Trojaner-Board
Seite 2 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   IMINENT auf Web.de mit Installation eines Shops (Mistding) (https://www.trojaner-board.de/142812-iminent-web-de-installation-shops-mistding.html)

schrauber 24.10.2013 09:21
Hi,

Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.


So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
http://www.trojaner-board.de/picture...&pictureid=307


frisches FRST log fehlt noch, und die Antwort auf meine Frage :)

alst_str 24.10.2013 09:58
Danke schrauber und sorry, dass ich FRST vergessen habe.
Ja, es gibt weiterhin Probleme. Mein Bildschirm wir immer noch mit extrem viel Werbung zugemüllt.
Hier nun FRST von gerade. Hoffentlich ist das so OK.
FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-10-2013
Ran by ast (administrator) on HP-NOTEBOOK on 24-10-2013 10:51:48
Running from C:\Users\ast\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(HP) C:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
() C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
(ArcSoft, Inc.) C:\Program Files (x86)\ArcSoft\TotalMedia 3\TMMonitor.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(CyberLink) C:\Program Files (x86)\HomeCinema\Power2Go\CLMLSvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(HP) C:\Program Files (x86)\HP SimplePass 2011\TouchControl.exe
(HP) C:\Program Files (x86)\HP SimplePass 2011\BioMonitor.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office\WINWORD.EXE
(Microsoft Corporation) C:\Windows\splwow64.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AcroRd32.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AcroRd32.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Adobe Systems Incorporated) C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_9_900_117_ActiveX.exe
(Microsoft Corporation) C:\Windows\system32\AUDIODG.EXE

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2799912 2011-06-10] (Synaptics Incorporated)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [1128448 2011-06-08] (IDT, Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKCU\...\Run: [KiesHelper] - C:\Program Files (x86)\Samsung\Kies\KiesHelper.exe [958352 2011-07-26] (Samsung)
HKCU\...\Run: [KiesTrayAgent] - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [3507088 2011-07-26] (Samsung Electronics Co., Ltd.)
HKCU\...\Run: [KiesPDLR] - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [20880 2011-07-26] ()
HKCU\...\Policies\system: [DisableLockWorkstation] 0
HKCU\...\Policies\system: [DisableChangePassword] 0
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-04-30] (Intel Corporation)
HKLM-x32\...\Run: [Easybits Recovery] - C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [61112 2011-05-17] (EasyBits Software AS)
HKLM-x32\...\Run: [CLMLServer] - C:\Program Files (x86)\HomeCinema\Power2Go\CLMLSvc.exe [107816 2010-08-03] (CyberLink)
HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [31072 2008-10-25] (Microsoft Corporation)
HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [163000 2012-12-12] (Geek Software GmbH)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [681032 2013-09-30] (Avira Operations GmbH & Co. KG)
AppInit_DLLs:    [0 ] ()

==================== Internet (Whitelisted) ====================

ProxyEnable: Internet Explorer proxy is enabled.
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.startpage.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT/4
URLSearchHook: (No Name) - {3bbd3c14-4c16-4989-8366-95bc9179779d} -  No File
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2102} URL =
SearchScopes: HKLM - {3BC70585-04B1-4BF3-BD1B-E829876E5EDA} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\x64\IEBHO.dll (HP)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\IEBHO.dll (HP)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -  No File
Toolbar: HKLM - No Name - !{3bbd3c14-4c16-4989-8366-95bc9179779d} -  No File
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM-x32 - No Name - !{3bbd3c14-4c16-4989-8366-95bc9179779d} -  No File
Toolbar: HKLM-x32 - No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} -  No File
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWow64\EZUPBH~1.DLL [52920 2011-07-15] (EasyBits Software Corp.)
ShellExecuteHooks-x32:  - UPB:{B5A7F190-DDA6-4420-B3BA-52453494E6CD} -  No File [ ]
Tcpip\..\Interfaces\{1ECC3226-0A37-4BA8-BE6D-A31C31DA44E7}: [NameServer]193.189.250.101 193.189.250.100

