Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Stake 7 öffnet sich im FF 30 in neuem Tab (https://www.trojaner-board.de/156048-stake-7-oeffnet-ff-30-neuem-tab.html)

Kassiopeia88 03.07.2014 20:51
Stake 7 öffnet sich im FF 30 in neuem Tab
 
Hallo Trojaner-Board-Leute :)

ich hab seit 5 Tagen das Problem, dass sich im Hintergrund im FF sich sehr oft wenn ich irgendwo hinklicke im Hintergrund "Stake7"-Casino-Werbung öffnet. Ich bin auf dieses Forum gekommen in dem ich das gegoogelt habe. Es gab also schonmal exakt das Problem vor ein Paar Tagen. Ich hab die Anweisungen dort (hoffentlich) erfüllt und poste mal meine Loggs.

Ich hoffe sehr ihr könnt mir helfen, da ich es allein nicht hinbekommen habe trotz der guten Anweisungen von "Schrauber"

Malwarebytes Anti-Malware
www.malwarebytes.org


Protection, 03.07.2014 20:56:36, SYSTEM, KASSIOPEIA, Protection, Malware Protection, Starting,
Protection, 03.07.2014 20:56:36, SYSTEM, KASSIOPEIA, Protection, Malware Protection, Started,
Protection, 03.07.2014 20:56:36, SYSTEM, KASSIOPEIA, Protection, Malicious Website Protection, Starting,
Protection, 03.07.2014 20:56:36, SYSTEM, KASSIOPEIA, Protection, Malicious Website Protection, Started,
Update, 03.07.2014 20:56:43, SYSTEM, KASSIOPEIA, Manual, Rootkit Database, 2014.2.20.1, 2014.7.1.1,
Update, 03.07.2014 20:56:50, SYSTEM, KASSIOPEIA, Manual, Malware Database, 2014.3.4.9, 2014.7.3.5,
Protection, 03.07.2014 20:56:53, SYSTEM, KASSIOPEIA, Protection, Refresh, Starting,
Protection, 03.07.2014 20:56:53, SYSTEM, KASSIOPEIA, Protection, Malicious Website Protection, Stopping,
Protection, 03.07.2014 20:56:53, SYSTEM, KASSIOPEIA, Protection, Malicious Website Protection, Stopped,
Protection, 03.07.2014 20:56:55, SYSTEM, KASSIOPEIA, Protection, Refresh, Success,
Protection, 03.07.2014 20:56:55, SYSTEM, KASSIOPEIA, Protection, Malicious Website Protection, Starting,
Protection, 03.07.2014 20:56:55, SYSTEM, KASSIOPEIA, Protection, Malicious Website Protection, Started,
Protection, 03.07.2014 21:04:48, SYSTEM, KASSIOPEIA, Protection, Malware Protection, Starting,
Protection, 03.07.2014 21:04:48, SYSTEM, KASSIOPEIA, Protection, Malware Protection, Started,
Protection, 03.07.2014 21:04:48, SYSTEM, KASSIOPEIA, Protection, Malicious Website Protection, Starting,
Protection, 03.07.2014 21:05:41, SYSTEM, KASSIOPEIA, Protection, Malicious Website Protection, Started,
Protection, 03.07.2014 21:11:12, SYSTEM, KASSIOPEIA, Protection, Malware Protection, Starting,
Protection, 03.07.2014 21:11:12, SYSTEM, KASSIOPEIA, Protection, Malware Protection, Started,
Protection, 03.07.2014 21:11:12, SYSTEM, KASSIOPEIA, Protection, Malicious Website Protection, Starting,
Protection, 03.07.2014 21:12:05, SYSTEM, KASSIOPEIA, Protection, Malicious Website Protection, Started,
Update, 03.07.2014 21:21:22, SYSTEM, KASSIOPEIA, Scheduler, Rootkit Database, 2014.7.1.1, 2014.7.3.1,
Protection, 03.07.2014 21:21:28, SYSTEM, KASSIOPEIA, Protection, Refresh, Starting,
Protection, 03.07.2014 21:21:28, SYSTEM, KASSIOPEIA, Protection, Malicious Website Protection, Stopping,
Protection, 03.07.2014 21:21:28, SYSTEM, KASSIOPEIA, Protection, Malicious Website Protection, Stopped,
Protection, 03.07.2014 21:21:30, SYSTEM, KASSIOPEIA, Protection, Refresh, Success,
Protection, 03.07.2014 21:21:30, SYSTEM, KASSIOPEIA, Protection, Malicious Website Protection, Starting,
Protection, 03.07.2014 21:21:31, SYSTEM, KASSIOPEIA, Protection, Malicious Website Protection, Started,
Protection, 03.07.2014 21:42:19, SYSTEM, KASSIOPEIA, Protection, Malware Protection, Starting,
Protection, 03.07.2014 21:42:19, SYSTEM, KASSIOPEIA, Protection, Malware Protection, Started,
Protection, 03.07.2014 21:42:19, SYSTEM, KASSIOPEIA, Protection, Malicious Website Protection, Starting,
Protection, 03.07.2014 21:43:11, SYSTEM, KASSIOPEIA, Protection, Malicious Website Protection, Started,

