| |
| |||||||
Log-Analyse und Auswertung: Windows 7, PayPal Phishing Mail.Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
| |
14.06.2014, 21:12
| #1 |
 |  Windows 7, PayPal Phishing Mail. Hallo liebes Team, ich habe es heute geschaft und bin auf eine Phishing Mail reingefallen  "Sehr geehrte Kundin, Sehr geehrter Kunde, Im Rahmen Ihrer Sicherheiten prüfen wir regelmäßig alle Vorgänge im PayPal-System. Bei einer Überprüfung haben wir kürzlich ein Problem im Zusammenhang mit Ihrem Konto festgestellt. Bitte helfen Sie uns dabei, Ihr PayPal-Konto wieder in Ordnung zu bringen. Bis dahin haben wir den Zugang zu Ihrem PayPal-Konto vorübergehend eingeschränkt. Wo liegt das Problem? Bei Ihrer letzten Kreditkartenzahlung sind uns ungewöhnliche Aktivitäten aufgefallen. Bearbeitungsnummer: PP-366-910-981-695. Was mache ich jetzt? Bitte verifizieren Sie sich über folgenden Link durch einen Abgleich Ihrer Daten als rechtmäßiger Besitzer. Im Anschluss können Sie Ihr Konto wieder uneingeschränkt nutzen: Konfliktlösungen Viele Grüße PayPal Support Wir stehen Ihnen jederzeit zur Verfügung. Kontaktieren Sie uns auf www.pp-absicherung-manager.net/support/ " Ich habe natürlich dummerweise auf den Link geklickt, dies leitete mich weiter auf eine andere Seite. Ich bekam dann die Anzeige 404 Error Seite nicht gefunden (das ganze halt wie immer auf English, wenn die Seiten nicht existieren), daraufhin hab ich die Seite geschloßen und mir noch einmal die Mail angeguckt und gesehen das oben im Logo steht: "Pay Pal Schicherererer" und habe daraufhin Panik bekommen das ich mir etwas eingefangen habe, Probleme habe ich bisher nicht. Daher die bitte ob Ihr mir villeicht weiter helfen könnt. Ich habe die Schritte welche auf eurer Seite sind durchgeführt, auser das mit den Emulgatoren, da ich keine verwende. An den Logs habe ich nichts geändert, hab sie nur kopiert, da ich sie irgentwie nicht speichern konnte. Ich hab bei Norton einen Scan durchlaufen lassen, leider weiß ich nicht wie ich den Log da herrausbekomme. FRST.TXT " FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:12-06-2014 02
Ran by stripcat (administrator) on STRIPCAT-PC on 14-06-2014 20:28:30
Running from C:\Users\stripcat\Downloads
Platform: Microsoft Windows 7 Ultimate (X86) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\21.3.0.12\nis.exe
() C:\Program Files\Synology\Assistant\UsbClientService.exe
(Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\21.3.0.12\nis.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
() C:\Windows\Samsung\PanelMgr\SSMMgr.exe
(Apple Inc.) E:\Programme\iTunesHelper.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Akamai Technologies, Inc.) C:\Users\stripcat\AppData\Local\Akamai\netsession_win.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Akamai Technologies, Inc.) C:\Users\stripcat\AppData\Local\Akamai\netsession_win.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Raptr, Inc) C:\Program Files\Raptr\raptr.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Raptr, Inc) C:\Program Files\Raptr\raptr_im.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Symantec Corporation) C:\Program Files\Norton Family\Engine\2.9.5.39\NF.exe
(Symantec Corporation) C:\Program Files\Norton Family\Engine\2.9.5.39\NF.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [946352 2012-12-03] (Adobe Systems Incorporated)
HKLM\...\Run: [Samsung PanelMgr] => C:\Windows\Samsung\PanelMgr\ssmmgr.exe [606208 2009-12-09] ()
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-05-30] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] => E:\Programme\iTunesHelper.exe [421776 2012-06-07] (Apple Inc.)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\x86\CLIStart.exe [748256 2014-04-17] (Advanced Micro Devices, Inc.)
HKLM\...\RunOnce: [*TampMon] - C:\Program Files\Norton Family\Engine\2.9.5.39\tampmon.exe [61792 2014-06-02] (Symantec Corporation)
HKU\.DEFAULT\...\Run: [Norton Download Manager{NF29539-PROD-FSD3202}] => C:\Program Files\Norton Internet Security\Engine\21.3.0.12\NIS.exe [276376 2014-05-11] (Symantec Corporation)
HKU\S-1-5-21-4289696554-3133879028-2902408677-1001\...\Run: [Sony PC Companion] => "C:\Program Files\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe" /Background
HKU\S-1-5-21-4289696554-3133879028-2902408677-1001\...\Run: [LightScribe Control Panel] => C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
HKU\S-1-5-21-4289696554-3133879028-2902408677-1001\...\Run: [Akamai NetSession Interface] => C:\Users\stripcat\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)
HKU\S-1-5-21-4289696554-3133879028-2902408677-1001\...\Run: [Raptr] => C:\Program Files\Raptr\raptrstub.exe [55360 2014-05-15] (Raptr, Inc)
HKU\S-1-5-21-4289696554-3133879028-2902408677-1001\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\system32\Macromed\Flash\FlashUtil32_13_0_0_214_Plugin.exe [847536 2014-05-14] (Adobe Systems Incorporated)
HKU\S-1-5-21-4289696554-3133879028-2902408677-1001\...\MountPoints2: {32998ded-4cf5-11e1-8763-6cf049a2cfd3} - H:\Startme.exe
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKCU - {AFBCB7E0-F91A-4951-9F31-58FEE57A25C4} URL = hxxp://nortonsafe.search.ask.com/web?q={SEARCHTERMS}&o=APN10506&l=dis&prt=NIS&chn=retail&geo=DE&ver=21&locale=de_DE&gct=sb&qsrc=2869
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\21.3.0.12\coIEPlg.dll (Symantec Corporation)
BHO: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\21.3.0.12\IPS\IPSBHO.DLL (Symantec Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Norton Family BHO - {B8E07826-0971-4f16-B133-047B88034E89} - C:\Program Files\Norton Family\Engine\2.9.5.39\coIEPlg.dll (Symantec Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\21.3.0.12\coIEPlg.dll (Symantec Corporation)
Toolbar: HKCU - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\21.3.0.12\coIEPlg.dll (Symantec Corporation)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\stripcat\AppData\Roaming\Mozilla\Firefox\Profiles\rz4mmn7m.default
FF DefaultSearchEngine: Ask Search
FF SearchEngineOrder.1: Ask Search
FF SelectedSearchEngine: Ask Search
FF Homepage: about:home
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 - E:\Programme\Mozilla Plugins\npitunes.dll ()
FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin: @SonyCreativeSoftware.com/Media Go,version=1.0 - C:\Program Files\Sony\Media Go\npmediago.dll (Sony Network Entertainment International LLC)
FF Plugin: @videolan.org/vlc,version=1.1.11 - C:\Program Files\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\stripcat\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF SearchPlugin: C:\Users\stripcat\AppData\Roaming\Mozilla\Firefox\Profiles\rz4mmn7m.default\searchplugins\ask-search.xml
FF SearchPlugin: C:\Users\stripcat\AppData\Roaming\Mozilla\Firefox\Profiles\rz4mmn7m.default\searchplugins\icqplugin-1.xml
FF SearchPlugin: C:\Users\stripcat\AppData\Roaming\Mozilla\Firefox\Profiles\rz4mmn7m.default\searchplugins\icqplugin-2.xml
FF SearchPlugin: C:\Users\stripcat\AppData\Roaming\Mozilla\Firefox\Profiles\rz4mmn7m.default\searchplugins\icqplugin-3.xml
FF SearchPlugin: C:\Users\stripcat\AppData\Roaming\Mozilla\Firefox\Profiles\rz4mmn7m.default\searchplugins\icqplugin-4.xml
FF SearchPlugin: C:\Users\stripcat\AppData\Roaming\Mozilla\Firefox\Profiles\rz4mmn7m.default\searchplugins\icqplugin-5.xml
FF SearchPlugin: C:\Users\stripcat\AppData\Roaming\Mozilla\Firefox\Profiles\rz4mmn7m.default\searchplugins\icqplugin-6.xml
FF SearchPlugin: C:\Users\stripcat\AppData\Roaming\Mozilla\Firefox\Profiles\rz4mmn7m.default\searchplugins\icqplugin-7.xml
FF SearchPlugin: C:\Users\stripcat\AppData\Roaming\Mozilla\Firefox\Profiles\rz4mmn7m.default\searchplugins\icqplugin.xml
FF SearchPlugin: C:\Users\stripcat\AppData\Roaming\Mozilla\Firefox\Profiles\rz4mmn7m.default\searchplugins\searchplugins-backup
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Microsoft .NET Framework Assistant - C:\Users\stripcat\AppData\Roaming\Mozilla\Firefox\Profiles\rz4mmn7m.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2011-09-11]
FF Extension: Updated Ad Blocker for Firefox 11+ - C:\Users\stripcat\AppData\Roaming\Mozilla\Firefox\Profiles\rz4mmn7m.default\Extensions\{4DC70064-89E2-4a55-8FC6-E8CDEAE3618C}.xpi [2013-05-31]
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\stripcat\AppData\Roaming\Mozilla\Firefox\Profiles\rz4mmn7m.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi [2012-11-20]
FF HKLM\...\Firefox\Extensions: [virtualKeyboard@kaspersky.ru] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\virtualKeyboard@kaspersky.ru
FF HKLM\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.2.0.38\IPSFF
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.2.0.38\IPSFF [2014-03-30]
FF HKLM\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.2.0.38\coFFPlgn\
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.2.0.38\coFFPlgn\ []
FF HKLM\...\Firefox\Extensions: [{6D5C8FC4-DE46-41bf-9092-93F0F78E9115}] - C:\ProgramData\Norton\{78CA3BF0-9C3B-40e1-B46D-38C877EF059A}\NSM_2.9.5.39\coFFFw\
FF Extension: Norton Family - C:\ProgramData\Norton\{78CA3BF0-9C3B-40e1-B46D-38C877EF059A}\NSM_2.9.5.39\coFFFw\ []
========================== Services (Whitelisted) =================
R2 NIS; C:\Program Files\Norton Internet Security\Engine\21.3.0.12\NIS.exe [276376 2014-05-11] (Symantec Corporation)
R2 NSM; C:\Program Files\Norton Family\Engine\2.9.5.39\NF.exe [570944 2014-06-02] (Symantec Corporation)
S3 Samsung UPD Service2; C:\Windows\System32\SUPDSvc2.exe [136784 2011-12-02] (Samsung Electronics)
S3 Sony PC Companion; C:\Program Files\Sony\Sony PC Companion\PCCService.exe [155320 2012-01-18] (Avanquest Software) [File not signed]
R2 UsbClientService; C:\Program Files\Synology\Assistant\UsbClientService.exe [248704 2013-01-25] () [File not signed]
==================== Drivers (Whitelisted) ====================
R1 BHDrvx86; C:\Program Files\Norton Internet Security\NortonData\21.2.0.38\Definitions\BASHDefs\20140606.001\BHDrvx86.sys [1101616 2014-05-10] (Symantec Corporation)
R3 busenum; C:\Windows\System32\DRIVERS\busenum.sys [45792 2012-08-03] (Windows (R) Win 7 DDK provider)
R1 ccSet_NIS; C:\Windows\system32\drivers\NIS\1503000.00C\ccSetx86.sys [127064 2014-02-25] (Symantec Corporation)
R1 ccSet_NSM; C:\Windows\system32\drivers\NSM\0209050.027\ccSetx86.sys [127064 2013-09-27] (Symantec Corporation)
R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [377648 2014-06-14] (Symantec Corporation)
U3 EraserUtilDrv11313; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv11313.sys [109872 2014-06-14] (Symantec Corporation)
R1 IDSVix86; C:\Program Files\Norton Internet Security\NortonData\21.2.0.38\Definitions\IPSDefs\20140613.001\IDSvix86.sys [395992 2014-03-28] (Symantec Corporation)
R3 NAVENG; C:\Program Files\Norton Internet Security\NortonData\21.2.0.38\Definitions\VirusDefs\20140613.017\NAVENG.SYS [93272 2014-03-29] (Symantec Corporation)
R3 NAVEX15; C:\Program Files\Norton Internet Security\NortonData\21.2.0.38\Definitions\VirusDefs\20140613.017\NAVEX15.SYS [1612376 2014-03-29] (Symantec Corporation)
S3 s0016bus; C:\Windows\System32\DRIVERS\s0016bus.sys [89256 2008-05-16] (MCCI Corporation)
S3 s0016mdfl; C:\Windows\System32\DRIVERS\s0016mdfl.sys [15016 2008-05-16] (MCCI Corporation)
S3 s0016mdm; C:\Windows\System32\DRIVERS\s0016mdm.sys [120744 2008-05-16] (MCCI Corporation)
S3 s0016mgmt; C:\Windows\System32\DRIVERS\s0016mgmt.sys [114216 2008-05-16] (MCCI Corporation)
S3 s0016nd5; C:\Windows\System32\DRIVERS\s0016nd5.sys [25512 2008-05-16] (MCCI Corporation)
S3 s0016obex; C:\Windows\System32\DRIVERS\s0016obex.sys [110632 2008-05-16] (MCCI Corporation)
S3 s0016unic; C:\Windows\System32\DRIVERS\s0016unic.sys [115752 2008-05-16] (MCCI Corporation)
R3 SRTSP; C:\Windows\System32\Drivers\NIS\1503000.00C\SRTSP.SYS [664280 2014-02-13] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NIS\1503000.00C\SRTSPX.SYS [32344 2013-10-30] (Symantec Corporation)
R2 SSPORT; C:\Windows\system32\Drivers\SSPORT.sys [5120 2007-08-13] (Samsung Electronics) [File not signed]
R0 SymDS; C:\Windows\System32\drivers\NIS\1503000.00C\SYMDS.SYS [367704 2013-10-30] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NIS\1503000.00C\SYMEFA.SYS [936152 2014-03-04] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [142936 2014-06-14] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NIS\1503000.00C\Ironx86.SYS [206936 2013-10-30] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NIS\1503000.00C\SYMNETS.SYS [447704 2014-02-18] (Symantec Corporation)
S3 SYMRDR_{78CA3BF0-9C3B-40e1-B46D-38C877EF059A}; C:\Windows\system32\drivers\NSM\0209050.027\SymRdrS.SYS [203992 2014-02-18] (Symantec Corporation)
S2 DgiVecp; \??\C:\Windows\system32\Drivers\DgiVecp.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-06-14 20:28 - 2014-06-14 20:28 - 00015569 _____ () C:\Users\stripcat\Downloads\FRST.txt
2014-06-14 20:28 - 2014-06-14 20:28 - 00000000 ____D () C:\FRST
2014-06-14 20:26 - 2014-06-14 20:26 - 01073152 _____ (Farbar) C:\Users\stripcat\Downloads\FRST.exe
2014-06-14 19:36 - 2014-06-14 19:36 - 00000000 ____D () C:\Windows\system32\Drivers\NSM
2014-06-14 19:36 - 2014-06-14 19:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Family
2014-06-14 19:36 - 2014-06-14 19:36 - 00000000 ____D () C:\Program Files\Norton Family
2014-05-25 09:18 - 2014-05-25 09:18 - 00000000 ____D () C:\ProgramData\ATI
2014-05-25 09:09 - 2014-05-25 09:09 - 00000000 ____D () C:\Users\stripcat\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AMD Gaming Evolved
2014-05-25 09:08 - 2014-06-14 19:31 - 00000000 ____D () C:\Users\stripcat\AppData\Roaming\Raptr
2014-05-25 09:08 - 2014-05-25 09:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center
2014-05-25 09:08 - 2014-05-25 09:08 - 00000000 ____D () C:\ProgramData\AMD
2014-05-25 09:08 - 2014-05-25 09:08 - 00000000 ____D () C:\Program Files\AMD AVT
2014-05-25 09:08 - 2014-05-25 09:08 - 00000000 ____D () C:\Program Files\AMD
2014-05-25 09:07 - 2014-05-25 09:07 - 00000000 ____D () C:\Program Files\Microsoft.NET
2014-05-25 09:07 - 2014-05-25 09:07 - 00000000 ____D () C:\Program Files\Common Files\ATI Technologies
2014-05-25 09:07 - 2009-11-25 11:47 - 01130824 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2014-05-25 09:07 - 2009-11-25 11:47 - 00297808 _____ (Microsoft Corporation) C:\Windows\system32\mscoree.dll
2014-05-25 09:07 - 2009-11-25 11:47 - 00295264 _____ (Microsoft Corporation) C:\Windows\system32\PresentationHost.exe
2014-05-25 09:07 - 2009-11-25 11:47 - 00099176 _____ (Microsoft Corporation) C:\Windows\system32\PresentationHostProxy.dll
2014-05-25 09:07 - 2009-11-25 11:47 - 00049472 _____ (Microsoft Corporation) C:\Windows\system32\netfxperf.dll
2014-05-25 09:06 - 2014-05-25 09:06 - 00000000 ____D () C:\ProgramData\Package Cache
2014-05-24 20:33 - 2014-06-08 12:26 - 00000000 ____D () C:\Users\stripcat\AppData\Local\CrashDumps
==================== One Month Modified Files and Folders =======
2014-06-14 20:28 - 2014-06-14 20:28 - 00015569 _____ () C:\Users\stripcat\Downloads\FRST.txt
2014-06-14 20:28 - 2014-06-14 20:28 - 00000000 ____D () C:\FRST
2014-06-14 20:28 - 2011-09-11 11:40 - 00000000 ____D () C:\Users\stripcat\AppData\Local\Temp
2014-06-14 20:26 - 2014-06-14 20:26 - 01073152 _____ (Farbar) C:\Users\stripcat\Downloads\FRST.exe
2014-06-14 20:17 - 2012-04-11 19:36 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-06-14 19:39 - 2009-07-14 06:34 - 00016944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-14 19:39 - 2009-07-14 06:34 - 00016944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-14 19:37 - 2011-09-11 11:38 - 01647128 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-14 19:36 - 2014-06-14 19:36 - 00000000 ____D () C:\Windows\system32\Drivers\NSM
