| |
| |||||||
Log-Analyse und Auswertung: Win 7: Firefox kann wegen Proxy Einstellungen keine Seiten öffnenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
30.09.2014, 12:32
| #1 |
| |  Win 7: Firefox kann wegen Proxy Einstellungen keine Seiten öffnen Hi, Bei mir ist soeben ein Problem wiedergekommen, dass meinen Rechner schonmal vor circa einem Monat plagte: Ich öffnete morgens Firefox und wollte normal surfen, bekam dann aber eine Fehlermeldung, dass Firefox aufgrund der Proxy Einstellungen keine Seiten öffnen könnte. Als ich das Problem das letzte mal hatte, habe ich die Proxy einstellungen deaktiviert und konnte wieder normal surfen, hab dann aber nach 2 Tagen oder so Win7 neu aufgesetzt. Jetzt kam die Problematik wie gesagt ca. einen Monat später auf meinem neu aufgesetzten Windows 7 wieder, das fand ich natürlich sehr unschön und hab flugs meine Platten nochmal formatiert und Windows nochmal neu aufgesetzt. Das heißt, die log Files die jetzt kommen sind von einer jungfräulichen Win7 Edition, alles was ich bisher gemacht habe ist Firefox, meinen Lan Treiber und meine USB 3.0 Treiber zu installieren, so wie die hier empfohlenen Tools zu laden und auszuführen. Das einzige, was ich gestern Abend, als der PC das letzte mal an war, genutzt habe, was anders war waren einige Datein von meiner externen Festplatte (die war an dieser frischen Windows-Installation noch nicht dran!). Es würde mich allerdings wundern, wenn an den Sachen was dran wäre, da die alle selbst erstellt sind, es handelt sich nämlich um Material von meiner Band, also Bilder, die wir selbst gemacht, bzw Kumpels gezeichnet haben, Textdatein die ich mit Libre Office selber geschrieben habe und .mp3s und .wavs die ich wiederrum mit Cubase erstellt habe, wäre also komisch, wenn da eine Infektion drinnen hinge. Die Idee hier zu posten kam mir leider erst nachdem ich den PC schon angefangen hab neu aufzusetzen. Ich hätte sonst noch n AntiVir log und ein Malwarebytes log poaten können, beide Scans waren aber ergebnislos. Naja, hier auf jeden Fall mal die Log-Files: Defogger Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 13:08 on 30/09/2014 (mn5)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-09-2014
Ran by mn5 (administrator) on mn5-PC on 30-09-2014 13:09:17
Running from C:\Users\mn5\Desktop
Loaded Profile: mn5 (Available profiles: mn5)
Platform: Windows 7 Professional (X64) OS Language: English (United States)
Internet Explorer Version 8
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\mn5\AppData\Roaming\Mozilla\Firefox\Profiles\es7o8spf.default
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
Chrome:
=======
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
U3 uwldypow; \??\C:\Users\mn5\AppData\Local\Temp\uwldypow.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-30 21:56 - 2014-09-30 12:53 - 00000000 ____D () C:\Windows\Panther
2014-09-30 13:09 - 2014-09-30 13:09 - 00002631 _____ () C:\Users\mn5\Desktop\FRST.txt
2014-09-30 13:09 - 2014-09-30 13:09 - 00000000 ____D () C:\FRST
2014-09-30 13:08 - 2014-09-30 13:08 - 00000468 _____ () C:\Users\mn5\Downloads\defogger_disable.log
2014-09-30 13:08 - 2014-09-30 13:08 - 00000468 _____ () C:\Users\mn5\Desktop\defogger_disable.log
2014-09-30 13:08 - 2014-09-30 13:08 - 00000000 _____ () C:\Users\mn5\defogger_reenable
2014-09-30 13:08 - 2014-09-30 13:05 - 02108928 _____ (Farbar) C:\Users\mn5\Desktop\FRST64.exe
2014-09-30 13:08 - 2014-09-30 13:05 - 00380416 _____ () C:\Users\mn5\Desktop\Gmer-19357.exe
2014-09-30 13:08 - 2014-09-30 13:05 - 00050477 _____ () C:\Users\mn5\Desktop\Defogger.exe
2014-09-30 13:05 - 2014-09-30 13:05 - 02108928 _____ (Farbar) C:\Users\mn5\Downloads\FRST64.exe
2014-09-30 13:05 - 2014-09-30 13:05 - 00380416 _____ () C:\Users\mn5\Downloads\Gmer-19357.exe
2014-09-30 13:05 - 2014-09-30 13:05 - 00050477 _____ () C:\Users\mn5\Downloads\Defogger.exe
2014-09-30 13:03 - 2014-09-30 13:03 - 00001163 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-09-30 13:03 - 2014-09-30 13:03 - 00001151 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-09-30 13:03 - 2014-09-30 13:03 - 00000000 ____D () C:\Users\mn5\AppData\Roaming\Mozilla
