| |
| |||||||
Log-Analyse und Auswertung: Potentiell gefährdeter Laptop (zahlreiche PUP entfernt) - nun sauber?Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
30.01.2014, 21:44
| #1 |
| |  Potentiell gefährdeter Laptop (zahlreiche PUP entfernt) - nun sauber? Hallo  ich habe hier einen Laptop, der von einer (potentiellen) Rogue Security Software (Advanced System Protector) befallen war. Außerdem waren mehrere Antivirenprogramme gleichzeitig installiert (wahrscheinlich in Panik über Viren-Meldungen, ausgelöst von mehreren ebenfalls vorhandenen harmlosen Adwares). Ich habe nun zunächst alle Virenprogramme deinstalliert und überlasse es der Besitzerin, eines ihrer Wahl auszusuchen und nur das zu nutzen. Der Scan mit ESET ergab dann folgende PUP (eben die Adwares und die Rogue Security Software): Code:
ATTFilter C:\$Recycle.Bin\S-1-5-21-535545297-3433116171-3722734622-1001\$RJYMLI3.exe Variante von Win32/Bundled.Toolbar.Ask Anwendung
C:\$Recycle.Bin\S-1-5-21-535545297-3433116171-3722734622-1001\$RNMTNH2.exe Variante von Win32/Bundled.Toolbar.Ask Anwendung
C:\OEM\Preload\Autorun\APP\Nero 10 Essentials Packard Bell Edition\ISSetupPrerequisites\{BF80A1C0-C3FF-4B1C-ABEF-22CD4F97A0AB}\Toolbar.exe Variante von Win32/Bundled.Toolbar.Ask.A Anwendung
C:\Program Files\Uninstaller\Uninstall.exe Variante von MSIL/DomaIQ.A Anwendung
C:\Program Files (x86)\WBDesktop.Updater.exe MSIL/WebCake.A Anwendung
C:\Program Files (x86)\WDesktop.Updater.exe Variante von MSIL/WebCake.A Anwendung
C:\Program Files (x86)\Advanced System Protector\AdvancedSystemProtector.exe Variante von MSIL/AdvancedSystemProtector.B Anwendung
C:\Program Files (x86)\Advanced System Protector\AspManager.exe Variante von MSIL/AdvancedSystemProtector.B Anwendung
C:\Program Files (x86)\Advanced System Protector\filetypehelper.exe Variante von MSIL/AdvancedSystemProtector.B Anwendung
C:\Program Files (x86)\Advanced System Protector\scandll.dll Variante von MSIL/AdvancedSystemProtector.B Anwendung
C:\Program Files (x86)\Avira\AntiVir Desktop\offercast_avirav7_.exe Variante von Win32/Bundled.Toolbar.Ask.D Anwendung
C:\Program Files (x86)\Betcat\WBDesktop.Updater.1.0.0.16.exe Variante von MSIL/WebCake.A Anwendung
C:\Program Files (x86)\Delta\delta\1.8.21.5\deltaApp.dll Variante von Win32/Toolbar.Montiera.A Anwendung
C:\Program Files (x86)\Delta\delta\1.8.21.5\deltaEng.dll möglicherweise Variante von Win32/Toolbar.Montiera.A Anwendung
C:\Program Files (x86)\Delta\delta\1.8.21.5\deltasrv.exe Variante von Win32/Toolbar.Montiera.A Anwendung
C:\Program Files (x86)\Delta\delta\1.8.21.5\deltaTlbr.dll Win32/Toolbar.Babylon.G Anwendung
C:\Program Files (x86)\Delta\delta\1.8.21.5\bh\delta.dll Win32/Toolbar.Escort.A Anwendung
C:\Program Files (x86)\Driver Pro\DPSmartScan.exe Win32/Adware.SpeedingUpMyPC.C Anwendung
C:\Program Files (x86)\Feven 1.5\Feven 1.5-bho64.dll Variante von Win64/Toolbar.Crossrider.B Anwendung
C:\Program Files (x86)\Feven 1.5\Feven 1.5-buttonutil64.dll möglicherweise Variante von Win64/Toolbar.Crossrider.B Anwendung
C:\Program Files (x86)\Feven 1.5\Feven 1.5-buttonutil64.exe Variante von Win64/Toolbar.Crossrider.B Anwendung
C:\Program Files (x86)\Feven 1.5\utils.exe Mehrere Bedrohungen
C:\Program Files (x86)\Feven 2.5\Feven 2.5-bho64.dll Variante von Win64/Toolbar.Crossrider.B Anwendung
C:\Program Files (x86)\Feven 2.5\Feven 2.5-buttonutil64.dll möglicherweise Variante von Win64/Toolbar.Crossrider.B Anwendung
C:\Program Files (x86)\Feven 2.5\Feven 2.5-buttonutil64.exe Variante von Win64/Toolbar.Crossrider.B Anwendung
C:\Program Files (x86)\Mobogenie\nengine.dll Win32/NextLive.A Anwendung
C:\Program Files (x86)\Optimizer Pro\OptimizerPro.exe Variante von Win32/SpeedingUpMyPC Anwendung
C:\Program Files (x86)\Optimizer Pro\OptProCrash.dll Variante von Win32/SProtector.D Anwendung
C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe Variante von Win32/AdWare.SpeedingUpMyPC.D Anwendung
C:\Program Files (x86)\Optimizer Pro\OptProSmartScan.exe Variante von Win32/Adware.SpeedingUpMyPC.C Anwendung
C:\Program Files (x86)\PC Speed Maximizer\PCSpeedMaximizer.exe Variante von Win32/SpeedingUpMyPC Anwendung
C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-bho64.dll Variante von Win64/Toolbar.Crossrider.B Anwendung
C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-buttonutil64.dll möglicherweise Variante von Win64/Toolbar.Crossrider.B Anwendung
C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-buttonutil64.exe Variante von Win64/Toolbar.Crossrider.B Anwendung
C:\Program Files (x86)\Plus-HD-1.2\utils.exe Mehrere Bedrohungen
C:\Program Files (x86)\Plus-HD-5.5\Plus-HD-5.5-bho64.dll Variante von Win64/Toolbar.Crossrider.B Anwendung
C:\Program Files (x86)\Plus-HD-5.5\Plus-HD-5.5-buttonutil64.dll möglicherweise Variante von Win64/Toolbar.Crossrider.B Anwendung
C:\Program Files (x86)\Plus-HD-5.5\Plus-HD-5.5-buttonutil64.exe Variante von Win64/Toolbar.Crossrider.B Anwendung
C:\Program Files (x86)\RegClean Pro\Cloud_Backup_Setup.exe Win32/MyPCBackup.A Anwendung
C:\Program Files (x86)\RegClean Pro\Cloud_Backup_Setup_Intl.exe Win32/MyPCBackup.A Anwendung
C:\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe Variante von Win32/Conduit.SearchProtect.H Anwendung
C:\Program Files (x86)\SearchProtect\Main\bin\SPTool.dll Variante von Win32/Conduit.SearchProtect.H Anwendung