2014-06-14 19:36 - 2014-06-14 19:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Family
2014-06-14 19:36 - 2014-06-14 19:36 - 00000000 ____D () C:\Program Files\Norton Family
2014-06-14 19:36 - 2014-03-30 11:14 - 00142936 _____ (Symantec Corporation) C:\Windows\system32\Drivers\SYMEVENT.SYS
2014-06-14 19:36 - 2014-03-30 11:14 - 00008194 _____ () C:\Windows\system32\Drivers\SYMEVENT.CAT
2014-06-14 19:36 - 2014-03-30 11:01 - 00000000 ____D () C:\ProgramData\Norton
2014-06-14 19:35 - 2014-03-30 11:01 - 00000000 ____D () C:\Users\Public\Downloads\Norton
2014-06-14 19:35 - 2011-09-11 11:40 - 01304894 _____ () C:\Windows\WindowsUpdate.log
2014-06-14 19:31 - 2014-05-25 09:08 - 00000000 ____D () C:\Users\stripcat\AppData\Roaming\Raptr
2014-06-14 19:31 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-14 19:31 - 2009-07-14 06:39 - 00069105 _____ () C:\Windows\setupact.log
2014-06-08 12:26 - 2014-05-24 20:33 - 00000000 ____D () C:\Users\stripcat\AppData\Local\CrashDumps
2014-06-08 12:22 - 2014-02-28 19:56 - 00000000 ____D () C:\Users\stripcat\AppData\Roaming\Awesomium
2014-05-31 21:45 - 2012-02-16 12:10 - 00001081 _____ () C:\Users\stripcat\Desktop\filme die ich gucken will.txt
2014-05-29 11:29 - 2012-02-03 13:02 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information
2014-05-29 11:27 - 2012-03-04 22:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gameforge
2014-05-29 11:27 - 2012-02-03 14:42 - 00000000 ____D () C:\Program Files\Sony
2014-05-29 11:26 - 2012-12-22 17:37 - 00000000 ____D () C:\Program Files\Common Files\LightScribe
2014-05-29 11:25 - 2011-11-19 18:08 - 00000000 ____D () C:\Windows\system32\appmgmt
2014-05-27 21:52 - 2012-01-15 21:19 - 00000000 ____D () C:\Users\stripcat\AppData\Roaming\TS3Client
2014-05-25 20:28 - 2014-03-30 11:14 - 00002462 _____ () C:\Users\Public\Desktop\Norton Internet Security.lnk
2014-05-25 20:28 - 2014-03-30 11:14 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Internet Security
2014-05-25 20:28 - 2014-03-30 11:14 - 00000000 ____D () C:\Windows\system32\Drivers\NIS
2014-05-25 09:28 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-05-25 09:18 - 2014-05-25 09:18 - 00000000 ____D () C:\ProgramData\ATI
2014-05-25 09:09 - 2014-05-25 09:09 - 00000000 ____D () C:\Users\stripcat\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AMD Gaming Evolved
2014-05-25 09:09 - 2014-01-12 23:58 - 00000000 ____D () C:\Program Files\Raptr
2014-05-25 09:08 - 2014-05-25 09:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center
2014-05-25 09:08 - 2014-05-25 09:08 - 00000000 ____D () C:\ProgramData\AMD
2014-05-25 09:08 - 2014-05-25 09:08 - 00000000 ____D () C:\Program Files\AMD AVT
2014-05-25 09:08 - 2014-05-25 09:08 - 00000000 ____D () C:\Program Files\AMD
2014-05-25 09:08 - 2011-09-11 11:59 - 00000000 ____D () C:\Program Files\ATI Technologies
2014-05-25 09:07 - 2014-05-25 09:07 - 00000000 ____D () C:\Program Files\Microsoft.NET
2014-05-25 09:07 - 2014-05-25 09:07 - 00000000 ____D () C:\Program Files\Common Files\ATI Technologies
2014-05-25 09:06 - 2014-05-25 09:06 - 00000000 ____D () C:\ProgramData\Package Cache
Files to move or delete:
====================
C:\Users\Public\Samsung_Universal_Print_Driver_V2.03.01.00_36.exe
Some content of TEMP:
====================
C:\Users\stripcat\AppData\Local\Temp\7z.dll
C:\Users\stripcat\AppData\Local\Temp\autorun.dll
C:\Users\stripcat\AppData\Local\Temp\InstallAX.exe
C:\Users\stripcat\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe
C:\Users\stripcat\AppData\Local\Temp\mgsqlite3.dll
C:\Users\stripcat\AppData\Local\Temp\raptrpatch.exe
C:\Users\stripcat\AppData\Local\Temp\raptr_stub.exe
C:\Users\stripcat\AppData\Local\Temp\swt-win32-3349.dll
C:\Users\stripcat\AppData\Local\Temp\TW_autoskip.exe
C:\Users\stripcat\AppData\Local\Temp\Uninstaller-1596.exe
C:\Users\stripcat\AppData\Local\Temp\wmfdist.exe
C:\Users\stripcat\AppData\Local\Temp\wvc1dmo.exe
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-06-08 11:00
==================== End Of Log ============================
--- --- --- " Addition.TXT "FRST Additions Logfile: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version:12-06-2014 02
Ran by stripcat at 2014-06-14 20:28:54
Running from C:\Users\stripcat\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Norton Internet Security (Enabled - Up to date) {D87FA2C0-F526-77B1-D6EC-0EDF3936CEDB}
AS: Norton Internet Security (Enabled - Up to date) {631E4324-D31C-783F-EC5C-35AD42B18466}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Norton Internet Security (Enabled) {E04423E5-BF49-76E9-FDB3-A7EAC7E589A0}
==================== Installed Programs ======================
Adobe AIR (HKLM\...\Adobe AIR) (Version: 3.0.0.4080 - Adobe Systems Incorporated)
Adobe AIR (Version: 3.0.0.4080 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 13 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Reader X (10.1.6) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.6 - Adobe Systems Incorporated)
Akamai NetSession Interface (HKCU\...\Akamai) (Version: - Akamai Technologies, Inc)
Albelli Fotobücher (HKCU\...\{EE20E438-B675-4421-AB07-928F0EC9FB22}_is1) (Version: - Albelli)
AMD Accelerated Video Transcoding (Version: 13.30.100.40417 - Advanced Micro Devices, Inc.) Hidden
AMD Catalyst Control Center (Version: 2014.0417.2226.38446 - Ihr Firmenname) Hidden
AMD Catalyst Install Manager (HKLM\...\{DC7723BE-A2BB-58A0-4820-5630F9B82198}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)
AMD Drag and Drop Transcoding (Version: 2.00.0000 - Advanced Micro Devices, Inc.) Hidden
AMD Wireless Display v3.0 (Version: 1.0.0.15 - Advanced Micro Devices, Inc.) Hidden
Apple Application Support (HKLM\...\{122ADF8C-DDA1-480C-9936-C88F2825B265}) (Version: 2.1.9 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{8F1ADE4D-EFAC-4F5A-B346-23C2687FAF50}) (Version: 5.2.0.6 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Battle.net (HKLM\...\Battle.net) (Version: - Blizzard Entertainment)
Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
Catalyst Control Center - Branding (Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (Version: 2014.0417.2226.38446 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (Version: 2014.0417.2226.38446 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (Version: 2014.0417.2226.38446 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden
ccc-utility (Version: 2014.0417.2226.38446 - Advanced Micro Devices, Inc.) Hidden
Das Schwarze Auge - Schicksalsklinge (HKLM\...\{8DA31208-BE1D-4D9C-B421-F97C04947F55}_is1) (Version: - UIG GmbH)
Das Zepter des Zeus (HKLM\...\Das Zepter des Zeus) (Version: - )
Diablo III (HKLM\...\Diablo III) (Version: - Blizzard Entertainment)
Die Gilde 2 - Gold Edition (HKLM\...\Die Gilde 2 - Gold Edition) (Version: V 1.20 - JoWood)
Die Gilde 2 Venedig (HKLM\...\{30F7A307-E595-40F6-8842-B36C7747E978}) (Version: 1.0.0 - JoWood)
Drakensang - Am Fluss der Zeit (HKLM\...\Drakensang_TRoT_is1) (Version: - dtp)
Drakensang - Phileassons Geheimnis (HKLM\...\Drakensang_Phileasson_is1) (Version: - dtp)
Fable III (Version: 1.0.0002.131 - Microsoft Game Studios) Hidden
ffdshow v1.2.4422 [2012-04-09] (HKLM\...\ffdshow_is1) (Version: 1.2.4422.0 - )
Free YouTube to MP3 Converter version 3.11.35.1031 (HKLM\...\Free YouTube to MP3 Converter_is1) (Version: 3.11.35.1031 - DVDVideoSoft Ltd.)
HDVidCodec (HKLM\...\1ClickDownload) (Version: 2.1 Build 26473 - hdvidcodec.com)
Hearthstone (HKLM\...\Hearthstone) (Version: - Blizzard Entertainment)
iTunes (HKLM\...\{6AD9F5F3-5BD0-4000-BD9C-B536CF86D988}) (Version: 10.6.3.25 - Apple Inc.)
Java 7 Update 51 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.510 - Oracle)
Java Auto Updater (Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Java(TM) 6 Update 30 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83216016FF}) (Version: 6.0.300 - Sun Microsystems, Inc.)
Media Go (HKLM\...\{167A1F6A-9BF2-4B24-83DB-C6D659F680EA}) (Version: 2.0.317 - Sony)
Microsoft .NET Framework 1.1 (HKLM\...\Microsoft .NET Framework 1.1 (1033)) (Version: - )
Microsoft .NET Framework 1.1 (Version: 1.1.4322 - Microsoft) Hidden
Microsoft .NET Framework 4.5 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50709 - Microsoft Corporation)
Microsoft .NET Framework 4.5 (Version: 4.5.50709 - Microsoft Corporation) Hidden
Microsoft Games for Windows - LIVE (HKLM\...\{F97E3841-CA9D-4964-9D64-26066241D26F}) (Version: 3.3.24.0 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM\...\{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}) (Version: 3.5.92.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable - KB2467175 (HKLM\...\{a0fe116e-9a8a-466f-aee0-625cb7c207e3}) (Version: 8.0.51011 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 (HKLM\...\{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}) (Version: 9.0.30411 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Mozilla Firefox 29.0.1 (x86 de) (HKLM\...\Mozilla Firefox 29.0.1 (x86 de)) (Version: 29.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Neverwinter (HKLM\...\Neverwinter) (Version: - Cryptic Studios)
Norton Family (HKLM\...\NSM) (Version: 2.9.5.39 - Symantec Corporation)
Norton Internet Security (HKLM\...\NIS) (Version: 21.3.0.12 - Symantec Corporation)
NVIDIA PhysX (HKLM\...\{B4F3A360-E1E2-479D-ADE7-9BE3B07F4539}) (Version: 9.10.0223 - NVIDIA Corporation)
OpenAL (HKLM\...\OpenAL) (Version: - )
OpenOffice.org 3.1 (HKLM\...\{99E862CC-6F69-4D39-99AA-DBF71BF3B585}) (Version: 3.1.9420 - OpenOffice.org)
Pando Media Booster (HKLM\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: 2.6.0.1 - Pando Networks Inc.)
PlayStation(R)Store (HKLM\...\{0E532C84-4275-41B3-9D81-D4A1A20D8EE7}) (Version: 4.5.16.13625 - Sony Computer Entertainment Inc.)
Raptr (HKLM\...\Raptr) (Version: - )
Samsung CLX-3170 Series (HKLM\...\Samsung CLX-3170 Series) (Version: - Samsung Electronics CO.,LTD)
Samsung Universal Print Driver (HKLM\...\Samsung Universal Print Driver) (Version: 2.03.01.00:36 - Samsung Electronics Co., Ltd.)
Sony Ericsson Update Engine (HKLM\...\Update Engine) (Version: 2.12.12.24 - Sony Ericsson Communications AB)
Sony PC Companion 2.10.094 (HKLM\...\{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}) (Version: 2.10.094 - Sony)
Synology Assistant (remove only) (HKLM\...\Synology Assistant) (Version: - )
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.11.1 - TeamSpeak Systems GmbH)
The Elder Scrolls Online Beta (HKLM\...\The Elder Scrolls Online Beta_is1) (Version: 0.3.4 - )
Torchlight II (HKLM\...\{55F7D521-17CA-454D-9D4D-975EF2E10708}_is1) (Version: - White Rabbit Interactive)
Unity Web Player (HKCU\...\UnityWebPlayer) (Version: - Unity Technologies ApS)
Venetica (HKLM\...\Venetica_is1) (Version: - dtp)
VLC media player 1.1.11 (HKLM\...\VLC media player) (Version: 1.1.11 - VideoLAN)
Windows Live ID Sign-in Assistant (HKLM\...\{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}) (Version: 6.500.3165.0 - Microsoft Corporation)
==================== Restore Points =========================
08-06-2014 09:07:07 Geplanter Prüfpunkt
==================== Hosts content: ==========================
2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {06FC2981-F4D8-4E5A-B852-8CBCB07AED5B} - System32\Tasks\Norton WSC Integration => C:\Program Files\Norton Internet Security\Engine\21.3.0.12\WSCStub.exe [2014-05-11] (Symantec Corporation)
Task: {5167C02B-8C2D-44F8-BDCA-7DEC22246F31} - System32\Tasks\229B350D-034F-4c01-BAF2-3EA03DCAE0B9 => C:\Program Files\Norton Family\Engine\2.9.5.39\tampmon.exe [2014-06-02] (Symantec Corporation)
Task: {5D2CD995-9F22-4E9A-9775-7E0DBF184A4F} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files\Norton Internet Security\Engine\21.3.0.12\SymErr.exe [2014-01-30] (Symantec Corporation)
Task: {A9AA8716-B688-41EA-8981-14157F68BE86} - System32\Tasks\Norton Family\Norton Error Processor => C:\Program Files\Norton Family\Engine\2.9.5.39\SymErr.exe [2013-08-01] (Symantec Corporation)
Task: {BB135B04-10BE-4E64-8E28-BDC9D8CE42DA} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files\Norton Internet Security\Engine\21.3.0.12\SymErr.exe [2014-01-30] (Symantec Corporation)
Task: {C479FE13-0CD2-42AF-BAAE-D100D43886BF} - System32\Tasks\Norton Family\Norton Error Analyzer => C:\Program Files\Norton Family\Engine\2.9.5.39\SymErr.exe [2013-08-01] (Symantec Corporation)
Task: {D7153B25-63FE-4143-89D5-09687E5EB848} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-14] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) =============
2012-05-25 17:52 - 2011-04-11 07:26 - 00024064 _____ () C:\Windows\System32\spd__l.dll
2011-10-03 12:02 - 2007-08-14 19:01 - 00022723 _____ () C:\Windows\System32\sst1cl3.dll
2012-05-25 17:52 - 2011-11-23 18:06 - 00684032 _____ () C:\Windows\system32\spool\DRIVERS\W32X86\3\spd__du.dll
2012-05-30 20:06 - 2012-05-30 20:06 - 00087912 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2012-05-30 20:06 - 2012-05-30 20:06 - 01242512 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2013-01-25 09:12 - 2013-01-25 09:12 - 00248704 _____ () C:\Program Files\Synology\Assistant\UsbClientService.exe
2011-10-03 12:02 - 2009-12-09 15:49 - 00606208 _____ () C:\Windows\Samsung\PanelMgr\SSMMgr.exe
2010-11-23 00:56 - 2010-11-23 00:56 - 00087040 _____ () C:\Program Files\Raptr\_ctypes.pyd
2010-11-23 00:56 - 2010-11-23 00:56 - 00043008 _____ () C:\Program Files\Raptr\_socket.pyd
2010-11-23 00:56 - 2010-11-23 00:56 - 00805376 _____ () C:\Program Files\Raptr\_ssl.pyd
2014-05-14 01:26 - 2014-05-14 01:26 - 05812736 _____ () C:\Program Files\Raptr\PyQt4.QtGui.pyd
2014-05-14 01:26 - 2014-05-14 01:26 - 00067584 _____ () C:\Program Files\Raptr\sip.pyd
2014-05-14 01:26 - 2014-05-14 01:26 - 01662464 _____ () C:\Program Files\Raptr\PyQt4.QtCore.pyd
2014-05-14 01:26 - 2014-05-14 01:26 - 00494592 _____ () C:\Program Files\Raptr\PyQt4.QtNetwork.pyd
2010-11-23 00:57 - 2010-11-23 00:57 - 00096256 _____ () C:\Program Files\Raptr\win32api.pyd
2010-11-23 00:56 - 2010-11-23 00:56 - 00110592 _____ () C:\Program Files\Raptr\pywintypes26.dll
2010-11-23 00:56 - 2010-11-23 00:56 - 00324608 _____ () C:\Program Files\Raptr\PIL._imaging.pyd
2010-11-23 00:56 - 2010-11-23 00:56 - 00356864 _____ () C:\Program Files\Raptr\_hashlib.pyd
2010-11-23 00:57 - 2010-11-23 00:57 - 00036352 _____ () C:\Program Files\Raptr\win32process.pyd
2010-11-23 00:57 - 2010-11-23 00:57 - 00111104 _____ () C:\Program Files\Raptr\win32file.pyd
2010-11-23 00:56 - 2010-11-23 00:56 - 00124928 _____ () C:\Program Files\Raptr\_elementtree.pyd
2010-11-23 00:56 - 2010-11-23 00:56 - 00127488 _____ () C:\Program Files\Raptr\pyexpat.pyd
2012-02-06 22:28 - 2012-02-06 22:28 - 00031744 _____ () C:\Program Files\Raptr\Crypto.Cipher.AES.pyd
2012-02-06 22:28 - 2012-02-06 22:28 - 00010752 _____ () C:\Program Files\Raptr\Crypto.Random.OSRNG.winrandom.pyd
2012-02-06 22:28 - 2012-02-06 22:28 - 00011264 _____ () C:\Program Files\Raptr\Crypto.Util._counter.pyd
2011-05-10 21:01 - 2011-05-10 21:01 - 00030208 _____ () C:\Program Files\Raptr\simplejson._speedups.pyd
2014-05-14 01:26 - 2014-05-14 01:26 - 00313856 _____ () C:\Program Files\Raptr\PyQt4.QtWebKit.pyd
2010-11-23 00:56 - 2010-11-23 00:56 - 00044544 _____ () C:\Program Files\Raptr\_sqlite3.pyd
2011-02-15 20:17 - 2011-02-15 20:17 - 00417501 _____ () C:\Program Files\Raptr\sqlite3.dll
2010-11-23 00:56 - 2010-11-23 00:56 - 00354304 _____ () C:\Program Files\Raptr\pythoncom26.dll
2010-11-23 00:57 - 2010-11-23 00:57 - 00016384 _____ () C:\Program Files\Raptr\win32trace.pyd
2010-11-23 00:57 - 2010-11-23 00:57 - 00167936 _____ () C:\Program Files\Raptr\win32gui.pyd
2010-11-23 00:56 - 2010-11-23 00:56 - 00009216 _____ () C:\Program Files\Raptr\winsound.pyd
2010-11-23 00:56 - 2010-11-23 00:56 - 00010240 _____ () C:\Program Files\Raptr\select.pyd
