| |
| |||||||
Log-Analyse und Auswertung: Windows 8.1 frisch installiert und dennoch Malware auf dem RechnerWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
05.04.2015, 19:37
| #1 |
| |  Windows 8.1 frisch installiert und dennoch Malware auf dem Rechner Hallo, ich habe heute mein Betriebssystem von Windows 7 auf Windows 8.1 aktuallisiert, weil das alte Betriebssystem leider voller Malware war. (An dieser stelle, danke an meine kleine Schwester) Bei der Neuinstallation habe ich alle Partitionen formatiert und Windows 8.1 neu installiert, jedoch ist mir aufgefallen, dass gleich beim ersten Start von Windows 8 ca. 10 neue Programme installiert wurden, als ich den Internet Explorer zum ersten mal öffnete um mir den Google Chrome Browser herunter zu laden. Dabei handelte es sich hauptsächlich um Programme die mir haufenweise Werbung öffnen aber auch Programme wie Skype und Opera waren dabei. Inwiefern diese mittlerweile von Windows selbst mitgeliefert bzw. nachträglich installiert werden weiß ich nicht. Ich hoffe dass sich hier jemand findet der sich meine Log files ansehen kann um mir zu helfen. FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015
Ran by Andrej (administrator) on ARBEITSZIMMERPC on 05-04-2015 20:23:15
Running from C:\Users\Andrej\AppData\Local\Microsoft\Windows\INetCache\IE\4FM3BGOB
Loaded Profiles: Andrej (Available profiles: Andrej)
Platform: Windows 8.1 Pro (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
() C:\Users\Andrej\AppData\Local\E423A3A0-1428260358-11D5-A383-50465D8E03F5\insp7214.tmp
() C:\Users\Andrej\AppData\Local\E423A3A0-1428259781-11D5-A383-50465D8E03F5\cnsfA083.tmp
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
() C:\ProgramData\LolliScan\LolliScan.exe
() C:\Users\Andrej\AppData\Roaming\E423A3A0-1428252381-11D5-A383-50465D8E03F5\nswCF19.tmpfs
() C:\Users\Andrej\AppData\Roaming\E423A3A0-1428252381-11D5-A383-50465D8E03F5\jnsfFFB4.tmp
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Blizzard Entertainment) C:\Program Files (x86)\Battle.net\Battle.net.5636\Battle.net.exe
(Blizzard Entertainment) C:\ProgramData\Battle.net\Agent\Agent.3915\Agent.exe
() C:\Users\Andrej\AppData\Local\E423A3A0-1428259781-11D5-A383-50465D8E03F5\ansu9D37.exe
(Microsoft Corporation) C:\Windows\System32\WWAHost.exe
(The Unico Browser Authors) C:\Users\Andrej\AppData\Local\UnicoBrowser\Application\unicobrowser.exe
(The Unico Browser Authors) C:\Users\Andrej\AppData\Local\UnicoBrowser\Application\unicobrowser.exe
(The Unico Browser Authors) C:\Users\Andrej\AppData\Local\UnicoBrowser\Application\unicobrowser.exe
(The Unico Browser Authors) C:\Users\Andrej\AppData\Local\UnicoBrowser\Application\unicobrowser.exe
(The Unico Browser Authors) C:\Users\Andrej\AppData\Local\UnicoBrowser\Application\unicobrowser.exe
(The Unico Browser Authors) C:\Users\Andrej\AppData\Local\UnicoBrowser\Application\unicobrowser.exe
(The Unico Browser Authors) C:\Users\Andrej\AppData\Local\UnicoBrowser\Application\unicobrowser.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Enigma Software Group USA, LLC.) C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe
(Enigma Software Group USA, LLC.) C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter4.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe
() C:\Users\Andrej\AppData\Local\Temp\nsb93A8.tmp
( ) C:\Users\Andrej\AppData\Roaming\E423A3A0-1428252381-11D5-A383-50465D8E03F5\vnsf8CE8.tmp
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM-x32\...\Run: [WinCheck] => C:\Users\Andrej\AppData\Local\E423A3A0-1428259641-11D5-A383-50465D8E03F5\bnsi798B.exe [212480 2015-04-05] ()
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [704512 2015-03-17] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126712 2015-01-19] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-3514346005-4174202986-2708488565-1004\...\Run: [UnicoBrowser] => C:\Users\Andrej\AppData\Local\UnicoBrowser\Application\unicobrowser.exe [1047176 2015-03-18] (The Unico Browser Authors)
Startup: C:\Users\Andrej\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\crossbrowse.lnk
ShortcutTarget: crossbrowse.lnk -> C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\crossbrowse.exe (No File)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.istartsurf.com/?type=hppp&ts=1428252213&from=tugs&uid=SAMSUNGXHD502IJ_S13TJ1BQ701063
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.istartsurf.com/?type=hppp&ts=1428252213&from=tugs&uid=SAMSUNGXHD502IJ_S13TJ1BQ701063
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.istartsurf.com/web/?type=dspp&ts=1428252213&from=tugs&uid=SAMSUNGXHD502IJ_S13TJ1BQ701063&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.istartsurf.com/web/?type=dspp&ts=1428252213&from=tugs&uid=SAMSUNGXHD502IJ_S13TJ1BQ701063&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.istartsurf.com/?type=hppp&ts=1428252213&from=tugs&uid=SAMSUNGXHD502IJ_S13TJ1BQ701063
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.istartsurf.com/?type=hppp&ts=1428252213&from=tugs&uid=SAMSUNGXHD502IJ_S13TJ1BQ701063
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.istartsurf.com/web/?type=dspp&ts=1428252213&from=tugs&uid=SAMSUNGXHD502IJ_S13TJ1BQ701063&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.istartsurf.com/web/?type=dspp&ts=1428252213&from=tugs&uid=SAMSUNGXHD502IJ_S13TJ1BQ701063&q={searchTerms}
