| |
| |||||||
Log-Analyse und Auswertung: Windows 7: trojaner GVU/Bundespolizei fährt den Pc im abgesicherten Modus runter!Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte. |
 |
02.05.2014, 10:30
| #16 |
| /// TB-Ausbilder     |  Windows 7: trojaner GVU/Bundespolizei fährt den Pc im abgesicherten Modus runter! Hallo, ich habe schon länger keine Antwort mehr von Dir erhalten. Benötigst Du weiterhin noch Hilfe? Wenn ich in den nächsten 24 Stunden nichts von Dir höre, gehe ich davon aus, dass sich das Thema erledigt hat wenn du weiter machen möchtest schicke mir bitte eine PN Hinweis: Wir sind noch nicht fertig! Auch wenn die Symptome verschwunden sein sollten, kann dein System weiterhin infiziert sein und über Sicherheitslücken verfügen, welche eine erneute Infektion möglich machen. |
|
03.05.2014, 03:13
| #17 |
| | Windows 7: trojaner GVU/Bundespolizei fährt den Pc im abgesicherten Modus runter! Hallo Sandra,
__________________Ehrlich gesagt weiss ich nicht was mit dem proxyserver: : 0 ist. Der andere im Firefox ist tatsächlich von der FH Köln. nun die logfiles: Fixlog: Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version:01-05-2014
Ran by Mo.T******* at 2014-05-03 03:01:54 Run:5
Running from C:\Users\Mo.T*******\Desktop
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
(APN LLC.) C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe
HKLM\...\Run: [ApnTBMon] => C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1558480 2013-07-26] (APN)
SearchScopes: HKCU - {15260EDB-65F3-41D3-9CA4-500D6C319CF3} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2625848
SearchScopes: HKCU - {5B291E6C-9A74-4034-971B-A4B007A0B315} URL = hxxp://radiobar.toolbarhome.com/search.aspx?q={searchTerms}&srch=dsp
R2 APNMCP; C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe [168400 2013-07-26] (APN LLC.)
C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe
C:\Program Files\RadioBar
*****************
[1936] C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe => Process closed successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\ApnTBMon => Value deleted successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{15260EDB-65F3-41D3-9CA4-500D6C319CF3} => Key not found.
HKCR\Wow6432Node\CLSID\{15260EDB-65F3-41D3-9CA4-500D6C319CF3} => Key not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{5B291E6C-9A74-4034-971B-A4B007A0B315} => Key not found.
HKCR\Wow6432Node\CLSID\{5B291E6C-9A74-4034-971B-A4B007A0B315} => Key not found.
APNMCP => Service deleted successfully.
C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe => Moved successfully.
"C:\Program Files\RadioBar" => File/Directory not found.
==== End of Fixlog ====
FRST log: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:01-05-2014 Ran by Mo.T******* (administrator) on MOT*******-PC on 03-05-2014 03:04:16 Running from C:\Users\Mo.T*******\Desktop Microsoft Windows 7 Professional Service Pack 1 (X86) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (AMD) C:\Windows\System32\atiesrxx.exe (AMD) C:\Windows\System32\atieclxx.exe (Hewlett-Packard) C:\Windows\System32\hpservice.exe (Lavasoft) C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Cisco Systems, Inc.) C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Juniper Networks) C:\Program Files\Juniper Networks\Common Files\dsNcService.exe (Garmin Ltd or its subsidiaries) C:\Program Files\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe () C:\altera\91\quartus\bin\jtagserver.exe (Juniper Networks) C:\Program Files\Common Files\Juniper Networks\JUNS\dsAccessService.exe (Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe (Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe (Yahoo! Inc.) C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe (Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe (Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe (Nokia) C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe (Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe (shbox.de) C:\Program Files\FreePDF_XP\fpassist.exe (Yahoo! Inc) C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe (Juniper Networks) C:\Program Files\Common Files\Juniper Networks\JamUI\Pulse.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (APN) C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe (Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe (Microsoft Corporation) C:\Program Files\Windows Live\Messenger\msnmsgr.exe (Nokia) C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation) C:\Windows\System32\StikyNot.exe (Lavasoft) C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe (Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe (Garmin Ltd or its subsidiaries) C:\Program Files\Garmin\Express Tray\ExpressTray.exe (TOSHIBA CORPORATION.) C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe (THe UDS) C:\Program Files\InstantTimeZone\InstantTimeZone.exe (Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.exe () C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe () C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe (OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.bin (THe UDS) C:\Program Files\InstantTimeZone\InstantTimeZone.exe (Nokia) C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Yahoo! Inc.) C:\Program Files\Yahoo!