2013-11-21 02:05 - 2013-11-21 02:05 - 00256000 _____ () C:\Program Files\Raptr\amd_ags.dll
2010-11-23 00:56 - 2010-11-23 00:56 - 00583680 _____ () C:\Program Files\Raptr\unicodedata.pyd
2014-05-14 21:17 - 2014-05-14 21:17 - 16361136 _____ () C:\Windows\system32\macromed\Flash\NPSWF32_13_0_0_214.dll
2010-11-23 00:57 - 2010-11-23 00:57 - 00263168 _____ () C:\Program Files\Raptr\win32com.shell.shell.pyd
2010-11-23 00:57 - 2010-11-23 00:57 - 00141312 _____ () C:\Program Files\Raptr\gobject._gobject.pyd
2012-10-27 09:53 - 2012-10-27 09:53 - 02717595 _____ () C:\Program Files\Raptr\heliotrope._purple.pyd
2011-02-15 20:17 - 2011-02-15 20:17 - 01213633 _____ () C:\Program Files\Raptr\libxml2-2.dll
2010-11-23 01:06 - 2010-11-23 01:06 - 00055808 _____ () C:\Program Files\Raptr\zlib1.dll
2013-05-10 01:52 - 2013-05-10 01:52 - 00495680 _____ () C:\Program Files\Raptr\plugins\libaim.dll
2013-05-10 01:52 - 2013-05-10 01:52 - 01183699 _____ () C:\Program Files\Raptr\liboscar.dll
2013-05-10 01:52 - 2013-05-10 01:52 - 00483306 _____ () C:\Program Files\Raptr\plugins\libicq.dll
2013-05-03 20:57 - 2013-05-03 20:57 - 00655356 _____ () C:\Program Files\Raptr\plugins\libirc.dll
2013-05-03 20:56 - 2013-05-03 20:56 - 01306387 _____ () C:\Program Files\Raptr\plugins\libmsn.dll
2013-05-03 20:56 - 2013-05-03 20:56 - 00565461 _____ () C:\Program Files\Raptr\plugins\libxmpp.dll
2013-05-03 20:57 - 2013-05-03 20:57 - 01640221 _____ () C:\Program Files\Raptr\libjabber.dll
2013-05-03 20:56 - 2013-05-03 20:56 - 00506276 _____ () C:\Program Files\Raptr\plugins\libyahoo.dll
2013-05-03 20:57 - 2013-05-03 20:57 - 01053730 _____ () C:\Program Files\Raptr\libymsg.dll
2013-05-03 20:57 - 2013-05-03 20:57 - 00497782 _____ () C:\Program Files\Raptr\plugins\libyahoojp.dll
2013-05-03 20:57 - 2013-05-03 20:57 - 00603326 _____ () C:\Program Files\Raptr\plugins\ssl-nss.dll
2013-05-03 20:57 - 2013-05-03 20:57 - 00474199 _____ () C:\Program Files\Raptr\plugins\ssl.dll
2014-05-10 12:16 - 2014-05-10 12:16 - 03839088 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2014-06-14 19:36 - 2012-05-29 20:21 - 00699280 ____R () C:\Program Files\Norton Family\Engine\2.9.5.39\wincfi39.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\ProgramData:gs5sys
AlternateDataStreams: C:\Users\All Users:gs5sys
AlternateDataStreams: C:\Users\stripcat:gs5sys
AlternateDataStreams: C:\ProgramData\Anwendungsdaten:gs5sys
AlternateDataStreams: C:\ProgramData\Application Data:gs5sys
AlternateDataStreams: C:\Users\Public\Documents\desktop.ini:gs5sys
AlternateDataStreams: C:\Users\stripcat\Anwendungsdaten:gs5sys
AlternateDataStreams: C:\Users\stripcat\Cookies:gs5sys
AlternateDataStreams: C:\Users\stripcat\Lokale Einstellungen:gs5sys
AlternateDataStreams: C:\Users\stripcat\Vorlagen:gs5sys
AlternateDataStreams: C:\Users\stripcat\Desktop\desktop.ini:gs5sys
AlternateDataStreams: C:\Users\stripcat\AppData\Local:gs5sys
AlternateDataStreams: C:\Users\stripcat\AppData\Roaming:gs5sys
AlternateDataStreams: C:\Users\stripcat\AppData\Local\Anwendungsdaten:gs5sys
AlternateDataStreams: C:\Users\stripcat\AppData\Local\Verlauf:gs5sys
AlternateDataStreams: C:\Users\stripcat\Documents\desktop.ini:gs5sys
==================== Safe Mode (whitelisted) ===================
==================== EXE Association (whitelisted) =============
==================== MSCONFIG/TASK MANAGER disabled items =========
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (06/08/2014 00:26:19 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Bethesda.net_Launcher.exe, Version: 3.5.2.0, Zeitstempel: 0x522d61dc
Name des fehlerhaften Moduls: ltc_fpsi32-82061.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x53481d72
Ausnahmecode: 0xc0000005
Fehleroffset: 0x69dd25a0
ID des fehlerhaften Prozesses: 0x14e8
Startzeit der fehlerhaften Anwendung: 0xBethesda.net_Launcher.exe0
Pfad der fehlerhaften Anwendung: Bethesda.net_Launcher.exe1
Pfad des fehlerhaften Moduls: Bethesda.net_Launcher.exe2
Berichtskennung: Bethesda.net_Launcher.exe3
Error: (06/07/2014 07:28:29 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Bethesda.net_Launcher.exe, Version: 3.5.2.0, Zeitstempel: 0x522d61dc
Name des fehlerhaften Moduls: ltc_fpsi32-82061.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x53481d72
Ausnahmecode: 0xc0000005
Fehleroffset: 0x592e25a0
ID des fehlerhaften Prozesses: 0x9ec
Startzeit der fehlerhaften Anwendung: 0xBethesda.net_Launcher.exe0
Pfad der fehlerhaften Anwendung: Bethesda.net_Launcher.exe1
Pfad des fehlerhaften Moduls: Bethesda.net_Launcher.exe2
Berichtskennung: Bethesda.net_Launcher.exe3
Error: (06/07/2014 07:12:41 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (06/07/2014 07:12:35 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (06/04/2014 09:22:14 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (06/04/2014 09:22:09 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (05/31/2014 02:33:07 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (05/31/2014 02:33:01 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (05/29/2014 02:04:04 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (05/29/2014 02:03:58 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
System errors:
=============
Error: (06/14/2014 07:31:28 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (06/08/2014 11:00:53 AM) (Source: volsnap) (EventID: 36) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
Error: (06/08/2014 09:22:35 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (06/07/2014 06:53:22 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (06/07/2014 08:01:42 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (06/05/2014 08:16:05 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (06/04/2014 09:25:29 PM) (Source: volsnap) (EventID: 36) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
Error: (06/04/2014 08:14:36 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (06/04/2014 07:55:00 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (06/01/2014 10:33:44 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Microsoft Office Sessions:
=========================
Error: (06/08/2014 00:26:19 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Bethesda.net_Launcher.exe3.5.2.0522d61dcltc_fpsi32-82061.dll_unloaded0.0.0.053481d72c000000569dd25a014e801cf82eae99d5b28E:\Spiele\Launcher\Bethesda.net_Launcher.exeltc_fpsi32-82061.dll53c7f8b1-eef7-11e3-b15b-6cf049a2cfd3
Error: (06/07/2014 07:28:29 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Bethesda.net_Launcher.exe3.5.2.0522d61dcltc_fpsi32-82061.dll_unloaded0.0.0.053481d72c0000005592e25a09ec01cf827540195ca6E:\Spiele\Launcher\Bethesda.net_Launcher.exeltc_fpsi32-82061.dll237ae088-ee69-11e3-b118-6cf049a2cfd3
Error: (06/07/2014 07:12:41 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\Sony\sony pc companion\Drivers\DPInst64.exe
Error: (06/07/2014 07:12:35 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\ati technologies\ATI.ACE\core-static\SLSTaskbar64.exe
Error: (06/04/2014 09:22:14 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\Sony\sony pc companion\Drivers\DPInst64.exe
Error: (06/04/2014 09:22:09 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\ati technologies\ATI.ACE\core-static\SLSTaskbar64.exe
Error: (05/31/2014 02:33:07 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\Sony\sony pc companion\Drivers\DPInst64.exe
Error: (05/31/2014 02:33:01 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\ati technologies\ATI.ACE\core-static\SLSTaskbar64.exe
Error: (05/29/2014 02:04:04 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\Sony\sony pc companion\Drivers\DPInst64.exe
Error: (05/29/2014 02:03:58 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\ati technologies\ATI.ACE\core-static\SLSTaskbar64.exe
CodeIntegrity Errors:
===================================
Date: 2014-03-30 10:50:16.885
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-03-30 10:50:16.885
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-03-30 10:50:16.885
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-03-30 10:50:16.869
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-03-30 10:50:16.869
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-03-30 10:50:16.869
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-03-30 10:50:16.869
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX86\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-03-30 10:50:16.854
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX86\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-03-30 10:50:16.854
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX86\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-03-30 10:50:16.854
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX86\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Percentage of memory in use: 41%
Total physical RAM: 3070.49 MB
Available physical RAM: 1803.55 MB
Total Pagefile: 6139.26 MB
Available Pagefile: 4655.36 MB
Total Virtual: 2047.88 MB
Available Virtual: 1882.87 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:55.89 GB) (Free:6.19 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive e: (Volume) (Fixed) (Total:931.51 GB) (Free:797.69 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 932 GB) (Disk ID: 000B9115)
Partition 1: (Not Active) - (Size=932 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 56 GB) (Disk ID: C553C553)
Partition 1: (Active) - (Size=56 GB) - (Type=07 NTFS)
==================== End Of Log ============================
" Gmer.txt "GMER Logfile: Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-06-14 21:02:45
Windows 6.1.7600 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP3T1L0-5 OCZ-VERTEX2 rev.1.27 55,90GB
Running: 1lqxtrbt.exe; Driver: C:\Users\stripcat\AppData\Local\Temp\uwlorkod.sys
---- System - GMER 2.1 ----
SSDT 86A4A950 ZwAlertResumeThread
SSDT 86A4A9E8 ZwAlertThread
SSDT 86A341F0 ZwAllocateVirtualMemory
SSDT 869CBC28 ZwAlpcConnectPort
SSDT 86A4A3C8 ZwAssignProcessToJobObject
SSDT 86A4A778 ZwCreateMutant
SSDT 86A4A1C0 ZwCreateSymbolicLinkObject
SSDT 86A46A88 ZwCreateThread
SSDT 86A4A268 ZwCreateThreadEx
SSDT 86A4A460 ZwDebugActiveProcess
SSDT 86A342F0 ZwDuplicateObject
SSDT 86A4AED8 ZwFreeVirtualMemory
SSDT 86A4A820 ZwImpersonateAnonymousToken
SSDT 86A4A8B8 ZwImpersonateThread
SSDT 86981CC8 ZwLoadDriver
SSDT 86A4AE20 ZwMapViewOfSection
SSDT 86A4A6E0 ZwOpenEvent
SSDT 86A34400 ZwOpenProcess
SSDT 86A34278 ZwOpenProcessToken
SSDT 86A4A5B0 ZwOpenSection
SSDT 86A34378 ZwOpenThread
SSDT 86A4A320 ZwProtectVirtualMemory
SSDT 86A4AA80 ZwResumeThread
SSDT 86A4AC48 ZwSetContextThread
SSDT 86A4ACE0 ZwSetInformationProcess
SSDT 86A4A4F8 ZwSetSystemInformation
SSDT 86A4A648 ZwSuspendProcess
SSDT 86A4AB18 ZwSuspendThread
SSDT 86A46B20 ZwTerminateProcess
SSDT 86A4ABB0 ZwTerminateThread
SSDT 86A4AD88 ZwUnmapViewOfSection
SSDT 86A4AF80 ZwWriteVirtualMemory
---- Kernel code sections - GMER 2.1 ----
.text ntkrnlpa.exe!ZwSaveKeyEx + 13AD 83059579 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 8307DF52 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text ntkrnlpa.exe!RtlSidHashLookup + 224 83085724 8 Bytes [50, A9, A4, 86, E8, A9, A4, ...]
.text ntkrnlpa.exe!RtlSidHashLookup + 23C 8308573C 4 Bytes [F0, 41, A3, 86]
.text ntkrnlpa.exe!RtlSidHashLookup + 248 83085748 4 Bytes [28, BC, 9C, 86]
.text ntkrnlpa.exe!RtlSidHashLookup + 29C 8308579C 4 Bytes [C8, A3, A4, 86] {ENTER 0xa4a3, 0x86}
.text ntkrnlpa.exe!RtlSidHashLookup + 318 83085818 4 Bytes [78, A7, A4, 86]
.text ...
.text C:\Windows\system32\DRIVERS\atikmdag.sys section is writeable [0x99A09000, 0x16640A, 0xE8000020]
---- User code sections - GMER 2.1 ----
.text C:\PROGRA~1\Raptr\raptr.exe[3340] USER32.dll!UpdateLayeredWindowIndirect 7619B5FA 5 Bytes JMP 65CE0D70 C:\PROGRA~1\Raptr\ltc_host.DLL
.text C:\PROGRA~1\Raptr\raptr.exe[3340] USER32.dll!UpdateLayeredWindow 7619C01F 5 Bytes JMP 65CE0CA0 C:\PROGRA~1\Raptr\ltc_host.DLL
.text C:\PROGRA~1\Raptr\raptr.exe[3340] USER32.dll!SetForegroundWindow 7619D3AE 5 Bytes JMP 65CE0800 C:\PROGRA~1\Raptr\ltc_host.DLL
.text C:\PROGRA~1\Raptr\raptr.exe[3340] USER32.dll!DestroyWindow 7619D5EF 5 Bytes JMP 65CE06D0 C:\PROGRA~1\Raptr\ltc_host.DLL
.text C:\PROGRA~1\Raptr\raptr.exe[3340] USER32.dll!CreateWindowExA 7619E18A 5 Bytes JMP 65CE0DF0 C:\PROGRA~1\Raptr\ltc_host.DLL
.text C:\PROGRA~1\Raptr\raptr.exe[3340] USER32.dll!CreateWindowExW 761A0E51 5 Bytes JMP 65CE0F20 C:\PROGRA~1\Raptr\ltc_host.DLL
.text C:\PROGRA~1\Raptr\raptr.exe[3340] USER32.dll!ShowWindow 761A147A 5 Bytes JMP 65CE05D0 C:\PROGRA~1\Raptr\ltc_host.DLL
.text C:\PROGRA~1\Raptr\raptr.exe[3340] USER32.dll!PeekMessageA 761A2EB2 5 Bytes JMP 65CE0860 C:\PROGRA~1\Raptr\ltc_host.DLL
.text C:\PROGRA~1\Raptr\raptr.exe[3340] USER32.dll!DispatchMessageA 761A3569 5 Bytes JMP 65CE0570 C:\PROGRA~1\Raptr\ltc_host.DLL
.text C:\PROGRA~1\Raptr\raptr.exe[3340] USER32.dll!SetWindowPos 761A3581 5 Bytes JMP 65CE0700 C:\PROGRA~1\Raptr\ltc_host.DLL
.text C:\PROGRA~1\Raptr\raptr.exe[3340] USER32.dll!SetCursor 761A52EA 5 Bytes JMP 65CE00B0 C:\PROGRA~1\Raptr\ltc_host.DLL
.text C:\PROGRA~1\Raptr\raptr.exe[3340] USER32.dll!EndPaint 761A7B73 5 Bytes JMP 65CE09A0 C:\PROGRA~1\Raptr\ltc_host.DLL
.text C:\PROGRA~1\Raptr\raptr.exe[3340] USER32.dll!BeginPaint 761A7B87 5 Bytes JMP 65CE0940 C:\PROGRA~1\Raptr\ltc_host.DLL
.text C:\PROGRA~1\Raptr\raptr.exe[3340] USER32.dll!DispatchMessageW 761A8E8D 5 Bytes JMP 65CE05A0 C:\PROGRA~1\Raptr\ltc_host.DLL
.text C:\PROGRA~1\Raptr\raptr.exe[3340] USER32.dll!PeekMessageW 761A91B5 5 Bytes JMP 65CE08C0 C:\PROGRA~1\Raptr\ltc_host.DLL
.text C:\PROGRA~1\Raptr\raptr.exe[3340] USER32.dll!BringWindowToTop 761C1B1D 5 Bytes JMP 65CE0920 C:\PROGRA~1\Raptr\ltc_host.DLL
.text C:\PROGRA~1\Raptr\raptr.exe[3340] USER32.dll!AnimateWindow 761C1D32 5 Bytes JMP 65CE0770 C:\PROGRA~1\Raptr\ltc_host.DLL
.text C:\PROGRA~1\Raptr\raptr.exe[3340] USER32.dll!SetCapture 761C6B2A 5 Bytes JMP 65CE0840 C:\PROGRA~1\Raptr\ltc_host.DLL
.text C:\PROGRA~1\Raptr\raptr.exe[3340] USER32.dll!WindowFromPoint 761C6D0C 5 Bytes JMP 65CE00D0 C:\PROGRA~1\Raptr\ltc_host.DLL
.text C:\PROGRA~1\Raptr\raptr.exe[3340] GDI32.dll!BitBlt 77677180 5 Bytes JMP 65CE0100 C:\PROGRA~1\Raptr\ltc_host.DLL
---- Registry - GMER 2.1 ----
Reg HKLM\SOFTWARE\Microsoft\Windows Search\UsnNotifier\Windows\Catalogs\SystemIndex@{A6C52F7D-DC58-11E0-8066-806E6F6E6963} 3675693232
---- EOF - GMER 2.1 ----
" Ich danke euch schon einmal und wünsche ein ruhiges Wochenende.  Geändert von kiddyba (14.06.2014 um 21:20 Uhr) |
|
15.06.2014, 06:02
| #2 |
| /// the machine /// TB-Ausbilder    | Windows 7, PayPal Phishing Mail. hi,
__________________Scan mit Combofix
__________________ |
|
15.06.2014, 10:04
| #3 |
| | Windows 7, PayPal Phishing Mail. Guten morgen und danke für die schnelle Antwort.
__________________Ich hab Combofix durchgeführt, vorher natürlich Norton ausgemacht, das Programm hat dennoch gemeckert, ansonsten lief es ohne Probleme, Neustart auch ohne Komplikationen. Da ich leider nicht weiß was ein CODE-Tag ist, habe ich es auf normale weise gepostet. Combofix Logfile: Code:
ATTFilter ComboFix 14-06-13.01 - stripcat 15.06.2014 10:46:31.1.2 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.49.1031.18.3070.2092 [GMT 2:00]
ausgeführt von:: c:\users\stripcat\Desktop\ComboFix.exe
AV: Norton Internet Security *Disabled/Updated* {D87FA2C0-F526-77B1-D6EC-0EDF3936CEDB}
FW: Norton Internet Security *Disabled* {E04423E5-BF49-76E9-FDB3-A7EAC7E589A0}
SP: Norton Internet Security *Enabled/Updated* {631E4324-D31C-783F-EC5C-35AD42B18466}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Public\Samsung_Universal_Print_Driver_V2.03.01.00_36.exe
E:\install.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-05-15 bis 2014-06-15 ))))))))))))))))))))))))))))))
.
.
