| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Datei xyz.exe enthielt einen Virus und wurde gelöschtWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
| |
04.01.2015, 11:50
| #1 |
| /// the machine /// TB-Ausbilder    |  Datei xyz.exe enthielt einen Virus und wurde gelöscht jop 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
04.01.2015, 14:24
| #2 |
 | Datei xyz.exe enthielt einen Virus und wurde gelöscht Hallo,
__________________AdwCleaner hat funktioniert: Code:
ATTFilter # AdwCleaner v4.106 - Bericht erstellt am 04/01/2015 um 13:44:20
# Aktualisiert 21/12/2014 von Xplode
# Database : 2014-12-21.4 [Local]
# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Benutzername : Benutzer - TM92D2000
# Gestartet von : C:\Users\Benutzer\Desktop\AdwCleaner_4.106.exe
# Option : Suchen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Datei Gefunden : C:\Windows\system32\conduitEngine.tmp
Ordner Gefunden : C:\ProgramData\Babylon
Ordner Gefunden : C:\Users\Benutzer\AppData\Local\Babylon
Ordner Gefunden : C:\Users\Benutzer\AppData\Local\Conduit
Ordner Gefunden : C:\Users\Benutzer\AppData\LocalLow\Conduit
Ordner Gefunden : C:\Users\Benutzer\AppData\LocalLow\iac
Ordner Gefunden : C:\Users\Benutzer\AppData\Roaming\Babylon
***** [ Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gefunden : HKCU\Software\dfa6abb465881f0c
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\DOMStorage\ask.com
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\ask.com
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{597b1823-7ff0-4cd3-8095-9d8cba514992}
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{76C3C547-AC64-4B72-BD0A-1B570F0F0B54}
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{79A765E1-C399-405B-85AF-466F52E918B0}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\conduitEngine
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{C424171E-592A-415A-9EB1-DFD6D95D3530}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{C424171E-592A-415A-9EB1-DFD6D95D3530}
Schlüssel Gefunden : HKCU\Software\YahooPartnerToolbar
Schlüssel Gefunden : HKLM\SOFTWARE\Babylon
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{C424171E-592A-415A-9EB1-DFD6D95D3530}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Toolbar.CT2529008
Schlüssel Gefunden : HKLM\SOFTWARE\Conduit
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{597b1823-7ff0-4cd3-8095-9d8cba514992}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}
Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{2318C2B1-4965-11D4-9B18-009027A5CD4F}]
Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{C424171E-592A-415A-9EB1-DFD6D95D3530}]
Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{EF99BD32-C1FB-11D2-892F-0090271D4F88}]
Wert Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{C424171E-592A-415A-9EB1-DFD6D95D3530}]
***** [ Browser ] *****
-\\ Internet Explorer v9.0.8112.16502
*************************
AdwCleaner[R0].txt - [3529 octets] - [04/01/2015 13:44:20]
########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [3589 octets] ##########
Code:
ATTFilter # AdwCleaner v4.106 - Bericht erstellt am 04/01/2015 um 13:49:07
# Aktualisiert 21/12/2014 von Xplode
# Database : 2014-12-21.4 [Local]
# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Benutzername : Benutzer - TM92D2000
# Gestartet von : C:\Users\Benutzer\Desktop\AdwCleaner_4.106.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\Users\Benutzer\AppData\Local\Babylon
Ordner Gelöscht : C:\Users\Benutzer\AppData\Local\Conduit
Ordner Gelöscht : C:\Users\Benutzer\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\Benutzer\AppData\LocalLow\iac
Ordner Gelöscht : C:\Users\Benutzer\AppData\Roaming\Babylon
Datei Gelöscht : C:\Windows\system32\conduitEngine.tmp
***** [ Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\DOMStorage\ask.com
Schlüssel Gelöscht : HKCU\Software\dfa6abb465881f0c
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2529008
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{C424171E-592A-415A-9EB1-DFD6D95D3530}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{C424171E-592A-415A-9EB1-DFD6D95D3530}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{C424171E-592A-415A-9EB1-DFD6D95D3530}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{C424171E-592A-415A-9EB1-DFD6D95D3530}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{C424171E-592A-415A-9EB1-DFD6D95D3530}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{2318C2B1-4965-11D4-9B18-009027A5CD4F}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{EF99BD32-C1FB-11D2-892F-0090271D4F88}]