\Messenger\Ymsgr_tray.exe (TOSHIBA CORPORATION) C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (TOSHIBA CORPORATION.) C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe (TOSHIBA CORPORATION.) C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe (TOSHIBA CORPORATION.) C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHSP.exe (Nokia) C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe (Nokia) C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe (Nokia) C:\Program Files\PC Connectivity Solution\Transports\NclToBTSrv.exe (Opera Software) C:\Program Files\Opera\opera.exe (Microsoft Corporation) C:\Windows\System32\wuauclt.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [NeroCheck] => C:\Windows\system32\NeroCheck.exe [155648 2003-07-13] (Ahead Software Gmbh) HKLM\...\Run: [WirelessAssistant] => C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [498744 2009-07-23] (Hewlett-Packard) HKLM\...\Run: [NokiaMServer] => C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup HKLM\...\Run: [NokiaMusic FastStart] => C:\Program Files\Nokia\Ovi Player\NokiaOviPlayer.exe [2090272 2009-11-06] (Nokia) HKLM\...\Run: [GrooveMonitor] => C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation) HKLM\...\Run: [FreePDF Assistant] => C:\Program Files\FreePDF_XP\fpassist.exe [385024 2009-09-05] (shbox.de) HKLM\...\Run: [YSearchProtection] => C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe [111856 2009-02-23] (Yahoo! Inc) HKLM\...\Run: [Pulse] => C:\Program Files\Common Files\Juniper Networks\JamUI\Pulse.exe [1698672 2010-10-23] (Juniper Networks) HKLM\...\Run: [ITSecMng] => C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe [83336 2009-07-22] (TOSHIBA CORPORATION) HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG) HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated) HKLM\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated) HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKU\S-1-5-21-2441125889-3839948254-335534644-1000\...\Run: [LightScribe Control Panel] => C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [2363392 2009-06-17] (Hewlett-Packard Company) HKU\S-1-5-21-2441125889-3839948254-335534644-1000\...\Run: [msnmsgr] => C:\Program Files\Windows Live\Messenger\msnmsgr.exe [3883840 2009-07-26] (Microsoft Corporation) HKU\S-1-5-21-2441125889-3839948254-335534644-1000\...\Run: [] => [X] HKU\S-1-5-21-2441125889-3839948254-335534644-1000\...\Run: [NokiaOviSuite2] => C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe [401728 2009-12-10] (Nokia) HKU\S-1-5-21-2441125889-3839948254-335534644-1000\...\Run: [Messenger (Yahoo!)] => C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe [5252408 2010-06-01] (Yahoo! Inc.) HKU\S-1-5-21-2441125889-3839948254-335534644-1000\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [354304 2009-07-14] (Microsoft Corporation) HKU\S-1-5-21-2441125889-3839948254-335534644-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files\DAEMON Tools Lite\DTLite.exe [3672384 2012-04-11] (DT Soft Ltd) HKU\S-1-5-21-2441125889-3839948254-335534644-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.) HKU\S-1-5-21-2441125889-3839948254-335534644-1000\...\Run: [GarminExpressTrayApp] => C:\Program Files\Garmin\Express Tray\ExpressTray.exe [1093464 2013-08-28] (Garmin Ltd or its subsidiaries) HKU\S-1-5-21-2441125889-3839948254-335534644-1000\...\MountPoints2: H - H:\AutoRun.exe HKU\S-1-5-21-2441125889-3839948254-335534644-1000\...\MountPoints2: I - I:\HTC_Sync_Manager_PC.exe HKU\S-1-5-21-2441125889-3839948254-335534644-1000\...\MountPoints2: {0df93878-198b-11e0-a313-91265f448b94} - H:\AutoRun.exe HKU\S-1-5-21-2441125889-3839948254-335534644-1000\...\MountPoints2: {0df93886-198b-11e0-a313-967bdee9a9b0} - I:\AutoRun.exe HKU\S-1-5-21-2441125889-3839948254-335534644-1000\...\MountPoints2: {1dfb02a9-a128-11e3-9981-d65de5f1a59d} - I:\HTC_Sync_Manager_PC.exe HKU\S-1-5-21-2441125889-3839948254-335534644-1000\...\MountPoints2: {7e07d585-9160-11e1-8b45-f20c468c9ea1} - H:\setup.exe HKU\S-1-5-21-2441125889-3839948254-335534644-1000\...\MountPoints2: {cd1a3888-3ac9-11e0-93cb-8b8d165d4ff3} - H:\AutoRun.exe HKU\S-1-5-21-2441125889-3839948254-335534644-1000\...\MountPoints2: {dc1bfdf4-274a-11e0-899c-e85aa09ff09b} - H:\AutoRun.exe HKU\S-1-5-21-2441125889-3839948254-335534644-1000\...\MountPoints2: {f6f4b7f7-2a53-11e0-85d0-d5f49d1021be} - I:\AutoRun.exe HKU\S-1-5-21-2441125889-3839948254-335534644-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [LightScribe Control Panel] => C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [2363392 2009-06-17] (Hewlett-Packard Company) HKU\S-1-5-21-2441125889-3839948254-335534644-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [msnmsgr] => C:\Program Files\Windows Live\Messenger\msnmsgr.exe [3883840 2009-07-26] (Microsoft Corporation) HKU\S-1-5-21-2441125889-3839948254-335534644-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [] => [X] HKU\S-1-5-21-2441125889-3839948254-335534644-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [NokiaOviSuite2] => C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe [401728 