HKU\S-1-5-21-3514346005-4174202986-2708488565-1004\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.istartsurf.com/?type=hppp&ts=1428252213&from=tugs&uid=SAMSUNGXHD502IJ_S13TJ1BQ701063
HKU\S-1-5-21-3514346005-4174202986-2708488565-1004\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
HKU\S-1-5-21-3514346005-4174202986-2708488565-1004\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.istartsurf.com/?type=hppp&ts=1428252213&from=tugs&uid=SAMSUNGXHD502IJ_S13TJ1BQ701063
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
SearchScopes: HKU\S-1-5-21-3514346005-4174202986-2708488565-1004 -> DefaultScope {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = hxxp://www.istartsurf.com/web/?utm_source=b&utm_medium=tugs&utm_campaign=install_ie&utm_content=ds&from=tugs&uid=SAMSUNGXHD502IJ_S13TJ1BQ701063&ts=1428252222&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3514346005-4174202986-2708488565-1004 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.istartsurf.com/web/?utm_source=b&utm_medium=tugs&utm_campaign=install_ie&utm_content=ds&from=tugs&uid=SAMSUNGXHD502IJ_S13TJ1BQ701063&ts=1428252222&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3514346005-4174202986-2708488565-1004 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = hxxp://www.istartsurf.com/web/?utm_source=b&utm_medium=tugs&utm_campaign=install_ie&utm_content=ds&from=tugs&uid=SAMSUNGXHD502IJ_S13TJ1BQ701063&ts=1428252222&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3514346005-4174202986-2708488565-1004 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.istartsurf.com/web/?utm_source=b&utm_medium=tugs&utm_campaign=install_ie&utm_content=ds&from=tugs&uid=SAMSUNGXHD502IJ_S13TJ1BQ701063&ts=1428252222&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3514346005-4174202986-2708488565-1004 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = hxxp://www.istartsurf.com/web/?utm_source=b&utm_medium=tugs&utm_campaign=install_ie&utm_content=ds&from=tugs&uid=SAMSUNGXHD502IJ_S13TJ1BQ701063&ts=1428252222&type=default&q={searchTerms}
BHO: SpeedChecker -> {FD457FBB-49E1-2DBB-AC1A-0F4A634B0681} -> C:\Program Files (x86)\version90SpeedChecker\191_x64.dll No File
BHO-x32: SpeedChecker -> {FD457FBB-49E1-2DBB-AC1A-0F4A634B0681} -> C:\Program Files (x86)\version90SpeedChecker\191.dll No File
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.istartsurf.com/?type=sc&ts=1428252179&from=tugs&uid=SAMSUNGXHD502IJ_S13TJ1BQ701063
FireFox:
========
FF Plugin-x32: @staging.google.com/globalUpdate Update;version=10 -> C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll No File
FF Plugin-x32: @staging.google.com/globalUpdate Update;version=4 -> C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll No File
FF HKU\S-1-5-21-3514346005-4174202986-2708488565-1004\...\Firefox\Extensions: [{BAA61DC0-942D-610B-9B47-565AFC929BBD}] - C:\Program Files (x86)\version90SpeedChecker\191.xpi
Chrome:
=======
CHR Profile: C:\Users\Andrej\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Adblock Plus) - C:\Users\Andrej\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2015-04-05]
CHR Extension: (I - Cinema) - C:\Users\Andrej\AppData\Local\Google\Chrome\User Data\Default\Extensions\dimfohdigjaffdaanhmbocfkpolglnjk [2015-04-05]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Andrej\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-04-05]
CHR Extension: (Google Wallet) - C:\Users\Andrej\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-04-05]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [432888 2015-03-17] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [432888 2015-03-17] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [182520 2015-01-19] (Avira Operations GmbH & Co. KG)
R2 cysofehu; C:\Users\Andrej\AppData\Local\E423A3A0-1428260358-11D5-A383-50465D8E03F5\insp7214.tmp [156672 2015-04-05] () [File not signed]
R2 hezopeno; C:\Users\Andrej\AppData\Local\E423A3A0-1428259781-11D5-A383-50465D8E03F5\cnsfA083.tmp [157696 2015-04-05] () [File not signed]
R2 LolliScan; C:\ProgramData\LolliScan\LolliScan.exe [335872 2015-04-02] () [File not signed]
R2 SpyHunter 4 Service; C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe [1026432 2015-04-05] (Enigma Software Group USA, LLC.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)
R2 xyhigysy; C:\Users\Andrej\AppData\Roaming\E423A3A0-1428252381-11D5-A383-50465D8E03F5\jnsfFFB4.tmp [151552 2015-04-05] () [File not signed]
S3 globalUpdatem; C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe /medsvc [X]
S2 gupdate; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc [X]
S3 gupdatem; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc [X]
R2 wodugide; C:\Users\Andrej\AppData\Roaming\E423A3A0-1428252381-11D5-A383-50465D8E03F5\nswCF19.tmpfs [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [128536 2015-03-17] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [132120 2015-03-17] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2015-03-17] (Avira Operations GmbH & Co. KG)
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2015-04-05] ()
R3 MTsensor; C:\Windows\system32\DRIVERS\ASACPI.sys [17280 2013-05-17] ()
S3 RecFltr; C:\Windows\system32\drivers\RecFltr.sys [45440 2007-01-18] ()
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)