2014-06-15 08:52 . 2014-06-15 08:52 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-06-15 08:23 . 2014-06-15 08:23 9310 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\TEXTBOX.JS
2014-06-15 08:23 . 2014-06-15 08:23 8646 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\TILEBOX.JS
2014-06-15 08:23 . 2014-06-15 08:23 8613 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\SAVEDUSER.JS
2014-06-15 08:23 . 2014-06-15 08:23 6429 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\UICORE.JS
2014-06-15 08:23 . 2014-06-15 08:23 63115 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\USERTILE.JS
2014-06-15 08:23 . 2014-06-15 08:23 5927 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\TEXT.JS
2014-06-15 08:23 . 2014-06-15 08:23 4599 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\UIRESOURCE.JS
2014-06-15 08:23 . 2014-06-15 08:23 1651 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\QUERYSTRING.JS
2014-06-15 08:23 . 2014-06-15 08:23 8288 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\IMAGE.JS
2014-06-15 08:23 . 2014-06-15 08:23 6910 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\NEWUSERCOMM.JS
2014-05-25 07:08 . 2014-05-25 07:08 -------- d-----w- c:\programdata\AMD
2014-05-25 07:08 . 2014-05-25 07:08 -------- d-----w- c:\program files\AMD AVT
2014-05-25 07:08 . 2014-05-25 07:08 -------- d-----w- c:\program files\AMD
2014-05-25 07:07 . 2014-05-25 07:07 -------- d-----w- c:\program files\Common Files\ATI Technologies
2014-05-25 07:07 . 2014-05-25 07:07 -------- d-----w- c:\program files\Microsoft.NET
2014-05-25 07:07 . 2009-11-25 09:47 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2014-05-25 07:07 . 2009-11-25 09:47 49472 ----a-w- c:\windows\system32\netfxperf.dll
2014-05-25 07:07 . 2009-11-25 09:47 297808 ----a-w- c:\windows\system32\mscoree.dll
2014-05-25 07:07 . 2009-11-25 09:47 295264 ----a-w- c:\windows\system32\PresentationHost.exe
2014-05-25 07:07 . 2009-11-25 09:47 1130824 ----a-w- c:\windows\system32\dfshim.dll
2014-05-25 07:06 . 2014-05-25 07:06 -------- d-----w- c:\programdata\Package Cache
2014-05-24 18:33 . 2014-06-08 10:26 -------- d-----w- c:\users\stripcat\AppData\Local\CrashDumps
2014-05-21 17:21 . 2014-06-07 06:25 -------- d-----w- c:\windows\system32\drivers\NIS\1503000.00C
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-06-14 17:36 . 2014-03-30 09:14 142936 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2014-05-14 19:17 . 2012-04-11 17:36 692400 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-05-14 19:17 . 2011-09-11 11:03 70832 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2014-04-18 02:43 . 2014-04-18 02:43 71704 ----a-w- c:\windows\system32\atimpc32.dll
2014-04-18 02:43 . 2014-04-18 02:43 71704 ----a-w- c:\windows\system32\amdpcom32.dll
2014-04-18 02:42 . 2014-04-18 02:42 126336 ----a-w- c:\windows\system32\atiuxpag.dll
2014-04-18 02:42 . 2014-04-18 02:42 99520 ----a-w- c:\windows\system32\atiu9pag.dll
2014-04-18 02:42 . 2014-04-18 02:42 1117184 ----a-w- c:\windows\system32\aticfx32.dll
2014-04-18 02:42 . 2014-04-18 02:42 8866928 ----a-w- c:\windows\system32\atidxx32.dll
2014-04-18 02:42 . 2014-04-18 02:42 6796592 ----a-w- c:\windows\system32\atiumdva.dll
2014-04-18 02:42 . 2014-04-18 02:42 6799688 ----a-w- c:\windows\system32\atiumdag.dll
2014-04-18 02:39 . 2014-04-18 02:39 247520 ----a-w- c:\windows\system32\drivers\amdacpksd.sys
2014-04-18 02:35 . 2014-04-18 02:35 13515264 ----a-w- c:\windows\system32\drivers\atikmdag.sys
2014-04-18 02:23 . 2014-04-18 02:23 200704 ----a-w- c:\windows\system32\clinfo.exe
2014-04-18 02:22 . 2014-04-18 02:22 995342 ----a-w- c:\windows\system32\amdocl_as32.exe
2014-04-18 02:22 . 2014-04-18 02:22 798734 ----a-w- c:\windows\system32\amdocl_ld32.exe
2014-04-18 02:22 . 2014-04-18 02:22 83456 ----a-w- c:\windows\system32\OpenVideo.dll
2014-04-18 02:22 . 2014-04-18 02:22 73216 ----a-w- c:\windows\system32\OVDecode.dll
2014-04-18 02:19 . 2014-04-18 02:19 24107520 ----a-w- c:\windows\system32\amdocl.dll
2014-04-18 02:17 . 2014-04-18 02:17 58880 ----a-w- c:\windows\system32\OpenCL.dll
2014-04-18 02:13 . 2014-04-18 02:13 113664 ----a-w- c:\windows\system32\mantle32.dll
2014-04-18 01:58 . 2014-04-18 01:58 4358656 ----a-w- c:\windows\system32\amdmantle32.dll
2014-04-18 01:51 . 2014-04-18 01:51 23409152 ----a-w- c:\windows\system32\atioglxx.dll
2014-04-18 01:46 . 2014-04-18 01:46 368128 ----a-w- c:\windows\system32\atiapfxx.exe
2014-04-18 01:46 . 2014-04-18 01:46 52224 ----a-w- c:\windows\system32\aticalrt.dll
2014-04-18 01:46 . 2014-04-18 01:46 49152 ----a-w- c:\windows\system32\aticalcl.dll
2014-04-18 01:45 . 2014-04-18 01:45 85504 ----a-w- c:\windows\system32\mantleaxl32.dll
2014-04-18 01:42 . 2014-04-18 01:42 14302208 ----a-w- c:\windows\system32\aticaldd.dll
2014-04-18 01:33 . 2014-04-18 01:33 37888 ----a-w- c:\windows\system32\amdmmcl.dll
2014-04-18 01:30 . 2014-04-18 01:30 442368 ----a-w- c:\windows\system32\atidemgy.dll
2014-04-18 01:29 . 2014-04-18 01:29 30720 ----a-w- c:\windows\system32\atimuixx.dll
2014-04-18 01:29 . 2014-04-18 01:29 491520 ----a-w- c:\windows\system32\atieclxx.exe
2014-04-18 01:29 . 2014-04-18 01:29 208896 ----a-w- c:\windows\system32\atiesrxx.exe
2014-04-18 01:28 . 2014-04-18 01:28 164352 ----a-w- c:\windows\system32\atitmmxx.dll
2014-04-18 01:21 . 2014-04-18 01:21 616960 ----a-w- c:\windows\system32\coinst_14.100.dll
2014-04-18 01:08 . 2014-04-18 01:08 848896 ----a-w- c:\windows\system32\atiadlxx.dll
2014-04-18 01:07 . 2014-04-18 01:07 69632 ----a-w- c:\windows\system32\atiglpxx.dll
2014-04-18 01:07 . 2014-04-18 01:07 133632 ----a-w- c:\windows\system32\atigktxx.dll
2014-04-18 01:06 . 2014-04-18 01:06 512000 ----a-w- c:\windows\system32\drivers\atikmpag.sys
2014-04-18 01:04 . 2014-04-18 01:04 43520 ----a-w- c:\windows\system32\drivers\ati2erec.dll
2014-04-17 20:28 . 2014-04-17 20:28 38912 ----a-w- c:\windows\system32\kdbsdk32.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Akamai NetSession Interface"="c:\users\stripcat\AppData\Local\Akamai\netsession_win.exe" [2014-04-17 4672920]
"Raptr"="c:\progra~1\Raptr\raptrstub.exe" [2014-05-14 55360]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]
"Samsung PanelMgr"="c:\windows\Samsung\PanelMgr\ssmmgr.exe" [2009-12-09 606208]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-30 59280]
"iTunesHelper"="e:\programme\iTunesHelper.exe" [2012-06-07 421776]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\x86\CLIStart.exe" [2014-04-17 748256]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"*TampMon"="c:\program files\Norton Family\Engine\2.9.5.39\tampmon.exe" [2014-06-02 61792]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Norton Download Manager{NF29539-PROD-FSD3202}"="c:\program files\Norton Internet Security\Engine\21.3.0.12\NIS.exe" [2014-05-11 276376]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys [2012-07-20 12400]
R3 s0016bus;Sony Ericsson Device 0016 driver (WDM);c:\windows\system32\DRIVERS\s0016bus.sys [2008-05-16 89256]
R3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s0016mdfl.sys [2008-05-16 15016]
R3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s0016mdm.sys [2008-05-16 120744]
R3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s0016mgmt.sys [2008-05-16 114216]
R3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS);c:\windows\system32\DRIVERS\s0016nd5.sys [2008-05-16 25512]
R3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s0016obex.sys [2008-05-16 110632]
R3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM);c:\windows\system32\DRIVERS\s0016unic.sys [2008-05-16 115752]
R3 Samsung UPD Service2;Samsung UPD Service2;c:\windows\System32\SUPDSvc2.exe [2011-12-02 136784]
R3 Sony PC Companion;Sony PC Companion;c:\program files\Sony\Sony PC Companion\PCCService.exe [2012-01-18 155320]
R3 SYMRDR_{78CA3BF0-9C3B-40e1-B46D-38C877EF059A};Symantec Redirector - Norton Family;c:\windows\system32\drivers\NSM\0209050.027\SymRdrS.SYS [2014-02-18 203992]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NIS\1503000.00C\SYMDS.SYS [2013-10-30 367704]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1503000.00C\SYMEFA.SYS [2014-03-04 936152]
S1 BHDrvx86;BHDrvx86;c:\program files\Norton Internet Security\NortonData\21.2.0.38\Definitions\BASHDefs\20140606.001\BHDrvx86.sys [2014-05-10 1101616]
S1 ccSet_NIS;NIS Settings Manager;c:\windows\system32\drivers\NIS\1503000.00C\ccSetx86.sys [2014-02-25 127064]
S1 ccSet_NSM;Norton Family Settings Manager;c:\windows\system32\drivers\NSM\0209050.027\ccSetx86.sys [2013-09-27 127064]
S1 IDSVix86;IDSVix86;c:\program files\Norton Internet Security\NortonData\21.2.0.38\Definitions\IPSDefs\20140613.001\IDSvix86.sys [2014-03-28 395992]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NIS\1503000.00C\Ironx86.SYS [2013-10-30 206936]
S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\NIS\1503000.00C\SYMNETS.SYS [2014-02-18 447704]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2014-04-18 208896]
S2 NIS;Norton Internet Security;c:\program files\Norton Internet Security\Engine\21.3.0.12\NIS.exe [2014-05-11 276376]
S2 NSM;Norton Family;c:\program files\Norton Family\Engine\2.9.5.39\NF.exe [2014-06-02 570944]
S2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys [2007-08-13 5120]
S2 UsbClientService;UsbClientService;c:\program files\Synology\Assistant\UsbClientService.exe [2013-01-25 248704]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [2013-12-19 77824]
S3 busenum;Synology Virtual USB Hub;c:\windows\system32\DRIVERS\busenum.sys [2012-08-03 45792]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2014-06-14 109872]
S3 RTL8167;Realtek 8167 NT-Treiber;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - ERASERUTILREBOOTDRV
.
Inhalt des "geplante Tasks" Ordners
.
2014-06-14 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-11 19:17]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = about:blank
mStart Page = about:blank
uInternet Settings,ProxyOverride = *.local;<local>
IE: Free YouTube to MP3 Converter - c:\users\stripcat\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
Trusted Zone: samsungsetup.com\www
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\stripcat\AppData\Roaming\Mozilla\Firefox\Profiles\rz4mmn7m.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.2.9&q=
FF - prefs.js: browser.search.selectedEngine - Ask Search
FF - prefs.js: browser.startup.homepage - about:home
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKCU-Run-Sony PC Companion - c:\program files\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe
HKCU-Run-LightScribe Control Panel - c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\NIS]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\21.3.0.12\NIS.exe\" /s \"NIS\" /m \"c:\program files\Norton Internet Security\Engine\21.3.0.12\diMaster.dll\" /prefetch:1"
--
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\NSM]
"ImagePath"="\"c:\program files\Norton Family\Engine\2.9.5.39\NF.exe\" /s \"NSM\" /m \"c:\program files\Norton Family\Engine\2.9.5.39\diMaster.dll\" /prefetch:1"
"ImagePath"="\SystemRoot\System32\Drivers\NIS\1503000.00C\SYMNETS.SYS"
"TrustedImagePaths"="c:\program files\Norton Internet Security\Engine\21.3.0.12"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-06-15 10:54:08
ComboFix-quarantined-files.txt 2014-06-15 08:54
.
Vor Suchlauf: 7.212.662.784 Bytes frei
Nach Suchlauf: 8.023.031.808 Bytes frei
.
- - End Of File - - D13EC293AAA15D0B3C4CB721083758D7
A36C5E4F47E84449FF07ED3517B43A31 |
|
15.06.2014, 19:17
| #4 |
| /// the machine /// TB-Ausbilder | Windows 7, PayPal Phishing Mail. Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
16.06.2014, 20:12
| #5 |
| | Windows 7, PayPal Phishing Mail. Nabend, habe alle Programme wie beschrieben ausgeführt. Bei dem letzten sollte ich vorher meine Schutzsoftwsare ausmachen, hab bei Norton die Intelligente Firewall und Anitvirus-Auto-Protect ausgemacht, ich hoffe das war das gemeinte, hab sonst nichts mit beenden gefunden. Malwarebytes Anti-Malware www.malwarebytes.org Protection, 16.06.2014 20:39:36, SYSTEM, STRIPCAT-PC, Protection, Malware Protection, Starting, Protection, 16.06.2014 20:39:36, SYSTEM, STRIPCAT-PC, Protection, Malware Protection, Started, Protection, 16.06.2014 20:39:36, SYSTEM, STRIPCAT-PC, Protection, Malicious Website Protection, Starting, Protection, 16.06.2014 20:39:42, SYSTEM, STRIPCAT-PC, Protection, Malicious Website Protection, Started, Update, 16.06.2014 20:39:46, SYSTEM, STRIPCAT-PC, Manual, Rootkit Database, 2014.2.20.1, 2014.6.2.1, Update, 16.06.2014 20:40:04, SYSTEM, STRIPCAT-PC, Manual, Malware Database, 2014.3.4.9, 2014.6.16.7, Protection, 16.06.2014 20:40:06, SYSTEM, STRIPCAT-PC, Protection, Refresh, Starting, Protection, 16.06.2014 20:40:06, SYSTEM, STRIPCAT-PC, Protection, Malicious Website Protection, Stopping, Protection, 16.06.2014 20:40:06, SYSTEM, STRIPCAT-PC, Protection, Malicious Website Protection, Stopped, Protection, 16.06.2014 20:40:10, SYSTEM, STRIPCAT-PC, Protection, Refresh, Success, Protection, 16.06.2014 20:40:10, SYSTEM, STRIPCAT-PC, Protection, Malicious Website Protection, Starting, Protection, 16.06.2014 20:40:11, SYSTEM, STRIPCAT-PC, Protection, Malicious Website Protection, Started, Protection, 16.06.2014 20:46:33, SYSTEM, STRIPCAT-PC, Protection, Malware Protection, Starting, Protection, 16.06.2014 20:46:33, SYSTEM, STRIPCAT-PC, Protection, Malware Protection, Started, Protection, 16.06.2014 20:46:33, SYSTEM, STRIPCAT-PC, Protection, Malicious Website Protection, Starting, Protection, 16.06.2014 20:46:38, SYSTEM, STRIPCAT-PC, Protection, Malicious Website Protection, Started, (end) AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v3.212 - Bericht erstellt am 16/06/2014 um 20:51:03
# Aktualisiert 05/06/2014 von Xplode
# Betriebssystem : Windows 7 Ultimate (32 bits)
# Benutzername : stripcat - STRIPCAT-PC
# Gestartet von : C:\Users\stripcat\Desktop\Neuer Ordner\adwcleaner_3.212.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\apn
Ordner Gelöscht : C:\Program Files\Common Files\DVDVideoSoft\TB
Ordner Gelöscht : C:\Users\stripcat\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\stripcat\AppData\Roaming\Mozilla\Firefox\Profiles\rz4mmn7m.default\ICQToolbarData
Datei Gelöscht : C:\Users\stripcat\AppData\Roaming\Mozilla\Firefox\Profiles\rz4mmn7m.default\searchplugins\ask-search.xml
Datei Gelöscht : C:\Users\stripcat\AppData\Roaming\Mozilla\Firefox\Profiles\rz4mmn7m.default\searchplugins\icqplugin.xml
Datei Gelöscht : C:\Users\stripcat\AppData\Roaming\Mozilla\Firefox\Profiles\rz4mmn7m.default\searchplugins\icqplugin-1.xml
Datei Gelöscht : C:\Users\stripcat\AppData\Roaming\Mozilla\Firefox\Profiles\rz4mmn7m.default\searchplugins\icqplugin-2.xml
Datei Gelöscht : C:\Users\stripcat\AppData\Roaming\Mozilla\Firefox\Profiles\rz4mmn7m.default\searchplugins\icqplugin-3.xml
Datei Gelöscht : C:\Users\stripcat\AppData\Roaming\Mozilla\Firefox\Profiles\rz4mmn7m.default\searchplugins\icqplugin-4.xml
Datei Gelöscht : C:\Users\stripcat\AppData\Roaming\Mozilla\Firefox\Profiles\rz4mmn7m.default\searchplugins\icqplugin-5.xml
Datei Gelöscht : C:\Users\stripcat\AppData\Roaming\Mozilla\Firefox\Profiles\rz4mmn7m.default\searchplugins\icqplugin-6.xml
Datei Gelöscht : C:\Users\stripcat\AppData\Roaming\Mozilla\Firefox\Profiles\rz4mmn7m.default\searchplugins\icqplugin-7.xml
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1EC9510D-A439-4950-9399-B6399EDF9EA7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ApnSetup_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ApnSetup_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BundleSweetIMSetup_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BundleSweetIMSetup_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\sweetimsetup_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\sweetimsetup_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C007DADD-132A-624C-088E-59EE6CF0711F}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}
***** [ Browser ] *****
-\\ Internet Explorer v8.0.7600.16385
-\\ Mozilla Firefox v29.0.1 (de)
[ Datei : C:\Users\stripcat\AppData\Roaming\Mozilla\Firefox\Profiles\rz4mmn7m.default\prefs.js ]
Zeile gelöscht : user_pref("browser.search.defaulturl", "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.2.9&q=");
Zeile gelöscht : user_pref("extensions.APN_TB.first-previous-keyword-url", "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.6&q=");
Zeile gelöscht : user_pref("extensions.CME-V7.previous-keyword-url", "\"hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.6&q=\"");
Zeile gelöscht : user_pref("icqtoolbar.allowSendURL", false);
Zeile gelöscht : user_pref("icqtoolbar.engineVerified", false);
Zeile gelöscht : user_pref("icqtoolbar.geolastmodified", 1321784063);
Zeile gelöscht : user_pref("icqtoolbar.hiddenElements", "itb_options");
Zeile gelöscht : user_pref("icqtoolbar.history", "pfingsten%20f%C3%BCr%20zwei%20alte%20leute||h%C3%A4nsel||Sophies%20Freunde%20Webseite||videol||studentin%2019%20sucht||h%C3%A4nsel%20und%20gretel||hxxp%3A%2F%2Fwww.rpr[...]