2009-12-10] (Nokia) HKU\S-1-5-21-2441125889-3839948254-335534644-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Messenger (Yahoo!)] => C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe [5252408 2010-06-01] (Yahoo! Inc.) HKU\S-1-5-21-2441125889-3839948254-335534644-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [354304 2009-07-14] (Microsoft Corporation) HKU\S-1-5-21-2441125889-3839948254-335534644-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [DAEMON Tools Lite] => C:\Program Files\DAEMON Tools Lite\DTLite.exe [3672384 2012-04-11] (DT Soft Ltd) HKU\S-1-5-21-2441125889-3839948254-335534644-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.) HKU\S-1-5-21-2441125889-3839948254-335534644-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [GarminExpressTrayApp] => C:\Program Files\Garmin\Express Tray\ExpressTray.exe [1093464 2013-08-28] (Garmin Ltd or its subsidiaries) HKU\S-1-5-21-2441125889-3839948254-335534644-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: H - H:\AutoRun.exe HKU\S-1-5-21-2441125889-3839948254-335534644-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: I - I:\HTC_Sync_Manager_PC.exe HKU\S-1-5-21-2441125889-3839948254-335534644-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {0df93878-198b-11e0-a313-91265f448b94} - H:\AutoRun.exe HKU\S-1-5-21-2441125889-3839948254-335534644-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {0df93886-198b-11e0-a313-967bdee9a9b0} - I:\AutoRun.exe HKU\S-1-5-21-2441125889-3839948254-335534644-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {1dfb02a9-a128-11e3-9981-d65de5f1a59d} - I:\HTC_Sync_Manager_PC.exe HKU\S-1-5-21-2441125889-3839948254-335534644-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {7e07d585-9160-11e1-8b45-f20c468c9ea1} - H:\setup.exe HKU\S-1-5-21-2441125889-3839948254-335534644-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {cd1a3888-3ac9-11e0-93cb-8b8d165d4ff3} - H:\AutoRun.exe HKU\S-1-5-21-2441125889-3839948254-335534644-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {dc1bfdf4-274a-11e0-899c-e85aa09ff09b} - H:\AutoRun.exe HKU\S-1-5-21-2441125889-3839948254-335534644-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {f6f4b7f7-2a53-11e0-85d0-d5f49d1021be} - I:\AutoRun.exe HKU\S-1-5-21-2441125889-3839948254-335534644-501-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [LightScribe Control Panel] => C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [2363392 2009-06-17] (Hewlett-Packard Company) HKU\S-1-5-21-2441125889-3839948254-335534644-501-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [msnmsgr] => C:\Program Files\Windows Live\Messenger\msnmsgr.exe [3883840 2009-07-26] (Microsoft Corporation) HKU\S-1-5-21-2441125889-3839948254-335534644-501-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [LowRateVoip] => C:\Program Files\LowRateVoip.com\LowRateVoip\LowRateVoip.exe [19452736 2013-07-20] (LowRateVoip) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth Manager.lnk ShortcutTarget: Bluetooth Manager.lnk -> C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe (TOSHIBA CORPORATION.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\InstantTimeZone.lnk ShortcutTarget: InstantTimeZone.lnk -> C:\Program Files\InstantTimeZone\InstantTimeZone.exe (THe UDS) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VPN Client.lnk ShortcutTarget: VPN Client.lnk -> C:\Windows\Installer\{51FB15F4-AD27-43BC-AD4B-DD0354FB6BBD}\Icon3E5562ED7.ico () Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> C:\Program Files\WISO\Steuersoftware 2013\mshaktuell.exe () Startup: C:\Users\Mo.T*******\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk ShortcutTarget: OneNote 2007 Screen Clipper and Launcher.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation) Startup: C:\Users\Mo.T*******\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk ShortcutTarget: OpenOffice.org 3.1.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe () ==================== Internet (Whitelisted) ==================== ProxyServer: :0 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xC00CCB7E1EB4CA01 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de URLSearchHook: HKCU - YTNavAssistPlugin Class - {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll (Yahoo! Inc.) SearchScopes: HKCU - {61DA61FF-CDAE-4D29-A3DD-CCA4690DB68E} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=302398&p={searchTerms} BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer) BHO: Avira SearchFree Toolbar plus Web Protection - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.) BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION) BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc) Toolbar: HKLM - EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION) Toolbar: HKLM - No Name - !