R1 cherimoya; system32\drivers\cherimoya.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-04-05 20:23 - 2015-04-05 20:23 - 00000000 ____D () C:\FRST
2015-04-05 20:12 - 2015-04-05 20:12 - 00000000 _____ () C:\autoexec.bat
2015-04-05 20:11 - 2015-04-05 20:11 - 00003344 _____ () C:\Windows\System32\Tasks\SpyHunter4Startup
2015-04-05 20:11 - 2015-04-05 20:11 - 00001103 _____ () C:\Users\Andrej\Desktop\SpyHunter.lnk
2015-04-05 20:11 - 2015-04-05 20:11 - 00000000 ____D () C:\Users\Andrej\AppData\Roaming\Enigma Software Group
2015-04-05 20:10 - 2015-04-05 20:11 - 00000000 ____D () C:\sh4ldr
2015-04-05 20:07 - 2015-04-05 20:07 - 00022704 _____ () C:\Windows\system32\Drivers\EsgScanner.sys
2015-04-05 20:07 - 2015-04-05 20:07 - 00000000 ____D () C:\Program Files\Enigma Software Group
2015-04-05 19:59 - 2015-04-05 19:59 - 00000000 ____D () C:\Windows\system32\appmgmt
2015-04-05 19:22 - 2015-04-05 19:22 - 00008192 __RSH () C:\BOOTSECT.BAK
2015-04-05 19:22 - 2015-04-05 19:22 - 00000004 _____ () C:\Windows\SysWOW64\029B560A371F4E00AB32838EBC01B9E7
2015-04-05 19:22 - 2015-04-05 19:22 - 00000000 _____ () C:\Windows\system32\atiicdxx.dat
2015-04-05 19:22 - 2015-04-05 19:22 - 00000000 _____ () C:\Windows\ativpsrm.bin
2015-04-05 19:19 - 2015-04-05 19:15 - 00613255 _____ (CMI Limited) C:\Users\Andrej\AppData\Local\nsn3574.tmp
2015-04-05 19:03 - 2015-04-05 19:03 - 00001270 _____ () C:\Users\Public\Desktop\World of Warcraft.lnk
2015-04-05 19:03 - 2015-04-05 19:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft
2015-04-05 19:03 - 2015-04-05 18:58 - 00043576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2015-04-05 19:00 - 2015-04-05 19:02 - 00008592 _____ () C:\Windows\SysWOW64\VCLOff.ini
2015-04-05 19:00 - 2015-04-05 19:02 - 00008592 _____ () C:\Windows\system32\VCLOff.ini
2015-04-05 19:00 - 2015-03-20 15:54 - 00335064 _____ (VC Corporation) C:\Windows\SysWOW64\VCL.dll
2015-04-05 18:59 - 2015-04-05 19:50 - 00000000 ____D () C:\Program Files (x86)\IGS
2015-04-05 18:59 - 2015-04-05 18:59 - 00000000 ____D () C:\Users\Andrej\AppData\Local\E423A3A0-1428260358-11D5-A383-50465D8E03F5
2015-04-05 18:58 - 2015-04-05 18:58 - 00001153 _____ () C:\Users\Public\Desktop\Avira.lnk
2015-04-05 18:58 - 2015-04-05 18:58 - 00000000 ____D () C:\Users\Andrej\AppData\Roaming\Avira
2015-04-05 18:58 - 2015-04-05 18:58 - 00000000 ____D () C:\ProgramData\Package Cache
2015-04-05 18:57 - 2015-04-05 18:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-04-05 18:57 - 2015-04-05 18:57 - 00002086 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2015-04-05 18:56 - 2015-04-05 18:58 - 00000000 ____D () C:\ProgramData\Avira
2015-04-05 18:56 - 2015-04-05 18:58 - 00000000 ____D () C:\Program Files (x86)\Avira
2015-04-05 18:56 - 2015-03-17 13:01 - 00132120 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-04-05 18:56 - 2015-03-17 13:01 - 00128536 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-04-05 18:56 - 2015-03-17 13:01 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2015-04-05 18:54 - 2015-04-05 18:54 - 00000000 ____D () C:\Users\Andrej\SupTab
2015-04-05 18:53 - 2015-04-05 19:03 - 00000000 ____D () C:\Program Files (x86)\World of Warcraft
2015-04-05 18:52 - 2015-04-05 18:55 - 165283560 _____ () C:\Users\Andrej\Downloads\avira_free_antivirus_de_15.0.9.504.exe
2015-04-05 18:52 - 2015-04-05 18:52 - 00002253 _____ () C:\Windows\patsearch.bin
2015-04-05 18:51 - 2015-04-05 20:22 - 00000000 ____D () C:\Users\Andrej\AppData\Local\Battle.net
2015-04-05 18:51 - 2015-04-05 18:52 - 00000000 ____D () C:\Users\Andrej\AppData\Roaming\Battle.net
2015-04-05 18:51 - 2015-04-05 18:51 - 00001160 _____ () C:\Users\Public\Desktop\Battle.net.lnk
2015-04-05 18:51 - 2015-04-05 18:51 - 00000000 ____D () C:\Users\Andrej\AppData\Local\Blizzard Entertainment
2015-04-05 18:51 - 2015-04-05 18:51 - 00000000 ____D () C:\ProgramData\VoCsJmHm
2015-04-05 18:51 - 2015-04-05 18:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle.net
2015-04-05 18:51 - 2015-04-05 18:51 - 00000000 ____D () C:\ProgramData\Blizzard Entertainment
2015-04-05 18:51 - 2015-04-05 18:51 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2015-04-05 18:50 - 2015-04-05 18:50 - 00000000 ____D () C:\ProgramData\Battle.net
2015-04-05 18:49 - 2015-04-05 19:57 - 00000000 ____D () C:\Users\Andrej\AppData\Local\E423A3A0-1428259796-11D5-A383-50465D8E03F5
2015-04-05 18:49 - 2015-04-05 18:49 - 02908728 _____ (Blizzard Entertainment) C:\Users\Andrej\Downloads\World-of-Warcraft-Setup-enGB.exe
2015-04-05 18:49 - 2015-04-05 18:49 - 00000000 ____D () C:\Users\Andrej\AppData\Local\E423A3A0-1428259781-11D5-A383-50465D8E03F5
2015-04-05 18:47 - 2015-04-05 18:47 - 00000000 ____D () C:\Users\Andrej\AppData\Local\E423A3A0-1428259641-11D5-A383-50465D8E03F5
2015-04-05 18:46 - 2015-04-05 19:59 - 00000000 ____D () C:\ProgramData\Skype
2015-04-05 18:46 - 2015-04-05 19:58 - 00000000 ____D () C:\Users\Andrej\AppData\Roaming\Opera Software
2015-04-05 18:46 - 2015-04-05 19:58 - 00000000 ____D () C:\Users\Andrej\AppData\Local\Opera Software
2015-04-05 18:46 - 2015-04-05 19:54 - 00000000 ____D () C:\Users\Andrej\AppData\Roaming\Skype
2015-04-05 18:46 - 2015-04-05 19:10 - 00000000 ____D () C:\Users\Andrej\AppData\Roaming\E423A3A0-1428252381-11D5-A383-50465D8E03F5