C:\Program Files (x86)\SearchProtect\Main\bin\SPtool.dll_1390923785118 Variante von Win32/Conduit.SearchProtect.H Anwendung
C:\Program Files (x86)\SearchProtect\Main\bin\SPtool.dll_1390923785376 Variante von Win32/Conduit.SearchProtect.H Anwendung
C:\Program Files (x86)\SearchProtect\Main\bin\uninstall.exe Variante von Win32/Conduit.SearchProtect.H Anwendung
C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPTool64.exe Variante von Win64/Conduit.SearchProtect.A Anwendung
C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC32.dll Variante von Win32/Conduit.SearchProtect.H Anwendung
C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC32Loader.dll Win32/Conduit.SearchProtect.H Anwendung
C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC64.dll Variante von Win64/Conduit.SearchProtect.A Anwendung
C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC64Loader.dll Variante von Win64/Conduit.SearchProtect.A Anwendung
C:\Program Files (x86)\WebCake\WebCakeDesktop.Updater.exe Win32/AdWare.Yontoo.E Anwendung
C:\ProgramData\BrowserDefender\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserDefender.exe Variante von Win32/bProtector.A Anwendung
C:\ProgramData\BrowserDefender\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\uninstall.exe Variante von Win32/bProtector.A Anwendung
C:\ProgramData\BrowserDefender\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\bprotector.js Win32/bProtector.F Anwendung
C:\ProgramData\downloadiotKeep\gpM.exe Variante von Win32/AdWare.MultiPlug.K.gen Anwendung
C:\ProgramData\downloadiotKeep\gpM.x64.dll Variante von Win64/Adware.MultiPlug.A Anwendung
C:\ProgramData\ssavernet\Omblf.exe Variante von Win32/AdWare.MultiPlug.K.gen Anwendung
C:\ProgramData\ssavernet\Omblf.x64.dll Variante von Win64/Adware.MultiPlug.A Anwendung
C:\ProgramData\Tarma Installer\{C4ED781C-7394-4906-AAFF-D6AB64FF7C38}\_Setupx.dll möglicherweise Variante von Win32/Adware.Yontoo.B Anwendung
C:\ProgramData\WPM\wprotectmanager.exe Win32/ELEX.Y Anwendung
C:\Users\All Users\BrowserDefender\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserDefender.exe Variante von Win32/bProtector.A Anwendung
C:\Users\All Users\BrowserDefender\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\uninstall.exe Variante von Win32/bProtector.A Anwendung
C:\Users\All Users\BrowserDefender\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\bprotector.js Win32/bProtector.F Anwendung
C:\Users\All Users\downloadiotKeep\gpM.exe Variante von Win32/AdWare.MultiPlug.K.gen Anwendung
C:\Users\All Users\downloadiotKeep\gpM.x64.dll Variante von Win64/Adware.MultiPlug.A Anwendung
C:\Users\All Users\ssavernet\Omblf.exe Variante von Win32/AdWare.MultiPlug.K.gen Anwendung
C:\Users\All Users\ssavernet\Omblf.x64.dll Variante von Win64/Adware.MultiPlug.A Anwendung
C:\Users\All Users\Tarma Installer\{C4ED781C-7394-4906-AAFF-D6AB64FF7C38}\_Setupx.dll möglicherweise Variante von Win32/Adware.Yontoo.B Anwendung
C:\Users\All Users\WPM\wprotectmanager.exe Win32/ELEX.Y Anwendung
C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\nnvudcmo.default\extensions\plugin@getwebcake.com\content\overlay.js JS/Adware.Yontoo.C Anwendung
C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\nnvudcmo.default\extensions\staged\{5e8cfb7c-9571-40c6-593c-72d5d5000fbd}\components\SmartbarFireFoxRemotePlugin_20.dll Win32/Toolbar.Linkury.D Anwendung
C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\nnvudcmo.default\extensions\staged\{5e8cfb7c-9571-40c6-593c-72d5d5000fbd}\components\SmartbarFireFoxRemotePlugin_21.dll Win32/Toolbar.Linkury.D Anwendung
C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\nnvudcmo.default\extensions\staged\{5e8cfb7c-9571-40c6-593c-72d5d5000fbd}\components\SmartbarFireFoxRemotePlugin_22.dll Variante von Win32/Toolbar.Linkury.D Anwendung
C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\nnvudcmo.default\extensions\staged\{5e8cfb7c-9571-40c6-593c-72d5d5000fbd}\components\SmartbarFireFoxRemotePlugin_23.dll Variante von Win32/Toolbar.Linkury.D Anwendung
C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\nnvudcmo.default\extensions\staged\{5e8cfb7c-9571-40c6-593c-72d5d5000fbd}\components\SmartbarFireFoxRemotePlugin_24.dll Variante von Win32/Toolbar.Linkury.D Anwendung
C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\nnvudcmo.default\extensions\staged\{5e8cfb7c-9571-40c6-593c-72d5d5000fbd}\components\SmartbarFireFoxRemotePlugin_25.dll Variante von Win32/Toolbar.Linkury.D Anwendung
C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\nnvudcmo.default\extensions\staged\{5e8cfb7c-9571-40c6-593c-72d5d5000fbd}\components\SmartbarFireFoxRemotePlugin_26.dll Variante von Win32/Toolbar.Linkury.D Anwendung
C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\nnvudcmo.default\extensions\{5e8cfb7c-9571-40c6-593c-72d5d5000fbd}\components\SmartbarFireFoxRemotePlugin_20.dll Win32/Toolbar.Linkury.D Anwendung
C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\nnvudcmo.default\extensions\{5e8cfb7c-9571-40c6-593c-72d5d5000fbd}\components\SmartbarFireFoxRemotePlugin_21.dll Win32/Toolbar.Linkury.D Anwendung
C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\nnvudcmo.default\extensions\{5e8cfb7c-9571-40c6-593c-72d5d5000fbd}\components\SmartbarFireFoxRemotePlugin_22.dll Variante von Win32/Toolbar.Linkury.D Anwendung
