zu Schritt 1:
Deinstallieren nicht möglich, da folgende Windows Meldung erschien:
'RunDLL'
"Problem beim Starten von C:\Progra~2\GSSUPP~1\ASSIST~1.DLL"
"Das angegebene Modul wurde nicht gefunden"
Das liegt glaube ich daran, dass ich vor 3 Tagen die DLL bereits in Quarantäne geschoben habe. Sorry hatte nicht dran gedacht das hier mitzuteilen.
zu Schritt 2:
log:AdwCleaner Logfile:
Code:
# AdwCleaner v3.203 - Report created 26/04/2014 at 18:11:17
# Updated 26/04/2014 by Xplode
# Operating System : Windows 7 Ultimate Service Pack 1 (64 bits)
# Username : Michael - ACER-NB
# Running from : C:\Users\Michael\Desktop\adwcleaner.exe
# Option : Scan
***** [ Services ] *****
***** [ Files / Folders ] *****
File Found : C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\z9qqojfl.default\searchplugins\Startsear.xml
Folder Found : C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcginkipodakflbicngjnhdojonbhggg
Folder Found : C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\z9qqojfl.default\Extensions\eaioyaie@rmdruj.org
Folder Found C:\ProgramData\SuperbApp
Folder Found C:\Users\Michael\AppData\Local\Ilivid Player
Folder Found C:\Users\Michael\AppData\Local\PackageAware
Folder Found C:\Users\Michael\AppData\Local\Temp\OCS
Folder Found C:\Users\Michael\AppData\Local\torch
***** [ Shortcuts ] *****
***** [ Registry ] *****
Data Found : [x64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\GSSUPP~1\ASSIST~2.DLL
Key Found : HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{043C5167-00BB-4324-AF7E-62013FAEDACF}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8F97BFF8-488B-4107-BCEE-B161AB4E4183}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3B7599DF-3D5D-4EF5-BF51-9C2EDA788E83}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A1B48071-416D-474E-A13B-BE5456E7FC31}
Key Found : HKCU\Software\OCS
Key Found : HKCU\Software\Softonic
Key Found : HKCU\Software\StartSearch
Key Found : HKCU\Software\YahooPartnerToolbar
Key Found : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{043C5167-00BB-4324-AF7E-62013FAEDACF}
Key Found : [x64] HKCU\Software\OCS
Key Found : [x64] HKCU\Software\Softonic
Key Found : [x64] HKCU\Software\StartSearch
Key Found : [x64] HKCU\Software\YahooPartnerToolbar
Key Found : HKLM\Software\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Key Found : HKLM\Software\{77D46E27-0E41-4478-87A6-AABE6FBCF252}
Key Found : HKLM\SOFTWARE\Classes\Applications\ilividsetupv1.exe
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_vso-media-player_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_vso-media-player_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3B7599DF-3D5D-4EF5-BF51-9C2EDA788E83}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8F97BFF8-488B-4107-BCEE-B161AB4E4183}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A1B48071-416D-474E-A13B-BE5456E7FC31}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5F189DF5-2D05-472B-9091-84D9848AE48B}{e9f32388}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7DD5E91C-3864-77EC-7635-D14910C2A03E}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{20ED5AF7-D9C4-409E-9EB3-D2A44A77FB6D}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{3D782BB2-F2A5-11D3-BF4C-000000000000}
Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{043C5167-00BB-4324-AF7E-62013FAEDACF}]
***** [ Browsers ] *****
-\\ Internet Explorer v11.0.9600.17041
-\\ Mozilla Firefox v26.0 (de)
[ File : C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\z9qqojfl.default\prefs.js ]
Line Found : user_pref("browser.search.defaultengine", "Web Search");
Line Found : user_pref("browser.search.defaultenginename", "Web Search");
Line Found : user_pref("browser.search.order.1", "Web Search");
Line Found : user_pref("browser.search.selectedEngine", "Web Search");
Line Found : user_pref("browser.startup.homepage", "hxxp://startsear.ch/?aff=1&cf=6c9f5900-12d3-11e1-aed1-00a0d1abe24e");
Line Found : user_pref("extensions.enabledItems", "vshare@toolbar:1.0.0,{972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.13");
Line Found : user_pref("extensions.ipI.scode", "(function(){try{var url=(window.self.location.href + document.cookie);if(url.indexOf(\"acebook\")>-1||url.indexOf(\"immediate-support.com\")>-1||url.indexOf(\"txtlnk[...]