FireFox:
========
FF ProfilePath: C:\Users\ast\AppData\Roaming\Mozilla\Firefox\Profiles\6eypn46a.default
FF NewTab: chrome://unitedtb/content/newtab/newtab-page.xhtml
FF Homepage: https://startpage.com/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll ()
FF Plugin: @java.com/DTPlugin,version=10.15.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.15.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX Player Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\ast\AppData\Roaming\Mozilla\Firefox\Profiles\6eypn46a.default\searchplugins\11-suche.xml
FF SearchPlugin: C:\Users\ast\AppData\Roaming\Mozilla\Firefox\Profiles\6eypn46a.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\ast\AppData\Roaming\Mozilla\Firefox\Profiles\6eypn46a.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\ast\AppData\Roaming\Mozilla\Firefox\Profiles\6eypn46a.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\ast\AppData\Roaming\Mozilla\Firefox\Profiles\6eypn46a.default\searchplugins\nation-secure-search.xml
FF SearchPlugin: C:\Users\ast\AppData\Roaming\Mozilla\Firefox\Profiles\6eypn46a.default\searchplugins\webde-suche.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\nation-secure-search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: FoxLingo - C:\Users\ast\AppData\Roaming\Mozilla\Firefox\Profiles\6eypn46a.default\Extensions\{ef62e1ce-d2a4-4cdd-b7ec-92b120366b66}
FF Extension: FoxyDeal - C:\Users\ast\AppData\Roaming\Mozilla\Firefox\Profiles\6eypn46a.default\Extensions\{F58A62EB-38DC-43C4-A539-DC52E135208D}
FF Extension: firefox - C:\Users\ast\AppData\Roaming\Mozilla\Firefox\Profiles\6eypn46a.default\Extensions\firefox@whilokii.net.xpi
FF Extension: toolbar - C:\Users\ast\AppData\Roaming\Mozilla\Firefox\Profiles\6eypn46a.default\Extensions\toolbar@web.de.xpi
FF Extension: zulagames - C:\Users\ast\AppData\Roaming\Mozilla\Firefox\Profiles\6eypn46a.default\Extensions\zulagames@ZulaGames.com.xpi
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\extensions\websitelogon@truesuite.com

Chrome:
=======
CHR HomePage: hxxp://www.google.com
CHR RestoreOnStartup: "hxxp://www.google.com"
CHR DefaultSearchURL: (Conduit) - hxxp://www.google.com
CHR DefaultSuggestURL: (Conduit) - hxxp://www.google.com
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.69\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_287.dll No File
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.69\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.69\pdf.dll ()
CHR Plugin: (Simple Pass 2011) - C:\Users\ast\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdhihajbmafmgilcciomnamcjfkdhikl\1.0_0\npwebsitelogon.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (DivX Player Netscape Plugin) - C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
CHR Plugin: (Windows Live Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
CHR Extension: (YouTube) - C:\Users\ast\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\ast\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Plus-HD-2.4) - C:\Users\ast\AppData\Local\Google\Chrome\User Data\Default\Extensions\hojmbfiljpkaijkdifoaacbpallpfkkf\1.24.48_0
CHR Extension: (Gmail) - C:\Users\ast\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1
CHR HKLM-x32\...\Chrome\Extension: [hdhihajbmafmgilcciomnamcjfkdhikl] - C:\Program Files (x86)\HP SimplePass 2011\tschrome.crx