C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\nnvudcmo.default\extensions\{5e8cfb7c-9571-40c6-593c-72d5d5000fbd}\components\SmartbarFireFoxRemotePlugin_23.dll Variante von Win32/Toolbar.Linkury.D Anwendung
C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\nnvudcmo.default\extensions\{5e8cfb7c-9571-40c6-593c-72d5d5000fbd}\components\SmartbarFireFoxRemotePlugin_24.dll Variante von Win32/Toolbar.Linkury.D Anwendung
C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\nnvudcmo.default\extensions\{5e8cfb7c-9571-40c6-593c-72d5d5000fbd}\components\SmartbarFireFoxRemotePlugin_25.dll Variante von Win32/Toolbar.Linkury.D Anwendung
C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\nnvudcmo.default\extensions\{5e8cfb7c-9571-40c6-593c-72d5d5000fbd}\components\SmartbarFireFoxRemotePlugin_26.dll Variante von Win32/Toolbar.Linkury.D Anwendung
C:\Users\*********\AppData\Roaming\newnext.me\nengine.dll Win32/NextLive.A Anwendung
C:\Users\*********\AppData\Roaming\Web Cake\WebCakeDesktop.exe MSIL/WebCake.A Anwendung
C:\Users\*********\AppData\Roaming\Web Cake\dat\Desktop.OS.dll Variante von MSIL/WebCake.A Anwendung
C:\Users\*********\AppData\Roaming\Web Cake\dat\Dora.dat Variante von MSIL/WebCake.A Anwendung
C:\Users\*********\AppData\Roaming\Web Cake\dat\Maintain.dat Variante von MSIL/WebCake.A Anwendung
C:\Users\*********\AppData\Roaming\Web Cake\dat\Paladin.dat Variante von MSIL/WebCake.A Anwendung
C:\Users\*********\AppData\Roaming\WebCake\WebCakeDesktop.exe MSIL/WebCake.B Anwendung
C:\Users\*********\AppData\Roaming\WebCake\dat\Desktop.OS.dll Variante von MSIL/WebCake.A Anwendung
C:\Users\*********\AppData\Roaming\WebCake\dat\Maintain.dat Variante von MSIL/WebCake.A Anwendung
C:\Users\*********\AppData\Roaming\WebCake\dat\Phoenix.dat Variante von MSIL/WebCake.A Anwendung
C:\Users\*********\AppData\Local\Google\Chrome\User Data\Default\Cache\f_019e36 Win32/Systweak.B Anwendung
C:\Users\*********\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\288QFQVY\ApnIC[1].0 Variante von Win32/Bundled.Toolbar.Ask Anwendung
C:\Users\*********\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\40E9TS8T\ApnIC[2].0 Variante von Win32/Bundled.Toolbar.Ask Anwendung
C:\Users\*********\AppData\Local\Temp\AskSLib.dll Variante von Win32/Bundled.Toolbar.Ask Anwendung
C:\Users\*********\AppData\Local\Temp\SPSetup.exe Mehrere Bedrohungen
C:\Users\*********\Desktop\*********\*********\Documents\SoftonicDownloader_fuer_photoscape.exe Win32/SoftonicDownloader.A Anwendung
C:\Users\*********\Downloads\FlashPlayersetup__5047_i259476686_il3.exe Variante von Win32/Amonetize.AA Anwendung
C:\Users\*********\Downloads\Java (1).exe Variante von Win32/DomaIQ.AU Anwendung
C:\Users\*********\Downloads\Java (2).exe Variante von Win32/DomaIQ.AU Anwendung
C:\Users\*********\Downloads\Java.exe Variante von Win32/DomaIQ.AU Anwendung
C:\Users\*********\Downloads\rcpsetupapnnew_apnnew2_1637942_de_bp.exe Win32/Systweak.B Anwendung
C:\Users\*********\Downloads\rcpsetupmapp1_mapp12133923 (1).exe Win32/Systweak.B Anwendung
C:\Users\*********\Downloads\rcpsetupmapp1_mapp12133923.exe Win32/Systweak.B Anwendung
C:\Users\*********\Downloads\rcpsetup_apptvlatest_apptvlatest (1).exe Win32/Systweak.B Anwendung
C:\Users\*********\Downloads\rcpsetup_apptvlatest_apptvlatest.exe Win32/Systweak.B Anwendung
C:\Users\*********\Downloads\Setup (1).exe Variante von Win32/DomaIQ.AU Anwendung
C:\Users\*********\Downloads\Setup (2).exe Variante von Win32/DomaIQ.AU Anwendung
C:\Users\*********\Downloads\Setup (3).exe MSIL/DomaIQ.Q Anwendung
C:\Users\*********\Downloads\setup (4).exe Variante von Win32/Bundlore.B Anwendung
C:\Users\*********\Downloads\Setup (5).exe Variante von Win32/DomaIQ.AV Anwendung
C:\Users\*********\Downloads\Setup.exe Variante von Win32/DomaIQ.AU Anwendung
C:\Users\*********\Downloads\speedupmypc_747063_.exe Win32/SpeedUpMyPC.A Anwendung
C:\Windows\Installer\1e989b.msi Mehrere Bedrohungen
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62AXOPQ5\ApnIC[1].0 Variante von Win32/Bundled.Toolbar.Ask Anwendung
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62AXOPQ5\ApnIC[1].0 Variante von Win32/Bundled.Toolbar.Ask Anwendung
C:\Windows\Temp\2570bd6c.ftf.ftf Variante von Win32/SProtector.D Anwendung
C:\Windows\Temp\AskSLib.dll Variante von Win32/Bundled.Toolbar.Ask Anwendung
C:\Windows\Temp\avnwldrtemp\setup\Offercast_AVIRAV7_.exe Variante von Win32/Bundled.Toolbar.Ask.D Anwendung
Nun habe ich per Malwarebytes einen genauen Scan durchgeführt und die gefundenen (~150) Bedrohungen entfernen lassen. Ein anschließender Quick-Scan ergab folgendes Log: Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2014.01.30.06 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 11.0.9600.16476 ******** :: ********-PC [Administrator] 30.01.2014 20:58:01 mbam-log-2014-01-30 (20-58-01).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 247729 Laufzeit: 8 Minute(n), 44 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-01-30 20:57:16
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD50 rev.01.0 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\*******~1\AppData\Local\Temp\pgdoqpow.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe[2268] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000770f1465 2 bytes [0F, 77]
