFA1630DFBA1A0CA9992
      Fuzzy  . . . . . . : 22.0
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         The Entry Point of this file lies in a resource section. This is an indication of malware infection.
         The .rsrc (resources) section in this program is set to executable. This is an indication of malware infection.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Program contains PE structure anomalies. This is not typical for most programs.

   C:\Users\Ich\AppData\Roaming\autobingooo\frlib_nl.dll
      Size . . . . . . . : 1.000.448 bytes
      Age  . . . . . . . : 385.2 days (2012-11-13 14:20:19)
      Entropy  . . . . . : 8.0
      SHA-256  . . . . . : 9E4FDD303574B2BD6D8899ED27D7A61D8DE275F3E0234C334E4DD6EC49B63609
      Fuzzy  . . . . . . : 22.0
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         The Entry Point of this file lies in a resource section. This is an indication of malware infection.
         The .rsrc (resources) section in this program is set to executable. This is an indication of malware infection.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Program contains PE structure anomalies. This is not typical for most programs.


Potential Unwanted Programs _________________________________________________

   HKU\S-1-5-21-920642279-2223160163-4085584906-1000\Software\Microsoft\Internet Explorer\Approved Extensions\{4D2D3B0F-69BE-477A-90F5-FDDB05357975} (Claro) -> Deleted

Cookies _____________________________________________________________________

   C:\Users\Ich\AppData\Roaming\Microsoft\Windows\Cookies\P6QGLTXH.txt
   C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\r07ream1.default\cookies.sqlite:ad.zanox.com
   C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\r07ream1.default\cookies.sqlite:youporn.com
         

Zitat: "Bitte während des Online-Scans Anti-Virus-Programm und Firewall deaktivieren."

Verstehe ich richtig, das eset ein online scanner ist, ich also online bleiben muss während des scannens?
Soll ich wirklich mein Antivirus Programm währenddessen abschalten? Was passiert dann mit potentiellen Angriffen?

Gruß Peter

Servus Peter

Zitat von peterpan111

Verstehe ich richtig, das eset ein online scanner ist, ich also online bleiben muss während des scannens?

Nur bis die Signaturen heruntergeladen wurden, während er scannt musst du meines Wissens nach nicht online sein.

Zitat von peterpan111

Soll ich wirklich mein Antivirus Programm währenddessen abschalten?

Ja, weil dein AV Programm ESET stören kann.

Zitat von peterpan111

Was passiert dann mit potentiellen Angriffen?

Denkst du, jemand hat dich ganz gezielt im Visier? Glaubst du, dass so Rechner infiziert werden?
Da kann ich dich beruhigen, das läuft anders ab, z. B. indem du eine infizierte Seite besuchst.... und ich gehe davon aus, dass du so etwas nicht machst.