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440392 2013-09-30] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440392 2013-09-30] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1164360 2013-09-30] (Avira Operations GmbH & Co. KG)
S3 COMSysApp; C:\Windows\SysWow64\dllhost.exe [7168 2009-07-14] (Microsoft Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 msiserver; C:\Windows\SysWow64\msiexec.exe [73216 2010-11-21] (Microsoft Corporation)
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [247152 2009-04-17] ()
R2 WSearch; C:\Windows\SysWow64\SearchIndexer.exe [427520 2011-05-04] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105856 2013-09-30] (Avira Operations GmbH & Co. KG)
R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [46368 2013-10-13] (AVG Technologies)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132600 2013-09-30] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-09-30] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [83160 2013-09-30] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 STTub30; C:\Windows\System32\Drivers\STTub30.sys [44768 2009-04-14] (STM)
S3 STTub30; C:\Windows\SysWow64\Drivers\STTub30.sys [31104 2009-03-24] (STM)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-10-24 10:48 - 2013-10-24 10:48 - 01955412 _____ (Farbar) C:\Users\ast\Downloads\FRST64.exe
2013-10-23 18:50 - 2013-10-23 18:50 - 00891167 _____ C:\Users\ast\Downloads\SecurityCheck.exe
2013-10-23 16:59 - 2013-10-23 16:59 - 02347384 _____ (ESET) C:\Users\ast\Downloads\esetsmartinstaller_enu.exe
2013-10-23 10:59 - 2013-10-23 16:44 - 00000000 ____D C:\BUS-BAHN
2013-10-21 15:17 - 2013-10-21 15:17 - 01060070 _____ C:\Users\ast\Downloads\adwcleaner.exe
2013-10-21 14:37 - 2013-10-21 14:37 - 01033335 _____ (Thisisu) C:\Users\ast\Downloads\JRT_6.0.7.exe
2013-10-17 12:39 - 2013-10-17 12:39 - 00000940 _____ C:\Users\Public\Desktop\Free PDF to Word Converter.lnk
2013-10-17 12:39 - 2013-10-17 12:39 - 00000000 ____D C:\Users\ast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Free PDF to Word Converter
2013-10-17 12:39 - 2013-10-17 12:39 - 00000000 ____D C:\Program Files\Free PDF to Word Converter
2013-10-15 17:01 - 2013-10-15 17:01 - 00000000 ____D C:\Users\ast\AppData\Roaming\Avira
2013-10-15 17:00 - 2013-10-15 17:00 - 00000000 _____ C:\Users\ast\Documents\APNSetup2.exe
2013-10-15 17:00 - 2013-10-15 17:00 - 00000000 _____ C:\Users\ast\Documents\APNSetup.exe
2013-10-15 16:58 - 2013-10-15 16:58 - 00002026 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-10-15 16:58 - 2013-10-15 16:58 - 00000000 ____D C:\ProgramData\Avira
2013-10-15 16:58 - 2013-10-15 16:58 - 00000000 ____D C:\Program Files (x86)\Avira
2013-10-15 16:58 - 2013-09-30 11:01 - 00132600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-10-15 16:58 - 2013-09-30 11:01 - 00105856 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-10-15 16:58 - 2013-09-30 11:01 - 00083160 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-10-15 16:58 - 2013-09-30 11:01 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-10-14 00:01 - 2013-10-14 00:01 - 00000000 ____D C:\Users\ast\AppData\Roaming\TeamViewer
2013-10-13 20:33 - 2013-10-13 20:34 - 32013346 _____ C:\Users\ast\Downloads\avira_free_antivirus_de(1).exe.part
2013-10-13 18:55 - 2013-10-13 18:55 - 00001069 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-10-13 18:55 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-10-13 18:54 - 2013-10-13 18:54 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\ast\Downloads\mbam-setup-1.75.0.1300.exe
2013-10-13 18:14 - 2013-10-13 18:14 - 00000000 _____ C:\Users\ast\Documents\APNSetup1.exe
2013-10-13 18:06 - 2013-10-13 18:10 - 122946048 _____ C:\Users\ast\Downloads\avira14_free_antivirus_de.exe
2013-10-13 17:49 - 2013-10-13 17:49 - 00003694 _____ C:\Windows\System32\Tasks\Adobe-Online-Aktualisierungsprogramm
2013-10-13 17:39 - 2013-10-13 17:39 - 00000000 ____D C:\Users\ast\AppData\Roaming\AVG
2013-10-13 17:38 - 2013-10-13 17:47 - 00000000 __SHD C:\ProgramData\{01BD4FC9-2F86-4706-A62E-774BB7E9D308}
2013-10-13 17:38 - 2013-10-13 17:43 - 00000000 ____D C:\ProgramData\AVG
2013-10-13 16:33 - 2013-10-13 16:33 - 00003230 _____ C:\Windows\System32\Tasks\SidebarExecute
2013-10-13 16:33 - 2013-10-13 16:33 - 00001702 _____ C:\Program Files (x86)\Mozilla Firefoxnation-secure-search.xml
2013-10-13 16:33 - 2013-10-13 16:33 - 00000000 ____D C:\Users\ast\AppData\Roaming\TuneUp Software
2013-10-13 16:33 - 2013-10-13 16:32 - 00046368 _____ (AVG Technologies) C:\Windows\system32\Drivers\avgtpx64.sys
2013-10-13 16:31 - 2013-10-13 18:24 - 00000000 ____D C:\Program Files (x86)\AVG
2013-10-13 16:22 - 2013-10-13 18:24 - 00000000 ____D C:\ProgramData\MFAData
2013-10-13 16:22 - 2013-10-13 16:22 - 04424240 _____ (AVG Technologies) C:\Users\ast\Downloads\avg_avct_stb_all_2014_4116_cm10.exe
2013-10-13 16:22 - 2013-10-13 16:22 - 00000000 ____D C:\Users\ast\AppData\Local\MFAData
2013-10-10 22:23 - 2013-10-23 18:53 - 00000000 ____D C:\AAAA-Trojaner
2013-10-10 21:46 - 2013-10-10 21:46 - 00000000 ____D C:\FRST
2013-10-10 21:36 - 2013-10-10 21:36 - 00000000 ____D C:\Windows\ERUNT
2013-10-10 14:30 - 2013-10-13 18:55 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-10-10 14:30 - 2013-10-10 14:30 - 00000000 ____D C:\Users\ast\AppData\Roaming\Malwarebytes
2013-10-10 14:30 - 2013-10-10 14:30 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-10 13:23 - 2013-10-10 13:23 - 00000000 ____D C:\Users\ast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PDF-to-Word
2013-10-10 11:57 - 2013-10-21 15:21 - 00000000 ____D C:\AdwCleaner
2013-10-02 14:15 - 2013-10-04 16:16 - 00000000 ____D C:\AA-GoogleKamp
2013-10-01 11:01 - 2013-10-13 16:33 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-25 08:55 - 2013-09-25 08:55 - 97673008 _____ C:\Windows\SysWOW64\璉ꚾ*