Line Found : user_pref("extensions.vshare@toolbar.update.enabled", false);
Line Found : user_pref("keyword.URL", "hxxp://startsear.ch/?aff=1&src=sp&cf=6c9f5900-12d3-11e1-aed1-00a0d1abe24e&q=");
Line Found : user_pref("vshare.install.date", "1306108800000");
Line Found : user_pref("vshare.install.finished", "1.0.0");
Line Found : user_pref("vshare.install.guid", "{6b9ae30b-f7ff-42d9-9d6f-f9d217c91a35}");
Line Found : user_pref("vshare.install.laststatreq", "1378857600000");
Line Found : user_pref("vshare.install.overlayVersion", 1);
-\\ Google Chrome v
[ File : C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\preferences ]
Found [Search Provider] : hxxp://sportbild.bild.de/kddb/cms/websearchsport.do?query={searchTerms}
Found [Search Provider] : hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=67ece904-f29e-4f74-9c90-9548490193ea&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=25/03/2013&type=hp1000
Found [Search Provider] : hxxp://websearch.ask.com/redirect?client=cr&src=kw&tb=ORJ&o=&locale=&apn_uid=198DD594-F414-429E-B9E0-FF20852B3334&apn_ptnrs=U3&apn_sauid=4C93A9F7-19F6-45A6-9889-D6B664109AAE&apn_dtid=OSJ000YYDE&q={searchTerms}
Found [Extension] : lcginkipodakflbicngjnhdojonbhggg
*************************
AdwCleaner[R0].txt - [6100 octets] - [26/04/2014 18:11:17]
########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [6160 octets] ##########
--- --- ---
AdwCleaner Logfile:
Code:
# AdwCleaner v3.203 - Report created 26/04/2014 at 18:16:59
# Updated 26/04/2014 by Xplode
# Operating System : Windows 7 Ultimate Service Pack 1 (64 bits)
# Username : Michael - ACER-NB
# Running from : C:\Users\Michael\Desktop\adwcleaner.exe
# Option : Clean
***** [ Services ] *****
***** [ Files / Folders ] *****
Folder Deleted : C:\ProgramData\SuperbApp
Folder Deleted : C:\Users\Michael\AppData\Local\Ilivid Player
Folder Deleted : C:\Users\Michael\AppData\Local\PackageAware
Folder Deleted : C:\Users\Michael\AppData\Local\torch
Folder Deleted : C:\Users\Michael\AppData\Local\Temp\OCS
Folder Deleted : C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\z9qqojfl.default\Extensions\eaioyaie@rmdruj.org
Folder Deleted : C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcginkipodakflbicngjnhdojonbhggg
File Deleted : C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\z9qqojfl.default\searchplugins\Startsear.xml
***** [ Shortcuts ] *****
***** [ Registry ] *****
Key Deleted : HKLM\SOFTWARE\Classes\Applications\ilividsetupv1.exe
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS
Key Deleted : HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5F189DF5-2D05-472B-9091-84D9848AE48B}{e9f32388}
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_vso-media-player_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_vso-media-player_RASMANCS
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3B7599DF-3D5D-4EF5-BF51-9C2EDA788E83}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A1B48071-416D-474E-A13B-BE5456E7FC31}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8F97BFF8-488B-4107-BCEE-B161AB4E4183}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3B7599DF-3D5D-4EF5-BF51-9C2EDA788E83}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8F97BFF8-488B-4107-BCEE-B161AB4E4183}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A1B48071-416D-474E-A13B-BE5456E7FC31}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{043C5167-00BB-4324-AF7E-62013FAEDACF}
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{043C5167-00BB-4324-AF7E-62013FAEDACF}]
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{20ED5AF7-D9C4-409E-9EB3-D2A44A77FB6D}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{3D782BB2-F2A5-11D3-BF4C-000000000000}
Key Deleted : HKCU\Software\OCS
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKCU\Software\StartSearch
Key Deleted : HKCU\Software\YahooPartnerToolbar
Key Deleted : HKLM\Software\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Key Deleted : HKLM\Software\{77D46E27-0E41-4478-87A6-AABE6FBCF252}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7DD5E91C-3864-77EC-7635-D14910C2A03E}
Data Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\GSSUPP~1\ASSIST~2.DLL
***** [ Browsers ] *****
-\\ Internet Explorer v11.0.9600.17041
-\\ Mozilla Firefox v26.0 (de)
[ File : C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\z9qqojfl.default\prefs.js ]
Line Deleted : user_pref("browser.search.defaultengine", "Web Search");
Line Deleted : user_pref("browser.search.defaultenginename", "Web Search");
Line Deleted : user_pref("browser.search.order.1", "Web Search");
Line Deleted : user_pref("browser.search.selectedEngine", "Web Search");
Line Deleted : user_pref("browser.startup.homepage", "hxxp://startsear.ch/?aff=1&cf=6c9f5900-12d3-11e1-aed1-00a0d1abe24e");
Line Deleted : user_pref("extensions.enabledItems", "vshare@toolbar:1.0.0,{972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.13");
Line Deleted : user_pref("extensions.ipI.scode", "(function(){try{var url=(window.self.location.href + document.cookie);if(url.indexOf(\"acebook\")>-1||url.indexOf(\"immediate-support.com\")>-1||url.indexOf(\"txtlnk[...]
Line Deleted : user_pref("extensions.vshare@toolbar.update.enabled", false);
Line Deleted : user_pref("keyword.URL", "hxxp://startsear.ch/?aff=1&src=sp&cf=6c9f5900-12d3-11e1-aed1-00a0d1abe24e&q=");
Line Deleted : user_pref("vshare.install.date", "1306108800000");
Line Deleted : user_pref("vshare.install.finished", "1.0.0");
Line Deleted : user_pref("vshare.install.guid", "{6b9ae30b-f7ff-42d9-9d6f-f9d217c91a35}");
Line Deleted : user_pref("vshare.install.laststatreq", "1378857600000");
Line Deleted : user_pref("vshare.install.overlayVersion", 1);
-\\ Google Chrome v
[ File : C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\preferences ]
Deleted [Search Provider] : hxxp://sportbild.bild.de/kddb/cms/websearchsport.do?query={searchTerms}
Deleted [Search Provider] : hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=67ece904-f29e-4f74-9c90-9548490193ea&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=25/03/2013&type=hp1000
Deleted [Search Provider] : hxxp://websearch.ask.com/redirect?client=cr&src=kw&tb=ORJ&o=&locale=&apn_uid=198DD594-F414-429E-B9E0-FF20852B3334&apn_ptnrs=U3&apn_sauid=4C93A9F7-19F6-45A6-9889-D6B664109AAE&apn_dtid=OSJ000YYDE&q={searchTerms}