2014-09-30 13:03 - 2014-09-30 13:03 - 00000000 ____D () C:\Users\mn5\AppData\Local\Mozilla
2014-09-30 13:03 - 2014-09-30 13:03 - 00000000 ____D () C:\ProgramData\Mozilla
2014-09-30 13:03 - 2014-09-30 13:03 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-09-30 13:03 - 2014-09-30 13:03 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-30 12:58 - 2014-09-30 12:58 - 00000000 ____D () C:\Program Files (x86)\Realtek
2014-09-30 12:58 - 2011-08-23 21:57 - 00565352 _____ (Realtek ) C:\Windows\system32\Drivers\Rt64win7.sys
2014-09-30 12:58 - 2011-08-23 21:57 - 00107552 _____ (Realtek Semiconductor Corporation) C:\Windows\system32\RTNUninst64.dll
2014-09-30 12:58 - 2011-08-23 21:57 - 00074272 _____ () C:\Windows\system32\RtNicProp64.dll
2014-09-30 12:57 - 2014-09-30 12:58 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-09-30 12:57 - 2014-09-30 12:57 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdFs_01_09_00.Wdf
2014-09-30 12:57 - 2014-09-30 12:57 - 00000000 ____D () C:\ProgramData\Hewlett-Packard
2014-09-30 12:57 - 2014-09-30 12:57 - 00000000 ____D () C:\Program Files (x86)\Etron Technology
2014-09-30 12:53 - 2014-09-30 13:08 - 00000000 ____D () C:\Users\mn5
2014-09-30 12:53 - 2014-09-30 12:53 - 00001447 _____ () C:\Users\mn5\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-09-30 12:53 - 2014-09-30 12:53 - 00001413 _____ () C:\Users\mn5\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
2014-09-30 12:53 - 2014-09-30 12:53 - 00000020 ___SH () C:\Users\mn5\ntuser.ini
2014-09-30 12:53 - 2014-09-30 12:53 - 00000000 __SHD () C:\Recovery
2014-09-30 12:53 - 2014-09-30 12:53 - 00000000 ____D () C:\Users\mn5\AppData\Local\VirtualStore
2014-09-30 12:53 - 2009-07-14 06:54 - 00000000 ___RD () C:\Users\mn5\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-09-30 12:53 - 2009-07-14 06:49 - 00000000 ___RD () C:\Users\mn5\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-09-30 12:52 - 2014-09-30 12:59 - 00020437 _____ () C:\Windows\WindowsUpdate.log
2014-09-30 11:59 - 2014-09-30 11:59 - 00001345 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
2014-09-30 11:59 - 2014-09-30 11:59 - 00001326 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
2014-09-30 11:59 - 2014-09-30 11:59 - 00001313 _____ () C:\Windows\TSSysprep.log
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-30 21:56 - 2009-07-14 07:38 - 00025600 ___SH () C:\Windows\system32\config\BCD-Template.LOG
2014-09-30 21:56 - 2009-07-14 07:32 - 00028672 _____ () C:\Windows\system32\config\BCD-Template
2014-09-30 12:58 - 2009-07-14 07:13 - 00713888 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-30 12:57 - 2009-07-14 06:51 - 00017064 _____ () C:\Windows\setupact.log
2014-09-30 12:56 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\system32\restore
2014-09-30 12:53 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Recovery
2014-09-30 12:53 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-09-30 12:52 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-30 12:52 - 2009-07-14 06:45 - 00013600 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-30 12:52 - 2009-07-14 06:45 - 00013600 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-30 12:00 - 2009-07-14 06:45 - 00274464 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-09-30 11:59 - 2009-07-14 06:46 - 00001774 _____ () C:\Windows\DtcInstall.log
2014-09-30 11:59 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-09-30 11:59 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\sysprep
2014-09-30 11:57 - 2009-07-14 09:46 - 00000000 ____D () C:\Windows\CSC
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-09-30 11:57
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 29-09-2014
Ran by mn5 at 2014-09-30 13:09:34
Running from C:\Users\mn5\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Etron USB3.0 Host Controller (HKLM-x32\...\InstallShield_{DFBB738C-71D8-4DC5-B8D2-D65C37680E27}) (Version: 0.96 - Etron Technology)
Etron USB3.0 Host Controller (x32 Version: 0.96 - Etron Technology) Hidden