(end)













# AdwCleaner v3.214 - Bericht erstellt am 03/07/2014 um 21:09:45
# Aktualisiert 29/06/2014 von Xplode
# Betriebssystem : Windows 8 Pro (64 bits)
# Benutzername : Philip - KASSIOPEIA
# Gestartet von : C:\Users\Philip\Downloads\adwcleaner_3.214.exe
# Option : Löschen

***** [ Dienste ] *****

Dienst Gelöscht : iSafeKrnl
Dienst Gelöscht : iSafeNetFilter
[#] Dienst Gelöscht : iSafeService

***** [ Dateien / Ordner ] *****

[!] Ordner Gelöscht : C:\Program Files (x86)\iSafe
Ordner Gelöscht : C:\Users\Philip\AppData\Roaming\eCyber
Ordner Gelöscht : C:\Users\Philip\AppData\Roaming\iSafe

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gelöscht : HKCU\Software\SmartBar
Schlüssel Gelöscht : HKCU\Software\V9
Schlüssel Gelöscht : HKLM\Software\iSafe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\iSafe

***** [ Browser ] *****

-\\ Internet Explorer v10.0.9200.16537


-\\ Mozilla Firefox v30.0 (de)

[ Datei : C:\Users\Philip\AppData\Roaming\Mozilla\Firefox\Profiles\5z3jjiub.default-1397244305940\prefs.js ]


[ Datei : C:\Users\Philip\AppData\Roaming\Mozilla\Firefox\Profiles\lhjyypb3.default-1404257789088\prefs.js ]


-\\ Google Chrome v35.0.1916.153

[ Datei : C:\Users\Philip\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [11944 octets] - [16/04/2014 21:14:53]
AdwCleaner[R1].txt - [11875 octets] - [11/05/2014 21:03:49]
AdwCleaner[R2].txt - [2154 octets] - [03/07/2014 21:09:24]
AdwCleaner[S0].txt - [1395 octets] - [16/04/2014 21:15:13]
AdwCleaner[S1].txt - [9108 octets] - [11/05/2014 21:04:48]
AdwCleaner[S2].txt - [1975 octets] - [03/07/2014 21:09:45]

########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [2035 octets] ##########













~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 8 Pro x64
Ran by Philip on 03.07.2014 at 21:16:01,62
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services

Failed to stop: [Service] isafekrnl
Failed to stop: [Service] isafeservice



~~~ Registry Values



~~~ Registry Keys

Failed to delete: [Registry Key] HKEY_LOCAL_MACHINE\Software\isafe



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Users\Philip\AppData\Roaming\isafe"
Failed to delete: [Folder] "C:\Program Files (x86)\isafe"



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 03.07.2014 at 21:19:13,78
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

schrauber 03.07.2014 21:27
hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)


Kassiopeia88 04.07.2014 16:28
Huhu, hier die Files

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03-07-2014
Ran by Philip (administrator) on KASSIOPEIA on 03-07-2014 22:37:20
Running from C:\Users\Philip\Downloads
Platform: Windows 8 Pro (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 10
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(Elex do Brasil Participações Ltda) C:\Program Files (x86)\iSafe\iSafeSvc.exe
(Elex do Brasil Participações Ltda) C:\Program Files (x86)\iSafe\iSafeSvc2.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Elex do Brasil Participações Ltda) C:\Program Files (x86)\iSafe\iSafeTray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Mozilla Corporation) C:\Program Files\MozillaFireFox\firefox.exe
(Mozilla Corporation) C:\Program Files\MozillaFireFox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe


==================== Registry (Whitelisted) ==================

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [750160 2014-07-03] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2014-05-08] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [310064 2014-05-28] (Samsung Electronics Co., Ltd.)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-1730578352-2912700084-1204674380-1001\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-1730578352-2912700084-1204674380-1001\...\MountPoints2: {cd8fed85-c1a6-11e3-be66-806e6f6e6963} - "D:\Diablo III Setup.exe"