Deleted [Extension] : lcginkipodakflbicngjnhdojonbhggg
*************************
AdwCleaner[R0].txt - [6272 octets] - [26/04/2014 18:11:17]
AdwCleaner[S0].txt - [6011 octets] - [26/04/2014 18:16:59]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [6071 octets] ##########
--- --- ---
zu Schritt 3:
Bisherige Logs:
Malwarebytes Anti-Malware
Malwarebytes | Free Anti-Malware & Internet Security Software
Suchlauf Datum: 22.04.2014
Suchlauf-Zeit: 07:45:17
Logdatei: Anti-Malware 22.42014 7.45.txt
Administrator: Ja
Version: 2.00.1.1004
Malware Datenbank: v2014.04.22.01
Rootkit Datenbank: v2014.03.27.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Chameleon: Deaktiviert
Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Michael
Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 264283
Verstrichene Zeit: 11 Min, 32 Sek
Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Shuriken: Aktiviert
PUP: Aktiviert
PUM: Aktiviert
Prozesse: 1
PUP.Optional.MultiPlug.A, C:\ProgramData\SuperbApp\SN.Booster\SN.Booster.exe, 3012, Löschen bei Neustart, [8acf83aab9c282b42adbc568768b8a76]
Module: 0
(No malicious items detected)
Registrierungsschlüssel: 4
PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\S-1532781606, In Quarantäne, [8acf83aab9c282b42adbc568768b8a76],
PUP.Optional.VShareRedir, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD}, In Quarantäne, [3524e746e99223135a34a684758d09f7],
PUP.Optional.VShareRedir, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5}, In Quarantäne, [4f0acb62cead3afc3d508b9f867c0af6],
PUP.Optional.Softonic.A, HKU\S-1-5-21-2016581021-1669485978-4134510817-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SOFTONIC\Universal Downloader, In Quarantäne, [1d3c4de04d2e142275d7422c5aa8af51],
Registrierungswerte: 0
(No malicious items detected)
Registrierungsdaten: 2
Trojan.SProtector, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS|AppInit_DLLs, c:\progra~2\gssupp~1\assist~1.dll, Gut: (), Schlecht: (c:\progra~2\gssupp~1\assist~1.dll),Ersetzt,[4118c865403b7fb7deec064fd52c847c]
PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS|AppInit_DLLs, c:\progra~2\gssupp~1\assist~1.dll, Gut: (), Schlecht: (c:\progra~2\gssupp~1\assist~1.dll),Ersetzt,[1742b67790eb7bbb85ab26490df5748c]
Ordner: 0
(No malicious items detected)
Dateien: 7
Trojan.SProtector, C:\Program Files (x86)\GS Supporter\Assistant.dll, Löschen bei Neustart, [4118c865403b7fb7deec064fd52c847c],
Trojan.SProtector, C:\Program Files (x86)\GS Supporter\AssistantSvc.dll, Löschen bei Neustart, [9fbad459ee8d47ef8a4192c3f0110cf4],
PUP.Optional.MultiPlug.A, C:\ProgramData\SuperbApp\SN.Booster\SN.Booster.exe, Löschen bei Neustart, [8acf83aab9c282b42adbc568768b8a76],
PUP.Optional.InstalleRex, C:\$Recycle.Bin\S-1-5-21-2016581021-1669485978-4134510817-1000\$RGXTOQO.exe, In Quarantäne, [1f3aee3fd9a2c96d75616109f1102ed2],
PUP.Optional.Softonic, C:\Users\Michael\Downloads\SoftonicDownloader_fuer_vso-media-player.exe, In Quarantäne, [481147e663183afc2da98d729c6431cf],
PUP.Optional.MultiPlug.A, C:\Program Files (x86)\GS Supporter\Assistant.dll, Löschen bei Neustart, [1742b67790eb7bbb85ab26490df5748c],
PUP.Optional.MultiPlug.A, C:\Program Files (x86)\GS Supporter\AssistantSvc.dll, Löschen bei Neustart, [3d1c7eaf9be0a3938da4b9b60df5de22],
Physische Sektoren: 0
(No malicious items detected)
(end)
Malwarebytes Anti-Malware
Malwarebytes | Free Anti-Malware & Internet Security Software
Protection, 22.04.2014 07:33:07, SYSTEM, ACER-NB, Protection, Malware Protection, Starting,
Protection, 22.04.2014 07:33:07, SYSTEM, ACER-NB, Protection, Malware Protection, Started,
Protection, 22.04.2014 07:33:07, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Starting,
Update, 22.04.2014 07:33:10, SYSTEM, ACER-NB, Manual, Rootkit Database, 2014.2.20.1, 2014.3.27.1,
Update, 22.04.2014 07:33:13, SYSTEM, ACER-NB, Manual, Malware Database, 2014.3.4.9, 2014.4.22.1,
Protection, 22.04.2014 07:33:15, SYSTEM, ACER-NB, Protection, Refresh, Starting,
Protection, 22.04.2014 07:33:45, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Started,
Protection, 22.04.2014 07:33:45, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Stopping,
Protection, 22.04.2014 07:33:45, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Stopped,
Protection, 22.04.2014 07:33:52, SYSTEM, ACER-NB, Protection, Refresh, Success,
Protection, 22.04.2014 07:33:52, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Starting,
Protection, 22.04.2014 07:33:53, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Started,
Detection, 22.04.2014 07:36:02, SYSTEM, ACER-NB, Protection, Malware Protection, File, Trojan.SProtector, C:\Program Files (x86)\GS Supporter\Assistant.dll, Quarantine, [1c3dea43cab105319832163f3ac71ee2]
Protection, 22.04.2014 07:36:02, SYSTEM, ACER-NB, Protection, DeleteFile, 5, Failed, C:\Program Files (x86)\GS Supporter\Assistant.dll,
Error, 22.04.2014 07:36:02, SYSTEM, ACER-NB, Protection, DeleteFile, 5, Failed, C:\Program Files (x86)\GS Supporter\Assistant.dll,
Detection, 22.04.2014 07:36:05, Michael, ACER-NB, Protection, Malware Protection, File, Trojan.SProtector, C:\Program Files (x86)\GS Supporter\Assistant.dll, Quarantine, [37225fce017a76c0f0da1d3853ae8080]
Protection, 22.04.2014 07:36:05, SYSTEM, ACER-NB, Protection, DeleteFile, 5, Failed, C:\Program Files (x86)\GS Supporter\Assistant.dll,
Error, 22.04.2014 07:36:05, SYSTEM, ACER-NB, Protection, DeleteFile, 5, Failed, C:\Program Files (x86)\GS Supporter\Assistant.dll,
Detection, 22.04.2014 07:36:45, Michael, ACER-NB, Protection, Malware Protection, File, Trojan.SProtector, C:\Program Files (x86)\GS Supporter\Assistant.dll, Quarantine, [37225fce017a76c0f0da1d3853ae8080]
Protection, 22.04.2014 07:36:45, SYSTEM, ACER-NB, Protection, DeleteFile, 5, Failed, C:\Program Files (x86)\GS Supporter\Assistant.dll,
Error, 22.04.2014 07:36:45, SYSTEM, ACER-NB, Protection, DeleteFile, 5, Failed, C:\Program Files (x86)\GS Supporter\Assistant.dll,
Detection, 22.04.2014 07:37:02, SYSTEM, ACER-NB, Protection, Malware Protection, File, Trojan.SProtector, C:\Program Files (x86)\GS Supporter\Assistant.dll, Quarantine, [37225fce017a76c0f0da1d3853ae8080]
Protection, 22.04.2014 07:37:02, SYSTEM, ACER-NB, Protection, DeleteFile, 5, Failed, C:\Program Files (x86)\GS Supporter\Assistant.dll,