2015-04-05 18:46 - 2015-04-05 18:46 - 00000000 ____D () C:\Users\Andrej\AppData\Local\Skype
2015-04-05 18:45 - 2015-04-05 19:58 - 00000000 ____D () C:\Program Files\shopperz
2015-04-05 18:45 - 2015-04-05 19:52 - 00002802 _____ () C:\Windows\Tasks\298e4a64-c0d9-4c16-86d7-7c80d9fe276d-5_user.job
2015-04-05 18:45 - 2015-04-05 19:52 - 00002802 _____ () C:\Windows\Tasks\298e4a64-c0d9-4c16-86d7-7c80d9fe276d-5.job
2015-04-05 18:45 - 2015-04-05 18:51 - 00000000 ___HD () C:\Users\Public\Temp
2015-04-05 18:45 - 2015-04-05 18:45 - 00005806 _____ () C:\Windows\System32\Tasks\298e4a64-c0d9-4c16-86d7-7c80d9fe276d-5
2015-04-05 18:45 - 2015-04-05 18:45 - 00000045 _____ () C:\user.js
2015-04-05 18:44 - 2015-04-05 19:52 - 00005874 _____ () C:\Windows\Tasks\298e4a64-c0d9-4c16-86d7-7c80d9fe276d-6.job
2015-04-05 18:44 - 2015-04-05 19:52 - 00005530 _____ () C:\Windows\Tasks\298e4a64-c0d9-4c16-86d7-7c80d9fe276d-7.job
2015-04-05 18:44 - 2015-04-05 19:52 - 00004506 _____ () C:\Windows\Tasks\298e4a64-c0d9-4c16-86d7-7c80d9fe276d-3.job
2015-04-05 18:44 - 2015-04-05 19:52 - 00003486 _____ () C:\Windows\Tasks\298e4a64-c0d9-4c16-86d7-7c80d9fe276d-1-7.job
2015-04-05 18:44 - 2015-04-05 19:52 - 00003486 _____ () C:\Windows\Tasks\298e4a64-c0d9-4c16-86d7-7c80d9fe276d-1-6.job
2015-04-05 18:44 - 2015-04-05 19:52 - 00002124 _____ () C:\Windows\Tasks\298e4a64-c0d9-4c16-86d7-7c80d9fe276d-10_user.job
2015-04-05 18:44 - 2015-04-05 18:44 - 00008878 _____ () C:\Windows\System32\Tasks\298e4a64-c0d9-4c16-86d7-7c80d9fe276d-6
2015-04-05 18:44 - 2015-04-05 18:44 - 00008534 _____ () C:\Windows\System32\Tasks\298e4a64-c0d9-4c16-86d7-7c80d9fe276d-7
2015-04-05 18:44 - 2015-04-05 18:44 - 00007510 _____ () C:\Windows\System32\Tasks\298e4a64-c0d9-4c16-86d7-7c80d9fe276d-3
2015-04-05 18:44 - 2015-04-05 18:44 - 00006490 _____ () C:\Windows\System32\Tasks\298e4a64-c0d9-4c16-86d7-7c80d9fe276d-1-7
2015-04-05 18:44 - 2015-04-05 18:44 - 00006490 _____ () C:\Windows\System32\Tasks\298e4a64-c0d9-4c16-86d7-7c80d9fe276d-1-6
2015-04-05 18:44 - 2015-04-05 18:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-04-05 18:43 - 2015-04-05 19:52 - 00001720 _____ () C:\Windows\Tasks\CKPYXOR.job
2015-04-05 18:43 - 2015-04-05 19:52 - 00001090 _____ () C:\Windows\Tasks\Crossbrowse.job
2015-04-05 18:43 - 2015-04-05 18:43 - 00004742 _____ () C:\Windows\System32\Tasks\CKPYXOR
2015-04-05 18:43 - 2015-04-05 18:43 - 00004094 _____ () C:\Windows\System32\Tasks\Crossbrowse
2015-04-05 18:43 - 2015-04-05 18:43 - 00003938 _____ () C:\Windows\System32\Tasks\PostPoneInstall
2015-04-05 18:43 - 2015-04-05 18:43 - 00003182 _____ () C:\Windows\System32\Tasks\Run_Browser
2015-04-05 18:43 - 2015-04-05 18:43 - 00000000 ____D () C:\Users\Andrej\AppData\Local\UnicoBrowser
2015-04-05 18:43 - 2015-04-05 18:43 - 00000000 ____D () C:\Users\Andrej\AppData\Local\globalUpdate
2015-04-05 18:42 - 2015-04-05 19:53 - 00001146 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-04-05 18:42 - 2015-04-05 18:52 - 00001150 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-04-05 18:42 - 2015-04-05 18:47 - 00004122 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-04-05 18:42 - 2015-04-05 18:47 - 00003886 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-04-05 18:42 - 2015-04-05 18:44 - 00000000 ____D () C:\Users\Andrej\AppData\Local\Google
2015-04-05 18:42 - 2015-04-05 18:43 - 00008558 _____ () C:\claraInstaller.txt
2015-04-05 18:42 - 2015-04-05 18:42 - 00003576 _____ () C:\Windows\System32\Tasks\VZZXGN
2015-04-05 18:42 - 2015-04-05 18:42 - 00000000 ____D () C:\ProgramData\LolliScan
2015-04-05 18:42 - 2015-04-05 18:42 - 00000000 ____D () C:\ProgramData\7b2a98c5c3a9485689cfb0f9c7e387ba
2015-04-05 18:42 - 2015-04-05 18:42 - 00000000 ____D () C:\ProgramData\4d0801eee76440b5aa8e9e9bd8f25f47
2015-04-05 18:40 - 2015-04-05 20:22 - 00003598 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3514346005-4174202986-2708488565-1004
2015-04-05 18:40 - 2015-04-05 19:54 - 00000000 ____D () C:\Users\Andrej\OneDrive
2015-04-05 18:40 - 2015-04-05 18:40 - 00003962 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{F3627B61-9F12-40DD-9141-4559DE26043D}
2015-04-05 18:40 - 2015-04-05 18:40 - 00000000 __SHD () C:\Users\Andrej\AppData\Local\EmieUserList
2015-04-05 18:40 - 2015-04-05 18:40 - 00000000 __SHD () C:\Users\Andrej\AppData\Local\EmieSiteList
2015-04-05 18:40 - 2015-04-05 18:40 - 00000000 __SHD () C:\Users\Andrej\AppData\Local\EmieBrowserModeList
2015-04-05 18:40 - 2015-04-05 18:40 - 00000000 ____D () C:\Users\Andrej\AppData\Roaming\Macromedia
2015-04-05 18:35 - 2015-04-05 18:35 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2015-04-05 18:34 - 2015-04-05 20:11 - 00000000 ____D () C:\Users\Andrej
2015-04-05 18:34 - 2015-04-05 18:42 - 00001654 _____ () C:\Users\Andrej\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-04-05 18:34 - 2015-04-05 18:37 - 00000000 ____D () C:\Users\Andrej\AppData\Local\Packages
2015-04-05 18:34 - 2015-04-05 18:34 - 00000020 ___SH () C:\Users\Andrej\ntuser.ini
2015-04-05 18:34 - 2015-04-05 18:34 - 00000000 _SHDL () C:\Users\Andrej\Vorlagen
2015-04-05 18:34 - 2015-04-05 18:34 - 00000000 _SHDL () C:\Users\Andrej\Startmenü
2015-04-05 18:34 - 2015-04-05 18:34 - 00000000 _SHDL () C:\Users\Andrej\Netzwerkumgebung
2015-04-05 18:34 - 2015-04-05 18:34 - 00000000 _SHDL () C:\Users\Andrej\Lokale Einstellungen