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://t.de.msn.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xF7481586B655CF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
StartMenuInternet: IEXPLORE.EXE - c:\program files (x86)\internet explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKLM - {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKLM-x32 - {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKCU - DefaultScope {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKCU - {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKCU - {9bb2c1cc-4a7d-4cd5-bce9-0ca5f9ff8391} URL = hxxp://wow.utop.it/?q={searchTerms}
BHO-x32: EZ YouTube Video Downloader 1.0 - {FDBFEA30-EC51-4B8D-B4F0-8CA4F7253C0A} - C:\Program Files (x86)\EZ YouTube Video Downloader\yvd.dll (XtensionPlus)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\Philip\AppData\Roaming\Mozilla\Firefox\Profiles\lhjyypb3.default-1404257789088
FF NewTab: about:blank
FF SearchEngineOrder.1: Google
FF SelectedSearchEngine: Google
FF Homepage: about:blank
FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Adblock Plus - C:\Users\Philip\AppData\Roaming\Mozilla\Firefox\Profiles\lhjyypb3.default-1404257789088\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-07-02]
FF HKLM\...\Firefox\Extensions: [{8167E8F2-A770-4EFB-BA53-8A511051CD9B}] - C:\Program Files (x86)\EZ YouTube Video Downloader\{8167E8F2-A770-4EFB-BA53-8A511051CD9B}
FF Extension: EZ YouTube Video Downloader - C:\Program Files (x86)\EZ YouTube Video Downloader\{8167E8F2-A770-4EFB-BA53-8A511051CD9B} [2014-07-01]
FF HKLM-x32\...\Firefox\Extensions: [{8167E8F2-A770-4EFB-BA53-8A511051CD9B}] - C:\Program Files (x86)\EZ YouTube Video Downloader\{8167E8F2-A770-4EFB-BA53-8A511051CD9B}
FF Extension: EZ YouTube Video Downloader - C:\Program Files (x86)\EZ YouTube Video Downloader\{8167E8F2-A770-4EFB-BA53-8A511051CD9B} [2014-07-01]

Chrome:
=======
CHR HomePage: about:blank
CHR StartupUrls: "about:blank"
CHR DefaultSearchKeyword: google
CHR DefaultSearchURL: hxxp://www.google.com/search?q={searchTerms}
CHR DefaultNewTabURL:
CHR Extension: (Google Docs) - C:\Users\Philip\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-04-13]
CHR Extension: (Google Drive) - C:\Users\Philip\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-04-13]
CHR Extension: (YouTube) - C:\Users\Philip\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-04-13]
CHR Extension: (FB Auto-Poker) - C:\Users\Philip\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmhccgdbmajoblcbfbgmhnpiecmjiadh [2014-04-13]
CHR Extension: (Google-Suche) - C:\Users\Philip\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-04-13]
CHR Extension: (Google Wallet) - C:\Users\Philip\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-13]
CHR Extension: (Google Mail) - C:\Users\Philip\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-04-13]

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-07-03] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-07-03] (Avira Operations GmbH & Co. KG)
R2 iSafeService; C:\Program Files (x86)\iSafe\iSafeSvc.exe [118056 2014-06-09] (Elex do Brasil Participações Ltda)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16056 2014-03-29] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