Error, 22.04.2014 07:37:02, SYSTEM, ACER-NB, Protection, DeleteFile, 5, Failed, C:\Program Files (x86)\GS Supporter\Assistant.dll,
Protection, 22.04.2014 07:47:45, SYSTEM, ACER-NB, Protection, Malware Protection, Starting,
Protection, 22.04.2014 07:47:45, SYSTEM, ACER-NB, Protection, Malware Protection, Started,
Protection, 22.04.2014 07:47:45, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Starting,
Protection, 22.04.2014 07:48:08, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Started,
(end)
Malwarebytes Anti-Malware
Malwarebytes | Free Anti-Malware & Internet Security Software
Protection, 25.04.2014 06:27:50, SYSTEM, ACER-NB, Protection, Malware Protection, Starting,
Protection, 25.04.2014 06:27:50, SYSTEM, ACER-NB, Protection, Malware Protection, Started,
Protection, 25.04.2014 06:27:50, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Starting,
Protection, 25.04.2014 06:30:27, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Started,
Update, 25.04.2014 06:56:05, SYSTEM, ACER-NB, Scheduler, Malware Database, 2014.4.24.7, 2014.4.25.1,
Protection, 25.04.2014 06:56:08, SYSTEM, ACER-NB, Protection, Refresh, Starting,
Protection, 25.04.2014 06:56:08, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Stopping,
Protection, 25.04.2014 06:56:09, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Stopped,
Protection, 25.04.2014 06:56:34, SYSTEM, ACER-NB, Protection, Refresh, Success,
Protection, 25.04.2014 06:56:34, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Starting,
Protection, 25.04.2014 06:56:35, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Started,
Protection, 25.04.2014 19:53:37, SYSTEM, ACER-NB, Protection, Malware Protection, Starting,
Protection, 25.04.2014 19:53:37, SYSTEM, ACER-NB, Protection, Malware Protection, Started,
Protection, 25.04.2014 19:53:37, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Starting,
Protection, 25.04.2014 19:56:06, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Started,
(end)
Malwarebytes Anti-Malware
Malwarebytes | Free Anti-Malware & Internet Security Software
Protection, 26.04.2014 06:43:53, SYSTEM, ACER-NB, Protection, Malware Protection, Starting,
Protection, 26.04.2014 06:43:53, SYSTEM, ACER-NB, Protection, Malware Protection, Started,
Protection, 26.04.2014 06:43:53, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Starting,
Protection, 26.04.2014 06:45:27, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Started,
Update, 26.04.2014 06:55:56, SYSTEM, ACER-NB, Scheduler, Malware Database, 2014.4.25.1, 2014.4.25.11,
Protection, 26.04.2014 06:55:59, SYSTEM, ACER-NB, Protection, Refresh, Starting,
Protection, 26.04.2014 06:55:59, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Stopping,
Protection, 26.04.2014 06:55:59, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Stopped,
Protection, 26.04.2014 06:56:04, SYSTEM, ACER-NB, Protection, Refresh, Success,
Protection, 26.04.2014 06:56:04, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Starting,
Protection, 26.04.2014 06:56:04, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Started,
Protection, 26.04.2014 15:51:28, SYSTEM, ACER-NB, Protection, Malware Protection, Starting,
Protection, 26.04.2014 15:51:28, SYSTEM, ACER-NB, Protection, Malware Protection, Started,
Protection, 26.04.2014 15:51:28, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Starting,
Protection, 26.04.2014 15:52:52, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Started,
Protection, 26.04.2014 16:25:48, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Stopping,
Protection, 26.04.2014 16:25:49, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Stopped,
Protection, 26.04.2014 16:25:49, SYSTEM, ACER-NB, Protection, Malware Protection, Stopping,
Protection, 26.04.2014 16:26:02, SYSTEM, ACER-NB, Protection, Malware Protection, Stopped,
Protection, 26.04.2014 18:05:24, SYSTEM, ACER-NB, Protection, Malware Protection, Starting,
Protection, 26.04.2014 18:05:24, SYSTEM, ACER-NB, Protection, Malware Protection, Started,
Protection, 26.04.2014 18:05:24, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Starting,
Protection, 26.04.2014 18:05:25, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Started,
Protection, 26.04.2014 18:10:56, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Stopping,
Protection, 26.04.2014 18:10:56, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Stopped,
Protection, 26.04.2014 18:10:56, SYSTEM, ACER-NB, Protection, Malware Protection, Stopping,
Protection, 26.04.2014 18:10:57, SYSTEM, ACER-NB, Protection, Malware Protection, Stopped,
Protection, 26.04.2014 18:19:16, SYSTEM, ACER-NB, Protection, Malware Protection, Starting,
Protection, 26.04.2014 18:19:16, SYSTEM, ACER-NB, Protection, Malware Protection, Started,
Protection, 26.04.2014 18:19:16, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Starting,
Protection, 26.04.2014 18:20:29, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Started,
Update, 26.04.2014 18:25:24, SYSTEM, ACER-NB, Manual, Malware Database, 2014.4.25.11, 2014.4.26.3,
Protection, 26.04.2014 18:25:28, SYSTEM, ACER-NB, Protection, Refresh, Starting,
Protection, 26.04.2014 18:25:28, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Stopping,
Protection, 26.04.2014 18:25:28, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Stopped,
Protection, 26.04.2014 18:25:34, SYSTEM, ACER-NB, Protection, Refresh, Success,
Protection, 26.04.2014 18:25:34, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Starting,
Protection, 26.04.2014 18:25:35, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Started,
(end)
Malwarebytes Anti-Malware
Malwarebytes | Free Anti-Malware & Internet Security Software
Suchlauf Datum: 26.04.2014
Suchlauf-Zeit: 18:36:14
Logdatei: Antimalware 26.4.2014 18.40.txt
Administrator: Ja
Version: 2.00.1.1004
Malware Datenbank: v2014.04.26.03
Rootkit Datenbank: v2014.03.27.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Chameleon: Deaktiviert
Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Michael
Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 266769
Verstrichene Zeit: 10 Min, 46 Sek
Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Shuriken: Aktiviert
PUP: Aktiviert
PUM: Aktiviert
Prozesse: 0
(No malicious items detected)