Zeile gelöscht : user_pref("icqtoolbar.hpChange", true);
Zeile gelöscht : user_pref("icqtoolbar.icqgeo", 49);
Zeile gelöscht : user_pref("icqtoolbar.installTime", "1320673096");
Zeile gelöscht : user_pref("icqtoolbar.installsource", "1");
Zeile gelöscht : user_pref("icqtoolbar.newtab_state", "1");
Zeile gelöscht : user_pref("icqtoolbar.numberOfSearches", 0);
Zeile gelöscht : user_pref("icqtoolbar.previousFFVersion", "7.0.1");
Zeile gelöscht : user_pref("icqtoolbar.skip_default_search", "no");
Zeile gelöscht : user_pref("icqtoolbar.suggestions", false);
Zeile gelöscht : user_pref("icqtoolbar.uniqueID", "130615002813062359711306529650997");
Zeile gelöscht : user_pref("icqtoolbar.usageStatstTimestamp", 1321988000);
Zeile gelöscht : user_pref("icqtoolbar.userHpApproved", true);
Zeile gelöscht : user_pref("icqtoolbar.version", "1.3.6");
Zeile gelöscht : user_pref("icqtoolbar.voucherHideClicks", 0);
Zeile gelöscht : user_pref("icqtoolbar.voucherMoreLinkClicks", 0);
Zeile gelöscht : user_pref("icqtoolbar.voucherRedeemClicks", 0);
Zeile gelöscht : user_pref("icqtoolbar.voucherWasShown", 0);
Zeile gelöscht : user_pref("icqtoolbar.xmlEnableHomePageDsGuard", false);
Zeile gelöscht : user_pref("icqtoolbar.xmlEnableSuggestions", false);
Zeile gelöscht : user_pref("icqtoolbar.xmlLanguage", "de");
*************************
AdwCleaner[R0].txt - [5276 octets] - [16/06/2014 20:50:22]
AdwCleaner[S0].txt - [5201 octets] - [16/06/2014 20:51:03]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [5261 octets] ##########
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 6.1.3 (03.23.2014:1) OS: Windows 7 Ultimate x86 Ran by stripcat on 16.06.2014 at 20:58:26,87 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys ~~~ Files ~~~ Folders ~~~ FireFox Emptied folder: C:\Users\stripcat\AppData\Roaming\mozilla\firefox\profiles\rz4mmn7m.default\minidumps [174 files] ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 16.06.2014 at 21:01:32,20 Computer was rebooted End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:16-06-2014 Ran by stripcat (administrator) on STRIPCAT-PC on 16-06-2014 21:02:48 Running from C:\Users\stripcat\Desktop\Neuer Ordner Platform: Microsoft Windows 7 Ultimate (X86) OS Language: German Standard Internet Explorer Version 8 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (AMD) C:\Windows\System32\atiesrxx.exe (AMD) C:\Windows\System32\atieclxx.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Malwarebytes Corporation) E:\Programme\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) E:\Programme\ Malwarebytes Anti-Malware \mbamservice.exe (Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\21.3.0.12\nis.exe (Symantec Corporation) C:\Program Files\Norton Family\Engine\2.9.5.39\NF.exe (Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\21.3.0.12\nis.exe () C:\Program Files\Synology\Assistant\UsbClientService.exe (Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Symantec Corporation) C:\Program Files\Norton Family\Engine\2.9.5.39\NF.exe (Malwarebytes Corporation) E:\Programme\ Malwarebytes Anti-Malware \mbam.exe (Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE (Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe () C:\Windows\Samsung\PanelMgr\SSMMgr.exe (Apple Inc.) E:\Programme\iTunesHelper.exe (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe (Akamai Technologies, Inc.) C:\Users\stripcat\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc.) C:\Users\stripcat\AppData\Local\Akamai\netsession_win.exe (Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Raptr, Inc) C:\Program Files\Raptr\raptr.exe (Raptr, Inc) C:\Program Files\Raptr\raptr_im.exe (Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [946352 2012-12-03] (Adobe Systems Incorporated) HKLM\...\Run: [Samsung PanelMgr] => C:\Windows\Samsung\PanelMgr\ssmmgr.exe [606208 2009-12-09] () HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-05-30] (Apple Inc.) HKLM\...\Run: [iTunesHelper] => E:\Programme\iTunesHelper.exe [421776 2012-06-07] (Apple Inc.) HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\x86\CLIStart.exe [748256 2014-04-17] (Advanced Micro Devices, Inc.) HKLM\...\RunOnce: [*TampMon] - C:\Program Files\Norton Family\Engine\2.9.5.39\TampMon.exe [61792 2014-06-02] (Symantec Corporation) HKU\.DEFAULT\...\Run: [Norton Download Manager{NF29539-PROD-FSD3202}] => C:\Program Files\Norton Internet Security\Engine\21.3.0.12\NIS.exe [276376 2014-05-11] (Symantec Corporation) HKU\S-1-5-21-4289696554-3133879028-2902408677-1001\...\Run: [Akamai NetSession Interface] => C:\Users\stripcat\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.) HKU\S-1-5-21-4289696554-3133879028-2902408677-1001\...\Run: [Raptr] => C:\Program Files\Raptr\raptrstub.exe [55360 2014-05-15] (Raptr, Inc) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank SearchScopes: HKLM - DefaultScope value is missing. BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\21.3.0.12\coIEPlg.dll (Symantec Corporation) BHO: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\21.3.0.12\IPS\IPSBHO.DLL (Symantec Corporation) BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO: Norton Family BHO - {B8E07826-0971-4f16-B133-047B88034E89} - C:\Program Files\Norton Family\Engine\2.9.5.39\coIEPlg.dll (Symantec Corporation) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\21.3.0.12\coIEPlg.dll (Symantec Corporation) Toolbar: HKCU - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\21.3.0.12\coIEPlg.dll (Symantec Corporation) DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\stripcat\AppData\Roaming\Mozilla\Firefox\Profiles\rz4mmn7m.default FF DefaultSearchEngine: Ask Search FF SearchEngineOrder.1: Ask Search FF SelectedSearchEngine: Ask Search FF Homepage: about:home FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_13_0_0_214.dll () FF Plugin: @Apple.com/iTunes,version=1.0 - E:\Programme\Mozilla Plugins\npitunes.dll () FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF Plugin: @SonyCreativeSoftware.com/Media Go,version=1.0 - C:\Program Files\Sony\Media Go\npmediago.dll (Sony Network Entertainment International LLC) FF Plugin: @videolan.org/vlc,version=1.1.11 - C:\Program Files\VideoLAN\VLC\npvlc.dll (the VideoLAN Team) FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\stripcat\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF SearchPlugin: C:\Users\stripcat\AppData\Roaming\Mozilla\Firefox\Profiles\rz4mmn7m.default\searchplugins\searchplugins-backup FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: Microsoft .NET Framework Assistant - C:\Users\stripcat\AppData\Roaming\Mozilla\Firefox\Profiles\rz4mmn7m.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2011-09-11] FF Extension: Updated Ad Blocker for Firefox 11+ - C:\Users\stripcat\AppData\Roaming\Mozilla\Firefox\Profiles\rz4mmn7m.default\Extensions\{4DC70064-89E2-4a55-8FC6-E8CDEAE3618C}.xpi [2013-05-31] FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\stripcat\AppData\Roaming\Mozilla\Firefox\Profiles\rz4mmn7m.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi [2012-11-20] FF HKLM\...\Firefox\Extensions: [virtualKeyboard@kaspersky.ru] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\virtualKeyboard@kaspersky.ru FF HKLM\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.2.0.38\IPSFF FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.2.0.38\IPSFF [2014-03-30] FF HKLM\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.2.0.38\coFFPlgn\ FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.2.0.38\coFFPlgn\ [] FF HKLM\...\Firefox\Extensions: [{6D5C8FC4-DE46-41bf-9092-93F0F78E9115}] - C:\ProgramData\Norton\{78CA3BF0-9C3B-40e1-B46D-38C877EF059A}\NSM_2.9.5.39\coFFFw\ FF Extension: Norton Family - C:\ProgramData\Norton\{78CA3BF0-9C3B-40e1-B46D-38C877EF059A}\NSM_2.9.5.39\coFFFw\ [] ========================== Services (Whitelisted) ================= R2 MBAMScheduler; E:\Programme\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) R2 MBAMService; E:\Programme\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation) R2 NIS; C:\Program Files\Norton Internet Security\Engine\21.3.0.12\NIS.exe [276376 2014-05-11] (Symantec Corporation) R2 NSM; C:\Program Files\Norton Family\Engine\2.9.5.39\NF.exe [570944 2014-06-02] (Symantec Corporation) S3 Samsung UPD Service2; C:\Windows\System32\SUPDSvc2.exe [136784 2011-12-02] (Samsung Electronics) S3 Sony PC Companion; C:\Program Files\Sony\Sony PC Companion\PCCService.exe [155320 2012-01-18] (Avanquest Software) [File not signed] R2 UsbClientService; C:\Program Files\Synology\Assistant\UsbClientService.exe [248704 2013-01-25] () [File not signed] ==================== Drivers (Whitelisted) ==================== R1 BHDrvx86; C:\Program Files\Norton Internet Security\NortonData\21.2.0.38\Definitions\BASHDefs\20140606.001\BHDrvx86.sys [1101616 2014-05-10] (Symantec Corporation) R3 busenum; C:\Windows\System32\DRIVERS\busenum.sys [45792 2012-08-03] (Windows (R) Win 7 DDK provider) R1 ccSet_NIS; C:\Windows\system32\drivers\NIS\1503000.00C\ccSetx86.sys [127064 2014-02-25] (Symantec Corporation) R1 ccSet_NSM; C:\Windows\system32\drivers\NSM\0209050.027\ccSetx86.sys [127064 2013-09-27] (Symantec Corporation) R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [377648 2014-06-14] (Symantec Corporation) R3 EraserUtilRebootDrv; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [109872 2014-06-14] (Symantec Corporation) R1 IDSVix86; C:\Program Files\Norton Internet Security\NortonData\21.2.0.38\Definitions\IPSDefs\20140613.001\IDSvix86.sys [395992 2014-03-28] (Symantec Corporation) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-06-16] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-05-12] (Malwarebytes Corporation) S3 NAVENG; C:\Program Files\Norton Internet Security\NortonData\21.2.0.38\Definitions\VirusDefs\20140614.001\NAVENG.SYS [93272 2014-03-29] (Symantec Corporation) S3 NAVEX15; C:\Program Files\Norton Internet Security\NortonData\21.2.0.38\Definitions\VirusDefs\20140614.001\NAVEX15.SYS [1612376 2014-03-29] (Symantec Corporation) S3 s0016bus; C:\Windows\System32\DRIVERS\s0016bus.sys [89256 2008-05-16] (MCCI Corporation) S3 s0016mdfl; C:\Windows\System32\DRIVERS\s0016mdfl.sys [15016 2008-05-16] (MCCI Corporation) S3 s0016mdm; C:\Windows\System32\DRIVERS\s0016mdm.sys [120744 2008-05-16] (MCCI Corporation) S3 s0016mgmt; C:\Windows\System32\DRIVERS\s0016mgmt.sys [114216 2008-05-16] (MCCI Corporation) S3 s0016nd5; C:\Windows\System32\DRIVERS\s0016nd5.sys [25512 2008-05-16] (MCCI Corporation) S3 s0016obex; C:\Windows\System32\DRIVERS\s0016obex.sys [110632 2008-05-16] (MCCI Corporation) S3 s0016unic; C:\Windows\System32\DRIVERS\s0016unic.sys [115752 2008-05-16] (MCCI Corporation) S3 SRTSP; C:\Windows\System32\Drivers\NIS\1503000.00C\SRTSP.SYS [664280 2014-02-13] (Symantec Corporation) R1 SRTSPX; C:\Windows\system32\drivers\NIS\1503000.00C\SRTSPX.SYS [32344 2013-10-30] (Symantec Corporation) R2 SSPORT; C:\Windows\system32\Drivers\SSPORT.sys [5120 2007-08-13] (Samsung Electronics) [File not signed] R0 SymDS; C:\Windows\System32\drivers\NIS\1503000.00C\SYMDS.SYS [367704 2013-10-30] (Symantec Corporation) R0 SymEFA; C:\Windows\System32\drivers\NIS\1503000.00C\SYMEFA.SYS [936152 2014-03-04] (Symantec Corporation) R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [142936 2014-06-14] (Symantec Corporation) R1 SymIRON; C:\Windows\system32\drivers\NIS\1503000.00C\Ironx86.SYS [206936 2013-10-30] (Symantec Corporation) R1 SymNetS; C:\Windows\System32\Drivers\NIS\1503000.00C\SYMNETS.SYS [447704 2014-02-18] (Symantec Corporation) S3 SYMRDR_{78CA3BF0-9C3B-40e1-B46D-38C877EF059A}; C:\Windows\system32\drivers\NSM\0209050.027\SymRdrS.SYS [203992 2014-02-18] (Symantec Corporation) S3 catchme; \??\C:\Users\stripcat\AppData\Local\Temp\catchme.sys [X] S2 DgiVecp; \??\C:\Windows\system32\Drivers\DgiVecp.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-06-16 21:01 - 2014-06-16 21:01 - 00000783 _____ () C:\Users\stripcat\Desktop\JRT.txt 2014-06-16 20:56 - 2014-06-16 20:56 - 01016261 _____ (Thisisu) C:\Users\stripcat\Downloads\JRT.exe 2014-06-16 20:56 - 2014-06-16 20:56 - 00000000 ____D () C:\Windows\ERUNT 2014-06-16 20:54 - 2014-06-16 20:51 - 00005341 _____ () C:\Users\stripcat\Desktop\AdwCleaner[S0].txt 2014-06-16 20:50 - 2014-06-16 20:51 - 00000000 ____D () C:\AdwCleaner 2014-06-16 20:48 - 2014-06-16 20:48 - 00001689 _____ () C:\Users\stripcat\Desktop\mbam.txt 2014-06-16 20:39 - 2014-06-16 20:58 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-06-16 20:38 - 2014-06-16 20:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-06-16 20:38 - 2014-06-16 20:38 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-06-16 20:38 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-06-16 20:38 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-06-16 20:38 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-06-16 20:37 - 2014-06-16 20:37 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\stripcat\Downloads\mbam-setup-2.0.2.1012.exe 2014-06-15 10:56 - 2014-06-15 10:56 - 00000000 __RSH () C:\MSDOS.SYS 2014-06-15 10:56 - 2014-06-15 10:56 - 00000000 __RSH () C:\IO.SYS 2014-06-15 10:54 - 2014-06-15 10:54 - 00014958 _____ () C:\ComboFix.txt 2014-06-15 10:54 - 2014-06-15 10:54 - 00000000 ____D () C:\Users\Public\AppData\Local\temp 2014-06-15 10:54 - 2014-06-15 10:54 - 00000000 ____D () C:\Users\dub_cm_auto\AppData\Local\temp 2014-06-15 10:54 - 2014-06-15 10:54 - 00000000 ____D () C:\Users\Default\AppData\Local\temp 2014-06-15 10:54 - 2014-06-15 10:54 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp 2014-06-15 10:45 - 2014-06-15 10:54 - 00000000 ____D () C:\ComboFix 2014-06-15 10:45 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe 2014-06-15 10:45 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe 2014-06-15 10:45 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2014-06-15 10:45 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2014-06-15 10:45 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2014-06-15 10:45 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe 2014-06-15 10:45 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe 2014-06-15 10:45 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe 2014-06-15 10:44 - 2014-06-15 10:54 - 00000000 ____D () C:\Qoobox 2014-06-15 10:44 - 2014-06-15 10:53 - 00000000 ____D () C:\Windows\erdnt 2014-06-14 23:00 - 2014-06-16 21:02 - 00000000 ____D () C:\Users\stripcat\Desktop\Neuer Ordner 2014-06-14 20:28 - 2014-06-16 21:02 - 00000000 ____D () C:\FRST 2014-06-14 19:36 - 2014-06-14 19:36 - 00000000 ____D () C:\Windows\system32\Drivers\NSM 2014-06-14 19:36 - 2014-06-14 19:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Family 2014-06-14 19:36 - 2014-06-14 19:36 - 00000000 ____D () C:\Program Files\Norton Family 2014-05-25 09:18 - 2014-05-25 09:18 - 00000000 ____D () C:\ProgramData\ATI 2014-05-25 09:09 - 2014-05-25 09:09 - 00000000 ____D () C:\Users\stripcat\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AMD Gaming Evolved 2014-05-25 09:08 - 2014-06-16 20:58 - 00000000 ____D () C:\Users\stripcat\AppData\Roaming\Raptr 2014-05-25 09:08 - 2014-05-25 09:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center 2014-05-25 09:08 - 2014-05-25 09:08 - 00000000 ____D () C:\ProgramData\AMD 2014-05-25 09:08 - 2014-05-25 09:08 - 00000000 ____D () C:\Program Files\AMD AVT 2014-05-25 09:08 - 2014-05-25 09:08 - 00000000 ____D () C:\Program Files\AMD 2014-05-25 09:07 - 2014-05-25 09:07 - 00000000 ____D () C:\Program Files\Microsoft.NET 2014-05-25 09:07 - 2014-05-25 09:07 - 00000000 ____D () C:\Program Files\Common Files\ATI Technologies 2014-05-25 09:07 - 2009-11-25 11:47 - 01130824 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll 2014-05-25 09:07 - 2009-11-25 11:47 - 00297808 _____ (Microsoft Corporation) C:\Windows\system32\mscoree.dll 2014-05-25 09:07 - 2009-11-25 11:47 - 00295264 _____ (Microsoft Corporation) C:\Windows\system32\PresentationHost.exe 2014-05-25 09:07 - 2009-11-25 11:47 - 00099176 _____ (Microsoft Corporation) C:\Windows\system32\PresentationHostProxy.dll 2014-05-25 09:07 - 2009-11-25 11:47 - 00049472 _____ (Microsoft Corporation) C:\Windows\system32\netfxperf.dll 2014-05-25 09:06 - 2014-05-25 09:06 - 00000000 ____D () C:\ProgramData\Package Cache 2014-05-24 20:33 - 2014-06-08 12:26 - 00000000 ____D () C:\Users\stripcat\AppData\Local\CrashDumps ==================== One Month Modified Files and Folders ======= 2014-06-16 21:03 - 2011-09-11 11:40 - 00000000 ____D () C:\Users\stripcat\AppData\Local\Temp 2014-06-16 21:02 - 2014-06-14 23:00 - 00000000 ____D () C:\Users\stripcat\Desktop\Neuer Ordner 2014-06-16 21:02 - 2014-06-14 20:28 - 00000000 ____D () C:\FRST 2014-06-16 21:02 - 2011-09-11 11:38 - 01647128 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-06-16 21:01 - 2014-06-16 21:01 - 00000783 _____ () C:\Users\stripcat\Desktop\JRT.txt 2014-06-16 20:58 - 2014-06-16 20:39 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-06-16 20:58 - 2014-05-25 09:08 - 00000000 ____D () C:\Users\stripcat\AppData\Roaming\Raptr 2014-06-16 20:57 - 2011-09-11 11:40 - 01591576 _____ () C:\Windows\WindowsUpdate.log 2014-06-16 20:57 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-06-16 20:57 - 2009-07-14 06:39 - 00069497 _____ () C:\Windows\setupact.log 2014-06-16 20:57 - 2009-07-14 06:34 - 00016944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-06-16 20:57 - 2009-07-14 06:34 - 00016944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-06-16 20:56 - 2014-06-16 20:56 - 01016261 _____ (Thisisu) C:\Users\stripcat\Downloads\JRT.exe 2014-06-16 20:56 - 2014-06-16 20:56 - 00000000 ____D () C:\Windows\ERUNT 2014-06-16 20:52 - 2012-06-20 18:44 - 00016352 _____ () C:\Windows\PFRO.log 2014-06-16 20:51 - 2014-06-16 20:54 - 00005341 _____ () C:\Users\stripcat\Desktop\AdwCleaner[S0].txt 2014-06-16 20:51 - 2014-06-16 20:50 - 00000000 ____D () C:\AdwCleaner 2014-06-16 20:48 - 2014-06-16 20:48 - 00001689 _____ () C:\Users\stripcat\Desktop\mbam.txt 2014-06-16 20:38 - 2014-06-16 20:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-06-16 20:38 - 2014-06-16 20:38 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-06-16 20:37 - 2014-06-16 20:37 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\stripcat\Downloads\mbam-setup-2.0.2.1012.exe 2014-06-15 19:17 - 2012-04-11 19:36 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-06-15 18:18 - 2014-02-28 19:56 - 00000000 ____D () C:\Users\stripcat\AppData\Roaming\Awesomium 2014-06-15 11:21 - 2014-01-12 23:58 - 00000000 ____D () C:\Program Files\Raptr 2014-06-15 10:56 - 2014-06-15 10:56 - 00000000 __RSH () C:\MSDOS.SYS 2014-06-15 10:56 - 2014-06-15 10:56 - 00000000 __RSH () C:\IO.SYS 2014-06-15 10:54 - 2014-06-15 10:54 - 00014958 _____ () C:\ComboFix.txt 2014-06-15 10:54 - 2014-06-15 10:54 - 00000000 ____D () C:\Users\Public\AppData\Local\temp 2014-06-15 10:54 - 2014-06-15 10:54 - 00000000 ____D () C:\Users\dub_cm_auto\AppData\Local\temp 2014-06-15 10:54 - 2014-06-15 10:54 - 00000000 ____D () C:\Users\Default\AppData\Local\temp 2014-06-15 10:54 - 2014-06-15 10:54 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp 2014-06-15 10:54 - 2014-06-15 10:45 - 00000000 ____D () C:\ComboFix 2014-06-15 10:54 - 2014-06-15 10:44 - 00000000 ____D () C:\Qoobox 2014-06-15 10:54 - 2014-04-23 17:33 - 00000000 ____D () C:\Users\dub_cm_auto 2014-06-15 10:54 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public 2014-06-15 10:53 - 2014-06-15 10:44 - 00000000 ____D () C:\Windows\erdnt 2014-06-15 10:52 - 2009-07-14 04:04 - 00000215 _____ () C:\Windows\system.ini 2014-06-14 23:00 - 2014-05-06 19:51 - 00000000 ____D () C:\Users\stripcat\AppData\Local\Albelli Fotobücher 2014-06-14 21:04 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\NDF 2014-06-14 19:36 - 2014-06-14 19:36 - 00000000 ____D () C:\Windows\system32\Drivers\NSM 2014-06-14 19:36 - 2014-06-14 19:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Family 2014-06-14 19:36 - 2014-06-14 19:36 - 00000000 ____D () C:\Program Files\Norton Family 2014-06-14 19:36 - 2014-03-30 11:14 - 00142936 _____ (Symantec Corporation) C:\Windows\system32\Drivers\SYMEVENT.SYS 2014-06-14 19:36 - 2014-03-30 11:14 - 00008194 _____ () C:\Windows\system32\Drivers\SYMEVENT.CAT 2014-06-14 19:36 - 2014-03-30 11:01 - 00000000 ____D () C:\ProgramData\Norton 2014-06-14 19:35 - 2014-03-30 11:01 - 00000000 ____D () C:\Users\Public\Downloads\Norton 2014-06-08 12:26 - 2014-05-24 20:33 - 00000000 ____D () C:\Users\stripcat\AppData\Local\CrashDumps 2014-05-31 21:45 - 2012-02-16 12:10 - 00001081 _____ () C:\Users\stripcat\Desktop\filme die ich gucken will.txt 2014-05-29 11:29 - 2012-02-03 13:02 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information 2014-05-29 11:27 - 2012-03-04 22:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gameforge 2014-05-29 11:27 - 2012-02-03 14:42 - 00000000 ____D () C:\Program Files\Sony 2014-05-29 11:26 - 2012-12-22 17:37 - 00000000 ____D () C:\Program Files\Common Files\LightScribe 2014-05-29 11:25 - 2011-11-19 18:08 - 00000000 ____D () C:\Windows\system32\appmgmt 2014-05-27 21:52 - 2012-01-15 21:19 - 00000000 ____D () C:\Users\stripcat\AppData\Roaming\TS3Client 2014-05-25 20:28 - 2014-03-30 11:14 - 00002462 _____ () C:\Users\Public\Desktop\Norton Internet Security.lnk 2014-05-25 20:28 - 2014-03-30 11:14 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Internet Security 2014-05-25 20:28 - 2014-03-30 11:14 - 00000000 ____D () C:\Windows\system32\Drivers\NIS 2014-05-25 09:28 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET 2014-05-25 09:18 - 2014-05-25 09:18 - 00000000 ____D () C:\ProgramData\ATI 2014-05-25 09:09 - 2014-05-25 09:09 - 00000000 ____D () C:\Users\stripcat\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AMD Gaming Evolved 2014-05-25 09:08 - 2014-05-25 09:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center 2014-05-25 09:08 - 2014-05-25 09:08 - 00000000 ____D () C:\ProgramData\AMD 2014-05-25 09:08 - 2014-05-25 09:08 - 00000000 ____D () C:\Program Files\AMD AVT 2014-05-25 09:08 - 2014-05-25 09:08 - 00000000 ____D () C:\Program Files\AMD 2014-05-25 09:08 - 2011-09-11 11:59 - 00000000 ____D () C:\Program Files\ATI Technologies 2014-05-25 09:07 - 2014-05-25 09:07 - 00000000 ____D () C:\Program Files\Microsoft.NET 2014-05-25 09:07 - 2014-05-25 09:07 - 00000000 ____D () C:\Program Files\Common Files\ATI Technologies 2014-05-25 09:06 - 2014-05-25 09:06 - 00000000 ____D () C:\ProgramData\Package Cache Some content of TEMP: ==================== C:\Users\stripcat\AppData\Local\Temp\Quarantine.exe ==================== Bamital & volsnap Check ================= C:\Windows\explorer.exe => File is digitally signed C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-06-08 11:00 ==================== End Of Log ============================ --- --- --- Meine Logg Ausbeute.  Ich wollte noch fragen ob Gefahr für den Rechner meines Verlobten besteht, da wir im Netzwerk hängen. Ich wünsche eine angenehme Nachtruhe. |
|
17.06.2014, 09:43
| #6 |
| /// the machine /// TB-Ausbilder | Windows 7, PayPal Phishing Mail. Downloade Dir bitte Malwarebytes Anti-Malware
Downloade Dir bitte AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ --> Windows 7, PayPal Phishing Mail. |
|
18.06.2014, 19:54
| #7 |
| | Windows 7, PayPal Phishing Mail. Nabend, hab wieder alles brav gemacht. AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v3.212 - Bericht erstellt am 18/06/2014 um 20:35:26
# Aktualisiert 05/06/2014 von Xplode
# Betriebssystem : Windows 7 Ultimate (32 bits)
# Benutzername : stripcat - STRIPCAT-PC
# Gestartet von : C:\Users\stripcat\Desktop\Neuer Ordner\adwcleaner_3.212.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
***** [ Browser ] *****
-\\ Internet Explorer v8.0.7600.16385
-\\ Mozilla Firefox v29.0.1 (de)
[ Datei : C:\Users\stripcat\AppData\Roaming\Mozilla\Firefox\Profiles\rz4mmn7m.default\prefs.js ]
*************************
AdwCleaner[R0].txt - [5276 octets] - [16/06/2014 20:50:22]
AdwCleaner[R1].txt - [937 octets] - [18/06/2014 20:32:07]
AdwCleaner[S0].txt - [5341 octets] - [16/06/2014 20:51:03]
AdwCleaner[S1].txt - [859 octets] - [18/06/2014 20:35:26]
########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [918 octets] ##########
Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 18.06.2014 Suchlauf-Zeit: 20:24:13 Logdatei: mbam.txt Administrator: Ja Version: 2.00.2.1012 Malware Datenbank: v2014.06.18.07 Rootkit Datenbank: v2014.06.02.01 Lizenz: Testversion Malware Schutz: Aktiviert Bösartiger Webseiten Schutz: Aktiviert Self-protection: Deaktiviert Betriebssystem: Windows 7 CPU: x86 Dateisystem: NTFS Benutzer: stripcat Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 271648 Verstrichene Zeit: 3 Min, 51 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristics: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 0 (No malicious items detected) Registrierungswerte: 0 (No malicious items detected) Registrierungsdaten: 0 (No malicious items detected) Ordner: 0 (No malicious items detected) Dateien: 0 (No malicious items detected) Physische Sektoren: 0 (No malicious items detected) (end) JRT Logfile: Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.3 (03.23.2014:1)
OS: Windows 7 Ultimate x86
Ran by stripcat on 18.06.2014 at 20:45:37,68
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 18.06.2014 at 20:48:51,86
Computer was rebooted
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:18-06-2014 Ran by stripcat (administrator) on STRIPCAT-PC on 18-06-2014 20:50:06 Running from C:\Users\stripcat\Desktop\Neuer Ordner Platform: Microsoft Windows 7 Ultimate (X86) OS Language: Deutsch (Deutschland) Internet Explorer Version 8 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (AMD) C:\Windows\System32\atiesrxx.exe (AMD) C:\Windows\System32\atieclxx.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Malwarebytes Corporation) E:\Programme\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) E:\Programme\ Malwarebytes Anti-Malware \mbamservice.exe (Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\21.3.0.12\nis.exe (Symantec Corporation) C:\Program Files\Norton Family\Engine\2.9.5.39\NF.exe (Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\21.3.0.12\nis.exe () C:\Program Files\Synology\Assistant\UsbClientService.exe (Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Malwarebytes Corporation) E:\Programme\ Malwarebytes Anti-Malware \mbam.exe (Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE (Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe () C:\Windows\Samsung\PanelMgr\SSMMgr.exe (Apple Inc.) E:\Programme\iTunesHelper.exe (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe (Akamai Technologies, Inc.) C:\Users\stripcat\AppData\Local\Akamai\netsession_win.exe (Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (Akamai Technologies, Inc.) C:\Users\stripcat\AppData\Local\Akamai\netsession_win.exe (ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Raptr, Inc) C:\Program Files\Raptr\raptr.exe (Raptr, Inc) C:\Program Files\Raptr\raptr_im.exe (Symantec Corporation) C:\Program Files\Norton Family\Engine\2.9.5.39\NF.exe (Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [946352 2012-12-03] (Adobe Systems Incorporated) HKLM\...\Run: [Samsung PanelMgr] => C:\Windows\Samsung\PanelMgr\ssmmgr.exe [606208 2009-12-09] () HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-05-30] (Apple Inc.) HKLM\...\Run: [iTunesHelper] => E:\Programme\iTunesHelper.exe [421776 2012-06-07] (Apple Inc.) HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\x86\CLIStart.exe [748256 2014-04-17] (Advanced Micro Devices, Inc.) HKLM\...\RunOnce: [*TampMon] - C:\Program Files\Norton Family\Engine\2.9.5.39\TampMon.exe [61792 2014-06-02] (Symantec Corporation) HKU\.DEFAULT\...\Run: [Norton Download Manager{NF29539-PROD-FSD3202}] => C:\Program Files\Norton Internet Security\Engine\21.3.0.12\NIS.exe [276376 2014-05-11] (Symantec Corporation) HKU\S-1-5-21-4289696554-3133879028-2902408677-1001\...\Run: [Akamai NetSession Interface] => C:\Users\stripcat\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.) HKU\S-1-5-21-4289696554-3133879028-2902408677-1001\...\Run: [Raptr] => C:\Program Files\Raptr\raptrstub.exe [55360 2014-05-15] (Raptr, Inc) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank SearchScopes: HKLM - DefaultScope value is missing. BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\21.3.0.12\coIEPlg.dll (Symantec Corporation) BHO: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\21.3.0.12\IPS\IPSBHO.DLL (Symantec Corporation) BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO: Norton Family BHO - {B8E07826-0971-4f16-B133-047B88034E89} - C:\Program Files\Norton Family\Engine\2.9.5.39\coIEPlg.dll (Symantec Corporation) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\21.3.0.12\coIEPlg.dll (Symantec Corporation) Toolbar: HKCU - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\21.3.0.12\coIEPlg.dll (Symantec Corporation) DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\stripcat\AppData\Roaming\Mozilla\Firefox\Profiles\rz4mmn7m.default FF DefaultSearchEngine: Ask Search FF SearchEngineOrder.1: Ask Search FF SelectedSearchEngine: Ask Search FF Homepage: about:home FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_13_0_0_214.dll () FF Plugin: @Apple.com/iTunes,version=1.0 - E:\Programme\Mozilla Plugins\npitunes.dll () FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF Plugin: @SonyCreativeSoftware.com/Media Go,version=1.0 - C:\Program Files\Sony\Media Go\npmediago.dll (Sony Network Entertainment International LLC) FF Plugin: @videolan.org/vlc,version=1.1.11 - C:\Program Files\VideoLAN\VLC\npvlc.dll (the VideoLAN Team) FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\stripcat\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF SearchPlugin: C:\Users\stripcat\AppData\Roaming\Mozilla\Firefox\Profiles\rz4mmn7m.default\searchplugins\searchplugins-backup FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: Microsoft .NET Framework Assistant - C:\Users\stripcat\AppData\Roaming\Mozilla\Firefox\Profiles\rz4mmn7m.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2011-09-11] FF Extension: Updated Ad Blocker for Firefox 11+ - C:\Users\stripcat\AppData\Roaming\Mozilla\Firefox\Profiles\rz4mmn7m.default\Extensions\{4DC70064-89E2-4a55-8FC6-E8CDEAE3618C}.xpi [2013-05-31] FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\stripcat\AppData\Roaming\Mozilla\Firefox\Profiles\rz4mmn7m.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi [2012-11-20] FF HKLM\...\Firefox\Extensions: [virtualKeyboard@kaspersky.ru] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\virtualKeyboard@kaspersky.ru FF HKLM\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.2.0.38\IPSFF FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.2.0.38\IPSFF [2014-03-30] FF HKLM\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.2.0.38\coFFPlgn\ FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.2.0.38\coFFPlgn\ [] FF HKLM\...\Firefox\Extensions: [{6D5C8FC4-DE46-41bf-9092-93F0F78E9115}] - C:\ProgramData\Norton\{78CA3BF0-9C3B-40e1-B46D-38C877EF059A}\NSM_2.9.5.39\coFFFw\ FF Extension: Norton Family - C:\ProgramData\Norton\{78CA3BF0-9C3B-40e1-B46D-38C877EF059A}\NSM_2.9.5.39\coFFFw\ [] ========================== Services (Whitelisted) ================= R2 MBAMScheduler; E:\Programme\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) R2 MBAMService; E:\Programme\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation) R2 NIS; C:\Program Files\Norton Internet Security\Engine\21.3.0.12\NIS.exe [276376 2014-05-11] (Symantec Corporation) R2 NSM; C:\Program Files\Norton Family\Engine\2.9.5.39\NF.exe [570944 2014-06-02] (Symantec Corporation) S3 Samsung UPD Service2; C:\Windows\System32\SUPDSvc2.exe [136784 2011-12-02] (Samsung Electronics) S3 Sony PC Companion; C:\Program Files\Sony\Sony PC Companion\PCCService.exe [155320 2012-01-18] (Avanquest Software) [File not signed] R2 UsbClientService; C:\Program Files\Synology\Assistant\UsbClientService.exe [248704 2013-01-25] () [File not signed] ==================== Drivers (Whitelisted) ==================== R1 BHDrvx86; C:\Program Files\Norton Internet Security\NortonData\21.2.0.38\Definitions\BASHDefs\20140606.001\BHDrvx86.sys [1101616 2014-05-10] (Symantec Corporation) R3 busenum; C:\Windows\System32\DRIVERS\busenum.sys [45792 2012-08-03] (Windows (R) Win 7 DDK provider) R1 ccSet_NIS; C:\Windows\system32\drivers\NIS\1503000.00C\ccSetx86.sys [127064 2014-02-25] (Symantec Corporation) R1 ccSet_NSM; C:\Windows\system32\drivers\NSM\0209050.027\ccSetx86.sys [127064 2013-09-27] (Symantec Corporation) R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [377648 2014-06-14] (Symantec Corporation) R3 EraserUtilRebootDrv; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [109872 2014-06-14] (Symantec Corporation) R1 IDSVix86; C:\Program Files\Norton Internet Security\NortonData\21.2.0.38\Definitions\IPSDefs\20140613.001\IDSvix86.sys [395992 2014-03-28] (Symantec Corporation) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-06-18] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-05-12] (Malwarebytes Corporation) S3 NAVENG; C:\Program Files\Norton Internet Security\NortonData\21.2.0.38\Definitions\VirusDefs\20140614.001\NAVENG.SYS [93272 2014-03-29] (Symantec Corporation) S3 NAVEX15; C:\Program Files\Norton Internet Security\NortonData\21.2.0.38\Definitions\VirusDefs\20140614.001\NAVEX15.SYS [1612376 2014-03-29] (Symantec Corporation) S3 s0016bus; C:\Windows\System32\DRIVERS\s0016bus.sys [89256 2008-05-16] (MCCI Corporation) S3 s0016mdfl; C:\Windows\System32\DRIVERS\s0016mdfl.sys [15016 2008-05-16] (MCCI Corporation) S3 s0016mdm; C:\Windows\System32\DRIVERS\s0016mdm.sys [120744 2008-05-16] (MCCI Corporation) S3 s0016mgmt; C:\Windows\System32\DRIVERS\s0016mgmt.sys [114216 2008-05-16] (MCCI Corporation) S3 s0016nd5; C:\Windows\System32\DRIVERS\s0016nd5.sys [25512 2008-05-16] (MCCI Corporation) S3 s0016obex; C:\Windows\System32\DRIVERS\s0016obex.sys [110632 2008-05-16] (MCCI Corporation) S3 s0016unic; C:\Windows\System32\DRIVERS\s0016unic.sys [115752 2008-05-16] (MCCI Corporation) S3 SRTSP; C:\Windows\System32\Drivers\NIS\1503000.00C\SRTSP.SYS [664280 2014-02-13] (Symantec Corporation) R1 SRTSPX; C:\Windows\system32\drivers\NIS\1503000.00C\SRTSPX.SYS [32344 2013-10-30] (Symantec Corporation) R2 SSPORT; C:\Windows\system32\Drivers\SSPORT.sys [5120 2007-08-13] (Samsung Electronics) [File not signed] R0 SymDS; C:\Windows\System32\drivers\NIS\1503000.00C\SYMDS.SYS [367704 2013-10-30] (Symantec Corporation) R0 SymEFA; C:\Windows\System32\drivers\NIS\1503000.00C\SYMEFA.SYS [936152 2014-03-04] (Symantec Corporation) R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [142936 2014-06-14] (Symantec Corporation) R1 SymIRON; C:\Windows\system32\drivers\NIS\1503000.00C\Ironx86.SYS [206936 2013-10-30] (Symantec Corporation) R1 SymNetS; C:\Windows\System32\Drivers\NIS\1503000.00C\SYMNETS.SYS [447704 2014-02-18] (Symantec Corporation) S3 SYMRDR_{78CA3BF0-9C3B-40e1-B46D-38C877EF059A}; C:\Windows\system32\drivers\NSM\0209050.027\SymRdrS.SYS [203992 2014-02-18] (Symantec Corporation) S3 catchme; \??\C:\Users\stripcat\AppData\Local\Temp\catchme.sys [X] S2 DgiVecp; \??\C:\Windows\system32\Drivers\DgiVecp.