S0 amdkmafd; C:\Windows\System32\drivers\amdkmafd.sys [21160 2012-09-23] (Advanced Micro Devices, Inc.)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [215040 2013-09-24] (Advanced Micro Devices)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-07-03] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [130584 2014-05-27] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2014-02-25] (Avira Operations GmbH & Co. KG)
R3 iSafeKrnl; C:\Program Files (x86)\iSafe\iSafeKrnl.sys [232960 2014-06-09] (Elex do Brasil Participações Ltda)
R1 iSafeKrnlKit; C:\Program Files (x86)\iSafe\iSafeKrnlKit.sys [66048 2014-06-09] (Elex do Brasil Participações Ltda)
R1 iSafeNetFilter; C:\Program Files (x86)\iSafe\iSafeNetFilter.sys [48640 2014-06-09] (Elex do Brasil Participações Ltda)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [122584 2014-07-03] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2014-05-12] (Malwarebytes Corporation)
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
S3 iSafeKrnlBoot; \??\system32\DRIVERS\iSafeKrnlBoot.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-07-03 22:37 - 2014-07-03 22:37 - 00010580 _____ () C:\Users\Philip\Downloads\FRST.txt
2014-07-03 22:37 - 2014-07-03 22:37 - 00000000 ____D () C:\FRST
2014-07-03 22:36 - 2014-07-03 22:36 - 02083840 _____ (Farbar) C:\Users\Philip\Downloads\FRST64.exe
2014-07-03 21:46 - 2014-07-03 21:46 - 00000000 _____ () C:\Users\Philip\Desktop\Neues Textdokument.txt
2014-07-03 21:32 - 2014-07-03 21:33 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Philip\Downloads\mbam-setup-2.0.2.1012 (1).exe
2014-07-03 21:19 - 2014-07-03 21:19 - 00000901 _____ () C:\Users\Philip\Desktop\JRT.txt
2014-07-03 21:17 - 2014-07-03 22:34 - 00000000 ____D () C:\Users\Philip\AppData\Roaming\iSafe
2014-07-03 21:16 - 2014-07-03 21:16 - 00000000 ____D () C:\WINDOWS\ERUNT
2014-07-03 21:15 - 2014-07-03 21:15 - 01016261 _____ (Thisisu) C:\Users\Philip\Desktop\JRT.exe
2014-07-03 21:09 - 2014-07-03 21:09 - 01346519 _____ () C:\Users\Philip\Downloads\adwcleaner_3.214.exe
2014-07-03 20:56 - 2014-07-03 20:56 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-07-03 20:56 - 2014-07-03 20:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-07-03 20:56 - 2014-07-03 20:56 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-07-03 20:56 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2014-07-03 20:56 - 2014-05-12 07:26 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2014-07-03 20:56 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2014-07-03 20:54 - 2014-07-03 20:54 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Philip\Downloads\mbam-setup-2.0.2.1012.exe
2014-07-02 01:41 - 2014-07-02 01:41 - 02347384 _____ (ESET) C:\Users\Philip\Downloads\esetsmartinstaller_deu.exe
2014-07-02 01:41 - 2014-07-02 01:41 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-07-02 01:33 - 2014-07-02 01:33 - 00000929 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-07-02 01:33 - 2014-07-02 01:33 - 00000917 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-07-02 01:33 - 2014-07-02 01:33 - 00000000 ____D () C:\Program Files\MozillaFireFox
2014-07-02 01:33 - 2014-07-02 01:33 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-07-02 01:32 - 2014-07-02 01:32 - 29677544 _____ (Mozilla) C:\Users\Philip\Downloads\Firefox_Setup_de30.0 (1).exe
2014-07-02 01:29 - 2014-07-02 01:29 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Philip\Downloads\revosetup95.exe
2014-07-02 01:29 - 2014-07-02 01:29 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-07-01 21:31 - 2014-07-01 21:31 - 00000000 ____D () C:\Program Files (x86)\EZ YouTube Video Downloader
2014-06-30 00:44 - 2014-06-30 00:44 - 00000632 _____ () C:\Users\Philip\Desktop\CO Fragen.txt
2014-06-29 18:43 - 2014-06-29 18:43 - 00072048 _____ () C:\Users\Philip\AppData\Local\GDIPFONTCACHEV1.DAT
2014-06-28 18:48 - 2014-07-03 04:36 - 02212978 _____ () C:\ProgramData\Setup_EZ_YouTube_Video_Downloader_v1.2.0.exe
2014-06-27 20:19 - 2014-06-27 20:19 - 00000000 ____D () C:\Users\Philip\AppData\Roaming\Macromedia
2014-06-27 20:19 - 2014-06-27 20:19 - 00000000 ____D () C:\Users\Philip\AppData\Local\Macromedia
2014-06-25 01:16 - 2014-07-03 21:43 - 00000374 _____ () C:\WINDOWS\system32\Drivers\etc\hosts.ics
2014-06-22 18:41 - 2014-06-22 18:41 - 00151593 _____ () C:\Users\Philip\Downloads\IT & Security in hospitals - (Philip).pptx
2014-06-20 17:43 - 2014-06-20 17:44 - 00151508 _____ () C:\Users\Philip\Documents\IT & Security in hospitals.pptx
2014-06-20 04:17 - 2014-07-02 01:39 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-06-20 04:03 - 2014-06-20 04:03 - 00040371 _____ () C:\Users\Philip\Downloads\Data communication.pptx
2014-06-13 02:27 - 2014-06-13 02:27 - 00000000 ____D () C:\Users\Philip\AppData\Local\Blizzard
2014-06-13 02:17 - 2014-06-13 02:27 - 00000000 ____D () C:\Program Files\Hearthstone
2014-06-13 02:17 - 2014-06-13 02:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hearthstone
2014-06-12 20:54 - 2014-07-03 21:11 - 00003488 _____ () C:\WINDOWS\PFRO.log
2014-06-09 15:02 - 2014-07-02 15:25 - 01944089 _____ () C:\WINDOWS\WindowsUpdate.log
2014-06-08 02:48 - 2014-07-02 17:51 - 00000000 ____D () C:\Users\Philip\Desktop\Diverses
2014-06-04 23:18 - 2014-06-04 23:18 - 00000000 ____D () C:\Users\Public\Documents\NativeFus_Log
2014-06-04 23:18 - 2014-06-04 23:18 - 00000000 ____D () C:\Users\Philip\Documents\samsung
2014-06-04 23:18 - 2014-06-04 23:18 - 00000000 ____D () C:\Users\Philip\AppData\Roaming\Samsung
2014-06-04 23:18 - 2014-06-04 23:18 - 00000000 ____D () C:\Users\Philip\AppData\Local\Samsung
2014-06-04 23:17 - 2014-06-04 23:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
2014-06-04 23:17 - 2014-06-04 23:17 - 00000000 ____D () C:\Program Files (x86)\InstallShield Installation Information
2014-06-04 23:17 - 2014-04-30 19:43 - 04659712 _____ (Dmitry Streblechenko) C:\WINDOWS\SysWOW64\Redemption.dll
2014-06-04 23:17 - 2014-04-30 19:43 - 00144664 _____ (MAPILab Ltd. & Add-in Express Ltd.) C:\WINDOWS\SysWOW64\secman.dll
2014-06-04 23:17 - 2014-04-11 10:39 - 00206080 _____ (DEVGURU Co., LTD.(www.devguru.co.kr)) C:\WINDOWS\system32\Drivers\ssudmdm.sys
2014-06-04 23:17 - 2014-04-11 10:39 - 00110336 _____ (DEVGURU Co., LTD.(www.devguru.co.kr)) C:\WINDOWS\system32\Drivers\ssudbus.sys
2014-06-04 23:16 - 2014-06-04 23:17 - 00000000 ____D () C:\ProgramData\Samsung
2014-06-04 23:16 - 2014-06-04 23:17 - 00000000 ____D () C:\Program Files (x86)\Samsung
2014-06-04 23:16 - 2014-06-04 23:16 - 00000000 ____D () C:\Users\Philip\AppData\Local\Downloaded Installations