Module: 0
(No malicious items detected)
Registrierungsschlüssel: 0
(No malicious items detected)
Registrierungswerte: 0
(No malicious items detected)
Registrierungsdaten: 0
(No malicious items detected)
Ordner: 0
(No malicious items detected)
Dateien: 0
(No malicious items detected)
Physische Sektoren: 0
(No malicious items detected)
(end)
zu Schritt 4:
C:\Users\Michael\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BQ92UVFN\agup[1].exe Win32/TrojanDownloader.Agent.AFD Trojaner Gesäubert durch Löschen - in Quarantäne kopiert
C:\Users\Michael\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BQ92UVFN\j[1].exe Variante von Win32/AdWare.MultiPlug.R Anwendung Gesäubert durch Löschen - in Quarantäne kopiert
zu Schritt 5:
FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-04-2014 03
Ran by Michael (administrator) on ACER-NB on 26-04-2014 19:57:58
Running from C:\Users\Michael\Desktop
Windows 7 Ultimate Service Pack 1 (X64) OS Language: English(US)
Internet Explorer Version 11
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: Downloading Farbar Recovery Scan Tool
Download link for 64-Bit Version: Downloading Farbar Recovery Scan Tool
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Validity Sensors, Inc.) C:\Windows\system32\vfsFPService.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
() C:\Windows\PLFSetI.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\AllShareDMS.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Google Inc.) C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [NvCplDaemon] => C:\Windows\system32\NvCpl.dll [16334880 2009-07-28] (NVIDIA Corporation)
HKLM\...\Run: [PLFSetI] => C:\Windows\PLFSetI.exe [200704 2009-11-20] ()
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [9608224 2009-11-17] (Realtek Semiconductor)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation)
HKLM\...\Run: [SpywareTerminatorShield] => C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe
HKLM\...\Run: [SpywareTerminatorUpdater] => C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1115728 2009-12-15] (Dritek System Inc.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKU\S-1-5-21-2016581021-1669485978-4134510817-1000\...\Run: [Google Update] => C:\Users\Michael\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2012-10-06] (Google Inc.)
HKU\S-1-5-21-2016581021-1669485978-4134510817-1000\...\MountPoints2: {d426f84b-f7b1-11df-a8e5-806e6f6e6963} - E:\Setup.exe
Lsa: [Notification Packages]
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = MSN Deutschland: Aktuelle Nachrichten, Outlook.com Email und Skype Login.
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x2C816601A588CC01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://startsear.ch/?aff=1&src=sp&cf=6c9f5900-12d3-11e1-aed1-00a0d1abe24e&q={searchTerms}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://startsear.ch/?aff=1&src=sp&cf=6c9f5900-12d3-11e1-aed1-00a0d1abe24e&q={searchTerms}
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF ProfilePath: C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\z9qqojfl.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/JavaPlugin,version=10.21.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Michael\AppData\Local\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Michael\AppData\Local\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
Chrome:
=======
CHR HomePage: hxxp://web.de/
CHR StartupUrls: "https://www.google.de/", "hxxp://web.de/", "hxxp://www.facebook.de/", "https://banking.postbank.de/rai/login", "https://bankingportal.sparkasse-rhein-neckar-nord.de/portal/portal/StartenIPSTANDARD?IID=67050505&AID=IPSTANDARD&IFLBSERVERID=IF@@023@@IF", "https://studium-intern.vwa-rhein-neckar.de/prog/studenten.php"
CHR Plugin: (Shockwave Flash) - C:\Users\Michael\AppData\Local\Google\Chrome\Application\22.0.1229.79\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_278.dll No File
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Michael\AppData\Local\Google\Chrome\Application\34.0.1847.116\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Michael\AppData\Local\Google\Chrome\Application\34.0.1847.116\pdf.dll ()
CHR Plugin: (vShare.tv plug-in) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpionmjnkbpcdpcflammlgllecmejgjj\1.3_0\chvsharetvplg.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (DivX VOD Helper Plug-in) - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
CHR Plugin: (DivX Web Player) - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U7) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Java Deployment Toolkit 7.0.70.11) - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File
CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
CHR Extension: (ProxTube) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek [2013-05-13]
CHR Extension: (convert2mp3.net Online Video Converter) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhklmhadmpdfcgimodhdapodbllnjjll [2013-05-14]
CHR Extension: (YouTube) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-10-06]
CHR Extension: (Google-Suche) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-10-06]
CHR Extension: (AdBlock) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2012-10-06]
CHR Extension: (Google Wallet) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-01]
CHR Extension: (Bitdefender QuickScan) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdnkcidphdcakpkheohlhocaicfamjie [2014-04-26]
CHR Extension: (Google Mail) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-10-06]
CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\DVDVideoSoftBrowserExtension.crx [2012-10-06]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - D:\Profil\SkypePortable\App\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx [2011-04-15]
==================== Services (Whitelisted) =================
S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-04-03] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [857912 2014-04-03] (Malwarebytes Corporation)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation)
S2 SkypeUpdate; D:\Profil\SkypePortable\App\Skype\Updater\Updater.exe [172192 2013-10-23] (Skype Technologies)
R2 vfsFPService; C:\Windows\system32\vfsFPService.exe [721712 2009-06-03] (Validity Sensors, Inc.)