==================== One Month Modified Files and Folders =======

2013-10-24 10:48 - 2013-10-24 10:48 - 01955412 _____ (Farbar) C:\Users\ast\Downloads\FRST64.exe
2013-10-24 10:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\tracing
2013-10-24 10:38 - 2012-11-06 18:24 - 00000000 ____D C:\A-MANUALS
2013-10-24 10:34 - 2012-04-06 11:12 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-10-24 10:18 - 2012-10-16 15:39 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-10-24 09:18 - 2012-10-16 15:39 - 00001100 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-10-24 09:02 - 2013-03-15 10:16 - 00000000 ____D C:\A-Umsatz
2013-10-24 08:33 - 2009-07-14 06:45 - 00031856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-24 08:33 - 2009-07-14 06:45 - 00031856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-24 08:29 - 2011-09-23 01:41 - 01891487 _____ C:\Windows\WindowsUpdate.log
2013-10-24 08:26 - 2012-12-09 19:20 - 00065536 _____ C:\Windows\system32\Ikeext.etl
2013-10-24 08:26 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-24 08:26 - 2009-07-14 06:51 - 00098921 _____ C:\Windows\setupact.log
2013-10-24 08:25 - 2010-11-21 05:47 - 01094408 _____ C:\Windows\PFRO.log
2013-10-23 18:53 - 2013-10-10 22:23 - 00000000 ____D C:\AAAA-Trojaner
2013-10-23 18:50 - 2013-10-23 18:50 - 00891167 _____ C:\Users\ast\Downloads\SecurityCheck.exe
2013-10-23 17:07 - 2011-07-16 06:07 - 00654166 _____ C:\Windows\system32\perfh007.dat
2013-10-23 17:07 - 2011-07-16 06:07 - 00130006 _____ C:\Windows\system32\perfc007.dat
2013-10-23 17:07 - 2009-07-14 07:13 - 01498506 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-23 16:59 - 2013-10-23 16:59 - 02347384 _____ (ESET) C:\Users\ast\Downloads\esetsmartinstaller_enu.exe
2013-10-23 16:51 - 2012-11-26 11:09 - 00000000 ____D C:\A-Marketing
2013-10-23 16:44 - 2013-10-23 10:59 - 00000000 ____D C:\BUS-BAHN
2013-10-22 11:40 - 2012-02-07 23:24 - 00000000 ____D C:\Users\ast\Documents\Youcam
2013-10-21 15:21 - 2013-10-10 11:57 - 00000000 ____D C:\AdwCleaner
2013-10-21 15:17 - 2013-10-21 15:17 - 01060070 _____ C:\Users\ast\Downloads\adwcleaner.exe
2013-10-21 14:37 - 2013-10-21 14:37 - 01033335 _____ (Thisisu) C:\Users\ast\Downloads\JRT_6.0.7.exe
2013-10-20 23:21 - 2012-11-17 10:20 - 00003174 _____ C:\Windows\System32\Tasks\HPCeeScheduleForast
2013-10-20 23:21 - 2012-11-17 10:20 - 00000324 _____ C:\Windows\Tasks\HPCeeScheduleForast.job
2013-10-18 22:28 - 2012-01-19 21:10 - 00000000 ____D C:\B-Africa-House
2013-10-18 18:02 - 2013-09-11 11:21 - 00000000 ____D C:\AA-Motion-Sensor
2013-10-17 12:39 - 2013-10-17 12:39 - 00000940 _____ C:\Users\Public\Desktop\Free PDF to Word Converter.lnk
2013-10-17 12:39 - 2013-10-17 12:39 - 00000000 ____D C:\Users\ast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Free PDF to Word Converter
2013-10-17 12:39 - 2013-10-17 12:39 - 00000000 ____D C:\Program Files\Free PDF to Word Converter
2013-10-15 17:01 - 2013-10-15 17:01 - 00000000 ____D C:\Users\ast\AppData\Roaming\Avira
2013-10-15 17:00 - 2013-10-15 17:00 - 00000000 _____ C:\Users\ast\Documents\APNSetup2.exe
2013-10-15 17:00 - 2013-10-15 17:00 - 00000000 _____ C:\Users\ast\Documents\APNSetup.exe
2013-10-15 16:58 - 2013-10-15 16:58 - 00002026 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-10-15 16:58 - 2013-10-15 16:58 - 00000000 ____D C:\ProgramData\Avira
2013-10-15 16:58 - 2013-10-15 16:58 - 00000000 ____D C:\Program Files (x86)\Avira
2013-10-14 09:13 - 2012-10-16 15:39 - 00004100 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-10-14 09:13 - 2012-10-16 15:39 - 00003848 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-10-14 02:11 - 2013-08-30 10:23 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-10-14 02:11 - 2012-09-18 20:16 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-10-14 02:11 - 2012-02-14 12:43 - 00000000 ____D C:\Windows\system32\Macromed
2013-10-14 02:11 - 2011-07-15 20:33 - 00000000 ____D C:\Windows\SysWOW64\Macromed
2013-10-14 02:11 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration
2013-10-14 02:11 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\AppCompat