==================== One Month Modified Files and Folders =======

2014-07-03 22:37 - 2014-07-03 22:37 - 00010580 _____ () C:\Users\Philip\Downloads\FRST.txt
2014-07-03 22:37 - 2014-07-03 22:37 - 00000000 ____D () C:\FRST
2014-07-03 22:36 - 2014-07-03 22:36 - 02083840 _____ (Farbar) C:\Users\Philip\Downloads\FRST64.exe
2014-07-03 22:34 - 2014-07-03 21:17 - 00000000 ____D () C:\Users\Philip\AppData\Roaming\iSafe
2014-07-03 22:28 - 2014-04-11 22:20 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2014-07-03 22:07 - 2014-04-11 21:54 - 00122584 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-07-03 22:03 - 2012-07-26 10:12 - 00000000 ____D () C:\WINDOWS\system32\sru
2014-07-03 21:46 - 2014-07-03 21:46 - 00000000 _____ () C:\Users\Philip\Desktop\Neues Textdokument.txt
2014-07-03 21:46 - 2012-07-26 12:27 - 00751892 _____ () C:\WINDOWS\system32\perfh007.dat
2014-07-03 21:46 - 2012-07-26 12:27 - 00155620 _____ () C:\WINDOWS\system32\perfc007.dat
2014-07-03 21:46 - 2012-07-26 09:28 - 01745416 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2014-07-03 21:43 - 2014-06-25 01:16 - 00000374 _____ () C:\WINDOWS\system32\Drivers\etc\hosts.ics
2014-07-03 21:43 - 2014-04-13 21:17 - 00001128 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2014-07-03 21:42 - 2014-05-11 21:09 - 00000000 ____D () C:\Program Files (x86)\iSafe
2014-07-03 21:42 - 2012-07-26 09:22 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-07-03 21:41 - 2014-04-13 21:17 - 00001132 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2014-07-03 21:41 - 2012-07-26 10:12 - 00000000 ____D () C:\WINDOWS\Branding
2014-07-03 21:33 - 2014-07-03 21:32 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Philip\Downloads\mbam-setup-2.0.2.1012 (1).exe
2014-07-03 21:19 - 2014-07-03 21:19 - 00000901 _____ () C:\Users\Philip\Desktop\JRT.txt
2014-07-03 21:16 - 2014-07-03 21:16 - 00000000 ____D () C:\WINDOWS\ERUNT
2014-07-03 21:15 - 2014-07-03 21:15 - 01016261 _____ (Thisisu) C:\Users\Philip\Desktop\JRT.exe
2014-07-03 21:11 - 2014-06-12 20:54 - 00003488 _____ () C:\WINDOWS\PFRO.log
2014-07-03 21:10 - 2014-04-16 21:14 - 00000000 ____D () C:\AdwCleaner
2014-07-03 21:09 - 2014-07-03 21:09 - 01346519 _____ () C:\Users\Philip\Downloads\adwcleaner_3.214.exe
2014-07-03 21:04 - 2012-07-26 07:26 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI
2014-07-03 20:58 - 2014-04-30 17:01 - 00000000 ____D () C:\Users\Philip\AppData\Roaming\Skype
2014-07-03 20:56 - 2014-07-03 20:56 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-07-03 20:56 - 2014-07-03 20:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-07-03 20:56 - 2014-07-03 20:56 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-07-03 20:54 - 2014-07-03 20:54 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Philip\Downloads\mbam-setup-2.0.2.1012.exe
2014-07-03 19:48 - 2014-04-11 21:44 - 00117712 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avgntflt.sys
2014-07-03 04:36 - 2014-06-28 18:48 - 02212978 _____ () C:\ProgramData\Setup_EZ_YouTube_Video_Downloader_v1.2.0.exe
2014-07-03 01:39 - 2012-07-26 09:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2014-07-02 20:15 - 2012-07-26 07:26 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM
2014-07-02 17:51 - 2014-06-08 02:48 - 00000000 ____D () C:\Users\Philip\Desktop\Diverses
2014-07-02 15:25 - 2014-06-09 15:02 - 01944089 _____ () C:\WINDOWS\WindowsUpdate.log
2014-07-02 02:29 - 2014-04-11 20:42 - 00003600 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1730578352-2912700084-1204674380-1001
2014-07-02 01:41 - 2014-07-02 01:41 - 02347384 _____ (ESET) C:\Users\Philip\Downloads\esetsmartinstaller_deu.exe
2014-07-02 01:41 - 2014-07-02 01:41 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-07-02 01:39 - 2014-06-20 04:17 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-07-02 01:33 - 2014-07-02 01:33 - 00000929 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-07-02 01:33 - 2014-07-02 01:33 - 00000917 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-07-02 01:33 - 2014-07-02 01:33 - 00000000 ____D () C:\Program Files\MozillaFireFox