.text C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe[2268] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000770f14bb 2 bytes [0F, 77]
.text ... * 2
.text C:\Program Files (x86)\Mobogenie\DaemonProcess.exe[3160] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000770f1465 2 bytes [0F, 77]
.text C:\Program Files (x86)\Mobogenie\DaemonProcess.exe[3160] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000770f14bb 2 bytes [0F, 77]
.text ... * 2
.text C:\Program Files (x86)\Launch Manager\LManager.exe[3216] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000770f1465 2 bytes [0F, 77]
.text C:\Program Files (x86)\Launch Manager\LManager.exe[3216] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000770f14bb 2 bytes [0F, 77]
.text ... * 2
.text C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe[3224] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000770f1465 2 bytes [0F, 77]
.text C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe[3224] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000770f14bb 2 bytes [0F, 77]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[3252] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000770f1465 2 bytes [0F, 77]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[3252] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000770f14bb 2 bytes [0F, 77]
.text ... * 2
---- EOF - GMER 2.1 ----
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-01-2014 01
Ran by ******** (administrator) on ********-PC on 30-01-2014 20:39:34
Running from C:\Users\**********\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe
(Just Develop It) C:\Program Files (x86)\MyPC Backup\BackupStack.exe
(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\BBSvc.EXE
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE
(Acer Incorporated) C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe
() C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe
() C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(Skype Technologies) C:\Program Files (x86)\Skype\Updater\Updater.exe
(Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
() C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
() C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\reader_sl.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerEvent.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11785832 2011-03-10] (Realtek Semiconductor)
HKLM\...\Run: [Power Management] - C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe [1831528 2011-05-10] (Acer Incorporated)
HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2589992 2011-04-05] (ELAN Microelectronics Corp.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [497648 2010-07-29] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [Norton Online Backup] - C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-01] (Symantec Corporation)
HKLM-x32\...\Run: [mobilegeni daemon] - C:\Program Files (x86)\Mobogenie\DaemonProcess.exe [761536 2013-12-26] ()
HKLM-x32\...\Run: [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe [1103440 2011-07-01] (Dritek System Inc.)
HKLM-x32\...\Run: [Guard.Mail.ru.gui] - C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe [1564368 2012-01-01] ()
HKLM-x32\...\Run: [EEventManager] - C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [1058400 2011-10-31] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [avgnt] - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
HKLM-x32\...\Run: [ApnUpdater] - "C:\Program Files (x86)\Ask.com\Updater\Updater.exe"
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
MountPoints2: {b4b792a0-7837-11e2-959f-b870f4df384e} - E:\Startme.exe
HKU\********\...\Run: [WebCake Desktop] - C:\Users\********\AppData\Roaming\Betcat\WebCakeDesktop.exe
HKU\********\...\Run: [EPLTarget\P0000000000000000] - C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIIKE.EXE [283232 2012-02-29] (SEIKO EPSON CORPORATION)
HKU\********\...\Run: [EPLTarget\P0000000000000001] - C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIIKE.EXE [283232 2012-02-29] (SEIKO EPSON CORPORATION)
HKU\********\...\Run: [NextLive] - C:\Windows\SysWOW64\rundll32.exe "C:\Users\********\AppData\Roaming\newnext.me\nengine.dll",EntryPoint -m l
HKU\********\...\Run: [Optimizer Pro] - C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe
HKU\********\...\Run: [Browser Infrastructure Helper] - C:\Users\********\AppData\Local\Smartbar\Application\SnapDo.exe startup
HKU\********\...\Run: [Driver Pro] - C:\Program Files (x86)\Driver Pro\DPLauncher.exe
HKU\********\...\Run: [PC Speed Maximizer] - C:\Program Files (x86)\PC Speed Maximizer\SPMLauncher.exe [135792 2013-12-19] (Smart PC Solutions)
HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Packard Bell\Screensaver\run_Packard Bell.exe [154144 2010-07-29] ()
HKU\Default User\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Packard Bell\Screensaver\run_Packard Bell.exe [154144 2010-07-29] ()
HKU\UpdatusUser\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Packard Bell\Screensaver\run_Packard Bell.exe [154144 2010-07-29] ()
AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll => File Not Found
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [226920 2011-03-30] (NVIDIA Corporation)