{41564952-412D-5637-00A7-7A786E7484D7} - No File Toolbar: HKCU - RadioBar Toolbar - {5B291E6C-9A74-4034-971B-A4B007A0B315} - No File Toolbar: HKCU - EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION) DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://juniper.net/dana-cached/sc/JuniperSetupClient.cab Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation) Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation) Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation) Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation) Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) Winsock: Catalog9 01 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 02 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 03 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 04 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 05 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 06 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 07 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 08 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 20 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 Tcpip\..\Interfaces\{3EA79C1B-0DC0-4B9D-BF9C-F5BDE5A0B36D}: [NameServer]193.189.244.225 193.189.244.206 Tcpip\..\Interfaces\{685DD7D7-5179-4D4C-9659-4250856CC6AE}: [NameServer]193.189.244.225 193.189.244.206 Tcpip\..\Interfaces\{8884D693-2566-4B02-B8AC-E5C0F23E15E2}: [NameServer]193.189.244.225 193.189.244.206 Tcpip\..\Interfaces\{AB2CFAED-59BF-470F-B35C-508B1E345305}: [NameServer]132.195.249.13 132.195.20.3 132.195.20.3 Tcpip\..\Interfaces\{DF4F6289-7F96-4AF3-AEE8-6C2429ACD57E}: [NameServer]193.189.244.225 193.189.244.206 FireFox: ======== FF ProfilePath: C:\Users\Mo.T*******\AppData\Roaming\Mozilla\Firefox\Profiles\sqxnp5f4.default FF Homepage: hxxp://www.google.de FF NetworkProxy: "ftp", "wwwproxy.fh-koeln.de" FF NetworkProxy: "ftp_port", 8080 FF NetworkProxy: "gopher", "wwwproxy.fh-koeln.de" FF NetworkProxy: "gopher_port", 8080 FF NetworkProxy: "http", "wwwproxy.fh-koeln.de" FF NetworkProxy: "http_port", 8080 FF NetworkProxy: "no_proxies_on", "139.6.*,*.fh-koeln.de" FF NetworkProxy: "share_proxy_settings", true FF NetworkProxy: "socks", "wwwproxy.fh-koeln.de" FF NetworkProxy: "socks_port", 8080 FF NetworkProxy: "ssl", "wwwproxy.fh-koeln.de" FF NetworkProxy: "ssl_port", 8080 FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_13_0_0_206.dll () FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw_1203133.dll (Adobe Systems, Inc.) FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 - C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.) FF Plugin: @microsoft.com/GENUINE - disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @real.com/nppl3260;version=15.0.2.72 - C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.) FF Plugin: @real.com/nprjplug;version=15.0.2.72 - C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.) FF Plugin: @real.com/nprpchromebrowserrecordext;version=15.0.2.72 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.) FF Plugin: @real.com/nprphtml5videoshim;version=15.0.2.72 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.) FF Plugin: @real.com/nprpjplug;version=15.0.2.72 - C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.) FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.) FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NPOFFICE.DLL (Microsoft Corporation) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppl3260.dll (RealNetworks, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nprjplug.dll (RealNetworks, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nprpjplug.dll (RealNetworks, Inc.) FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: No Name - C:\Users\Mo.T*******\AppData\Roaming\Mozilla\Firefox\Profiles\sqxnp5f4.default\Extensions\staged [2013-04-22] FF Extension: Garmin Communicator - C:\Users\Mo.T*******\AppData\Roaming\Mozilla\Firefox\Profiles\sqxnp5f4.default\Extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} [2013-12-12] FF Extension: Yahoo! Toolbar - C:\Users\Mo.T*******\AppData\Roaming\Mozilla\Firefox\Profiles\sqxnp5f4.default\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} [2014-04-24] FF Extension: Personas Plus - C:\Users\Mo.T*******\AppData\Roaming\Mozilla\Firefox\Profiles\sqxnp5f4.default\Extensions\personas@christopher.beard.xpi [2013-03-02] FF Extension: Avira SearchFree Toolbar plus Web Protection - C:\Users\Mo.T*******\AppData\Roaming\Mozilla\Firefox\Profiles\sqxnp5f4.default\Extensions\toolbar_AVIRA-V7@apn.ask.com.xpi [2013-07-26] FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\Mo.T*******\AppData\Roaming\Mozilla\Firefox\Profiles\sqxnp5f4.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi [2012-11-22] FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-04-24] FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext FF Extension: RealPlayer Browser Record Plugin - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011-07-01] Chrome: ======= CHR HomePage: hxxp://www.google.com CHR RestoreOnStartup: "hxxp://www.google.com" CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\27.0.1453.94\PepperFlash\pepflashplayer.dll No File CHR Extension: (RealPlayer HTML5Video Downloader Extension) - C:\Users\Mo.T*******\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk [2011-07-01] CHR Extension: (Skype Click to Call) - C:\Users\Mo.T*******\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2013-05-25] CHR Extension: (DvdVideoSoft Free Youtube Download) - C:\Users\Mo.T*******\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp [2013-05-25] CHR HKLM\...