2014-07-02 01:33 - 2014-07-02 01:33 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-07-02 01:33 - 2014-04-11 21:15 - 00000000 ____D () C:\Users\Philip\AppData\Roaming\Mozilla
2014-07-02 01:32 - 2014-07-02 01:32 - 29677544 _____ (Mozilla) C:\Users\Philip\Downloads\Firefox_Setup_de30.0 (1).exe
2014-07-02 01:29 - 2014-07-02 01:29 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Philip\Downloads\revosetup95.exe
2014-07-02 01:29 - 2014-07-02 01:29 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-07-02 01:28 - 2014-04-20 22:28 - 00414208 ___SH () C:\Users\Philip\Desktop\Thumbs.db
2014-07-01 21:31 - 2014-07-01 21:31 - 00000000 ____D () C:\Program Files (x86)\EZ YouTube Video Downloader
2014-06-30 00:44 - 2014-06-30 00:44 - 00000632 _____ () C:\Users\Philip\Desktop\CO Fragen.txt
2014-06-29 18:43 - 2014-06-29 18:43 - 00072048 _____ () C:\Users\Philip\AppData\Local\GDIPFONTCACHEV1.DAT
2014-06-27 21:59 - 2014-04-12 21:18 - 00000000 ____D () C:\Users\Philip\AppData\Local\Battle.net
2014-06-27 20:19 - 2014-06-27 20:19 - 00000000 ____D () C:\Users\Philip\AppData\Roaming\Macromedia
2014-06-27 20:19 - 2014-06-27 20:19 - 00000000 ____D () C:\Users\Philip\AppData\Local\Macromedia
2014-06-25 22:27 - 2014-04-12 21:18 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2014-06-25 17:49 - 2014-05-14 19:24 - 02501961 _____ () C:\ProgramData\Setup_EZ_YouTube_Video_Downloader_v1.1.9.exe
2014-06-24 20:36 - 2014-04-13 21:17 - 00004104 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2014-06-24 20:36 - 2014-04-13 21:17 - 00003868 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2014-06-22 18:41 - 2014-06-22 18:41 - 00151593 _____ () C:\Users\Philip\Downloads\IT & Security in hospitals - (Philip).pptx
2014-06-20 17:44 - 2014-06-20 17:43 - 00151508 _____ () C:\Users\Philip\Documents\IT & Security in hospitals.pptx
2014-06-20 04:03 - 2014-06-20 04:03 - 00040371 _____ () C:\Users\Philip\Downloads\Data communication.pptx
2014-06-17 15:25 - 2014-04-27 21:41 - 02032309 _____ () C:\ProgramData\yvd_chrome_se.exe
2014-06-17 15:25 - 2014-04-27 21:41 - 01525193 _____ () C:\ProgramData\yvd_firefox_se.exe
2014-06-17 15:25 - 2014-04-27 21:41 - 00837543 _____ () C:\ProgramData\yvd_ie_se.exe
2014-06-13 02:27 - 2014-06-13 02:27 - 00000000 ____D () C:\Users\Philip\AppData\Local\Blizzard
2014-06-13 02:27 - 2014-06-13 02:17 - 00000000 ____D () C:\Program Files\Hearthstone
2014-06-13 02:17 - 2014-06-13 02:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hearthstone
2014-06-13 02:16 - 2014-04-12 21:32 - 00000000 ____D () C:\Program Files (x86)\Diablo III
2014-06-12 20:55 - 2014-04-21 23:13 - 00316320 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2014-06-09 09:57 - 2014-05-11 21:09 - 00043520 _____ (Elex do Brasil Participações Ltda) C:\WINDOWS\system32\Drivers\iSafeKrnlBoot.sys
2014-06-08 01:53 - 2014-05-05 20:52 - 00000000 ____D () C:\Users\Philip\.gimp-2.8
2014-06-04 23:18 - 2014-06-04 23:18 - 00000000 ____D () C:\Users\Public\Documents\NativeFus_Log
2014-06-04 23:18 - 2014-06-04 23:18 - 00000000 ____D () C:\Users\Philip\Documents\samsung
2014-06-04 23:18 - 2014-06-04 23:18 - 00000000 ____D () C:\Users\Philip\AppData\Roaming\Samsung
2014-06-04 23:18 - 2014-06-04 23:18 - 00000000 ____D () C:\Users\Philip\AppData\Local\Samsung
2014-06-04 23:17 - 2014-06-04 23:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
2014-06-04 23:17 - 2014-06-04 23:17 - 00000000 ____D () C:\Program Files (x86)\InstallShield Installation Information
2014-06-04 23:17 - 2014-06-04 23:16 - 00000000 ____D () C:\ProgramData\Samsung
2014-06-04 23:17 - 2014-06-04 23:16 - 00000000 ____D () C:\Program Files (x86)\Samsung
2014-06-04 23:16 - 2014-06-04 23:16 - 00000000 ____D () C:\Users\Philip\AppData\Local\Downloaded Installations