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-06-18 20:48 - 2014-06-18 20:48 - 00000647 _____ () C:\Users\stripcat\Desktop\JRT.txt 2014-06-18 20:38 - 2014-06-18 20:38 - 00000997 _____ () C:\Users\stripcat\Desktop\AdwCleaner[S1].txt 2014-06-18 20:31 - 2014-06-18 20:31 - 00001144 _____ () C:\Users\stripcat\Desktop\mbam.txt 2014-06-16 20:56 - 2014-06-16 20:56 - 00000000 ____D () C:\Windows\ERUNT 2014-06-16 20:50 - 2014-06-18 20:35 - 00000000 ____D () C:\AdwCleaner 2014-06-16 20:39 - 2014-06-18 20:45 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-06-16 20:38 - 2014-06-16 20:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-06-16 20:38 - 2014-06-16 20:38 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-06-16 20:38 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-06-16 20:38 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-06-16 20:38 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-06-16 20:37 - 2014-06-16 20:37 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\stripcat\Downloads\mbam-setup-2.0.2.1012.exe 2014-06-15 10:56 - 2014-06-15 10:56 - 00000000 __RSH () C:\MSDOS.SYS 2014-06-15 10:56 - 2014-06-15 10:56 - 00000000 __RSH () C:\IO.SYS 2014-06-15 10:54 - 2014-06-15 10:54 - 00014958 _____ () C:\ComboFix.txt 2014-06-15 10:45 - 2014-06-15 10:54 - 00000000 ____D () C:\ComboFix 2014-06-15 10:45 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe 2014-06-15 10:45 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe 2014-06-15 10:45 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2014-06-15 10:45 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2014-06-15 10:45 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2014-06-15 10:45 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe 2014-06-15 10:45 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe 2014-06-15 10:45 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe 2014-06-15 10:44 - 2014-06-15 10:54 - 00000000 ____D () C:\Qoobox 2014-06-15 10:44 - 2014-06-15 10:53 - 00000000 ____D () C:\Windows\erdnt 2014-06-14 23:00 - 2014-06-18 20:50 - 00000000 ____D () C:\Users\stripcat\Desktop\Neuer Ordner 2014-06-14 20:28 - 2014-06-18 20:50 - 00000000 ____D () C:\FRST 2014-06-14 19:36 - 2014-06-14 19:36 - 00000000 ____D () C:\Windows\system32\Drivers\NSM 2014-06-14 19:36 - 2014-06-14 19:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Family 2014-06-14 19:36 - 2014-06-14 19:36 - 00000000 ____D () C:\Program Files\Norton Family 2014-05-25 09:18 - 2014-05-25 09:18 - 00000000 ____D () C:\ProgramData\ATI 2014-05-25 09:09 - 2014-05-25 09:09 - 00000000 ____D () C:\Users\stripcat\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AMD Gaming Evolved 2014-05-25 09:08 - 2014-06-18 20:45 - 00000000 ____D () C:\Users\stripcat\AppData\Roaming\Raptr 2014-05-25 09:08 - 2014-05-25 09:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center 2014-05-25 09:08 - 2014-05-25 09:08 - 00000000 ____D () C:\ProgramData\AMD 2014-05-25 09:08 - 2014-05-25 09:08 - 00000000 ____D () C:\Program Files\AMD AVT 2014-05-25 09:08 - 2014-05-25 09:08 - 00000000 ____D () C:\Program Files\AMD 2014-05-25 09:07 - 2014-05-25 09:07 - 00000000 ____D () C:\Program Files\Microsoft.NET 2014-05-25 09:07 - 2014-05-25 09:07 - 00000000 ____D () C:\Program Files\Common Files\ATI Technologies 2014-05-25 09:07 - 2009-11-25 11:47 - 01130824 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll 2014-05-25 09:07 - 2009-11-25 11:47 - 00297808 _____ (Microsoft Corporation) C:\Windows\system32\mscoree.dll 2014-05-25 09:07 - 2009-11-25 11:47 - 00295264 _____ (Microsoft Corporation) C:\Windows\system32\PresentationHost.exe 2014-05-25 09:07 - 2009-11-25 11:47 - 00099176 _____ (Microsoft Corporation) C:\Windows\system32\PresentationHostProxy.dll 2014-05-25 09:07 - 2009-11-25 11:47 - 00049472 _____ (Microsoft Corporation) C:\Windows\system32\netfxperf.dll 2014-05-25 09:06 - 2014-05-25 09:06 - 00000000 ____D () C:\ProgramData\Package Cache 2014-05-24 20:33 - 2014-06-08 12:26 - 00000000 ____D () C:\Users\stripcat\AppData\Local\CrashDumps ==================== One Month Modified Files and Folders ======= 2014-06-18 20:50 - 2014-06-14 23:00 - 00000000 ____D () C:\Users\stripcat\Desktop\Neuer Ordner 2014-06-18 20:50 - 2014-06-14 20:28 - 00000000 ____D () C:\FRST 2014-06-18 20:50 - 2011-09-11 11:38 - 01647128 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-06-18 20:48 - 2014-06-18 20:48 - 00000647 _____ () C:\Users\stripcat\Desktop\JRT.txt 2014-06-18 20:45 - 2014-06-16 20:39 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-06-18 20:45 - 2014-05-25 09:08 - 00000000 ____D () C:\Users\stripcat\AppData\Roaming\Raptr 2014-06-18 20:45 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-06-18 20:45 - 2009-07-14 06:39 - 00069777 _____ () C:\Windows\setupact.log 2014-06-18 20:44 - 2011-09-11 11:40 - 01711835 _____ () C:\Windows\WindowsUpdate.log 2014-06-18 20:44 - 2009-07-14 06:34 - 00016944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-06-18 20:44 - 2009-07-14 06:34 - 00016944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-06-18 20:38 - 2014-06-18 20:38 - 00000997 _____ () C:\Users\stripcat\Desktop\AdwCleaner[S1].txt 2014-06-18 20:36 - 2012-06-20 18:44 - 00016662 _____ () C:\Windows\PFRO.log 2014-06-18 20:35 - 2014-06-16 20:50 - 00000000 ____D () C:\AdwCleaner 2014-06-18 20:31 - 2014-06-18 20:31 - 00001144 _____ () C:\Users\stripcat\Desktop\mbam.txt 2014-06-16 20:56 - 2014-06-16 20:56 - 00000000 ____D () C:\Windows\ERUNT 2014-06-16 20:38 - 2014-06-16 20:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-06-16 20:38 - 2014-06-16 20:38 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-06-16 20:37 - 2014-06-16 20:37 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\stripcat\Downloads\mbam-setup-2.0.2.1012.exe 2014-06-15 19:17 - 2012-04-11 19:36 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-06-15 18:18 - 2014-02-28 19:56 - 00000000 ____D () C:\Users\stripcat\AppData\Roaming\Awesomium 2014-06-15 11:21 - 2014-01-12 23:58 - 00000000 ____D () C:\Program Files\Raptr 2014-06-15 10:56 - 2014-06-15 10:56 - 00000000 __RSH () C:\MSDOS.SYS 2014-06-15 10:56 - 2014-06-15 10:56 - 00000000 __RSH () C:\IO.SYS 2014-06-15 10:54 - 2014-06-15 10:54 - 00014958 _____ () C:\ComboFix.txt 2014-06-15 10:54 - 2014-06-15 10:45 - 00000000 ____D () C:\ComboFix 2014-06-15 10:54 - 2014-06-15 10:44 - 00000000 ____D () C:\Qoobox 2014-06-15 10:54 - 2014-04-23 17:33 - 00000000 ____D () C:\Users\dub_cm_auto 2014-06-15 10:54 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public 2014-06-15 10:53 - 2014-06-15 10:44 - 00000000 ____D () C:\Windows\erdnt 2014-06-15 10:52 - 2009-07-14 04:04 - 00000215 _____ () C:\Windows\system.ini 2014-06-14 23:00 - 2014-05-06 19:51 - 00000000 ____D () C:\Users\stripcat\AppData\Local\Albelli Fotobücher 2014-06-14 21:04 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\NDF 2014-06-14 19:36 - 2014-06-14 19:36 - 00000000 ____D () C:\Windows\system32\Drivers\NSM 2014-06-14 19:36 - 2014-06-14 19:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Family 2014-06-14 19:36 - 2014-06-14 19:36 - 00000000 ____D () C:\Program Files\Norton Family 2014-06-14 19:36 - 2014-03-30 11:14 - 00142936 _____ (Symantec Corporation) C:\Windows\system32\Drivers\SYMEVENT.SYS 2014-06-14 19:36 - 2014-03-30 11:14 - 00008194 _____ () C:\Windows\system32\Drivers\SYMEVENT.CAT 2014-06-14 19:36 - 2014-03-30 11:01 - 00000000 ____D () C:\ProgramData\Norton 2014-06-14 19:35 - 2014-03-30 11:01 - 00000000 ____D () C:\Users\Public\Downloads\Norton 2014-06-08 12:26 - 2014-05-24 20:33 - 00000000 ____D () C:\Users\stripcat\AppData\Local\CrashDumps 2014-05-31 21:45 - 2012-02-16 12:10 - 00001081 _____ () C:\Users\stripcat\Desktop\filme die ich gucken will.txt 2014-05-29 11:29 - 2012-02-03 13:02 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information 2014-05-29 11:27 - 2012-03-04 22:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gameforge 2014-05-29 11:27 - 2012-02-03 14:42 - 00000000 ____D () C:\Program Files\Sony 2014-05-29 11:26 - 2012-12-22 17:37 - 00000000 ____D () C:\Program Files\Common Files\LightScribe 2014-05-29 11:25 - 2011-11-19 18:08 - 00000000 ____D () C:\Windows\system32\appmgmt 2014-05-27 21:52 - 2012-01-15 21:19 - 00000000 ____D () C:\Users\stripcat\AppData\Roaming\TS3Client 2014-05-25 20:28 - 2014-03-30 11:14 - 00002462 _____ () C:\Users\Public\Desktop\Norton Internet Security.lnk 2014-05-25 20:28 - 2014-03-30 11:14 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Internet Security 2014-05-25 20:28 - 2014-03-30 11:14 - 00000000 ____D () C:\Windows\system32\Drivers\NIS 2014-05-25 09:28 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET 2014-05-25 09:18 - 2014-05-25 09:18 - 00000000 ____D () C:\ProgramData\ATI 2014-05-25 09:09 - 2014-05-25 09:09 - 00000000 ____D () C:\Users\stripcat\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AMD Gaming Evolved 2014-05-25 09:08 - 2014-05-25 09:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center 2014-05-25 09:08 - 2014-05-25 09:08 - 00000000 ____D () C:\ProgramData\AMD 2014-05-25 09:08 - 2014-05-25 09:08 - 00000000 ____D () C:\Program Files\AMD AVT 2014-05-25 09:08 - 2014-05-25 09:08 - 00000000 ____D () C:\Program Files\AMD 2014-05-25 09:08 - 2011-09-11 11:59 - 00000000 ____D () C:\Program Files\ATI Technologies 2014-05-25 09:07 - 2014-05-25 09:07 - 00000000 ____D () C:\Program Files\Microsoft.NET 2014-05-25 09:07 - 2014-05-25 09:07 - 00000000 ____D () C:\Program Files\Common Files\ATI Technologies 2014-05-25 09:06 - 2014-05-25 09:06 - 00000000 ____D () C:\ProgramData\Package Cache Some content of TEMP: ==================== C:\Users\stripcat\AppData\Local\Temp\Quarantine.exe ==================== Bamital & volsnap Check ================= C:\Windows\explorer.exe => File is digitally signed C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-06-08 11:00 ==================== End Of Log ============================ --- --- --- |
|
19.06.2014, 16:36
| #8 |
| /// the machine /// TB-Ausbilder | Windows 7, PayPal Phishing Mail.ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
20.06.2014, 19:31
| #9 |
| | Windows 7, PayPal Phishing Mail. Nabend, hab wieder brav meine Hausaufgaben gemacht. Probleme an sich hatte ich eigentlich nicht, hatte halt nur Angst das ich mir was eingefangen hab. Mal sehen wie es weiter geht, mein Elderscrolls Online war kaputt, ging aber mit reparieren wieder, mein Norton hab ich jetzt 3 mal (das Symbol), wenn ich in der Leiste unten rechts den Pfeil klicke, funktioniert aber glaub ich nach wie vor. ESETSmartInstaller@High as downloader log: all ok # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.7587 # api_version=3.0.2 # EOSSerial=0baf9bd64bb07c4ca5c353d50f160d4e # engine=18804 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2014-06-20 05:56:09 # local_time=2014-06-20 07:56:09 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1031 # osver=6.1.7600 NT # compatibility_mode_1='Norton Internet Security' # compatibility_mode=3597 16777213 100 100 439979 165883554 0 0 # compatibility_mode_1='' # compatibility_mode=5893 16776574 100 94 87551777 155725712 0 0 # scanned=335530 # found=2 # cleaned=0 # scan_time=3781 sh=8992F72873D09212597E582A16F8D9BC60E6A22A ft=1 fh=e21391a34e842ffc vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Common Files\DVDVideoSoft\TB\ConduitInstaller.exe.vir" sh=C70872D7B4F48D529A179C0FA54AB65FB1B982F4 ft=1 fh=f2e2b15faf5e28f3 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Windows\Installer\MSI988C.tmp" Results of screen317's Security Check version 0.99.83 Windows 7 x86 (UAC is enabled) Out of date service pack!! ``````````````Antivirus/Firewall Check:`````````````` Norton Internet Security WMI entry may not exist for antivirus; attempting automatic update. `````````Anti-malware/Other Utilities Check:````````` Java(TM) 6 Update 30 Java 7 Update 51 Java version out of Date! Adobe Flash Player 13.0.0.214 Adobe Reader 10.1.6 Adobe Reader out of Date! Mozilla Firefox (30.0) ````````Process Check: objlist.exe by Laurent```````` Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbam.exe Malwarebytes Anti-Malware mbamscheduler.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:20-06-2014 Ran by stripcat (administrator) on STRIPCAT-PC on 20-06-2014 20:31:44 Running from C:\Users\stripcat\Desktop\Neuer Ordner Platform: Microsoft Windows 7 Ultimate (X86) OS Language: Deutsch (Deutschland) Internet Explorer Version 8 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (AMD) C:\Windows\System32\atiesrxx.exe (AMD) C:\Windows\System32\atieclxx.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Malwarebytes Corporation) E:\Programme\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) E:\Programme\ Malwarebytes Anti-Malware \mbamservice.exe (Malwarebytes Corporation) E:\Programme\ Malwarebytes Anti-Malware \mbam.exe (Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\21.3.0.12\nis.exe (Symantec Corporation) C:\Program Files\Norton Family\Engine\2.9.5.39\NF.exe (Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\21.3.0.12\nis.exe () C:\Program Files\Synology\Assistant\UsbClientService.exe (Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Symantec Corporation) C:\Program Files\Norton Family\Engine\2.9.5.39\NF.exe (Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE (Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe () C:\Windows\Samsung\PanelMgr\SSMMgr.exe (Apple Inc.) E:\Programme\iTunesHelper.exe (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe (Akamai Technologies, Inc.) C:\Users\stripcat\AppData\Local\Akamai\netsession_win.exe (Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (Akamai Technologies, Inc.) C:\Users\stripcat\AppData\Local\Akamai\netsession_win.exe (ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Raptr, Inc) C:\Program Files\Raptr\raptr.exe (Raptr, Inc) C:\Program Files\Raptr\raptr_im.exe (Microsoft Corporation) C:\Windows\System32\wuauclt.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe (Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe (Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [946352 2012-12-03] (Adobe Systems Incorporated) HKLM\...\Run: [Samsung PanelMgr] => C:\Windows\Samsung\PanelMgr\ssmmgr.exe [606208 2009-12-09] () HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-05-30] (Apple Inc.) HKLM\...\Run: [iTunesHelper] => E:\Programme\iTunesHelper.exe [421776 2012-06-07] (Apple Inc.) HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\x86\CLIStart.exe [748256 2014-04-17] (Advanced Micro Devices, Inc.) HKLM\...\RunOnce: [*TampMon] - C:\Program Files\Norton Family\Engine\2.9.5.39\TampMon.exe [61792 2014-06-02] (Symantec Corporation) HKU\.DEFAULT\...\Run: [Norton Download Manager{NF29539-PROD-FSD3202}] => C:\Program Files\Norton Internet Security\Engine\21.3.0.12\NIS.exe [276376 2014-05-11] (Symantec Corporation) HKU\S-1-5-21-4289696554-3133879028-2902408677-1001\...\Run: [Akamai NetSession Interface] => C:\Users\stripcat\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.) HKU\S-1-5-21-4289696554-3133879028-2902408677-1001\...\Run: [Raptr] => C:\Program Files\Raptr\raptrstub.exe [55360 2014-05-15] (Raptr, Inc) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank SearchScopes: HKLM - DefaultScope value is missing. BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\21.3.0.12\coIEPlg.dll (Symantec Corporation) BHO: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\21.3.0.12\IPS\IPSBHO.DLL (Symantec Corporation) BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO: Norton Family BHO - {B8E07826-0971-4f16-B133-047B88034E89} - C:\Program Files\Norton Family\Engine\2.9.5.39\coIEPlg.dll (Symantec Corporation) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\21.3.0.12\coIEPlg.dll (Symantec Corporation) Toolbar: HKCU - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\21.3.0.12\coIEPlg.dll (Symantec Corporation) DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\stripcat\AppData\Roaming\Mozilla\Firefox\Profiles\rz4mmn7m.default FF DefaultSearchEngine: Ask Search FF SearchEngineOrder.1: Ask Search FF SelectedSearchEngine: Ask Search FF Homepage: about:home FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_13_0_0_214.dll () FF Plugin: @Apple.com/iTunes,version=1.0 - E:\Programme\Mozilla Plugins\npitunes.dll () FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF Plugin: @SonyCreativeSoftware.com/Media Go,version=1.0 - C:\Program Files\Sony\Media Go\npmediago.dll (Sony Network Entertainment International LLC) FF Plugin: @videolan.org/vlc,version=1.1.11 - C:\Program Files\VideoLAN\VLC\npvlc.dll (the VideoLAN Team) FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\stripcat\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF SearchPlugin: C:\Users\stripcat\AppData\Roaming\Mozilla\Firefox\Profiles\rz4mmn7m.default\searchplugins\searchplugins-backup FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: Microsoft .NET Framework Assistant - C:\Users\stripcat\AppData\Roaming\Mozilla\Firefox\Profiles\rz4mmn7m.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2011-09-11] FF Extension: Updated Ad Blocker for Firefox 11+ - C:\Users\stripcat\AppData\Roaming\Mozilla\Firefox\Profiles\rz4mmn7m.default\Extensions\{4DC70064-89E2-4a55-8FC6-E8CDEAE3618C}.xpi [2013-05-31] FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\stripcat\AppData\Roaming\Mozilla\Firefox\Profiles\rz4mmn7m.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi [2012-11-20] FF HKLM\...\Firefox\Extensions: [virtualKeyboard@kaspersky.ru] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\virtualKeyboard@kaspersky.ru FF HKLM\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.2.0.38\IPSFF FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.2.0.38\IPSFF [2014-03-30] FF HKLM\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.2.0.38\coFFPlgn\ FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.2.0.38\coFFPlgn\ [] FF HKLM\...