2015-04-05 18:34 - 2015-04-05 18:34 - 00000000 _SHDL () C:\Users\Andrej\Eigene Dateien
2015-04-05 18:34 - 2015-04-05 18:34 - 00000000 _SHDL () C:\Users\Andrej\Druckumgebung
2015-04-05 18:34 - 2015-04-05 18:34 - 00000000 _SHDL () C:\Users\Andrej\Documents\Eigene Musik
2015-04-05 18:34 - 2015-04-05 18:34 - 00000000 _SHDL () C:\Users\Andrej\Documents\Eigene Bilder
2015-04-05 18:34 - 2015-04-05 18:34 - 00000000 _SHDL () C:\Users\Andrej\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2015-04-05 18:34 - 2015-04-05 18:34 - 00000000 _SHDL () C:\Users\Andrej\AppData\Local\Verlauf
2015-04-05 18:34 - 2015-04-05 18:34 - 00000000 _SHDL () C:\Users\Andrej\AppData\Local\Anwendungsdaten
2015-04-05 18:34 - 2015-04-05 18:34 - 00000000 _SHDL () C:\Users\Andrej\Anwendungsdaten
2015-04-05 18:34 - 2015-04-05 18:34 - 00000000 ____D () C:\Users\Andrej\AppData\Roaming\Adobe
2015-04-05 18:34 - 2015-04-05 18:34 - 00000000 ____D () C:\Users\Andrej\AppData\Local\VirtualStore
2015-04-05 18:34 - 2015-02-04 12:20 - 00000000 ___RD () C:\Users\Andrej\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2015-04-05 18:34 - 2015-02-04 12:20 - 00000000 ___RD () C:\Users\Andrej\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2015-04-05 18:34 - 2014-03-18 12:12 - 00000369 _____ () C:\Users\Andrej\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk
2015-04-05 18:34 - 2014-03-18 12:12 - 00000369 _____ () C:\Users\Andrej\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk
2015-04-05 18:34 - 2014-01-12 07:50 - 00015360 _____ () C:\Windows\system32\SppExtComObjHook.dll
2015-04-05 18:34 - 2014-01-12 07:50 - 00004608 _____ () C:\Windows\system32\SppExtComObjPatcher.exe
2015-04-05 18:34 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Andrej\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-04-05 18:34 - 2013-08-22 17:36 - 00000000 ____D () C:\Users\Andrej\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2015-04-05 18:30 - 2015-04-05 18:30 - 00000000 ____D () C:\Windows\CSC
2015-04-05 18:25 - 2015-04-05 20:06 - 00418176 _____ () C:\Windows\WindowsUpdate.log
2015-04-05 18:24 - 2015-04-05 18:24 - 00002302 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3514346005-4174202986-2708488565-500
2015-03-26 21:14 - 2015-03-26 21:14 - 00005542 _____ () C:\Users\Andrej\AppData\Roaming\CKPYXOR
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-04-05 20:00 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\sru
2015-04-05 19:58 - 2014-03-18 12:04 - 01776918 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-04-05 19:58 - 2014-03-18 11:25 - 00764340 _____ () C:\Windows\system32\perfh007.dat
2015-04-05 19:58 - 2014-03-18 11:25 - 00159160 _____ () C:\Windows\system32\perfc007.dat
2015-04-05 19:58 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\restore
2015-04-05 19:52 - 2013-08-22 16:46 - 00023016 _____ () C:\Windows\setupact.log
2015-04-05 19:52 - 2013-08-22 16:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-04-05 19:51 - 2014-03-18 03:51 - 00228216 _____ () C:\Windows\PFRO.log
2015-04-05 19:51 - 2013-08-22 15:25 - 00262144 ___SH () C:\Windows\system32\config\BBI
2015-04-05 19:22 - 2013-08-22 17:36 - 00262144 _____ () C:\Windows\system32\config\BCD-Template
2015-04-05 18:46 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\AppReadiness
2015-04-05 18:35 - 2015-02-04 11:22 - 00000000 ____D () C:\Windows\Panther
2015-04-05 18:34 - 2013-08-22 16:45 - 00000000 ____D () C:\Windows\Setup
2015-04-05 18:27 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\rescache
2015-04-05 18:25 - 2015-02-04 11:24 - 00000000 __SHD () C:\Recovery
2015-04-05 18:25 - 2013-08-22 17:37 - 00003843 _____ () C:\Windows\DtcInstall.log
2015-04-05 18:25 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\Recovery
==================== Files in the root of some directories =======
2015-03-26 21:14 - 2015-03-26 21:14 - 0005542 _____ () C:\Users\Andrej\AppData\Roaming\CKPYXOR
2015-04-05 19:19 - 2015-04-05 19:15 - 0613255 _____ (CMI Limited) C:\Users\Andrej\AppData\Local\nsn3574.tmp
Some content of TEMP:
====================
C:\Users\Andrej\AppData\Local\Temp\079CD119-532D-6D75-1C2F-618037BEB765.dll
C:\Users\Andrej\AppData\Local\Temp\079CD119-532D-6D75-1C2F-618037BEB765.exe
C:\Users\Andrej\AppData\Local\Temp\avgnt.exe
C:\Users\Andrej\AppData\Local\Temp\bitool.dll
C:\Users\Andrej\AppData\Local\Temp\SpOrder.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-02-04 11:22
==================== End Of Log ============================
Und hier die Addition Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-03-2015
Ran by Andrej at 2015-04-05 20:24:00
Running from C:\Users\Andrej\AppData\Local\Microsoft\Windows\INetCache\IE\4FM3BGOB
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Avira (HKLM-x32\...\{bd538030-07d4-4999-a525-7fafa2483f56}) (Version: 1.1.30.21727 - Avira Operations & Co. KG)
Avira (x32 Version: 1.1.30.21727 - Avira Operations & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 15.0.8.656 - Avira)
Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment)
Bid Forward (HKLM-x32\...\IGS) (Version: - )
Firewall Menu (HKLM-x32\...\ConvertAd) (Version: 1.0.0.0 - Firewall Menu) <==== ATTENTION
From Article (HKLM-x32\...\igsc) (Version: 1.0.0.0 - From Article)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 41.0.2272.118 - Google Inc.)