Files to move or delete:
====================
C:\ProgramData\Setup_EZ_YouTube_Video_Downloader_v1.1.5.exe
C:\ProgramData\Setup_EZ_YouTube_Video_Downloader_v1.1.7.exe
C:\ProgramData\Setup_EZ_YouTube_Video_Downloader_v1.1.8.exe
C:\ProgramData\Setup_EZ_YouTube_Video_Downloader_v1.1.9.exe
C:\ProgramData\Setup_EZ_YouTube_Video_Downloader_v1.2.0.exe
C:\ProgramData\yvd_chrome_se.exe
C:\ProgramData\yvd_firefox_se.exe
C:\ProgramData\yvd_ie_se.exe


Some content of TEMP:
====================
C:\Users\Philip\AppData\Local\Temp\avgnt.exe
C:\Users\Philip\AppData\Local\Temp\PrefJsonCpp.exe
C:\Users\Philip\AppData\Local\Temp\Quarantine.exe
C:\Users\Philip\AppData\Local\Temp\sqlite3.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-06-30 20:44

==================== End Of Log ============================
--- --- ---

--- --- ---








FRST Additions Logfile:
Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 03-07-2014
Ran by Philip at 2014-07-03 22:37:37
Running from C:\Users\Philip\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.07) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)
AMD Accelerated Video Transcoding (Version: 13.20.100.31206 - Advanced Micro Devices, Inc.) Hidden
AMD APP SDK Runtime (Version: 10.0.938.2 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Control Center (x32 Version: 2013.1206.1603.28764 - Ihr Firmenname) Hidden
AMD Catalyst Install Manager (HKLM\...\{308051DA-0048-7A07-FE8B-9B6EC119A9E8}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)
AMD Drag and Drop Transcoding (Version: 2.00.0000 - Advanced Micro Devices, Inc.) Hidden
AMD Media Foundation Decoders (Version: 1.0.70620.1740 - Advanced Micro Devices, Inc.) Hidden
AMD Wireless Display v3.0 (Version: 1.0.0.14 - Advanced Micro Devices, Inc.) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.5.450 - Avira)
Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
Diablo III (HKLM-x32\...\Diablo III) (Version:  - Blizzard Entertainment)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )
EZ YouTube Video Downloader (HKLM-x32\...\EZ YouTube Video Downloader) (Version: 1.2.0 - XtensionPlus)
GIMP 2.8.10 (HKLM\...\GIMP-2_is1) (Version: 2.8.10 - The GIMP Team)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 35.0.1916.153 - Google Inc.)
Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden
Hearthstone (HKLM-x32\...\Hearthstone) (Version:  - Blizzard Entertainment)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3412 - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.37 - Irfan Skiljan)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft App Update for microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe (x64) (Version: 1.0.0.0 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Home and Student 2007 (HKLM-x32\...\HOMESTUDENTR) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
Mozilla Firefox 30.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 30.0 (x86 de)) (Version: 30.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 30.0 - Mozilla)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.6.3.14044_16 - Samsung Electronics Co., Ltd.)
Samsung Kies (x32 Version: 2.6.3.14044_16 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.43.0 - SAMSUNG Electronics Co., Ltd.)
Shopping Helper Smartbar (HKLM-x32\...\{7DD65DA0-AD4F-4974-AAC6-5834DD7F6841}) (Version: 11.43.63.16271 - ReSoft Ltd.) <==== ATTENTION
Skype™ 6.16 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.16.105 - Skype Technologies S.A.)
StarCraft II (HKLM-x32\...\StarCraft II) (Version:  - Blizzard Entertainment)
Update for Microsoft Office Word 2007 (KB974631) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{1D53FB73-9826-4541-B2E0-A239C6EBA718}) (Version:  - )
Update for Microsoft Office Word 2007 (KB974631) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{34726474-50D6-49FC-B8AC-35411459D27A}) (Version:  - )

==================== Restore Points  =========================

19-06-2014 18:43:32 Geplanter Prüfpunkt
27-06-2014 01:06:33 Geplanter Prüfpunkt
01-07-2014 23:30:12 Revo Uninstaller's restore point - Mozilla Firefox 30.0 (x86 de)
02-07-2014 23:39:03 Windows Modules Installer