AppInit_DLLs: c:\PROGRA~2\OPTIMI~1\OPTPRO~2.DLL => File Not Found
AppInit_DLLs-x32: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll => File Not Found
AppInit_DLLs-x32: c:\progra~3\browse~1\261339~1.144\{c16c1~1\browse~1.dll => File Not Found
AppInit_DLLs-x32: c:\windows\syswow64\nvinit.dll => c:\windows\syswow64\nvinit.dll [193128 2011-03-30] (NVIDIA Corporation)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://packardbell.msn.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1388429095&from=tugs&uid=WDCXWD5000BPVT-22HXZT3_WD-WXJ1A61N8749N8749&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nationzoom.com/?type=hp&ts=1388429095&from=tugs&uid=WDCXWD5000BPVT-22HXZT3_WD-WXJ1A61N8749N8749
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nationzoom.com/?type=hp&ts=1388429095&from=tugs&uid=WDCXWD5000BPVT-22HXZT3_WD-WXJ1A61N8749N8749
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.nationzoom.com/web/?type=ds&ts=1388429095&from=tugs&uid=WDCXWD5000BPVT-22HXZT3_WD-WXJ1A61N8749N8749&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1388429095&from=tugs&uid=WDCXWD5000BPVT-22HXZT3_WD-WXJ1A61N8749N8749&q={searchTerms}
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1388429095&from=tugs&uid=WDCXWD5000BPVT-22HXZT3_WD-WXJ1A61N8749N8749&q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=Tuguu&co=DE&userid=5e8cfb7c-9571-40c6-593c-72d5d5000fbd&searchtype=ds&q={searchTerms}&installDate=31/12/2013
SearchScopes: HKLM-x32 - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=Tuguu&co=DE&userid=5e8cfb7c-9571-40c6-593c-72d5d5000fbd&searchtype=ds&q={searchTerms}&installDate=31/12/2013
SearchScopes: HKCU - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=Tuguu&co=DE&userid=5e8cfb7c-9571-40c6-593c-72d5d5000fbd&searchtype=ds&q={searchTerms}&installDate=31/12/2013
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=Tuguu&co=DE&userid=5e8cfb7c-9571-40c6-593c-72d5d5000fbd&searchtype=ds&q={searchTerms}&installDate=31/12/2013
SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL =
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Plus-HD-1.2 - {11111111-1111-1111-1111-110311121155} - C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-bho64.dll No File
BHO: Feven 1.5 - {11111111-1111-1111-1111-110311851132} - C:\Program Files (x86)\Feven 1.5\Feven 1.5-bho64.dll No File
BHO: Feven 2.5 - {11111111-1111-1111-1111-110411901108} - C:\Program Files (x86)\Feven 2.5\Feven 2.5-bho64.dll No File
BHO: Plus-HD-5.5 - {11111111-1111-1111-1111-110411901160} - C:\Program Files (x86)\Plus-HD-5.5\Plus-HD-5.5-bho64.dll No File
BHO: Snap.DoEngine - {31ad400d-1b06-4e33-a59a-90c2c140cba0} - C:\Windows\system32\mscoree.dll (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
BHO: downloadiotKeep - {A8A56ADD-A5ED-734F-1D22-0949078095CF} - C:\ProgramData\downloadiotKeep\gpM.x64.dll No File
BHO: ssavernet - {B53AE25A-08F3-320F-8293-BAD1C3FF3B2C} - C:\ProgramData\ssavernet\Omblf.x64.dll No File
BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\amd64\BingExt.dll (Microsoft Corporation.)
BHO-x32: ICQ Sparberater - {0766C1B9-B2DC-46E5-8934-4F3D6B42B1BD} - C:\Program Files (x86)\icq\Internet Explorer\icq.dll (solute gmbh)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\BingExt.dll (Microsoft Corporation.)
BHO-x32: Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll No File
BHO-x32: No Name - {EF7BD87A-8024-11E2-F316-F3E56188709B} - No File
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
Toolbar: HKLM - Snap.Do - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\system32\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\amd64\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM-x32 - Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll No File
Toolbar: HKLM-x32 - ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)
Toolbar: HKLM-x32 - Snap.Do - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\BingExt.dll (Microsoft Corporation.)
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Chrome:
=======
CHR HomePage: hxxp://www.google.com
CHR RestoreOnStartup: "hxxp://www.google.com"
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\pdf.dll ()
CHR Plugin: (Skype Toolbars) - C:\Users\**********\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.7.0.8773_0\npSkypeChromePlugin.dll (Skype Technologies S.A.)
CHR Plugin: (Norton Confidential) - C:\Users\**********\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk\2012.5.6.10_0\npcoplgn.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
CHR Plugin: (Windows Live Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Extension: (Google Docs) - C:\Users\**********\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-01-21]
CHR Extension: (Plus-HD-5.5) - C:\Users\**********\AppData\Local\Google\Chrome\User Data\Default\Extensions\aoilcbjfkbdplcfglkiedhefcomondlk [2014-01-05]
CHR Extension: (Google Drive) - C:\Users\**********\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-01-21]
CHR Extension: (Feven 1.5) - C:\Users\**********\AppData\Local\Google\Chrome\User Data\Default\Extensions\baodmgdpdoelldjmkhknbolcldnfjegg [2013-12-31]
CHR Extension: (YouTube) - C:\Users\**********\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-01-21]
CHR Extension: (downloadiotKeep) - C:\Users\**********\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfaknkffffmbadnnkpoimdkaaahgflcg [2014-01-29]