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
Internet Service Provider Low Resolution (HKLM-x32\...\wincheck) (Version: 1.0.0.0 - Internet Service Provider Low Resolution)
LolliScan (HKLM-x32\...\LolliScan) (Version: - )
SpyHunter 4 (HKLM-x32\...\SpyHunter) (Version: 4.19.13.4482 - Enigma Software Group, LLC)
StartIsBack+ (HKLM-x32\...\StartIsBack) (Version: 1.7 - startisback.com)
WinRAR 5.20 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.20.0 - win.rar GmbH)
World of Warcraft (HKLM-x32\...\World of Warcraft) (Version: - Blizzard Entertainment)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
05-04-2015 19:58:58 Removed Skype™ 7.3
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {04968582-6164-457F-9B8B-46B731C98BF3} - System32\Tasks\298e4a64-c0d9-4c16-86d7-7c80d9fe276d-10_user => C:\Program Files (x86)\I - Cinema\298e4a64-c0d9-4c16-86d7-7c80d9fe276d-10.exe <==== ATTENTION
Task: {123B1F1C-C733-499C-98C9-4D91A38EA1A9} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2014-12-31] (Microsoft Corporation)
Task: {157FE157-455C-492D-8730-778BA0F8B67F} - System32\Tasks\298e4a64-c0d9-4c16-86d7-7c80d9fe276d-5 => C:\Program Files (x86)\I - Cinema\298e4a64-c0d9-4c16-86d7-7c80d9fe276d-5.exe <==== ATTENTION
Task: {318490EE-CB23-4E0D-B229-968F6AF2271E} - System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcTrigger
Task: {36CA73FD-C7EC-44E2-B726-977629677FD6} - System32\Tasks\298e4a64-c0d9-4c16-86d7-7c80d9fe276d-6 => C:\Program Files (x86)\I - Cinema\298e4a64-c0d9-4c16-86d7-7c80d9fe276d-6.exe <==== ATTENTION
Task: {38265361-082F-42B9-9F36-DEDAFF300947} - \Optimize Start Menu Cache Files-S-1-5-21-3514346005-4174202986-2708488565-1001 No Task File <==== ATTENTION
Task: {3A1A3F55-79A7-442D-8950-93F073AC25D2} - System32\Tasks\CKPYXOR => C:\Users\Andrej\AppData\Roaming\CKPYXOR.exe <==== ATTENTION
Task: {3FD166F2-AF13-4A5D-A455-9F151F8C33C8} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: {4AAA4FA7-F141-4044-8D0B-AD6609012366} - System32\Tasks\298e4a64-c0d9-4c16-86d7-7c80d9fe276d-5_user => C:\Program Files (x86)\I - Cinema\298e4a64-c0d9-4c16-86d7-7c80d9fe276d-5.exe <==== ATTENTION
Task: {4BCDB6E4-86F0-4CAD-B071-FC465791AEFE} - System32\Tasks\PostPoneInstall => C:\Users\Andrej\AppData\Local\Temp\ce98ac2e-20c0-4a93-86f6-bdb3e61caf55.exe <==== ATTENTION
Task: {51043B06-2D44-4E2B-ABF1-36B39F07F1A2} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: {54A81083-ED65-4750-9488-CBF7C762C895} - System32\Tasks\SpyHunter4Startup => C:\Program Files\Enigma Software Group\SpyHunter\Spyhunter4.exe [2015-04-05] (Enigma Software Group USA, LLC.)