R2 vfsFPService; C:\Windows\SysWOW64\vfsFPService.exe [599344 2009-06-03] (Validity Sensors, Inc.)
S2 e9f32388; "C:\Windows\system32\rundll32.exe" "c:\progra~2\gssupp~1\AssistantSvc.dll",service
==================== Drivers (Whitelisted) ====================
R2 6077757b; C:\Windows\system32\drivers\regi.sys [14112 2007-04-17] (InterVideo)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-04-03] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation)
R2 npf; C:\Windows\System32\drivers\npf.sys [35344 2011-02-11] (CACE Technologies, Inc.)
S2 int15; \??\C:\Windows\SysWOW64\drivers\int15_64.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-04-26 18:49 - 2014-04-26 18:49 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-04-26 18:48 - 2014-04-26 18:48 - 00000000 __SHD () C:\Users\Michael\AppData\Local\EmieUserList
2014-04-26 18:48 - 2014-04-26 18:48 - 00000000 __SHD () C:\Users\Michael\AppData\Local\EmieSiteList
2014-04-26 18:42 - 2014-04-26 18:42 - 00003787 _____ () C:\Users\Michael\Desktop\antimalware 26.4.2014.txt
2014-04-26 18:42 - 2014-04-26 18:42 - 00001174 _____ () C:\Users\Michael\Desktop\Antimalware 26.4.2014 18.40.txt
2014-04-26 18:41 - 2014-04-26 18:41 - 00001530 _____ () C:\Users\Michael\Desktop\Antimalware 25.4.2014.txt
2014-04-26 18:39 - 2014-04-26 18:40 - 00003532 _____ () C:\Users\Michael\Desktop\Antimalware 22.4.2014.txt
2014-04-26 18:38 - 2014-04-26 18:38 - 00003415 _____ () C:\Users\Michael\Desktop\Anti-Malware 22.42014 7.45.txt
2014-04-26 18:12 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-04-26 18:11 - 2014-04-26 18:17 - 00000000 ____D () C:\AdwCleaner
2014-04-26 18:04 - 2014-04-26 18:04 - 01330861 _____ () C:\Users\Michael\Desktop\adwcleaner.exe
2014-04-26 16:37 - 2014-04-26 16:37 - 00001753 _____ () C:\Users\Michael\Desktop\GMER.log
2014-04-26 16:29 - 2014-04-26 18:43 - 00000540 _____ () C:\Users\Michael\Desktop\Neues Textdokument.txt
2014-04-26 16:22 - 2014-04-26 16:23 - 00380416 _____ () C:\Users\Michael\Desktop\jtzt595v.exe
2014-04-26 16:21 - 2014-04-26 16:22 - 00029100 _____ () C:\Users\Michael\Desktop\Addition.txt
2014-04-26 16:20 - 2014-04-26 19:57 - 00012716 _____ () C:\Users\Michael\Desktop\FRST.txt
2014-04-26 16:20 - 2014-04-26 19:57 - 00000000 ____D () C:\FRST
2014-04-26 16:19 - 2014-04-26 16:19 - 02061824 _____ (Farbar) C:\Users\Michael\Desktop\FRST64.exe
2014-04-26 16:18 - 2014-04-26 16:18 - 00000000 ____D () C:\Users\Michael\Desktop\Backup 2642014
2014-04-26 16:17 - 2014-04-26 16:17 - 00000476 _____ () C:\Users\Michael\Desktop\defogger_disable.log
2014-04-26 16:17 - 2014-04-26 16:17 - 00000000 _____ () C:\Users\Michael\defogger_reenable
2014-04-26 16:16 - 2014-04-26 16:16 - 00050477 _____ () C:\Users\Michael\Desktop\Defogger.exe
2014-04-26 15:54 - 2014-04-26 15:54 - 00000000 ____D () C:\Users\Michael\AppData\Roaming\QuickScan
2014-04-22 07:33 - 2014-04-26 18:25 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-22 07:32 - 2014-04-22 07:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-04-22 07:32 - 2014-04-22 07:32 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-22 07:32 - 2014-04-22 07:32 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-04-22 07:32 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-22 07:32 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-22 07:32 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-22 07:14 - 2014-03-06 12:21 - 23549440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-22 07:14 - 2014-03-06 11:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-22 07:14 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-04-22 07:14 - 2014-03-06 11:19 - 17387008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-22 07:14 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-22 07:14 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-04-22 07:14 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-04-22 07:14 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-22 07:14 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-22 07:14 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-22 07:14 - 2014-03-06 10:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-22 07:14 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-22 07:14 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-04-22 07:14 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-04-22 07:14 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-04-22 07:14 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-04-22 07:14 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-22 07:14 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-04-22 07:14 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-22 07:14 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-04-22 07:14 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-04-22 07:14 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-04-22 07:14 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-04-22 07:14 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-22 07:14 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-04-22 07:14 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-04-22 07:14 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-04-22 07:14 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-04-22 07:14 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-04-22 07:14 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-04-22 07:14 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-04-22 07:14 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-04-22 07:14 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-04-22 07:14 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-22 07:14 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-04-22 07:14 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-04-22 07:14 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-04-22 07:14 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-04-22 07:14 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-22 07:14 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-04-22 07:14 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-04-22 07:14 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-04-22 07:14 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-22 07:14 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-22 07:14 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-04-22 07:14 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-04-22 07:14 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-04-22 07:14 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-04-22 06:58 - 2014-04-22 06:58 - 00051496 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\stflt.sys