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{597b1823-7ff0-4cd3-8095-9d8cba514992}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{76C3C547-AC64-4B72-BD0A-1B570F0F0B54}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{597b1823-7ff0-4cd3-8095-9d8cba514992}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Babylon
Schlüssel Gelöscht : HKLM\SOFTWARE\Conduit
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{79A765E1-C399-405B-85AF-466F52E918B0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\conduitEngine
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\ask.com
***** [ Browser ] *****
-\\ Internet Explorer v9.0.8112.16502
*************************
AdwCleaner[R0].txt - [3669 octets] - [04/01/2015 13:44:20]
AdwCleaner[S0].txt - [3501 octets] - [04/01/2015 13:49:07]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [3561 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.1 (12.28.2014:1)
OS: Windows Vista (TM) Home Premium x86
Ran by Benutzer on 04.01.2015 at 13:55:53,57
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
Successfully deleted: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\syshost32
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{5AA2BA46-9913-4DC7-9620-69AB0FA17AE7}
~~~ Files
~~~ Folders
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 04.01.2015 at 13:57:58,26
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 02-01-2015
Ran by Benutzer (administrator) on TM92D2000 on 04-01-2015 14:12:49
Running from C:\Users\Benutzer\Desktop
Loaded Profile: Benutzer (Available profiles: Benutzer & Gast)
Platform: Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
(HiTRSUT) C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
(Acer Inc.) C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
(Acer Inc.) C:\Acer\Empowering Technology\eNet\eNet Service.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
() C:\Acer\Mobility Center\MobilityService.exe
() C:\Program Files\CyberLink\Shared Files\RichVideo.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Conexant Systems, Inc.) C:\Windows\System32\drivers\XAudio.exe
(Acer Inc.) C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
() C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
(acer) C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Cyberlink Corp.) C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
(HiTRUST) C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe
(Realtek Semiconductor Corp.) C:\Users\Benutzer\AppData\Local\temp\RtkBtMnt.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\LManager.exe
(Adobe Systems Incorporated) C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Sun Microsystems, Inc.) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(1und1 Mail und Media GmbH) C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck_Broker.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Acer Inc.) C:\Acer\Empowering Technology\eNet\eNMTray.exe
(Acer Inc.) C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
(Acer Inc.) C:\Acer\Empowering Technology\Acer.Empowering.Framework.Supervisor.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Acer Inc.) C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
(Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [4472832 2007-05-29] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [815104 2006-10-23] (Synaptics, Inc.)
HKLM\...\Run: [IAAnotif] => C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe [178712 2007-07-12] (Intel Corporation)
HKLM\...\Run: [RemoteControl] => C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [71216 2007-03-14] (Cyberlink Corp.)
HKLM\...\Run: [LanguageShortcut] => C:\Program Files\CyberLink\PowerDVD\Language\Language.exe [54832 2007-02-07] ()
HKLM\...\Run: [eDataSecurity Loader] => C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe [457216 2007-04-25] (HiTRUST)
HKLM\...\Run: [LManager] => C:\Program Files\Launch Manager\LManager.exe [858632 2007-10-17] (Dritek System Inc.)
HKLM\...\Run: [WarReg_PopUp] => C:\Acer\WR_PopUp\WarReg_PopUp.exe [57344 2006-11-05] (Acer Inc.)
HKLM\...\Run: [Skytel] => C:\Windows\Skytel.exe [1826816 2007-05-29] (Realtek Semiconductor Corp.)
HKLM\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [39792 2008-01-11] (Adobe Systems Incorporated)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [253672 2011-01-07] (Sun Microsystems, Inc.)