\Firefox\Extensions: [{6D5C8FC4-DE46-41bf-9092-93F0F78E9115}] - C:\ProgramData\Norton\{78CA3BF0-9C3B-40e1-B46D-38C877EF059A}\NSM_2.9.5.39\coFFFw\ FF Extension: Norton Family - C:\ProgramData\Norton\{78CA3BF0-9C3B-40e1-B46D-38C877EF059A}\NSM_2.9.5.39\coFFFw\ [] ========================== Services (Whitelisted) ================= R2 MBAMScheduler; E:\Programme\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) R2 MBAMService; E:\Programme\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation) R2 NIS; C:\Program Files\Norton Internet Security\Engine\21.3.0.12\NIS.exe [276376 2014-05-11] (Symantec Corporation) R2 NSM; C:\Program Files\Norton Family\Engine\2.9.5.39\NF.exe [570944 2014-06-02] (Symantec Corporation) S3 Samsung UPD Service2; C:\Windows\System32\SUPDSvc2.exe [136784 2011-12-02] (Samsung Electronics) S3 Sony PC Companion; C:\Program Files\Sony\Sony PC Companion\PCCService.exe [155320 2012-01-18] (Avanquest Software) [File not signed] R2 UsbClientService; C:\Program Files\Synology\Assistant\UsbClientService.exe [248704 2013-01-25] () [File not signed] ==================== Drivers (Whitelisted) ==================== R1 BHDrvx86; C:\Program Files\Norton Internet Security\NortonData\21.2.0.38\Definitions\BASHDefs\20140606.001\BHDrvx86.sys [1101616 2014-05-10] (Symantec Corporation) R3 busenum; C:\Windows\System32\DRIVERS\busenum.sys [45792 2012-08-03] (Windows (R) Win 7 DDK provider) R1 ccSet_NIS; C:\Windows\system32\drivers\NIS\1503000.00C\ccSetx86.sys [127064 2014-02-25] (Symantec Corporation) R1 ccSet_NSM; C:\Windows\system32\drivers\NSM\0209050.027\ccSetx86.sys [127064 2013-09-27] (Symantec Corporation) R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [377648 2014-06-14] (Symantec Corporation) R3 EraserUtilRebootDrv; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [109872 2014-06-14] (Symantec Corporation) R1 IDSVix86; C:\Program Files\Norton Internet Security\NortonData\21.2.0.38\Definitions\IPSDefs\20140619.001\IDSvix86.sys [395992 2014-03-28] (Symantec Corporation) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-06-20] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-05-12] (Malwarebytes Corporation) R3 NAVENG; C:\Program Files\Norton Internet Security\NortonData\21.2.0.38\Definitions\VirusDefs\20140620.002\NAVENG.SYS [93272 2014-03-29] (Symantec Corporation) R3 NAVEX15; C:\Program Files\Norton Internet Security\NortonData\21.2.0.38\Definitions\VirusDefs\20140620.002\NAVEX15.SYS [1612376 2014-03-29] (Symantec Corporation) S3 s0016bus; C:\Windows\System32\DRIVERS\s0016bus.sys [89256 2008-05-16] (MCCI Corporation) S3 s0016mdfl; C:\Windows\System32\DRIVERS\s0016mdfl.sys [15016 2008-05-16] (MCCI Corporation) S3 s0016mdm; C:\Windows\System32\DRIVERS\s0016mdm.sys [120744 2008-05-16] (MCCI Corporation) S3 s0016mgmt; C:\Windows\System32\DRIVERS\s0016mgmt.sys [114216 2008-05-16] (MCCI Corporation) S3 s0016nd5; C:\Windows\System32\DRIVERS\s0016nd5.sys [25512 2008-05-16] (MCCI Corporation) S3 s0016obex; C:\Windows\System32\DRIVERS\s0016obex.sys [110632 2008-05-16] (MCCI Corporation) S3 s0016unic; C:\Windows\System32\DRIVERS\s0016unic.sys [115752 2008-05-16] (MCCI Corporation) R3 SRTSP; C:\Windows\System32\Drivers\NIS\1503000.00C\SRTSP.SYS [664280 2014-02-13] (Symantec Corporation) R1 SRTSPX; C:\Windows\system32\drivers\NIS\1503000.00C\SRTSPX.SYS [32344 2013-10-30] (Symantec Corporation) R2 SSPORT; C:\Windows\system32\Drivers\SSPORT.sys [5120 2007-08-13] (Samsung Electronics) [File not signed] R0 SymDS; C:\Windows\System32\drivers\NIS\1503000.00C\SYMDS.SYS [367704 2013-10-30] (Symantec Corporation) R0 SymEFA; C:\Windows\System32\drivers\NIS\1503000.00C\SYMEFA.SYS [936152 2014-03-04] (Symantec Corporation) R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [142936 2014-06-14] (Symantec Corporation) R1 SymIRON; C:\Windows\system32\drivers\NIS\1503000.00C\Ironx86.SYS [206936 2013-10-30] (Symantec Corporation) R1 SymNetS; C:\Windows\System32\Drivers\NIS\1503000.00C\SYMNETS.SYS [447704 2014-02-18] (Symantec Corporation) S3 SYMRDR_{78CA3BF0-9C3B-40e1-B46D-38C877EF059A}; C:\Windows\system32\drivers\NSM\0209050.027\SymRdrS.SYS [203992 2014-02-18] (Symantec Corporation) S3 catchme; \??\C:\Users\stripcat\AppData\Local\Temp\catchme.sys [X] S2 DgiVecp; \??\C:\Windows\system32\Drivers\DgiVecp.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-06-20 18:48 - 2014-06-20 18:48 - 00000000 ____D () C:\Program Files\ESET 2014-06-20 18:45 - 2014-06-20 18:45 - 02347384 _____ (ESET) C:\Users\stripcat\Downloads\esetsmartinstaller_deu.exe 2014-06-19 13:38 - 2014-06-19 13:38 - 00000000 ____D () C:\Program Files\Mozilla Firefox 2014-06-16 20:56 - 2014-06-16 20:56 - 00000000 ____D () C:\Windows\ERUNT 2014-06-16 20:50 - 2014-06-18 20:35 - 00000000 ____D () C:\AdwCleaner 2014-06-16 20:39 - 2014-06-20 19:47 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-06-16 20:38 - 2014-06-16 20:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-06-16 20:38 - 2014-06-16 20:38 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-06-16 20:38 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-06-16 20:38 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-06-16 20:38 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-06-16 20:37 - 2014-06-16 20:37 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\stripcat\Downloads\mbam-setup-2.0.2.1012.exe 2014-06-15 10:56 - 2014-06-15 10:56 - 00000000 __RSH () C:\MSDOS.SYS 2014-06-15 10:56 - 2014-06-15 10:56 - 00000000 __RSH () C:\IO.SYS 2014-06-15 10:54 - 2014-06-15 10:54 - 00014958 _____ () C:\ComboFix.txt 2014-06-15 10:45 - 2014-06-15 10:54 - 00000000 ____D () C:\ComboFix 2014-06-15 10:45 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe 2014-06-15 10:45 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe 2014-06-15 10:45 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2014-06-15 10:45 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2014-06-15 10:45 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2014-06-15 10:45 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe 2014-06-15 10:45 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe 2014-06-15 10:45 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe 2014-06-15 10:44 - 2014-06-15 10:54 - 00000000 ____D () C:\Qoobox 2014-06-15 10:44 - 2014-06-15 10:53 - 00000000 ____D () C:\Windows\erdnt 2014-06-14 23:00 - 2014-06-20 20:31 - 00000000 ____D () C:\Users\stripcat\Desktop\Neuer Ordner 2014-06-14 20:28 - 2014-06-20 20:31 - 00000000 ____D () C:\FRST 2014-06-14 19:36 - 2014-06-14 19:36 - 00000000 ____D () C:\Windows\system32\Drivers\NSM 2014-06-14 19:36 - 2014-06-14 19:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Family 2014-06-14 19:36 - 2014-06-14 19:36 - 00000000 ____D () C:\Program Files\Norton Family 2014-05-25 09:18 - 2014-05-25 09:18 - 00000000 ____D () C:\ProgramData\ATI 2014-05-25 09:09 - 2014-05-25 09:09 - 00000000 ____D () C:\Users\stripcat\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AMD Gaming Evolved 2014-05-25 09:08 - 2014-06-20 19:32 - 00000000 ____D () C:\Users\stripcat\AppData\Roaming\Raptr 2014-05-25 09:08 - 2014-05-25 09:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center 2014-05-25 09:08 - 2014-05-25 09:08 - 00000000 ____D () C:\ProgramData\AMD 2014-05-25 09:08 - 2014-05-25 09:08 - 00000000 ____D () C:\Program Files\AMD AVT 2014-05-25 09:08 - 2014-05-25 09:08 - 00000000 ____D () C:\Program Files\AMD 2014-05-25 09:07 - 2014-05-25 09:07 - 00000000 ____D () C:\Program Files\Microsoft.NET 2014-05-25 09:07 - 2014-05-25 09:07 - 00000000 ____D () C:\Program Files\Common Files\ATI Technologies 2014-05-25 09:07 - 2009-11-25 11:47 - 01130824 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll 2014-05-25 09:07 - 2009-11-25 11:47 - 00297808 _____ (Microsoft Corporation) C:\Windows\system32\mscoree.dll 2014-05-25 09:07 - 2009-11-25 11:47 - 00295264 _____ (Microsoft Corporation) C:\Windows\system32\PresentationHost.exe 2014-05-25 09:07 - 2009-11-25 11:47 - 00099176 _____ (Microsoft Corporation) C:\Windows\system32\PresentationHostProxy.dll 2014-05-25 09:07 - 2009-11-25 11:47 - 00049472 _____ (Microsoft Corporation) C:\Windows\system32\netfxperf.dll 2014-05-25 09:06 - 2014-05-25 09:06 - 00000000 ____D () C:\ProgramData\Package Cache 2014-05-24 20:33 - 2014-06-19 13:35 - 00000000 ____D () C:\Users\stripcat\AppData\Local\CrashDumps ==================== One Month Modified Files and Folders ======= 2014-06-20 20:31 - 2014-06-14 23:00 - 00000000 ____D () C:\Users\stripcat\Desktop\Neuer Ordner 2014-06-20 20:31 - 2014-06-14 20:28 - 00000000 ____D () C:\FRST 2014-06-20 20:23 - 2014-01-12 23:58 - 00000000 ____D () C:\Program Files\Raptr 2014-06-20 20:17 - 2012-04-11 19:36 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-06-20 19:47 - 2014-06-16 20:39 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-06-20 19:32 - 2014-05-25 09:08 - 00000000 ____D () C:\Users\stripcat\AppData\Roaming\Raptr 2014-06-20 18:48 - 2014-06-20 18:48 - 00000000 ____D () C:\Program Files\ESET 2014-06-20 18:45 - 2014-06-20 18:45 - 02347384 _____ (ESET) C:\Users\stripcat\Downloads\esetsmartinstaller_deu.exe 2014-06-20 16:20 - 2014-02-09 13:02 - 00000000 ____D () C:\Users\stripcat\AppData\Local\Akamai 2014-06-20 15:39 - 2009-07-14 06:34 - 00016944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-06-20 15:39 - 2009-07-14 06:34 - 00016944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-06-20 15:37 - 2011-09-11 11:38 - 01647128 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-06-20 15:36 - 2011-09-11 11:40 - 01839463 _____ () C:\Windows\WindowsUpdate.log 2014-06-20 15:32 - 2012-05-05 14:31 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service 2014-06-20 15:32 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-06-20 15:32 - 2009-07-14 06:39 - 00069945 _____ () C:\Windows\setupact.log 2014-06-19 13:38 - 2014-06-19 13:38 - 00000000 ____D () C:\Program Files\Mozilla Firefox 2014-06-19 13:35 - 2014-05-24 20:33 - 00000000 ____D () C:\Users\stripcat\AppData\Local\CrashDumps 2014-06-19 13:33 - 2014-02-28 19:56 - 00000000 ____D () C:\Users\stripcat\AppData\Roaming\Awesomium 2014-06-18 20:36 - 2012-06-20 18:44 - 00016662 _____ () C:\Windows\PFRO.log 2014-06-18 20:35 - 2014-06-16 20:50 - 00000000 ____D () C:\AdwCleaner 2014-06-16 20:56 - 2014-06-16 20:56 - 00000000 ____D () C:\Windows\ERUNT 2014-06-16 20:38 - 2014-06-16 20:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-06-16 20:38 - 2014-06-16 20:38 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-06-16 20:37 - 2014-06-16 20:37 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\stripcat\Downloads\mbam-setup-2.0.2.1012.exe 2014-06-15 10:56 - 2014-06-15 10:56 - 00000000 __RSH () C:\MSDOS.SYS 2014-06-15 10:56 - 2014-06-15 10:56 - 00000000 __RSH () C:\IO.SYS 2014-06-15 10:54 - 2014-06-15 10:54 - 00014958 _____ () C:\ComboFix.txt 2014-06-15 10:54 - 2014-06-15 10:45 - 00000000 ____D () C:\ComboFix 2014-06-15 10:54 - 2014-06-15 10:44 - 00000000 ____D () C:\Qoobox 2014-06-15 10:54 - 2014-04-23 17:33 - 00000000 ____D () C:\Users\dub_cm_auto 2014-06-15 10:54 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public 2014-06-15 10:53 - 2014-06-15 10:44 - 00000000 ____D () C:\Windows\erdnt 2014-06-15 10:52 - 2009-07-14 04:04 - 00000215 _____ () C:\Windows\system.ini 2014-06-14 23:00 - 2014-05-06 19:51 - 00000000 ____D () C:\Users\stripcat\AppData\Local\Albelli Fotobücher 2014-06-14 21:04 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\NDF 2014-06-14 19:36 - 2014-06-14 19:36 - 00000000 ____D () C:\Windows\system32\Drivers\NSM 2014-06-14 19:36 - 2014-06-14 19:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Family 2014-06-14 19:36 - 2014-06-14 19:36 - 00000000 ____D () C:\Program Files\Norton Family 2014-06-14 19:36 - 2014-03-30 11:14 - 00142936 _____ (Symantec Corporation) C:\Windows\system32\Drivers\SYMEVENT.SYS 2014-06-14 19:36 - 2014-03-30 11:14 - 00008194 _____ () C:\Windows\system32\Drivers\SYMEVENT.CAT 2014-06-14 19:36 - 2014-03-30 11:01 - 00000000 ____D () C:\ProgramData\Norton 2014-06-14 19:35 - 2014-03-30 11:01 - 00000000 ____D () C:\Users\Public\Downloads\Norton 2014-05-31 21:45 - 2012-02-16 12:10 - 00001081 _____ () C:\Users\stripcat\Desktop\filme die ich gucken will.txt 2014-05-29 11:29 - 2012-02-03 13:02 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information 2014-05-29 11:27 - 2012-03-04 22:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gameforge 2014-05-29 11:27 - 2012-02-03 14:42 - 00000000 ____D () C:\Program Files\Sony 2014-05-29 11:26 - 2012-12-22 17:37 - 00000000 ____D () C:\Program Files\Common Files\LightScribe 2014-05-29 11:25 - 2011-11-19 18:08 - 00000000 ____D () C:\Windows\system32\appmgmt 2014-05-27 21:52 - 2012-01-15 21:19 - 00000000 ____D () C:\Users\stripcat\AppData\Roaming\TS3Client 2014-05-25 20:28 - 2014-03-30 11:14 - 00002462 _____ () C:\Users\Public\Desktop\Norton Internet Security.lnk 2014-05-25 20:28 - 2014-03-30 11:14 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Internet Security 2014-05-25 20:28 - 2014-03-30 11:14 - 00000000 ____D () C:\Windows\system32\Drivers\NIS 2014-05-25 09:28 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET 2014-05-25 09:18 - 2014-05-25 09:18 - 00000000 ____D () C:\ProgramData\ATI 2014-05-25 09:09 - 2014-05-25 09:09 - 00000000 ____D () C:\Users\stripcat\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AMD Gaming Evolved 2014-05-25 09:08 - 2014-05-25 09:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center 2014-05-25 09:08 - 2014-05-25 09:08 - 00000000 ____D () C:\ProgramData\AMD 2014-05-25 09:08 - 2014-05-25 09:08 - 00000000 ____D () C:\Program Files\AMD AVT 2014-05-25 09:08 - 2014-05-25 09:08 - 00000000 ____D () C:\Program Files\AMD 2014-05-25 09:08 - 2011-09-11 11:59 - 00000000 ____D () C:\Program Files\ATI Technologies 2014-05-25 09:07 - 2014-05-25 09:07 - 00000000 ____D () C:\Program Files\Microsoft.NET 2014-05-25 09:07 - 2014-05-25 09:07 - 00000000 ____D () C:\Program Files\Common Files\ATI Technologies 2014-05-25 09:06 - 2014-05-25 09:06 - 00000000 ____D () C:\ProgramData\Package Cache Some content of TEMP: ==================== C:\Users\stripcat\AppData\Local\Temp\Quarantine.exe ==================== Bamital & volsnap Check ================= C:\Windows\explorer.exe => File is digitally signed C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-06-19 13:53 ==================== End Of Log ============================ Als ich FRST startete hatte ich vergessen mein Norten auszumachen, auf einmal war das Programm weg. o.O Was hab ich eigentlich schönes gemacht und wie siehts mit dem Risiko aus das mein Verlobter sich was geholt haben könnte? ^^ |
|
21.06.2014, 20:55
| #10 |
| /// the machine /// TB-Ausbilder | Windows 7, PayPal Phishing Mail. Java und Adobe updaten. Unbedingt WIndows pdaten, da fehlt ein Servicepack. War nur Adware. Ich würd aber Norton weg machen, hat die schlechteste Erkennungsraten von allen. Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop. Schließe nun alle offenen Programme und trenne Dich von dem Internet. Doppelklick auf die TFC.exe und drücke auf Start. Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen. Fertig Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
28.06.2014, 10:46
| #11 |
| | Windows 7, PayPal Phishing Mail. Mahlzeit, entschuldige die verspätete Antwort, war leider auser gefecht gesetz. Hab TFC durchgejagt, Defogger hab ich bei mir nicht gefunden, Combofix ist weg, hab da dann das zum Abschluß bekommen: # DelFix v10.7 - Datei am 28/06/2014 um 11:37:00 erstellt # Aktualisiert am 27/04/2014 von Xplode # Benutzer : stripcat - STRIPCAT-PC # Betriebssystem : Windows 7 Ultimate (32 bits) ~ Aktiviere die Benutzerkontensteuerung ... OK ~ Entferne die Bereinigungsprogramme ... Gelöscht : C:\Qoobox Gelöscht : C:\32788R22FWJFW Gelöscht : C:\Combofix Gelöscht : C:\FRST Gelöscht : C:\AdwCleaner Gelöscht : C:\ComboFix.txt Gelöscht : C:\Users\stripcat\Downloads\esetsmartinstaller_deu.exe Gelöscht : C:\Windows\grep.exe Gelöscht : C:\Windows\PEV.exe Gelöscht : C:\Windows\NIRCMD.exe Gelöscht : C:\Windows\MBR.exe Gelöscht : C:\Windows\SED.exe Gelöscht : C:\Windows\SWREG.exe Gelöscht : C:\Windows\SWSC.exe Gelöscht : C:\Windows\SWXCACLS.exe Gelöscht : C:\Windows\Zip.exe Gelöscht : HKLM\SOFTWARE\OldTimer Tools Gelöscht : HKLM\SOFTWARE\AdwCleaner Gelöscht : HKLM\SOFTWARE\Swearware Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\combofix.exe Gelöscht : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart Gelöscht : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys Gelöscht : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PEVSystemStart Gelöscht : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\procexp90.Sys ~ Erstelle ein Backup der Registrierungsdatenbank ... OK ~ Lösche die Wiederherstellungspunkte ... Gelöscht : RP #206 [Geplanter Prüfpunkt | 06/25/2014 23:02:37] Ein neuer Wiederherstellungspunkt wurde erstellt ! ~ Stelle die Systemeinstellungen wieder her ... OK ########## - EOF - ########## Jetz ist meine Frage ob mein Netzwerk betroffen ist, da mein Verlobter mit drin hängt und ob ich jetzt wieder sauber bin. ^^ Schönen Tag noch. Kiddyba |
|
29.06.2014, 10:51
| #12 |
| /// the machine /// TB-Ausbilder | Windows 7, PayPal Phishing Mail. nein, Netzwerk ist sicher
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
29.06.2014, 12:39
| #13 |
| | Windows 7, PayPal Phishing Mail. Großes Dankeschön für deine Hilfe, werd in Zukunft überlegen wo ich angemeldet bin bevor ich irgentwo drauf klicke. xD Ich wünsche ein ruhiges rest Wochenende. Einzige Frage ich noch hab ist, warum hab ich seit dem jetz 3 Norton Symbole (heißen gleich und sehen gleich aus) in der Leiste unten rechts? LG. Kiddyba |
|
29.06.2014, 12:45
| #14 |
| /// the machine /// TB-Ausbilder | Windows 7, PayPal Phishing Mail. Screenshot davon bitte
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
18.07.2014, 16:32
| #15 |
| | Windows 7, PayPal Phishing Mail. Huhu, sorry das ich erst jetzt antworte. Kannst du mir verraten wie ich ein Screenshot im Windows machen? Hab da leider keine Ahnung von. MfG Kiddy |
|
| Themen zu Windows 7, PayPal Phishing Mail. |
| akamai, askbar, association, bonjour, branding, browser, converter, cursor, defender, desktop, dvdvideosoft ltd., einstellungen, error, firefox, flash player, homepage, installation, karte, kunde, link geklickt, mozilla, mp3, paypal phishing, paypal phising, phishing, problem, registry, security, services.exe, software, svchost.exe, symantec, synology, windows |
WARNUNG an die MITLESER: 
Hybrid-Darstellung