CHR Extension: (Google-Suche) - C:\Users\**********\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-01-21]
CHR Extension: (Re-markit) - C:\Users\**********\AppData\Local\Google\Chrome\User Data\Default\Extensions\dcpfhaghaadpjpgocojgnlhjcieeooel [2013-12-30]
CHR Extension: (Skype Click to Call) - C:\Users\**********\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2013-01-21]
CHR Extension: (Norton Identity Protection) - C:\Users\**********\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk [2013-01-21]
CHR Extension: (Google Wallet) - C:\Users\**********\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23]
CHR Extension: (ICQ Sparberater) - C:\Users\**********\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmpllndkedbnmonoomepeeglghdelffo [2013-01-21]
CHR Extension: (Google Mail) - C:\Users\**********\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-01-21]
CHR Extension: (Feven 2.5) - C:\Users\**********\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkbhkhbgdaamliaimlpdlhokkecoibka [2014-01-12]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx [2011-11-14]
CHR HKLM-x32\...\Chrome\Extension: [nmpllndkedbnmonoomepeeglghdelffo] - C:\Program Files (x86)\icq\Chrome\icq-1.3.671.crx [2011-12-28]
CHR StartMenuInternet: Google Chrome - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe hxxp://www.nationzoom.com/?type=sc&ts=1388429095&from=tugs&uid=WDCXWD5000BPVT-22HXZT3_WD-WXJ1A61N8749N8749
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Services (Whitelisted) =================
R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
R2 BackupStack; C:\Program Files (x86)\MyPC Backup\BackupStack.exe [38440 2013-09-19] (Just Develop It)
R2 ePowerSvc; C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe [872552 2011-05-10] (Acer Incorporated)
R2 EpsonScanSvc; C:\Windows\system32\EscSvc64.exe [135824 2011-12-12] (Seiko Epson Corporation)
R2 GREGService; C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe [39528 2011-01-18] (Acer Incorporated)
R2 Guard.Mail.ru; C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe [1564368 2012-01-01] ()
R2 ICQ Service; C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe [247872 2011-08-17] ()
R2 Live Updater Service; C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe [244624 2011-04-22] (Acer Incorporated)
S3 lxcg_device; C:\Windows\system32\lxcgcoms.exe [451584 2005-07-25] ( )
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-01] (Symantec Corporation)
S2 70e6ca8c; "C:\Windows\system32\rundll32.exe" "c:\progra~2\optimi~1\OptProCrashSvc.dll",ServiceMain
S2 BrowserDefendert; C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserDefender.exe [x]
==================== Drivers (Whitelisted) ====================
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-01-30 19:02 - 2014-01-30 19:02 - 00001121 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-30 19:02 - 2014-01-30 19:02 - 00000000 ____D C:\Users\**********\AppData\Roaming\Malwarebytes
2014-01-30 19:02 - 2014-01-30 19:02 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-30 19:02 - 2014-01-30 19:02 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-30 19:02 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-01-30 18:15 - 2014-01-30 18:15 - 00262144 _____ C:\Windows\Minidump\013014-57018-01.dmp
2014-01-30 18:03 - 2014-01-30 20:39 - 00019468 _____ C:\Users\**********\Desktop\FRST.txt
2014-01-30 18:03 - 2014-01-30 20:39 - 00000000 ____D C:\FRST
2014-01-30 18:02 - 2014-01-30 18:02 - 00000486 _____ C:\Users\**********\Desktop\defogger_disable.log
2014-01-30 18:02 - 2014-01-30 18:02 - 00000000 _____ C:\Users\**********\defogger_reenable
2014-01-30 18:01 - 2014-01-30 17:59 - 00380416 _____ C:\Users\**********\Desktop\Gmer-19357.exe
2014-01-30 18:01 - 2014-01-30 17:58 - 02079744 _____ (Farbar) C:\Users\**********\Desktop\FRST64.exe
2014-01-30 18:01 - 2014-01-30 17:56 - 00050477 _____ C:\Users\**********\Desktop\Defogger.exe
2014-01-30 18:01 - 2014-01-30 17:52 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\**********\Desktop\mbam-setup-1.75.0.1300.exe
2014-01-30 15:19 - 2014-01-30 15:28 - 00000000 ____D C:\Windows\pss
2014-01-30 15:15 - 2014-01-30 18:16 - 00001426 _____ C:\Users\**********\Desktop\Registry kostenlos entrümpeln!.lnk
2014-01-29 10:00 - 2014-01-30 20:36 - 00000000 ____D C:\ProgramData\ssavernet
2014-01-29 10:00 - 2014-01-29 10:00 - 00000000 ____D C:\ProgramData\ldkiphmeoipnafigkjjgddpkgakabiep
2014-01-29 10:00 - 2014-01-29 10:00 - 00000000 ____D C:\ProgramData\8817108a53eb8930
2014-01-29 09:47 - 2014-01-29 09:47 - 02347384 _____ (ESET) C:\Users\**********\Downloads\esetsmartinstaller_deu.exe
2014-01-29 09:47 - 2014-01-29 09:47 - 00000000 ____D C:\Program Files (x86)\ESET
2014-01-28 16:43 - 2014-01-28 16:43 - 00000000 ____D C:\Windows\SysWOW64\SearchProtect
2014-01-15 10:23 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 10:23 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 10:23 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 10:23 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 10:23 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 10:23 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 10:23 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 10:23 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-15 10:23 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-14 13:11 - 2014-01-14 13:11 - 00000000 ____D C:\Users\**********\Desktop\**********