2013-10-14 02:09 - 2012-05-03 10:36 - 00000000 ____D C:\Users\ast\AppData\Local\Google
2013-10-14 00:01 - 2013-10-14 00:01 - 00000000 ____D C:\Users\ast\AppData\Roaming\TeamViewer
2013-10-13 20:34 - 2013-10-13 20:33 - 32013346 _____ C:\Users\ast\Downloads\avira_free_antivirus_de(1).exe.part
2013-10-13 18:55 - 2013-10-13 18:55 - 00001069 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-10-13 18:55 - 2013-10-10 14:30 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-10-13 18:54 - 2013-10-13 18:54 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\ast\Downloads\mbam-setup-1.75.0.1300.exe
2013-10-13 18:24 - 2013-10-13 16:31 - 00000000 ____D C:\Program Files (x86)\AVG
2013-10-13 18:24 - 2013-10-13 16:22 - 00000000 ____D C:\ProgramData\MFAData
2013-10-13 18:14 - 2013-10-13 18:14 - 00000000 _____ C:\Users\ast\Documents\APNSetup1.exe
2013-10-13 18:10 - 2013-10-13 18:06 - 122946048 _____ C:\Users\ast\Downloads\avira14_free_antivirus_de.exe
2013-10-13 17:49 - 2013-10-13 17:49 - 00003694 _____ C:\Windows\System32\Tasks\Adobe-Online-Aktualisierungsprogramm
2013-10-13 17:47 - 2013-10-13 17:38 - 00000000 __SHD C:\ProgramData\{01BD4FC9-2F86-4706-A62E-774BB7E9D308}
2013-10-13 17:47 - 2012-02-16 12:59 - 00000000 ____D C:\ProgramData\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}
2013-10-13 17:47 - 2012-02-06 16:47 - 00000000 ____D C:\Users\ast\AppData\Local\Downloaded Installations
2013-10-13 17:47 - 2012-01-06 19:21 - 00000000 ____D C:\Users\ast\AppData\Roaming\hpqlog
2013-10-13 17:43 - 2013-10-13 17:38 - 00000000 ____D C:\ProgramData\AVG
2013-10-13 17:39 - 2013-10-13 17:39 - 00000000 ____D C:\Users\ast\AppData\Roaming\AVG
2013-10-13 16:33 - 2013-10-13 16:33 - 00003230 _____ C:\Windows\System32\Tasks\SidebarExecute
2013-10-13 16:33 - 2013-10-13 16:33 - 00001702 _____ C:\Program Files (x86)\Mozilla Firefoxnation-secure-search.xml
2013-10-13 16:33 - 2013-10-13 16:33 - 00000000 ____D C:\Users\ast\AppData\Roaming\TuneUp Software
2013-10-13 16:33 - 2013-10-01 11:01 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-10-13 16:32 - 2013-10-13 16:33 - 00046368 _____ (AVG Technologies) C:\Windows\system32\Drivers\avgtpx64.sys
2013-10-13 16:22 - 2013-10-13 16:22 - 04424240 _____ (AVG Technologies) C:\Users\ast\Downloads\avg_avct_stb_all_2014_4116_cm10.exe
2013-10-13 16:22 - 2013-10-13 16:22 - 00000000 ____D C:\Users\ast\AppData\Local\MFAData
2013-10-13 16:12 - 2012-01-06 19:18 - 00000000 ____D C:\Users\ast
2013-10-10 21:46 - 2013-10-10 21:46 - 00000000 ____D C:\FRST
2013-10-10 21:36 - 2013-10-10 21:36 - 00000000 ____D C:\Windows\ERUNT
2013-10-10 14:30 - 2013-10-10 14:30 - 00000000 ____D C:\Users\ast\AppData\Roaming\Malwarebytes
2013-10-10 14:30 - 2013-10-10 14:30 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-10 13:23 - 2013-10-10 13:23 - 00000000 ____D C:\Users\ast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PDF-to-Word
2013-10-09 14:34 - 2012-04-06 11:12 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-10-09 14:34 - 2012-04-06 11:12 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-10-09 14:34 - 2011-07-15 20:33 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-10-04 16:16 - 2013-10-02 14:15 - 00000000 ____D C:\AA-GoogleKamp
2013-10-04 12:33 - 2013-09-23 09:08 - 00000000 ____D C:\BremenWahl2013
2013-10-04 12:28 - 2012-02-06 12:06 - 00000000 ____D C:\Users\ast\AppData\Local\CrashDumps
2013-10-04 11:04 - 2013-09-18 18:53 - 00000000 ____D C:\AA-SAP
2013-10-02 13:36 - 2013-04-21 17:11 - 00000000 ____D C:\A-ADREmail
2013-10-01 12:11 - 2012-09-18 20:16 - 00000000 ____D C:\Users\ast\AppData\Local\Mozilla
2013-09-30 11:01 - 2013-10-15 16:58 - 00132600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-09-30 11:01 - 2013-10-15 16:58 - 00105856 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-09-30 11:01 - 2013-10-15 16:58 - 00083160 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-09-30 11:01 - 2013-10-15 16:58 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-09-25 20:36 - 2013-07-05 12:14 - 00000000 ____D C:\AA-Mitbewerb
2013-09-25 08:55 - 2013-09-25 08:55 - 97673008 _____ C:\Windows\SysWOW64\璉ꚾ*