==================== Hosts content: ==========================

2012-07-26 07:26 - 2012-07-26 07:26 - 00000824 ____N C:\WINDOWS\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {1AAFF332-5C62-4558-9991-DAA649C4C9C5} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {23A5D8BE-9196-40EB-BD89-794398B2B073} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {68D3024B-D9C7-432E-81CD-09C16E1319A8} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-13] (Adobe Systems Incorporated)
Task: {7A84F348-0CE7-4AFC-85D4-DF18E233622B} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-04-13] (Google Inc.)
Task: {A72208BF-7A49-4FB8-B684-252375F3443A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {ABD20D22-EF54-40A4-B483-30AF7CF433DA} - System32\Tasks\Microsoft\Windows\Setup\Pre-staged GDR Notification => C:\WINDOWS\system32\NotificationUI.exe [2014-04-19] (Microsoft Corporation)
Task: {B09D1ECE-6DFC-4D81-9619-4D3E3DF7ACBD} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-04-13] (Google Inc.)
Task: {C6A88F2D-53D2-4805-9D69-443738A1847C} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {EBF06DEC-4228-4813-AC0C-62821AE4E330} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2014-05-11 21:09 - 2014-06-09 09:55 - 00092328 ____N () C:\Program Files (x86)\iSafe\curlpp.dll
2014-05-11 21:09 - 2014-06-09 09:57 - 00065704 ____N () C:\Program Files (x86)\iSafe\zlib1.dll
2014-05-11 21:09 - 2014-04-21 10:22 - 00176976 ____N () C:\Program Files (x86)\iSafe\tws\unrar.dll
2014-05-11 21:09 - 2014-04-21 10:22 - 00068432 ____N () C:\Program Files (x86)\iSafe\tws\zlib1.dll
2014-05-11 21:09 - 2014-04-21 10:22 - 00087744 ____N () C:\Program Files (x86)\iSafe\tws\unacev2.dll
2014-05-11 21:09 - 2014-06-09 09:57 - 00182272 ____N () C:\Program Files (x86)\iSafe\libpng.dll
2014-06-13 01:39 - 2014-06-05 15:58 - 00716616 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\libglesv2.dll
2014-06-13 01:39 - 2014-06-05 15:58 - 00126280 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\libegl.dll
2014-06-13 01:39 - 2014-06-05 15:58 - 01732424 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\ffmpegsumo.dll
2014-06-13 01:39 - 2014-06-05 15:58 - 14612296 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\PepperFlash\pepflashplayer.dll
2014-07-02 01:33 - 2014-06-06 06:38 - 03852912 _____ () C:\Program Files\MozillaFireFox\mozjs.dll
2014-06-13 01:39 - 2014-06-05 15:58 - 04217672 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\pdf.dll
2014-06-13 01:39 - 2014-06-05 15:58 - 00414536 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\ppGoogleNaClPluginChrome.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== EXE Association (whitelisted) =============


==================== MSCONFIG/TASK MANAGER disabled items =========

HKLM\...\StartupApproved\Run32: => "KiesTrayAgent"

==================== Faulty Device Manager Devices =============

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============
Error: (07/03/2014 09:41:43 PM) (Source: DCOM) (EventID: 10010) (User: Kassiopeia)
Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}

Error: (07/03/2014 09:41:43 PM) (Source: DCOM) (EventID: 10010) (User: Kassiopeia)
Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}

Error: (07/03/2014 09:37:25 PM) (Source: DCOM) (EventID: 10010) (User: Kassiopeia)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}

Error: (07/03/2014 09:36:55 PM) (Source: DCOM) (EventID: 10010) (User: Kassiopeia)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}

Error: (07/03/2014 09:36:25 PM) (Source: DCOM) (EventID: 10010) (User: Kassiopeia)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}

Error: (07/03/2014 09:35:55 PM) (Source: DCOM) (EventID: 10010) (User: Kassiopeia)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}

Error: (07/03/2014 09:35:25 PM) (Source: DCOM) (EventID: 10010) (User: Kassiopeia)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}


Microsoft Office Sessions:
=========================

==================== Memory info ===========================

Percentage of memory in use: 25%
Total physical RAM: 8086 MB
Available physical RAM: 5990.3 MB
Total Pagefile: 9302 MB
Available Pagefile: 6479.16 MB
Total Virtual: 8192 MB
Available Virtual: 8191.77 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:118.9 GB) (Free:33.23 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (D3C1.0.0) (CDROM) (Total:7.66 GB) (Free:0 GB) UDF

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 119 GB) (Disk ID: F7D8AF0C)
Partition 1: (Active) - (Size=119 GB) - (Type=07 NTFS)

==================== End Of Log ============================
--- --- ---


@Schrauber
Wenn du sonst noch was brauchst, einfach sagen, kriegst umgehen. weil ich schaffs leider nicht allein :(

schrauber 05.07.2014 16:42
Adware & Co. deinstallieren

Solltest Du ein Programm nicht finden oder nicht deinstallieren können, mache bitte mit dem nächsten Schritt weiter:



Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Kassiopeia88 06.07.2014 19:03
Scheint geklappt zu haben. Eine riesen Dankeschön für die Mühen.

Klasse Arbeit

Lieben Gruß,
Philip

schrauber 07.07.2014 12:49
hab ich gesagt dass wir fertig sind?


Alle Zeitangaben in WEZ +1. Es ist jetzt 17:47 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131