2014-01-12 17:05 - 2014-01-12 17:05 - 00001125 _____ C:\Users\Public\Desktop\NewPlayer.lnk
2014-01-12 17:05 - 2014-01-12 17:05 - 00000000 ____D C:\Program Files (x86)\NewPlayer
2014-01-12 17:04 - 2014-01-12 17:04 - 00000000 ____D C:\Users\********\AppData\Roaming\PC Speed Maximizer
2014-01-12 17:04 - 2014-01-12 17:04 - 00000000 ____D C:\Program Files (x86)\PC Speed Maximizer
2014-01-12 16:23 - 2014-01-30 20:37 - 00000000 ____D C:\Users\**********\AppData\Roaming\Systweak
2014-01-12 15:57 - 2014-01-30 18:17 - 00003120 _____ C:\Windows\System32\Tasks\Advanced System Protector_startup
2014-01-12 15:56 - 2014-01-30 20:37 - 00000000 ____D C:\ProgramData\Systweak
2014-01-12 15:56 - 2014-01-12 15:56 - 00003320 _____ C:\Windows\System32\Tasks\Advanced System Protector
2014-01-12 15:56 - 2012-07-25 12:03 - 00016896 _____ C:\Windows\system32\sasnative64.exe
2014-01-12 15:55 - 2014-01-30 18:18 - 00003108 _____ C:\Windows\System32\Tasks\RegClean Pro
2014-01-12 15:54 - 2014-01-30 20:37 - 00000000 ____D C:\Users\********\AppData\Roaming\systweak
2014-01-12 15:54 - 2014-01-12 15:54 - 00001062 _____ C:\Users\Public\Desktop\RegClean Pro.lnk
2014-01-12 15:54 - 2013-12-27 18:10 - 00020312 _____ (Systweak Inc., (www.systweak.com)) C:\Windows\system32\roboot64.exe
2014-01-10 10:18 - 2014-01-10 10:18 - 00138616 _____ C:\Users\**********\Downloads\setup (4).exe
2014-01-08 16:00 - 2014-01-08 16:00 - 01289264 _____ C:\Users\**********\Downloads\Gutes neues Jahr (1).mp4
2014-01-08 15:59 - 2014-01-08 15:59 - 01289264 _____ C:\Users\**********\Downloads\Gutes neues Jahr.mp4
2014-01-07 10:32 - 2014-01-07 10:32 - 00185750 _____ C:\Users\**********\Documents\ADOLF.xps
2014-01-05 10:20 - 2014-01-05 10:20 - 00001045 _____ C:\Users\Public\Desktop\VideoPlayer.lnk
2014-01-05 10:17 - 2014-01-05 10:17 - 00000546 _____ C:\Windows\KB893803v2.log
2014-01-05 10:16 - 2014-01-30 20:36 - 00000000 ____D C:\Program Files (x86)\SearchProtect
2014-01-05 10:16 - 2014-01-05 10:20 - 00000000 ____D C:\Program Files (x86)\VideoPlayer
2014-01-05 10:16 - 2014-01-05 10:16 - 00000000 ____D C:\Users\**********\AppData\Local\SearchProtect
2013-12-31 09:36 - 2014-01-30 20:37 - 00002425 _____ C:\Users\**********\daemonprocess.txt
==================== One Month Modified Files and Folders =======
2014-01-30 20:39 - 2014-01-30 18:03 - 00019468 _____ C:\Users\**********\Desktop\FRST.txt
2014-01-30 20:39 - 2014-01-30 18:03 - 00000000 ____D C:\FRST
2014-01-30 20:39 - 2013-01-21 11:30 - 00000000 ____D C:\Users\**********\AppData\Local\CrashDumps
2014-01-30 20:38 - 2012-06-25 10:20 - 00000000 ____D C:\Users\Public\Documents\phase6_19_Daten
2014-01-30 20:38 - 2011-11-19 12:58 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-30 20:38 - 2010-11-21 04:47 - 00652296 _____ C:\Windows\PFRO.log
2014-01-30 20:38 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-30 20:38 - 2009-07-14 05:51 - 00180615 _____ C:\Windows\setupact.log
2014-01-30 20:37 - 2014-01-12 16:23 - 00000000 ____D C:\Users\**********\AppData\Roaming\Systweak
2014-01-30 20:37 - 2014-01-12 15:56 - 00000000 ____D C:\ProgramData\Systweak
2014-01-30 20:37 - 2014-01-12 15:54 - 00000000 ____D C:\Users\**********\AppData\Roaming\systweak
2014-01-30 20:37 - 2013-12-31 09:36 - 00002425 _____ C:\Users\**********\daemonprocess.txt
2014-01-30 20:37 - 2013-06-13 20:23 - 00000000 ____D C:\ProgramData\BrowserDefender
2014-01-30 20:37 - 2011-08-16 03:33 - 01569465 _____ C:\Windows\WindowsUpdate.log
2014-01-30 20:36 - 2014-01-29 10:00 - 00000000 ____D C:\ProgramData\ssavernet
2014-01-30 20:36 - 2014-01-05 10:16 - 00000000 ____D C:\Program Files (x86)\SearchProtect
2014-01-30 20:36 - 2013-07-29 13:47 - 00000000 ____D C:\Users\********\AppData\Roaming\Web Cake
2014-01-30 20:22 - 2013-06-13 20:22 - 00000286 _____ C:\Windows\Tasks\DSite.job
2014-01-30 20:13 - 2011-11-19 12:58 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-30 20:08 - 2012-06-16 12:24 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-30 19:02 - 2014-01-30 19:02 - 00001121 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-30 19:02 - 2014-01-30 19:02 - 00000000 ____D C:\Users\**********\AppData\Roaming\Malwarebytes
2014-01-30 19:02 - 2014-01-30 19:02 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-30 19:02 - 2014-01-30 19:02 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-30 18:24 - 2009-07-14 05:45 - 00016976 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-30 18:24 - 2009-07-14 05:45 - 00016976 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-30 18:18 - 2014-01-12 15:55 - 00003108 _____ C:\Windows\System32\Tasks\RegClean Pro
2014-01-30 18:17 - 2014-01-12 15:57 - 00003120 _____ C:\Windows\System32\Tasks\Advanced System Protector_startup
2014-01-30 18:16 - 2014-01-30 15:15 - 00001426 _____ C:\Users\**********\Desktop\Registry kostenlos entrümpeln!.lnk
2014-01-30 18:15 - 2014-01-30 18:15 - 00262144 _____ C:\Windows\Minidump\013014-57018-01.dmp
2014-01-30 18:15 - 2011-12-31 17:43 - 00000000 ____D C:\Windows\Minidump
2014-01-30 18:14 - 2011-12-31 17:43 - 901918507 _____ C:\Windows\MEMORY.DMP