Mozilla Firefox 32.0.3 (x86 de) (HKLM-x32\...\Mozilla Firefox 32.0.3 (x86 de)) (Version: 32.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 32.0.3 - Mozilla)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.48.823.2011 - Realtek)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
30-09-2014 10:56:58 Installed Etron USB3.0 Host Controller
30-09-2014 10:58:32 Installiert Realtek Ethernet Controller Driver
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
==================== Loaded Modules (whitelisted) =============
2014-09-30 13:03 - 2014-09-24 07:09 - 03715184 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
========================= Accounts: ==========================
Administrator (S-1-5-21-1724413821-3312833941-2955506347-500 - Administrator - Disabled)
Guest (S-1-5-21-1724413821-3312833941-2955506347-501 - Limited - Disabled)
mn5 (S-1-5-21-1724413821-3312833941-2955506347-1000 - Administrator - Enabled) => C:\Users\mn5
==================== Faulty Device Manager Devices =============
Name: PCI Simple Communications Controller
Description: PCI Simple Communications Controller
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Video Controller
Description: Video Controller
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: SM Bus Controller
Description: SM Bus Controller
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (09/30/2014 00:56:37 PM) (Source: MsiInstaller) (EventID: 1013) (User: mn5-PC)
Description: Product: Etron USB3.0 Host Controller -- This installation cannot be run by directly launching the MSI package. You must run setup.exe.
System errors:
=============
Microsoft Office Sessions:
=========================
Error: (09/30/2014 00:56:37 PM) (Source: MsiInstaller) (EventID: 1013) (User: mn5-PC)
Description: Product: Etron USB3.0 Host Controller -- This installation cannot be run by directly launching the MSI package. You must run setup.exe.(NULL)(NULL)(NULL)(NULL)(NULL)
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i5-2500K CPU @ 3.30GHz
Percentage of memory in use: 14%
Total physical RAM: 8104.67 MB
Available physical RAM: 6921.98 MB
Total Pagefile: 16207.49 MB
Available Pagefile: 15018.95 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:232.79 GB) (Free:211.07 GB) NTFS
Drive e: (treiber) (CDROM) (Total:0.02 GB) (Free:0 GB) UDF
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: 15081508)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=232.8 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 931.5 GB) (Disk ID: EF66118D)
Partition 1: (Not Active) - (Size=931.5 GB) - (Type=06)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-09-30 13:15:35
Windows 6.1.7600 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T1L0-7 SAMSUNG_HD252HJ rev.1AC01112 232,89GB
Running: Gmer-19357.exe; Driver: C:\Users\mn5\AppData\Local\Temp\uwldypow.sys
---- Threads - GMER 2.1 ----
Thread C:\Windows\system32\winlogon.exe [416:480] 000007fefd7fa5e4
Thread C:\Windows\system32\winlogon.exe [416:484] 000007fefd7fa5e4
---- Processes - GMER 2.1 ----
Library C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{24B13F00-DF94-47E2-9C13-E0627AA64A6D}\mpengine.dll (*** suspicious ***) @ C:\Windows\System32\svchost.exe [2200] (Microsoft Malware Protection Engine/Microsoft Corporation)(2014-09-30 11:11:10) 000007feefc40000
---- EOF - GMER 2.1 ----
Wenn sich jetzt nichts ergibt, was eine Infektion auf dem Rechner angeht, bin ich natürlich glücklich, änder meine Passwörter und hoffe, dass der Mist nicht nochmal kommt. Bzw. würde ich dann einmal meine externe anschließen und mich nochmal durch die Band Sachen von gestern Abend durchklicken, um zu sehen ob die gleiche Symptomatik sich dann nochmal ergibt. Vielen Dank auf jeden Fall schonmal. |
| Themen zu Win 7: Firefox kann wegen Proxy Einstellungen keine Seiten öffnen |
| adware, antivir, bccode: 1000009f, browser, cubase, defender, einstellungen, explorer, fehlercode 0x5, fehlercode 28, fehlercode windows, fehlermeldung, festplatte, iexplore.exe, problem, proxy, registry, services.exe, svchost.exe, system, windows, windows xp |
Baum-Darstellung