Task: {97FD164D-E026-4F07-8DF7-0001C4741286} - System32\Tasks\298e4a64-c0d9-4c16-86d7-7c80d9fe276d-1-6 => C:\Program Files (x86)\I - Cinema\298e4a64-c0d9-4c16-86d7-7c80d9fe276d-1-6.exe <==== ATTENTION
Task: {AEA47298-C526-46DA-BF8B-375568BA2AFE} - System32\Tasks\298e4a64-c0d9-4c16-86d7-7c80d9fe276d-7 => C:\Program Files (x86)\I - Cinema\298e4a64-c0d9-4c16-86d7-7c80d9fe276d-7.exe <==== ATTENTION
Task: {B688E2DC-7456-4E35-A64E-229BA72EC012} - System32\Tasks\298e4a64-c0d9-4c16-86d7-7c80d9fe276d-1-7 => C:\Program Files (x86)\I - Cinema\298e4a64-c0d9-4c16-86d7-7c80d9fe276d-1-7.exe <==== ATTENTION
Task: {BC569234-24DE-48B9-86AB-1D431153796F} - System32\Tasks\Run_Browser => C:\Users\Andrej\AppData\Local\UnicoBrowser\Application\unicobrowser.exe [2015-03-18] (The Unico Browser Authors)
Task: {CC9091C8-D5A1-4D0D-87A3-0A8FA98EF971} - System32\Tasks\298e4a64-c0d9-4c16-86d7-7c80d9fe276d-3 => C:\Program Files (x86)\I - Cinema\298e4a64-c0d9-4c16-86d7-7c80d9fe276d-3.exe <==== ATTENTION
Task: {DBBEE193-2B8B-4DBA-8E2E-1D24458E45AA} - System32\Tasks\VZZXGN => C:\ProgramData\4d0801eee76440b5aa8e9e9bd8f25f47\4d0801eee76440b5aa8e9e9bd8f25f47.exe [2015-04-02] ()
Task: {ED17397F-7187-40BD-AC29-471CD275C31E} - System32\Tasks\Crossbrowse => C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\utility.exe
Task: C:\Windows\Tasks\298e4a64-c0d9-4c16-86d7-7c80d9fe276d-1-6.job => C:\Program Files (x86)\I - Cinema\298e4a64-c0d9-4c16-86d7-7c80d9fe276d-1-6.exe <==== ATTENTION
Task: C:\Windows\Tasks\298e4a64-c0d9-4c16-86d7-7c80d9fe276d-1-7.job => C:\Program Files (x86)\I - Cinema\298e4a64-c0d9-4c16-86d7-7c80d9fe276d-1-7.exe <==== ATTENTION
Task: C:\Windows\Tasks\298e4a64-c0d9-4c16-86d7-7c80d9fe276d-10_user.job => C:\Program Files (x86)\I - Cinema\298e4a64-c0d9-4c16-86d7-7c80d9fe276d-10.exe <==== ATTENTION
Task: C:\Windows\Tasks\298e4a64-c0d9-4c16-86d7-7c80d9fe276d-3.job => C:\Program Files (x86)\I - Cinema\298e4a64-c0d9-4c16-86d7-7c80d9fe276d-3.exe <==== ATTENTION
Task: C:\Windows\Tasks\298e4a64-c0d9-4c16-86d7-7c80d9fe276d-5.job => C:\Program Files (x86)\I - Cinema\298e4a64-c0d9-4c16-86d7-7c80d9fe276d-5.exe <==== ATTENTION
Task: C:\Windows\Tasks\298e4a64-c0d9-4c16-86d7-7c80d9fe276d-5_user.job => C:\Program Files (x86)\I - Cinema\298e4a64-c0d9-4c16-86d7-7c80d9fe276d-5.exe <==== ATTENTION
Task: C:\Windows\Tasks\298e4a64-c0d9-4c16-86d7-7c80d9fe276d-6.job => C:\Program Files (x86)\I - Cinema\298e4a64-c0d9-4c16-86d7-7c80d9fe276d-6.exe <==== ATTENTION
Task: C:\Windows\Tasks\298e4a64-c0d9-4c16-86d7-7c80d9fe276d-7.job => C:\Program Files (x86)\I - Cinema\298e4a64-c0d9-4c16-86d7-7c80d9fe276d-7.exe <==== ATTENTION
Task: C:\Windows\Tasks\CKPYXOR.job => C:\Users\Andrej\AppData\Roaming\CKPYXOR.exe <==== ATTENTION
Task: C:\Windows\Tasks\Crossbrowse.job => C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\utility.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) ==============
2015-04-05 18:59 - 2015-04-05 18:59 - 00156672 _____ () C:\Users\Andrej\AppData\Local\E423A3A0-1428260358-11D5-A383-50465D8E03F5\insp7214.tmp
2015-04-05 18:49 - 2015-04-05 18:49 - 00157696 _____ () C:\Users\Andrej\AppData\Local\E423A3A0-1428259781-11D5-A383-50465D8E03F5\cnsfA083.tmp
2015-04-05 18:42 - 2015-04-02 15:59 - 00335872 _____ () C:\ProgramData\LolliScan\LolliScan.exe
2015-04-05 18:46 - 2015-04-05 18:46 - 00205312 _____ () C:\Users\Andrej\AppData\Roaming\E423A3A0-1428252381-11D5-A383-50465D8E03F5\nswCF19.tmpfs
2015-04-05 18:46 - 2015-04-05 18:46 - 00151552 _____ () C:\Users\Andrej\AppData\Roaming\E423A3A0-1428252381-11D5-A383-50465D8E03F5\jnsfFFB4.tmp
2015-04-05 17:49 - 2015-04-05 17:49 - 01807360 _____ () C:\Users\Andrej\AppData\Local\E423A3A0-1428259781-11D5-A383-50465D8E03F5\ansu9D37.exe
2015-04-05 20:22 - 2015-04-05 20:23 - 00082501 _____ () C:\Users\Andrej\AppData\Local\Temp\nsb93A8.tmp
2015-04-05 18:51 - 2015-04-05 18:51 - 26065408 _____ () C:\Program Files (x86)\Battle.net\Battle.net.5636\libcef.dll
2015-04-05 18:51 - 2015-04-05 18:51 - 00739840 _____ () C:\Program Files (x86)\Battle.net\Battle.net.5636\libGLESv2.dll
2015-04-05 18:51 - 2015-04-05 18:51 - 00908288 _____ () C:\Program Files (x86)\Battle.net\Battle.net.5636\platforms\qwindows.dll
2015-04-05 18:51 - 2015-04-05 18:51 - 00130048 _____ () C:\Program Files (x86)\Battle.net\Battle.net.5636\libEGL.dll
2015-04-05 18:51 - 2015-04-05 18:51 - 00020992 _____ () C:\Program Files (x86)\Battle.net\Battle.net.5636\imageformats\qgif.dll
2015-04-05 18:51 - 2015-04-05 18:51 - 00021504 _____ () C:\Program Files (x86)\Battle.net\Battle.net.5636\imageformats\qico.dll
2015-04-05 18:51 - 2015-04-05 18:51 - 00205312 _____ () C:\Program Files (x86)\Battle.net\Battle.net.5636\imageformats\qjpeg.dll
2015-04-05 18:51 - 2015-04-05 18:51 - 00225792 _____ () C:\Program Files (x86)\Battle.net\Battle.net.5636\imageformats\qmng.dll
2015-04-05 18:51 - 2015-04-05 18:51 - 00015872 _____ () C:\Program Files (x86)\Battle.net\Battle.net.5636\imageformats\qsvg.dll
2015-04-05 18:51 - 2015-04-05 18:51 - 00312832 _____ () C:\Program Files (x86)\Battle.net\Battle.net.5636\imageformats\qtiff.dll
2015-04-05 18:51 - 2015-04-05 18:51 - 00010240 _____ () C:\Program Files (x86)\Battle.net\Battle.net.5636\qml\QtQuick.2\qtquick2plugin.dll
2015-04-05 18:51 - 2015-04-05 18:51 - 00054272 _____ () C:\Program Files (x86)\Battle.net\Battle.net.5636\qml\QtQuick\Layouts\qquicklayoutsplugin.dll
2015-04-05 18:51 - 2015-04-05 18:51 - 00010240 _____ () C:\Program Files (x86)\Battle.net\Battle.net.5636\qml\QtQml\Models.2\modelsplugin.dll
2015-04-05 18:43 - 2015-03-18 15:27 - 01037448 _____ () C:\Users\Andrej\AppData\Local\UnicoBrowser\Application\39.0.2132.8\libglesv2.dll
2015-04-05 18:43 - 2015-03-18 15:27 - 00210568 _____ () C:\Users\Andrej\AppData\Local\UnicoBrowser\Application\39.0.2132.8\libegl.dll