2014-01-30 18:14 - 2011-07-20 15:06 - 00000000 ____D C:\ProgramData\Norton
2014-01-30 18:04 - 2011-08-16 13:23 - 00716782 _____ C:\Windows\system32\perfh007.dat
2014-01-30 18:04 - 2011-08-16 13:23 - 00155688 _____ C:\Windows\system32\perfc007.dat
2014-01-30 18:04 - 2009-07-14 06:13 - 01656284 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-30 18:02 - 2014-01-30 18:02 - 00000486 _____ C:\Users\**********\Desktop\defogger_disable.log
2014-01-30 18:02 - 2014-01-30 18:02 - 00000000 _____ C:\Users\**********\defogger_reenable
2014-01-30 18:02 - 2013-01-17 17:32 - 00000000 ____D C:\Users\**********
2014-01-30 17:59 - 2014-01-30 18:01 - 00380416 _____ C:\Users\**********\Desktop\Gmer-19357.exe
2014-01-30 17:58 - 2014-01-30 18:01 - 02079744 _____ (Farbar) C:\Users\**********\Desktop\FRST64.exe
2014-01-30 17:56 - 2014-01-30 18:01 - 00050477 _____ C:\Users\**********\Desktop\Defogger.exe
2014-01-30 17:52 - 2014-01-30 18:01 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\**********\Desktop\mbam-setup-1.75.0.1300.exe
2014-01-30 17:41 - 2011-11-02 17:08 - 00000000 ____D C:\ProgramData\Avira
2014-01-30 17:21 - 2013-08-16 15:22 - 00000000 ____D C:\Program Files (x86)\Betcat
2014-01-30 15:28 - 2014-01-30 15:19 - 00000000 ____D C:\Windows\pss
2014-01-29 10:00 - 2014-01-29 10:00 - 00000000 ____D C:\ProgramData\ldkiphmeoipnafigkjjgddpkgakabiep
2014-01-29 10:00 - 2014-01-29 10:00 - 00000000 ____D C:\ProgramData\8817108a53eb8930
2014-01-29 09:47 - 2014-01-29 09:47 - 02347384 _____ (ESET) C:\Users\**********\Downloads\esetsmartinstaller_deu.exe
2014-01-29 09:47 - 2014-01-29 09:47 - 00000000 ____D C:\Program Files (x86)\ESET
2014-01-28 16:43 - 2014-01-28 16:43 - 00000000 ____D C:\Windows\SysWOW64\SearchProtect
2014-01-28 16:34 - 2009-07-14 05:45 - 00314984 _____ C:\Windows\system32\FNTCACHE.DAT
2014-01-28 16:32 - 2009-07-14 06:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2014-01-16 09:59 - 2010-11-21 04:27 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-01-15 11:10 - 2011-10-15 19:24 - 00000000 ____D C:\ProgramData\Microsoft Help
2014-01-14 13:12 - 2011-10-15 19:00 - 00000000 ____D C:\Users\**********\AppData\Roaming\Mozilla
2014-01-14 13:11 - 2014-01-14 13:11 - 00000000 ____D C:\Users\**********\Desktop\**********
2014-01-14 13:11 - 2011-10-16 00:49 - 00000000 ____D C:\Users\**********
2014-01-14 13:06 - 2013-12-30 19:45 - 00000276 _____ C:\Users\**********\daemonprocess.txt
2014-01-12 17:05 - 2014-01-12 17:05 - 00001125 _____ C:\Users\Public\Desktop\NewPlayer.lnk
2014-01-12 17:05 - 2014-01-12 17:05 - 00000000 ____D C:\Program Files (x86)\NewPlayer
2014-01-12 17:04 - 2014-01-12 17:04 - 00000000 ____D C:\Users\**********\AppData\Roaming\PC Speed Maximizer
2014-01-12 17:04 - 2014-01-12 17:04 - 00000000 ____D C:\Program Files (x86)\PC Speed Maximizer
2014-01-12 15:56 - 2014-01-12 15:56 - 00003320 _____ C:\Windows\System32\Tasks\Advanced System Protector
2014-01-12 15:55 - 2013-12-30 19:46 - 00000000 ____D C:\Program Files (x86)\MyPC Backup
2014-01-12 15:54 - 2014-01-12 15:54 - 00001062 _____ C:\Users\Public\Desktop\RegClean Pro.lnk
2014-01-10 10:18 - 2014-01-10 10:18 - 00138616 _____ C:\Users\**********\Downloads\setup (4).exe
2014-01-08 17:22 - 2013-07-27 11:22 - 00000118 _____ C:\Users\**********\AppData\Roaming\WB.CFG
2014-01-08 17:18 - 2009-07-14 06:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2014-01-08 16:12 - 2012-03-07 07:49 - 01634178 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2014-01-08 16:00 - 2014-01-08 16:00 - 01289264 _____ C:\Users\**********\Downloads\Gutes neues Jahr (1).mp4
2014-01-08 15:59 - 2014-01-08 15:59 - 01289264 _____ C:\Users\**********\Downloads\Gutes neues Jahr.mp4
2014-01-07 10:32 - 2014-01-07 10:32 - 00185750 _____ C:\Users\**********\Documents\ADOLF.xps
2014-01-05 19:14 - 2013-09-15 16:32 - 00000000 ____D C:\ProgramData\EPSON
2014-01-05 19:09 - 2013-09-15 16:34 - 00000000 ____D C:\Program Files (x86)\EPSON Software
2014-01-05 19:02 - 2013-09-15 16:36 - 00000942 _____ C:\Users\Public\Desktop\EPSON Scan.lnk
2014-01-05 10:20 - 2014-01-05 10:20 - 00001045 _____ C:\Users\Public\Desktop\VideoPlayer.lnk
2014-01-05 10:20 - 2014-01-05 10:16 - 00000000 ____D C:\Program Files (x86)\VideoPlayer
2014-01-05 10:17 - 2014-01-05 10:17 - 00000546 _____ C:\Windows\KB893803v2.log
2014-01-05 10:16 - 2014-01-05 10:16 - 00000000 ____D C:\Users\**********\AppData\Local\SearchProtect
Some content of TEMP:
====================
C:\Users\**********\AppData\Local\Temp\AskSLib.dll
C:\Users\**********\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-09-05 13:33
==================== End Of Log ============================
Da ich nicht weiß, wie schädlich dieser SystemProtector nun war (dazu gibt es unterschiedliche Aussagen im Internet), wäre ich dankbar, wenn sich jemand die Mühe machen könnte, die Logs durchzugehen und mir zu sagen, ob die Bedrohung eliminiert und der PC sicher als virenfrei bezeichnet werden kann. Vielen Dank schonmal Echt eine tolle Sache, dass es solche Foren hier mit derart engagierten Usern gibt! EDIT: Arrrg, der Threadname ist vielleicht etwas zu allgemein gewählt... kann man leider nachträglich nicht mehr ändern? "Advanced System Protector per Malwarebytes entfernt - System nun sauber?" wäre intuitiver  Geändert von waldiphil (30.01.2014 um 22:32 Uhr) |
Baum-Darstellung