HKLM\...\Run: [MailCheck IE Broker] => C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck_Broker.exe [2135104 2014-11-17] (1und1 Mail und Media GmbH)
HKU\S-1-5-21-3684640303-488887037-2534449567-1003\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-18] (Microsoft Corporation)
HKU\S-1-5-21-3684640303-488887037-2534449567-1003\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-18] (Microsoft Corporation)
HKU\S-1-5-21-3684640303-488887037-2534449567-1003\...\Run: [Acer Tour Reminder] => C:\Acer\AcerTour\Reminder.exe [151552 2007-05-22] (Acer Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Empowering Technology Launcher.lnk
ShortcutTarget: Empowering Technology Launcher.lnk -> C:\Acer\Empowering Technology\eAPLauncher.exe (Acer Inc.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-3684640303-488887037-2534449567-1003\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.intl.acer.yahoo.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://global.acer.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3684640303-488887037-2534449567-1003\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKU\S-1-5-21-3684640303-488887037-2534449567-1003\Software\Microsoft\Internet Explorer\Main,SEARCH PAGE = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-3684640303-488887037-2534449567-1003\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-3684640303-488887037-2534449567-1003 -> {017A9D0A-E989-4F86-A351-9D010F72B83B} URL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
SearchScopes: HKU\S-1-5-21-3684640303-488887037-2534449567-1003 -> {09038620-190C-402B-A92F-18864E6AB22F} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKU\S-1-5-21-3684640303-488887037-2534449567-1003 -> {40064957-18EB-412d-9146-3F57E8D92EEC} URL = hxxp://go.web.de/br/ie9_search_pic/?su={searchTerms}
SearchScopes: HKU\S-1-5-21-3684640303-488887037-2534449567-1003 -> {5A817CF6-92D5-4DE5-AC38-82DF8A73EF28} URL = hxxp://go.gmx.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKU\S-1-5-21-3684640303-488887037-2534449567-1003 -> {6B1D1FB7-7233-4F7C-802C-21A1DDB12754} URL = hxxp://go.web.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKU\S-1-5-21-3684640303-488887037-2534449567-1003 -> {8D27B32E-89EE-460e-82D2-5FC354078EAD} URL = hxxp://go.web.de/br/ie9_search_produkte/?su={searchTerms}
SearchScopes: HKU\S-1-5-21-3684640303-488887037-2534449567-1003 -> {DCE59F23-A446-45a5-9459-E68FDC0DE38D} URL = hxxp://go.web.de/br/ie9_search_maps/?su={searchTerms}
SearchScopes: HKU\S-1-5-21-3684640303-488887037-2534449567-1003 -> {E339BBA1-DCF4-4B00-92ED-F309B7D55AA1} URL = hxxp://go.mail.com/tb/en-us/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKU\S-1-5-21-3684640303-488887037-2534449567-1003 -> {F1F2E24C-BC10-4493-9EFA-859AEEBF07FB} URL = hxxp://suche.web.de/search/web/?su={searchTerms}&origin=searchplugin
BHO: Adobe PDF Reader -> {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO: ShowBarObj Class -> {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} -> C:\Windows\system32\ActiveToolBand.dll (HiTRUST)
BHO: WEB.DE MailCheck BHO -> {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} -> C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll (HiTRUST)
DPF: {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} hxxp://quickscan.bitdefender.com/qsax/qsax.cab
Handler: webde - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF Plugin: @java.com/JavaPlugin -> C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2011-02-09]
Chrome:
=======
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S3 BFE; . [0 2015-01-04] () [File not signed]
R2 eDataSecurity Service; C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe [457512 2007-04-25] (HiTRSUT)
R2 eLockService; C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe [24576 2007-04-23] (Acer Inc.) [File not signed]
R2 eNet Service; C:\Acer\Empowering Technology\eNet\eNet Service.exe [135168 2007-06-13] (Acer Inc.) [File not signed]
R2 eRecoveryService; C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe [57344 2007-09-10] (Acer Inc.) [File not signed]
R2 eSettingsService; C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe [24576 2007-06-28] () [File not signed]
R2 LightScribeService; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [61440 2007-01-17] (Hewlett-Packard Company) [File not signed]
R2 MobilityService; C:\Acer\Mobility Center\MobilityService.exe [107008 2006-11-24] () [File not signed]
S3 MpsSvc; . [0 2015-01-04] () [File not signed]