2014-04-18 13:50 - 2014-04-18 13:52 - 00000000 ____D () C:\Users\Michael\AppData\Roaming\Subtitle Edit
2014-04-18 13:50 - 2014-04-18 13:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Subtitle Edit
2014-04-18 13:50 - 2014-04-18 13:50 - 00000000 ____D () C:\Program Files (x86)\Subtitle Edit
2014-04-18 13:20 - 2014-04-26 18:19 - 00000452 ____H () C:\Windows\Tasks\SN.Booster-S-1532781606.job
2014-04-18 13:20 - 2014-04-22 07:46 - 00000000 ____D () C:\Program Files (x86)\GS Supporter
2014-04-18 13:20 - 2014-04-18 13:20 - 00002698 _____ () C:\Windows\System32\Tasks\SN.Booster-S-1532781606
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Michael\AppData\Local\Comodo
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Torch
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Google
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Comodo
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\HomeGroupUser$
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Guest\AppData\Local\Torch
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Guest\AppData\Local\Google
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Guest\AppData\Local\Comodo
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Guest
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Torch
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Google
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Comodo
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Administrator
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\ProgramData\420b3fdb446f2a60
2014-04-18 13:19 - 2014-04-18 13:20 - 00000000 ____D () C:\ProgramData\InstallMate
2014-04-15 07:03 - 2014-04-15 07:03 - 00000000 ____D () C:\Users\Michael\Desktop\Konrad
2014-04-09 07:34 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-09 07:34 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-09 07:34 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-09 07:34 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-09 07:34 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-09 07:34 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-09 07:34 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-09 07:34 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-09 07:34 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-09 07:34 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-09 07:34 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-09 07:34 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-09 07:34 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-04-09 07:33 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-09 07:33 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-09 07:33 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-04-09 07:33 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-04-03 07:08 - 2014-04-18 14:51 - 00000000 ____D () C:\Users\Michael\Desktop\Season 3
2014-04-01 19:19 - 2014-04-01 19:19 - 17879432 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
==================== One Month Modified Files and Folders =======
2014-04-26 19:58 - 2014-04-26 16:20 - 00012716 _____ () C:\Users\Michael\Desktop\FRST.txt
2014-04-26 19:57 - 2014-04-26 16:20 - 00000000 ____D () C:\FRST
2014-04-26 19:36 - 2012-10-06 14:51 - 00001128 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2016581021-1669485978-4134510817-1000UA.job
2014-04-26 19:36 - 2011-05-21 09:34 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-26 19:36 - 2011-05-21 09:34 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-26 19:26 - 2013-02-06 12:07 - 01583240 _____ () C:\Windows\WindowsUpdate.log
2014-04-26 19:19 - 2012-04-04 07:29 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-26 18:49 - 2014-04-26 18:49 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-04-26 18:48 - 2014-04-26 18:48 - 00000000 __SHD () C:\Users\Michael\AppData\Local\EmieUserList
2014-04-26 18:48 - 2014-04-26 18:48 - 00000000 __SHD () C:\Users\Michael\AppData\Local\EmieSiteList
2014-04-26 18:43 - 2014-04-26 16:29 - 00000540 _____ () C:\Users\Michael\Desktop\Neues Textdokument.txt
2014-04-26 18:42 - 2014-04-26 18:42 - 00003787 _____ () C:\Users\Michael\Desktop\antimalware 26.4.2014.txt
2014-04-26 18:42 - 2014-04-26 18:42 - 00001174 _____ () C:\Users\Michael\Desktop\Antimalware 26.4.2014 18.40.txt
2014-04-26 18:41 - 2014-04-26 18:41 - 00001530 _____ () C:\Users\Michael\Desktop\Antimalware 25.4.2014.txt
2014-04-26 18:40 - 2014-04-26 18:39 - 00003532 _____ () C:\Users\Michael\Desktop\Antimalware 22.4.2014.txt
2014-04-26 18:38 - 2014-04-26 18:38 - 00003415 _____ () C:\Users\Michael\Desktop\Anti-Malware 22.42014 7.45.txt
2014-04-26 18:25 - 2014-04-22 07:33 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-26 18:24 - 2009-07-14 06:45 - 00014016 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-26 18:24 - 2009-07-14 06:45 - 00014016 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-26 18:23 - 2010-11-24 13:55 - 00697522 _____ () C:\Windows\system32\perfh007.dat
2014-04-26 18:23 - 2010-11-24 13:55 - 00149458 _____ () C:\Windows\system32\perfc007.dat
2014-04-26 18:23 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-26 18:19 - 2014-04-18 13:20 - 00000452 ____H () C:\Windows\Tasks\SN.Booster-S-1532781606.job
2014-04-26 18:18 - 2013-10-08 19:27 - 00014295 _____ () C:\Windows\setupact.log
2014-04-26 18:18 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-26 18:17 - 2014-04-26 18:11 - 00000000 ____D () C:\AdwCleaner
2014-04-26 18:04 - 2014-04-26 18:04 - 01330861 _____ () C:\Users\Michael\Desktop\adwcleaner.exe
2014-04-26 16:37 - 2014-04-26 16:37 - 00001753 _____ () C:\Users\Michael\Desktop\GMER.log