2015-04-05 18:43 - 2015-03-18 15:27 - 08875144 _____ () C:\Users\Andrej\AppData\Local\UnicoBrowser\Application\39.0.2132.8\pdf.dll
2015-04-05 18:43 - 2015-03-18 15:27 - 01679496 _____ () C:\Users\Andrej\AppData\Local\UnicoBrowser\Application\39.0.2132.8\ffmpegsumo.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\Users\Andrej\OneDrive:ms-properties
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\VCL => ""="service"
==================== EXE Association (whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-3514346005-4174202986-2708488565-1004\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\wallpaper\Windows\img0.jpg
DNS Servers: 192.168.178.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
==================== Accounts: =============================
Administrator (S-1-5-21-3514346005-4174202986-2708488565-500 - Administrator - Disabled)
Andrej (S-1-5-21-3514346005-4174202986-2708488565-1004 - Administrator - Enabled) => C:\Users\Andrej
Gast (S-1-5-21-3514346005-4174202986-2708488565-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3514346005-4174202986-2708488565-1003 - Limited - Enabled)
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (04/05/2015 07:59:03 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".
Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll.
System Error:
Zugriff verweigert
.
Error: (04/05/2015 06:44:45 PM) (Source: MsiInstaller) (EventID: 11309) (User: ARBEITSZIMMERPC)
Description: Product: Google Update Helper -- Error 1309. Error reading from file: C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\Google\Update\RequiredFile.txt. System error 3. Verify that the file exists and that you can access it.
Error: (04/05/2015 06:43:39 PM) (Source: MsiInstaller) (EventID: 11309) (User: ARBEITSZIMMERPC)
Description: Product: Google Update Helper -- Error 1309. Error reading from file: C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\Google\Update\RequiredFile.txt. System error 3. Verify that the file exists and that you can access it.
System errors:
=============
Error: (04/05/2015 07:58:35 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "csrcc" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (04/05/2015 07:58:34 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "70F4EEDB-1367-4b4f-8247-3133551A7415" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (04/05/2015 07:21:13 PM) (Source: DCOM) (EventID: 10010) (User: ARBEITSZIMMERPC)
Description: {4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474}
Error: (04/05/2015 07:19:33 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "VCL" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (04/05/2015 07:18:33 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "kDMBpyuusq" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (04/05/2015 07:16:17 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "IHProtect Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (04/05/2015 07:15:11 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "WindowsMangerProtect Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (04/05/2015 07:15:06 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "rcores" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (04/05/2015 06:43:27 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "ClaraUpdater" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
Error: (04/05/2015 06:24:45 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Netzwerklistendienst" wurde mit folgendem Fehler beendet:
%%21
Microsoft Office Sessions:
=========================
Error: (04/05/2015 07:59:03 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description:
Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll.
System Error:
Zugriff verweigert
Error: (04/05/2015 06:44:45 PM) (Source: MsiInstaller) (EventID: 11309) (User: ARBEITSZIMMERPC)
Description: Product: Google Update Helper -- Error 1309. Error reading from file: C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\Google\Update\RequiredFile.txt. System error 3. Verify that the file exists and that you can access it.(NULL)(NULL)(NULL)(NULL)(NULL)
Error: (04/05/2015 06:43:39 PM) (Source: MsiInstaller) (EventID: 11309) (User: ARBEITSZIMMERPC)
Description: Product: Google Update Helper -- Error 1309. Error reading from file: C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\Google\Update\RequiredFile.txt. System error 3. Verify that the file exists and that you can access it.(NULL)(NULL)(NULL)(NULL)(NULL)
==================== Memory info ===========================
Processor: AMD FX(tm)-4100 Quad-Core Processor
Percentage of memory in use: 38%
Total physical RAM: 6126.11 MB
Available physical RAM: 3797.35 MB
Total Pagefile: 7790.11 MB
Available Pagefile: 5018.05 MB
Total Virtual: 131072 MB
Available Virtual: 131071.8 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:98.57 GB) (Free:70.27 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: () (Fixed) (Total:367.19 GB) (Free:366.4 GB) NTFS
==================== MBR & Partition Table ==================
==================== End Of Log ============================
Vielen Dank schonmal im Vorraus Achja, vielleicht ist auch noch von Bedeutung dass ich bisher nichts außer Antivir, Battle.net, SpyHunter, FRST sowie Chrome installiert habe. Avira hat mir Chrome aber sofort in die Quarantäne verschoben. |
| Themen zu Windows 8.1 frisch installiert und dennoch Malware auf dem Rechner |
| adobe, adware, antivir, antivirus, avira, browser, cherimoya.sys, defender, desktop, esgscanner.sys, explorer, fehler, google, helper, internet, internet explorer, logfile, malware, registry, scan, security, services.exe, software, start von windows, svchost.exe, temp, unico browser, werbung, windows |
Baum-Darstellung