S4 MSSQLServerADHelper; C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [44384 2010-12-10] (Microsoft Corporation)
R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [272024 2007-04-03] ()
R2 WMIService; C:\Acer\Empowering Technology\ePower\ePowerSvc.exe [167936 2007-06-13] (acer) [File not signed]
S2 CLTNetCnService; "c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R3 Cam5607; C:\Windows\System32\Drivers\BisonC07.sys [974248 2007-07-27] (Bison Electronics. Inc. )
R1 FNETDEVI; C:\Windows\system32\drivers\FNETDEVI.SYS [19572 2011-08-12] (FNet Co., Ltd.) [File not signed]
R2 int15; C:\Windows\system32\drivers\int15.sys [76584 2007-03-02] ()
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [114904 2015-01-04] (Malwarebytes Corporation)
R3 NTIDrvr; C:\Windows\System32\DRIVERS\NTIDrvr.sys [6144 2007-07-04] (NewTech Infosystems, Inc.) [File not signed]
R0 PSDFilter; C:\Windows\System32\DRIVERS\psdfilter.sys [20776 2007-04-25] (HiTRUST)
R0 PSDNServ; C:\Windows\System32\drivers\PSDNServ.sys [16680 2007-04-25] (HiTRUST)
R0 psdvdisk; C:\Windows\System32\drivers\psdvdisk.sys [60712 2007-04-25] (HiTRUST)
S3 WSVD; C:\Windows\system32\drivers\WSVD.sys [80744 2006-09-19] (Wasay)
R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B}; C:\Program Files\CyberLink\PowerDVD\000.fcl [13560 2006-11-02] (Cyberlink Corp.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-18] (Microsoft Corporation)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-04 14:08 - 2015-01-04 14:08 - 00000000 ____D () C:\Users\Benutzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD
2015-01-04 13:57 - 2015-01-04 13:57 - 00000901 _____ () C:\Users\Benutzer\Desktop\JRT.txt
2015-01-04 13:55 - 2015-01-04 13:55 - 00000000 ____D () C:\Windows\ERUNT
2015-01-04 13:53 - 2015-01-04 08:33 - 01707939 _____ (Thisisu) C:\Users\Benutzer\Desktop\JRT.exe
2015-01-04 13:44 - 2015-01-04 13:49 - 00000000 ____D () C:\AdwCleaner
2015-01-04 13:43 - 2015-01-04 08:33 - 02173952 _____ () C:\Users\Benutzer\Desktop\AdwCleaner_4.106.exe
2015-01-04 08:37 - 2015-01-04 08:37 - 00000000 ____D () C:\Program Files\Malwarebytes' Anti-Malware
2015-01-04 08:37 - 2015-01-04 08:31 - 07747104 _____ (Malwarebytes Corporation ) C:\Users\Benutzer\Desktop\mbam-rules.exe
2015-01-04 08:09 - 2015-01-04 08:59 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-01-04 08:09 - 2015-01-04 08:09 - 00000903 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-01-04 08:09 - 2015-01-04 08:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-01-04 08:09 - 2015-01-04 08:09 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware
2015-01-04 08:09 - 2014-11-21 06:14 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-01-04 08:09 - 2014-11-21 06:14 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-01-04 08:09 - 2014-11-21 06:14 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-01-04 08:08 - 2015-01-03 23:19 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Benutzer\Downloads\mbam-setup-2.0.4.1028.exe
2015-01-04 00:21 - 2015-01-04 08:37 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-01-04 00:18 - 2015-01-04 00:18 - 00008832 _____ () C:\Users\Benutzer\Desktop\Combofix.txt
2015-01-04 00:10 - 2015-01-04 00:10 - 00008832 _____ () C:\ComboFix.txt
2015-01-03 23:39 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-01-03 23:39 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-01-03 23:39 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-01-03 23:39 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-01-03 23:39 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-01-03 23:39 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2015-01-03 23:39 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2015-01-03 23:39 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2015-01-03 23:37 - 2015-01-04 00:14 - 00000000 ____D () C:\Qoobox
2015-01-03 23:37 - 2015-01-04 00:07 - 00000000 ____D () C:\Windows\erdnt
2015-01-03 23:35 - 2015-01-03 23:14 - 05609858 ____R (Swearware) C:\Users\Benutzer\Desktop\ComboFix.exe
2015-01-03 16:47 - 2015-01-03 16:48 - 00139104 _____ () C:\Windows\Minidump\Mini010315-01.dmp
2015-01-03 14:30 - 2015-01-03 14:31 - 00025174 _____ () C:\Users\Benutzer\Desktop\Addition.txt
2015-01-03 14:28 - 2015-01-04 14:12 - 00014116 _____ () C:\Users\Benutzer\Desktop\FRST.txt
2015-01-03 14:28 - 2015-01-04 14:12 - 00000000 ____D () C:\FRST
2015-01-03 14:27 - 2015-01-03 14:25 - 01115136 _____ (Farbar) C:\Users\Benutzer\Desktop\FRST.exe
2015-01-03 14:00 - 2015-01-03 14:00 - 00000000 ____D () C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD
2015-01-03 14:00 - 2015-01-03 14:00 - 00000000 ____D () C:\Users\Gast\AppData\Roaming\Macromedia
2015-01-03 13:59 - 2015-01-03 13:59 - 00000953 _____ () C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-01-03 13:59 - 2015-01-03 13:59 - 00000948 _____ () C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-01-03 13:59 - 2015-01-03 13:59 - 00000919 _____ () C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk
2015-01-03 13:59 - 2015-01-03 13:59 - 00000020 ___SH () C:\Users\Gast\ntuser.ini
2015-01-03 13:59 - 2015-01-03 13:59 - 00000000 _SHDL () C:\Users\Gast\Startmenü
2015-01-03 13:59 - 2015-01-03 13:59 - 00000000 _SHDL () C:\Users\Gast\Netzwerkumgebung
2015-01-03 13:59 - 2015-01-03 13:59 - 00000000 _SHDL () C:\Users\Gast\Druckumgebung
2015-01-03 13:59 - 2015-01-03 13:59 - 00000000 _SHDL () C:\Users\Gast\Documents\Eigene Musik
2015-01-03 13:59 - 2015-01-03 13:59 - 00000000 _SHDL () C:\Users\Gast\Documents\Eigene Bilder
2015-01-03 13:59 - 2015-01-03 13:59 - 00000000 _SHDL () C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2015-01-03 13:59 - 2015-01-03 13:59 - 00000000 _SHDL () C:\Users\Gast\AppData\Local\Verlauf
2015-01-03 13:59 - 2015-01-03 13:59 - 00000000 ____D () C:\Users\Gast\AppData\Local\VirtualStore
2015-01-03 13:59 - 2015-01-03 13:59 - 00000000 ____D () C:\Users\Gast
2015-01-03 13:59 - 2011-02-09 19:02 - 00000000 ____D () C:\Users\Gast\AppData\Local\Microsoft Help
2015-01-03 13:59 - 2008-06-21 13:03 - 00000000 ___RD () C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2015-01-03 13:59 - 2008-06-21 13:03 - 00000000 ___RD () C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-01-03 13:37 - 2015-01-03 13:40 - 00015730 _____ () C:\Users\Benutzer\Desktop\Rkill.txt
2014-12-23 13:58 - 2015-01-03 08:00 - 00000000 ____D () C:\Windows\pss
2014-12-21 19:27 - 2014-12-21 19:27 - 00000000 ____D () C:\ProgramData\UUdb
2014-12-21 19:27 - 2014-12-21 19:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WEB.DE MailCheck
2014-12-21 19:27 - 2014-12-21 19:27 - 00000000 ____D () C:\ProgramData\1&1 Mail & Media GmbH
2014-12-21 19:27 - 2014-12-21 19:27 - 00000000 ____D () C:\Program Files\WEB.DE MailCheck
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-04 14:12 - 2006-11-02 11:33 - 01592792 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-01-04 14:08 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-04 14:08 - 2006-11-02 13:47 - 00003568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-04 14:08 - 2006-11-02 13:47 - 00003568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-04 14:00 - 2007-12-20 12:25 - 01941177 _____ () C:\Windows\WindowsUpdate.log
2015-01-04 14:00 - 2006-11-02 14:01 - 00032584 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-01-04 13:50 - 2007-07-04 17:22 - 00070436 _____ () C:\Windows\PFRO.log
2015-01-04 00:14 - 2006-11-02 12:18 - 00000000 __RHD () C:\Users\Default
2015-01-04 00:14 - 2006-11-02 12:18 - 00000000 ___RD () C:\Users\Public
2015-01-04 00:01 - 2006-11-02 11:23 - 00000215 _____ () C:\Windows\system.ini
2015-01-03 17:15 - 2013-06-24 19:41 - 00001356 _____ () C:\Users\Benutzer\AppData\Local\d3d9caps.dat
2015-01-03 16:47 - 2013-03-01 23:42 - 111980373 _____ () C:\Windows\MEMORY.DMP
2015-01-03 16:47 - 2013-03-01 23:42 - 00000000 ____D () C:\Windows\Minidump
2014-12-22 11:35 - 2012-10-16 21:20 - 00000000 ____D () C:\Program Files\Google
2014-12-22 11:01 - 2008-06-21 10:56 - 00000000 ____D () C:\Program Files\Yahoo!
2014-12-22 10:56 - 2012-10-16 21:21 - 00000000 ____D () C:\Users\Benutzer\AppData\Local\Google
2014-12-22 10:56 - 2012-10-16 21:20 - 00000000 ____D () C:\ProgramData\Google
2014-12-21 19:27 - 2011-05-14 17:27 - 00000000 ____D () C:\Program Files\1und1Softwareaktualisierung
2014-12-21 19:26 - 2011-05-14 17:27 - 00000000 ____D () C:\ProgramData\1und1InternetExplorerAddon
Some content of TEMP:
====================
C:\Users\Benutzer\AppData\Local\temp\Quarantine.exe
C:\Users\Benutzer\AppData\Local\temp\RtkBtMnt.exe
C:\Users\Benutzer\AppData\Local\temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-01-04 13:58
==================== End Of Log ============================
--- --- --- MfG |
|
| Themen zu Datei xyz.exe enthielt einen Virus und wurde gelöscht |
| abgesicherte, abgesicherten, arbeiten, ausführen, datei, erstellung, gelöscht, gesperrt, home, installiert, logfiles, meldung, modus, probleme, programme, rechner, schei, service, speicher, speichern, speichern unter, system, virus, vista, vista home premium, windows vista |
Hybrid-Darstellung