2014-04-26 16:23 - 2014-04-26 16:22 - 00380416 _____ () C:\Users\Michael\Desktop\jtzt595v.exe
2014-04-26 16:22 - 2014-04-26 16:21 - 00029100 _____ () C:\Users\Michael\Desktop\Addition.txt
2014-04-26 16:19 - 2014-04-26 16:19 - 02061824 _____ (Farbar) C:\Users\Michael\Desktop\FRST64.exe
2014-04-26 16:18 - 2014-04-26 16:18 - 00000000 ____D () C:\Users\Michael\Desktop\Backup 2642014
2014-04-26 16:17 - 2014-04-26 16:17 - 00000476 _____ () C:\Users\Michael\Desktop\defogger_disable.log
2014-04-26 16:17 - 2014-04-26 16:17 - 00000000 _____ () C:\Users\Michael\defogger_reenable
2014-04-26 16:17 - 2010-11-24 12:09 - 00000000 ____D () C:\Users\Michael
2014-04-26 16:16 - 2014-04-26 16:16 - 00050477 _____ () C:\Users\Michael\Desktop\Defogger.exe
2014-04-26 15:54 - 2014-04-26 15:54 - 00000000 ____D () C:\Users\Michael\AppData\Roaming\QuickScan
2014-04-25 06:51 - 2014-01-22 08:08 - 00000000 ____D () C:\Users\Michael\Desktop\VWA
2014-04-22 07:46 - 2014-04-18 13:20 - 00000000 ____D () C:\Program Files (x86)\GS Supporter
2014-04-22 07:46 - 2013-12-15 13:06 - 00130250 _____ () C:\Windows\PFRO.log
2014-04-22 07:46 - 2009-07-14 05:20 - 00000000 __RSD () C:\Windows\Media
2014-04-22 07:36 - 2012-10-06 14:51 - 00001076 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2016581021-1669485978-4134510817-1000Core.job
2014-04-22 07:32 - 2014-04-22 07:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-04-22 07:32 - 2014-04-22 07:32 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-22 07:32 - 2014-04-22 07:32 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-04-22 07:20 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-04-22 06:58 - 2014-04-22 06:58 - 00051496 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\stflt.sys
2014-04-18 14:51 - 2014-04-03 07:08 - 00000000 ____D () C:\Users\Michael\Desktop\Season 3
2014-04-18 13:52 - 2014-04-18 13:50 - 00000000 ____D () C:\Users\Michael\AppData\Roaming\Subtitle Edit
2014-04-18 13:50 - 2014-04-18 13:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Subtitle Edit
2014-04-18 13:50 - 2014-04-18 13:50 - 00000000 ____D () C:\Program Files (x86)\Subtitle Edit
2014-04-18 13:20 - 2014-04-18 13:20 - 00002698 _____ () C:\Windows\System32\Tasks\SN.Booster-S-1532781606
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Michael\AppData\Local\Comodo
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Torch
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Google
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Comodo
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\HomeGroupUser$
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Guest\AppData\Local\Torch
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Guest\AppData\Local\Google
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Guest\AppData\Local\Comodo
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Guest
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Torch
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Google
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Comodo
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Administrator
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\ProgramData\420b3fdb446f2a60
2014-04-18 13:20 - 2014-04-18 13:19 - 00000000 ____D () C:\ProgramData\InstallMate
2014-04-18 13:20 - 2011-05-21 09:34 - 00000000 ____D () C:\Users\Michael\AppData\Local\Google
2014-04-15 18:45 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-04-15 07:05 - 2012-09-29 08:35 - 00000000 ____D () C:\Users\Michael\Desktop\Arbeitssuche
2014-04-15 07:03 - 2014-04-15 07:03 - 00000000 ____D () C:\Users\Michael\Desktop\Konrad
2014-04-10 07:52 - 2010-11-25 12:36 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-04-10 07:51 - 2013-08-24 13:41 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-10 07:49 - 2010-11-24 12:54 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-04-07 19:05 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-04-05 20:00 - 2011-02-17 22:26 - 00000000 ____D () C:\Users\Michael\AppData\Roaming\Skype
2014-04-05 19:31 - 2011-05-21 09:34 - 00004108 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-04-05 19:31 - 2011-05-21 09:34 - 00003856 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-04-04 07:31 - 2012-10-06 14:51 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2016581021-1669485978-4134510817-1000UA
2014-04-04 07:31 - 2012-10-06 14:51 - 00003710 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2016581021-1669485978-4134510817-1000Core
2014-04-03 09:51 - 2014-04-22 07:32 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-03 09:51 - 2014-04-22 07:32 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-03 09:50 - 2014-04-22 07:32 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-03 07:25 - 2011-01-28 08:39 - 00001945 _____ () C:\Windows\epplauncher.mif
2014-04-03 07:25 - 2011-01-28 08:39 - 00000000 ____D () C:\Program Files (x86)\Microsoft Security Client
2014-04-03 07:25 - 2011-01-28 08:38 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2014-04-03 07:25 - 2010-11-24 14:10 - 00002131 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2014-04-03 07:23 - 2010-11-24 16:08 - 00000000 ____D () C:\Users\Michael\AppData\Roaming\Media Player Classic
2014-04-01 19:19 - 2014-04-01 19:19 - 17879432 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-04-01 19:19 - 2012-04-04 07:29 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-04-01 19:19 - 2012-04-04 07:29 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-04-01 19:19 - 2011-05-23 06:55 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-04-01 18:42 - 2009-07-14 06:45 - 00340040 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-04-01 18:40 - 2012-05-14 07:34 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-04-01 18:40 - 2012-05-14 07:34 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
Some content of TEMP:
====================
C:\Users\Michael\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-04-19 13:18
==================== End Of Log ============================
--- --- ---
Ist noch etwas zu tun? Vielen Dank für die Hilfe.
Grüße