Some content of TEMP:
====================
C:\Users\ast\AppData\Local\Temp\APNSetup1.exe
C:\Users\ast\AppData\Local\Temp\AskSLib.dll
C:\Users\ast\AppData\Local\Temp\avgnt.exe
C:\Users\ast\AppData\Local\Temp\bdfilters.dll
C:\Users\ast\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\ast\AppData\Local\Temp\hvpekgi0.dll
C:\Users\ast\AppData\Local\Temp\ICReinstall_DownloadManagerSetup.exe
C:\Users\ast\AppData\Local\Temp\installhelper.dll
C:\Users\ast\AppData\Local\Temp\nsc9501.tmp.exe
C:\Users\ast\AppData\Local\Temp\nsj8C58.tmp.exe
C:\Users\ast\AppData\Local\Temp\oi_{CCBA115E-48D0-444E-9060-72FA624116E3}.exe
C:\Users\ast\AppData\Local\Temp\pdf24-creator-update.exe
C:\Users\ast\AppData\Local\Temp\Quarantine.exe
C:\Users\ast\AppData\Local\Temp\SetupDataMngr_jZip.exe
C:\Users\ast\AppData\Local\Temp\sp58915.exe
C:\Users\ast\AppData\Local\Temp\SRAssetsHelper.dll
C:\Users\ast\AppData\Local\Temp\tbSyst.dll
C:\Users\ast\AppData\Local\Temp\UninstallHPSA.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-10-21 11:31