\Chrome\Extension: [aaaaacalgebmfelllfiaoknifldpngjh] - C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\CRX\ToolbarCR.crx [2013-07-26] CHR HKLM\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Ext\rphtml5video.crx [2011-07-01] CHR HKLM\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx [2012-05-30] ========================== Services (Whitelisted) ================= R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG) R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1017424 2014-02-20] (Avira Operations GmbH & Co. KG) R2 CVPND; C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe [1528608 2008-08-29] (Cisco Systems, Inc.) R2 dsNcService; C:\Program Files\Juniper Networks\Common Files\dsNcService.exe [660848 2010-08-27] (Juniper Networks) R2 Garmin Core Update Service; C:\Program Files\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [246616 2013-08-28] (Garmin Ltd or its subsidiaries) R2 HP Health Check Service; C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [124928 2009-07-09] (Hewlett-Packard) R2 JTAGServer; c:\altera\91\quartus\bin\jtagserver.exe [164352 2009-10-22] () R2 JuniperAccessService; C:\Program Files\Common Files\Juniper Networks\JUNS\dsAccessService.exe [198000 2010-10-22] (Juniper Networks) R2 Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe [1378040 2011-04-24] (Lavasoft) S2 matlabserver; C:\MATLAB7\webserver\bin\win32\matlabserver.exe [536576 2004-04-24] () R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-04-03] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [857912 2014-04-03] (Malwarebytes Corporation) S4 RichVideo; C:\Program Files\CyberLink\Shared files\RichVideo.exe [247152 2009-01-21] () R2 Skype C2C Service; C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3048136 2012-05-30] (Skype Technologies S.A.) S3 rpcapd; "%ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini" [X] ==================== Drivers (Whitelisted) ==================== R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-12-17] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135648 2013-12-17] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-12-12] (Avira Operations GmbH & Co. KG) S3 CVirtA; C:\Windows\System32\DRIVERS\CVirtA.sys [5275 2007-01-18] (Cisco Systems, Inc.) R2 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306299 2008-08-29] (Cisco Systems, Inc.) R3 DCamUSBNovatek; C:\Windows\System32\Drivers\nvtcam.sys [2704640 2010-09-07] (Novatek) R3 DNE; C:\Windows\System32\DRIVERS\dne2000.sys [125328 2008-03-29] (Deterministic Networks, Inc.) R3 dsNcAdpt; C:\Windows\System32\DRIVERS\dsNcAdpt.sys [26624 2010-06-11] (Juniper Networks) R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [242240 2012-04-28] (DT Soft Ltd) R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [376920 2014-05-01] (Symantec Corporation) S3 grmnusb; C:\Windows\System32\drivers\grmnusb.sys [15720 2012-04-18] (GARMIN Corp.) R3 jnprna; C:\Windows\System32\DRIVERS\jnprna.sys [420464 2010-07-23] (Juniper Networks, Inc.) S3 jnprva; C:\Windows\System32\DRIVERS\jnprva.sys [25456 2010-07-23] (Juniper Networks, Inc.) R3 JnprVaMgr; C:\Windows\System32\DRIVERS\jnprvamgr.sys [36776 2010-07-23] (Juniper Networks, Inc.) S3 Lavasoft Kernexplorer; C:\Program Files\Lavasoft\Ad-Aware\KernExplorer.sys [15264 2010-11-19] () R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-04-03] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [107736 2014-05-02] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51416 2014-04-03] (Malwarebytes Corporation) S3 NPF; C:\Windows\System32\drivers\npf.sys [50704 2009-10-20] (CACE Technologies, Inc.) R2 Sentinel; C:\Windows\System32\Drivers\SENTINEL.SYS [76288 2009-10-21] (Rainbow Technologies, Inc.) S3 Sntnlusb; C:\Windows\System32\DRIVERS\SNTNLUSB.SYS [26120 2009-10-21] (Rainbow Technologies Inc.) R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-09-03] (Avira GmbH) S3 StarOpen; C:\Windows\system32\Drivers\StarOpen.sys [7168 2009-11-12] () R3 WinDriver6; C:\Windows\System32\drivers\windrvr6.sys [194362 2010-09-16] (Jungo) S3 XilinxFirmwareEmbeddedLpLoader; C:\Windows\System32\Drivers\xusb_emb.sys [17408 2010-09-16] (Xilinx, Inc.) R2 XilinxPC4Driver; C:\Windows\System32\drivers\xpc4drvr.sys [16000 2010-09-16] (Xilinx, Inc.) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-05-03 02:24 - 2014-05-03 02:24 - 00000000 ____D () C:\ProgramData\Oracle 2014-05-03 02:23 - 2014-05-03 02:23 - 00000000 ____D () C:\Program Files\Common Files\Java 2014-05-03 02:23 - 2014-05-03 02:22 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe 2014-05-03 02:22 - 2014-05-03 02:22 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe 2014-05-03 02:22 - 2014-05-03 02:22 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\java.exe 2014-05-03 02:22 - 2014-05-03 02:22 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll 2014-05-03 02:22 - 2014-05-03 02:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2014-05-03 02:22 - 2014-05-03 02:22 - 00000000 ____D () C:\Program Files\Java 2014-05-01 14:39 - 2014-05-01 14:39 - 00000000 ____D () C:\Windows\system32\Drivers\NSS 2014-05-01 14:39 - 2014-05-01 14:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Security Scan 2014-05-01 14:39 - 2014-05-01 14:39 - 00000000 ____D () C:\Program Files\Norton Security Scan 2014-04-30 03:27 - 2014-05-02 20:27 - 00000370 _____ () C:\Windows\Tasks\Ad-Aware Update (Weekly).job 2014-04-30 03:02 - 2014-03-06 11:19 - 17387008 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-04-30 03:02 - 2014-03-06 10:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-04-30 03:02 - 2014-03-06 10:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-04-30 03:02 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-04-30 03:02 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-04-30 03:02 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-04-30 03:02 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-04-30 03:02 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-04-30 03:02 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-04-30 03:02 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-04-30 03:02 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-04-30 03:02 - 2014-03-06 09:38 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-04-30 03:02 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-04-30 03:02 - 2014-03-06 09:28 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-04-30 03:02 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-04-30 03:02 - 2014-03-06 09:18 - 00575488 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-04-30 03:02 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-04-30 03:02 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-04-30 03:02 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-04-30 03:02 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-04-30 03:02 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-04-30 03:02 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-04-30 03:02 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-04-30 03:02 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-04-30 03:02 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-04-30 03:01 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-04-29 22:19 - 2014-04-29 22:19 - 00000979 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 9.lnk 2014-04-29 22:19 - 2014-04-29 22:19 - 00000967 _____ () C:\Users\Public\Desktop\TeamViewer 9.lnk 2014-04-26 18:14 - 2014-05-03 03:01 - 00000000 ____D () C:\Users\Mo.T*******\Desktop\FRST-OlderVersion 2014-04-24 23:19 - 2014-04-24 23:20 - 00000000 ____D () C:\Program Files\Mozilla Firefox 2014-04-22 11:27 - 2014-04-22 11:27 - 00000000 ____D () C:\Users\Mo.T*******\AppData\Roaming\EPSON 2014-04-21 14:44 - 2014-05-02 23:35 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-04-21 14:43 - 2014-04-21 14:43 - 00001060 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-04-21 14:43 - 2014-04-21 14:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-04-21 14:43 - 2014-04-21 14:43 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-04-21 14:43 - 2014-04-21 14:43 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2014-04-21 14:43 - 2014-04-03 09:51 - 00073432 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-04-21 14:43 - 2014-04-03 09:51 - 00051416 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-04-21 14:43 - 2014-04-03 09:50 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-04-21 14:40 - 2014-03-04 11:17 - 00868352 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll 2014-04-21 14:40 - 2014-02-04 04:07 - 00234432 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys 2014-04-21 14:40 - 2014-02-04 04:07 - 00149440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys 2014-04-21 14:40 - 2014-02-04 04:07 - 00027072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys 2014-04-21 14:40 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll 2014-04-21 14:40 - 2014-01-24 04:18 - 01212352 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys 2014-04-21 14:39 - 2014-04-21 02:28 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Mo.T*******\Desktop\mbam-setup-2.0.1.1004.exe 2014-04-21 12:16 - 2014-04-21 12:16 - 00000000 ____D () C:\Users\Mo.T*******\AppData\Local\AskPartnerNetwork 2014-04-20 13:18 - 2014-04-20 13:08 - 02237968 _____ (Kaspersky Lab ZAO) C:\Users\Mo.T*******\Desktop\tdsskiller.exe 2014-04-18 01:03 - 2014-04-18 01:48 - 00000000 ____D () C:\AdwCleaner 2014-04-18 01:02 - 2014-04-18 01:01 - 01426178 _____ () C:\Users\Mo.T*******\Desktop\adwcleaner.exe 2014-04-18 00:23 - 2014-04-18 00:23 - 00000079 _____ () C:\Windows\wininit.ini 2014-04-17 00:38 - 2014-05-03 03:04 - 00031296 _____ () C:\Users\Mo.T*******\Desktop\FRST.txt 2014-04-17 00:36 - 2014-05-03 03:01 - 01050624 _____ (Farbar) C:\Users\Mo.T*******\Desktop\FRST.exe 2014-04-15 01:21 - 2014-05-03 03:04 - 00000000 ____D () C:\FRST 2014-04-09 21:29 - 2014-04-18 00:45 - 00000000 ____D () C:\Windows\pss ==================== One Month Modified Files and Folders ======= 2014-05-03 03:05 - 2014-04-17 00:38 - 00031296 _____ () C:\Users\Mo.T*******\Desktop\FRST.txt 2014-05-03 03:04 - 2014-04-15 01:21 - 00000000 ____D () C:\FRST 2014-05-03 03:01 - 2014-04-26 18:14 - 00000000 ____D () C:\Users\Mo.T*******\Desktop\FRST-OlderVersion 2014-05-03 03:01 - 2014-04-17 00:36 - 01050624 _____ (Farbar) C:\Users\Mo.T*******\Desktop\FRST.exe 2014-05-03 03:01 - 2010-01-20 01:36 - 01122367 _____ () C:\Windows\WindowsUpdate.log 2014-05-03 02:47 - 2011-07-01 19:52 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-05-03 02:24 - 2014-05-03 02:24 - 00000000 ____D () C:\ProgramData\Oracle 2014-05-03 02:23 - 2014-05-03 02:23 - 00000000 ____D () C:\Program Files\Common Files\Java 2014-05-03 02:22 - 2014-05-03 02:23 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe 2014-05-03 02:22 - 2014-05-03 02:22 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe 2014-05-03 02:22 - 2014-05-03 02:22 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\java.exe 2014-05-03 02:22 - 2014-05-03 02:22 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll 2014-05-03 02:22 - 2014-05-03 02:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2014-05-03 02:22 - 2014-05-03 02:22 - 00000000 ____D () C:\Program Files\Java 2014-05-03 02:21 - 2012-08-12 20:11 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-05-03 00:47 - 2011-07-01 19:52 - 00001104 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-05-02 23:35 - 2014-04-21 14:44 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-05-02 23:31 - 2010-02-15 21:05 - 00000000 ____D () C:\Users\Mo.T*******\AppData\Roaming\Skype 2014-05-02 21:59 - 2009-07-14 06:34 - 00013792 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-05-02 21:59 - 2009-07-14 06:34 - 00013792 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-05-02 20:31 - 2010-01-31 19:56 - 00000000 ____D () C:\Users\Mo.T*******\Tracing 2014-05-02 20:27 - 2014-04-30 03:27 - 00000370 _____ () C:\Windows\Tasks\Ad-Aware Update (Weekly).job 2014-05-02 20:26 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-05-02 20:25 - 2013-06-18 22:40 - 00217014 _____ () C:\Windows\PFRO.log 2014-05-02 20:25 - 2013-06-14 02:09 - 00016582 _____ () C:\Windows\setupact.log 2014-05-02 20:25 - 2010-09-27 08:39 - 00284367 _____ () C:\aaw7boot.log 2014-05-01 22:41 - 2013-02-17 23:42 - 00000452 ____H () C:\Windows\Tasks\Norton Security Scan for Mo.T*******.job 2014-05-01 14:47 - 2013-05-01 19:21 - 00000000 ____D () C:\Program Files\Common Files\Symantec Shared 2014-05-01 14:39 - 2014-05-01 14:39 - 00000000 ____D () C:\Windows\system32\Drivers\NSS 2014-05-01 14:39 - 2014-05-01 14:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Security Scan 2014-05-01 14:39 - 2014-05-01 14:39 - 00000000 ____D () C:\Program Files\Norton Security Scan 2014-05-01 14:39 - 2013-02-17 23:42 - 00001411 _____ () C:\Users\Public\Desktop\Norton Security Scan.LNK 2014-05-01 14:39 - 2013-02-17 23:42 - 00000000 ____D () C:\ProgramData\Norton 2014-04-30 19:33 - 2010-01-27 21:40 - 00125648 _____ () C:\Users\Mo.T*******\AppData\Local\GDIPFONTCACHEV1.DAT 2014-04-30 04:02 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache 2014-04-30 03:23 - 2009-07-14 06:33 - 00459296 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-04-30 03:21 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE 2014-04-29 22:19 - 2014-04-29 22:19 - 00000979 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 9.lnk 2014-04-29 22:19 - 2014-04-29 22:19 - 00000967 _____ () C:\Users\Public\Desktop\TeamViewer 9.lnk 2014-04-29 22:19 - 2013-02-25 00:24 - 00000000 ____D () C:\Program Files\TeamViewer 2014-04-29 21:01 - 2011-07-01 19:53 - 00002040 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2014-04-29 20:45 - 2012-05-03 19:17 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service 2014-04-29 01:12 - 2010-02-28 22:28 - 00025088 ___SH () C:\Users\Mo.T*******\Thumbs.db 2014-04-28 23:21 - 2012-08-12 20:11 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe 2014-04-28 23:21 - 2011-05-15 09:57 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl 2014-04-28 21:32 - 2010-02-02 04:15 - 00000000 ____D () C:\Program Files\Opera 2014-04-24 23:20 - 2014-04-24 23:19 - 00000000 ____D () C:\Program Files\Mozilla Firefox 2014-04-24 03:05 - 2010-01-20 01:58 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-04-22 11:27 - 2014-04-22 11:27 - 00000000 ____D () C:\Users\Mo.T*******\AppData\Roaming\EPSON 2014-04-22 07:24 - 2013-08-16 10:13 - 00000000 ____D () C:\Windows\system32\MRT 2014-04-22 06:40 - 2010-01-31 20:43 - 88028728 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-04-21 21:28 - 2009-07-14 06:53 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-04-21 14:43 - 2014-04-21 14:43 - 00001060 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-04-21 14:43 - 2014-04-21 14:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-04-21 14:43 - 2014-04-21 14:43 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-04-21 14:43 - 2014-04-21 14:43 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2014-04-21 12:16 - 2014-04-21 12:16 - 00000000 ____D () C:\Users\Mo.T*******\AppData\Local\AskPartnerNetwork 2014-04-21 02:28 - 2014-04-21 14:39 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Mo.T*******\Desktop\mbam-setup-2.0.1.1004.exe 2014-04-20 13:08 - 2014-04-20 13:18 - 02237968 _____ (Kaspersky Lab ZAO) C:\Users\Mo.T*******\Desktop\tdsskiller.exe 2014-04-18 01:54 - 2010-02-06 10:30 - 00000346 _____ () C:\Windows\Tasks\HPCeeScheduleForMo.T*******.job 2014-04-18 01:48 - 2014-04-18 01:03 - 00000000 ____D () C:\AdwCleaner 2014-04-18 01:01 - 2014-04-18 01:02 - 01426178 _____ () C:\Users\Mo.T*******\Desktop\adwcleaner.exe 2014-04-18 00:45 - 2014-04-09 21:29 - 00000000 ____D () C:\Windows\pss 2014-04-18 00:25 - 2011-05-20 21:43 - 00000000 ____D () C:\Program Files\Free Video Converter 2014-04-18 00:23 - 2014-04-18 00:23 - 00000079 _____ () C:\Windows\wininit.ini 2014-04-17 00:40 - 2010-01-20 01:50 - 01644734 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-04-10 00:13 - 2010-12-09 19:51 - 00000000 ____D () C:\Users\Gast\Tracing 2014-04-09 23:52 - 2011-03-24 21:52 - 00000978 _____ () C:\Users\Mo.T*******\Desktop\Bluetooth-Informationsaustausch.lnk 2014-04-09 22:32 - 2010-02-27 10:46 - 00007605 _____ () C:\Users\Mo.T*******\AppData\Local\Resmon.ResmonCfg 2014-04-03 09:51 - 2014-04-21 14:43 - 00073432 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-04-03 09:51 - 2014-04-21 14:43 - 00051416 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-04-03 09:50 - 2014-04-21 14:43 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys Some content of TEMP: ==================== C:\Users\Gast\AppData\Local\Temp\avgnt.exe C:\Users\Gast\AppData\Local\Temp\SkypeSetup.exe C:\Users\Mo.T*******\AppData\Local\Temp\avgnt.exe C:\Users\Mo.T*******\AppData\Local\Temp\Quarantine.exe ==================== Bamital & volsnap Check ================= C:\Windows\explorer.exe => MD5 is legit C:\Windows\system32\winlogon.exe => MD5 is legit C:\Windows\system32\wininit.exe => MD5 is legit C:\Windows\system32\svchost.exe => MD5 is legit C:\Windows\system32\services.exe => MD5 is legit C:\Windows\system32\User32.dll => MD5 is legit C:\Windows\system32\userinit.exe => MD5 is legit C:\Windows\system32\rpcss.dll => MD5 is legit C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-04-30 03:53 ==================== End Of Log ============================ Danke und Grüße, Papy |
|
03.05.2014, 21:56
| #18 | |
| /// TB-Ausbilder | Windows 7: trojaner GVU/Bundespolizei fährt den Pc im abgesicherten Modus runter! Hallo papy,
__________________Zitat:
Schritt 1 Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter ProxyServer: :0
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Den Java Cache hast du gelöscht bekommen? Die anderen Funde sind ja in der Quarantäne von FTS, die löschen wir gleich  OK So wie ich es sehe, haben wir damit alles Schadhafte entfernt. Deine Logs sind sauber. Abschließend räumen wir noch etwas auf, führen Updates durch und dann bekommst du noch etwas Lesestoff von mir. Schritt 1 Falls Du Malwarebytes-Antimalware und den ESET-Onlinescan nicht mehr benötigst, kannst Du beide Programme einfach über die Programmdeinstallation deinstallieren. Ich empfehle Dir aber zumindest Malwarebytes zu behalten, und damit einmal die Woche einen Kontrollscan zu machen. Schritt 2 Downloade dir bitte delfix auf deinen Desktop.
Updates / Programme aktualisieren Du hast neben zwei aktuellen Versionen des Flashplayers (Flashplayer 12) auch noch eine veraltete auf dem Rechner (10), diese kannst du deinstallieren.
Startseite von Firefox festlegen
Lade dir bitte von hier den aktuellen Firefox herunter.
Nun zum Schluss noch ein paar Tipps zur Absicherung deines Systems. Aktualität des Systems Es ist extrem wichtig, dass sowohl dein System als auch die darauf installierte sicherheitsrelevante Software (Flash Player, PDF-Reader und besonders Java, sofern vorhanden) aktuell sind.
Falls du Java doch unbedingt benötigst, dann
Dazu:
Hier findest du eine Anleitung dazu. Antivirensoftware
Zusätzlicher Schutz
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der Internet Explorer, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Systemleistung Lösche regelmäßig deine temporären Dateien. Ich empfehle hierzu TFC Halte dich fern von jeglichen Registry Cleanern. Diese schaden deinem System mehr als dass sie es schneller machen. Verhaltensregeln zum sichereren Surfen
Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen. Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind. Falls Du Lob oder Kritik abgeben möchtest, kannst Du das sehr gerne hier tun. Wenn Du etwas für das Forum und unsere Arbeit spenden möchtest, so kannst Du das hier tun.
__________________ |
|
05.05.2014, 01:27
| #19 |
| | Windows 7: trojaner GVU/Bundespolizei fährt den Pc im abgesicherten Modus runter! Hallo Sandra, vielen Dank für deine Hilfe. Ohne dieser weiß ich nicht ob ich geschafft hätte, dieser Trojaner aus meinem Pc zu vertreiben. Ja, ich habe die Cache-datei von Java gelöscht und habe die neue Version(java 7) jetzt drauf. hier die letzte Logfile: Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version:04-05-2014
Ran by Mo.t******* at 2014-05-05 00:48:07 Run:6
Running from C:\Users\Mo.t*******\Desktop
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
ProxyServer: :0
*****************
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => Value deleted successfully.
==== End of Fixlog ====
Papy |
|
| Themen zu Windows 7: trojaner GVU/Bundespolizei fährt den Pc im abgesicherten Modus runter! |
| .dll, ad-aware, adobe, antivir, association, avg, avira, bildschirm, desktop, entfernen, explorer, mozilla, opera, registry, scan, sekunden, services.exe, software, suche, svchost.exe, symantec, system, temp, trojaner, windows, winlogon.exe |
