| |
| |||||||
Log-Analyse und Auswertung: Win7 Umbenennung Chrome Browser, Installation Continue Live InstallationWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
23.12.2014, 00:26
| #1 |
| |  Win7 Umbenennung Chrome Browser, Installation Continue Live Installation Hallo! Vor zwei Tagen hat sich nach einem Windows Update mein Chrome Browser umbenannt (leider weiß ich nicht mehr wie) und mehrere Programme (youtube-, facebook- und amazon-Verknüpfungen) wurden installiert. Mein Freund hat dieses Problem irgendwie beseitigen können (leider weiß er nicht mehr genau wie). Die Logs meines AVG Virenscanners vom 20.12. poste ich unten als erstes. Heute habe ich das Programm "Continue Live Installation" auf meinem Desktop gefunden und hier in dem Forum bin ich drauf gestoßen, dass das Problem wohl noch längst nicht beseitigt ist... Vielen Dank schon mal im Voraus! Code:
ATTFilter "";"Potenziell unerwünschte Anwendung: Downloader.CBD, C:\Users\Wilhelm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\33C1B628\Setup[2].exe";"Gesichert"
"";"MalSign.MyBackup.940 gefunden, C:\Users\Wilhelm\AppData\Local\Temp\CloudBackup4159.exe";"Gesichert"
"";"MalSign.MyBackup.940 gefunden, C:\Users\Wilhelm\AppData\Local\Temp\CloudBackup1457.exe";"Gesichert"
"";"MalSign.Generic.7D7 gefunden, C:\Users\Wilhelm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\33C1B628\aff_setup[2].exe";"Gesichert"
"";"MalSign.Generic.7D7 gefunden, C:\Users\Wilhelm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\33C1B628\aff_setup[1].exe";"Gesichert"
"";"Beschädigte ausführbare Datei, C:\Users\Wilhelm\AppData\Local\Temp\{CD5DC4C0-E789-44C4-99B6-470E2255B9D4}-34.0.1847.137_34.0.1847.131_chrome_updater.exe";"Gesichert"
"";"Adware: Generic6.CKA, C:\ProgramData\PurpleRain\PurpleRain.exe";"Gesichert"
Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 23:40 on 22/12/2014 (Wilhelm)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 22-12-2014 01
Ran by Wilhelm at 2014-12-22 23:44:24
Running from C:\Users\Wilhelm\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: AVG AntiVirus Free Edition 2015 (Enabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: AVG AntiVirus Free Edition 2015 (Enabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Flash Player 11 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 11.8.800.94 - Adobe Systems Incorporated)
Adobe Reader X (10.1.8) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.8 - Adobe Systems Incorporated)
Apple Application Support (HKLM-x32\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{BDD99690-3541-4619-9D2A-3CDDB3E15F9E}) (Version: 8.0.5.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
AVG 2014 (Version: 14.0.4794 - AVG Technologies) Hidden
AVG 2015 (HKLM\...\AVG) (Version: 2015.0.5645 - AVG Technologies)
AVG 2015 (Version: 15.0.4257 - AVG Technologies) Hidden
AVG 2015 (Version: 15.0.5645 - AVG Technologies) Hidden
AVG Security Toolbar (HKLM-x32\...\AVG Secure Search) (Version: 18.1.9.799 - AVG Technologies)
Benutzerhandbuch (x32 Version: 2.0.0.2 - Lenovo) Hidden
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
CSI - Tödliche Verschwörung (HKLM-x32\...\CSI - Tödliche Verschwörung) (Version: 1.0.0.0 - Ubisoft)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dropbox (HKU\S-1-5-21-2955863073-899098632-722755702-1001\...\Dropbox) (Version: 2.0.22 - Dropbox, Inc.)
DVDFab 8.1.8.5 (24/05/2012) Qt (HKLM-x32\...\DVDFab 8 Qt_is1) (Version: - Fengtao Software Inc.)
ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 14.3.20130522 - Landesfinanzdirektion Thüringen)
Energy Management (HKLM-x32\...\InstallShield_{D0956C11-0F60-43FE-99AD-524E833471BB}) (Version: 6.0.2.8 - Lenovo)
Energy Management (x32 Version: 6.0.2.8 - Lenovo) Hidden
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version: - Seiko Epson Corporation)
EpsonNet Print (HKLM-x32\...\{3E31400D-274E-4647-916C-2CACC3741799}) (Version: 2.5.00 - SEIKO EPSON CORPORATION)
ETDWare PS/2-X64 8.0.4.4_WHQL (HKLM\...\Elantech) (Version: 8.0.4.4 - ELAN Microelectronic Corp.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 39.0.2171.95 - Google Inc.)
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-12-2014 01
Ran by Wilhelm (administrator) on WILHELM-PC on 22-12-2014 23:43:22
Running from C:\Users\Wilhelm\Downloads
Loaded Profile: Wilhelm (Available profiles: Wilhelm)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgrsa.exe
(Egis Technology Inc. ) C:\Program Files (x86)\EgisTec Port Locker\Egishlpsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Fuyu LIMITED) C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\ConversionService.exe
(AVG Secure Search) C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\ToolbarUpdater.exe
() C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\loggingserver.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgemca.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Photosmart 5510d series\Bin\ScanToPCActivationApp.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
(Egis Technology Inc. ) C:\Program Files (x86)\EgisTec Port Locker\EgisPLTSR.exe
(CyberLink) C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net Rootkit scan 2014-12-23 00:01:27 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD32 rev.01.0 298,09GB Running: Gmer-19357.exe; Driver: C:\Users\Wilhelm\AppData\Local\Temp\uwriyfow.sys ---- Kernel code sections - GMER 2.1 ---- INITKDBG C:\windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff800035bc000 45 bytes [00, 00, 53, 02, 50, 72, 6F, ...] INITKDBG C:\windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 575 fffff800035bc02f 16 bytes [00, 02, 00, 00, 00, 00, 00, ...] ---- User code sections - GMER 2.1 ---- .text C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[1588] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075dd1465 2 bytes [DD, 75] .text C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[1588] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075dd14bb 2 bytes [DD, 75] .text ... * 2 .text C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe[1952] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075dd1465 2 bytes [DD, 75] .text C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe[1952] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075dd14bb 2 bytes [DD, 75] .text ... * 2 .text C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\ToolbarUpdater.exe[2156] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075dd1465 2 bytes [DD, 75] .text C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\ToolbarUpdater.exe[2156] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075dd14bb 2 bytes [DD, 75] .text ... * 2 .text C:\Program Files (x86)\AVG Secure Search\vprot.exe[3748] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075dd1465 2 bytes [DD, 75] .text C:\Program Files (x86)\AVG Secure Search\vprot.exe[3748] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075dd14bb 2 bytes [DD, 75] .text ... * 2 .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[3604] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075dd1465 2 bytes [DD, 75] .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[3604] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075dd14bb 2 bytes [DD, 75] .text ... * 2 .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[556] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075dd1465 2 bytes [DD, 75] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[556] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075dd14bb 2 bytes [DD, 75] .text ... * 2 ? C:\windows\system32\mssprxy.dll [556] entry point in ".rdata" section 000000006a1671e6 ---- Processes - GMER 2.1 ---- Process C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe (*** suspicious ***) @ C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [1588] (WindowsProtectManger Service/Fuyu LIMITED)(2014-12-14 19:31:29) 0000000001020000 ---- Registry - GMER 2.1 ---- |
Baum-Darstellung