==================== End Of Log ============================
--- --- ---

schrauber 24.10.2013 11:55
Dein Bildschirm? Aber nur im Browser oder? wenn ja in welchem?

alst_str 24.10.2013 12:46
danke schrauber,
ja, immer dann wenn ich online bin, geht's los mit dem Werbemüll.
Und ich glaube sogar, nur bei Firefox.
Kannst Du damit was anfangen?
Gruß

schrauber 25.10.2013 06:51
Revo Uninstaller - Download - Filepony
damit Firefox deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren.

nochmal testen und ein frisches FRST log bitte.

alst_str 25.10.2013 08:41
danke schrauber,

hab ich gemacht. Allerdings mit komischem Gefühl.
Ich hab auch darauf verzichtet (in zweiten Lauf mit Tiefenscann) ca. 1.000
Einträge zu löschen, die im Namen Mozilla haben. Aus Angst davor, dass mir meine Email-Accounts um die Ohren fliegen.
Also, der Werbemüll ist immer noch da.
Also ALLE Einträge - auch die Firefox/Mozilla Einträge - löschen?????

Gruß

schrauber 25.10.2013 11:14
Ja, aber nur Firefox, nicht Thunderbird.


Alle Zeitangaben in WEZ +1. Es ist jetzt 19:25 Uhr.
Seite 2 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131