Trojaner-Board - Windows 7 - Befallen von Malware oder Trojaner!

Sorry, Fixlog vergessen:

Code:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 19-01-2015

Ran by Hüseyin Kapsuk at 2015-01-22 22:38:05 Run:1

Running from C:\Program Files (x86)\Malware

Loaded Profiles: Hüseyin Kapsuk (Available profiles: Hüseyin Kapsuk)

Boot Mode: Normal

==============================================
 

Content of fixlist:

*****************

CloseProcesses:

HKU\S-1-5-21-1458254147-1400175667-4214555082-1000\...\Run: [Super Optimizer] => C:\Program Files (x86)\Super Optimizer\SupOptLauncher.exe

C:\Program Files (x86)\Super Optimizer

GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

FF HKU\S-1-5-21-1458254147-1400175667-4214555082-1000\...\Firefox\Extensions: [{EA471FD8-F2FD-61B2-94F2-06775D9026BA}] - C:\Program Files (x86)\ver2SpeedCheck\184.xpi

S2 cae99edb; "C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\Super Optimizer\SupOptStats.dll",ENT

Task: {89024E8D-CD5A-484B-93F9-F8BCB05FB80B} - System32\Tasks\newSI_618 => C:\Users\Hüseyin Kapsuk\AppData\Roaming\newSI_618\s_inst.exe [2014-12-03] ()

Task: C:\Windows\Tasks\MWDGAUNT.job => C:\Users\Hýÿseyin Kapsuk\AppData\Roaming\MWDGAUNT.exe 

Task: C:\Windows\Tasks\newSI_618.job => C:\Users\Hüseyin Kapsuk\AppData\Roaming\newSI_618\s_inst.exe

CreateRestorePoint:

EmptyTemp:

*****************
 

Processes closed successfully.

HKU\S-1-5-21-1458254147-1400175667-4214555082-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Super Optimizer => value deleted successfully.

"C:\Program Files (x86)\Super Optimizer" => File/Directory not found.

C:\Windows\system32\GroupPolicy\Machine => Moved successfully.

C:\Windows\system32\GroupPolicy\GPT.ini => Moved successfully.

"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.

HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.

HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.

HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.

HKU\S-1-5-21-1458254147-1400175667-4214555082-1000\Software\Mozilla\Firefox\Extensions\\{EA471FD8-F2FD-61B2-94F2-06775D9026BA} => value deleted successfully.

cae99edb => Service deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{89024E8D-CD5A-484B-93F9-F8BCB05FB80B}" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{89024E8D-CD5A-484B-93F9-F8BCB05FB80B}" => Key deleted successfully.

C:\Windows\System32\Tasks\newSI_618 => Moved successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\newSI_618" => Key deleted successfully.

C:\Windows\Tasks\MWDGAUNT.job => Moved successfully.

C:\Windows\Tasks\newSI_618.job => Moved successfully.

Restore point was successfully created.

EmptyTemp: => Removed 2.1 GB temporary data.
 
 

The system needed a reboot. 
 

==== End of Fixlog 22:38:20 ====

ESET:

Code:

ESETSmartInstaller@High as downloader log:

all ok

# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.7623

# api_version=3.0.2

# EOSSerial=6d8059a3620f854eb52ef295ea8b0251

# engine=22088

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2015-01-23 07:24:05

# local_time=2015-01-23 08:24:05 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# lang=1031

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode_1=''

# compatibility_mode=5893 16776573 100 94 39685 173627695 0 0

# scanned=141547

# found=22

# cleaned=0

# scan_time=1008

sh=9A29621DAC829144D9648B534CB5A0B24C21AA76 ft=1 fh=e533b0cb5e03e94e vn="Variante von Win32/AdWare.EoRezo.AU Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\gmsd_de_40\gamesdesktop_widget.exe.vir"

sh=84FF48621208C926E8FCC3DAD23B33A0504CEE6B ft=1 fh=f88e52f2d1553095 vn="Variante von Win32/AdWare.EoRezo.AU Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\gmsd_de_40\gmsd_de_40.exe.vir"

sh=B2E86B8C9317BAD0EB4DA8EE4B48B7E480C24D99 ft=1 fh=b125be9ec423d2f7 vn="Variante von Win32/Toolbar.CrossRider.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\HQPro-Video 1.6V24.12\Uninstall.exe.vir"

sh=1AB0980D6216415031DFBDF8E56ECD479BE5F777 ft=1 fh=05efd1e59785f63e vn="Variante von Win32/SpeedingUpMyPC Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Super Optimizer\SuperOptimizer.exe.vir"

sh=10F18DE8B9AD7C7AC9EA32E9827044DEF0B28ECA ft=1 fh=5a1ff9e78156c197 vn="Variante von Win32/Adware.SpeedingUpMyPC.C Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Super Optimizer\SupOptSmartScan.exe.vir"

sh=C115266B0C7A676829C24F39D20F318DEF49CB0B ft=1 fh=2ebe1483bccc99eb vn="Variante von Win32/Adware.MultiPlug.DX Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Super Optimizer\SupOptStats.dll.vir"

sh=86EA851108D635D9ED47C01E86899845DFDA3EC7 ft=1 fh=90733a3b10b3e858 vn="Variante von Win32/Thinknice.F evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\HpUI.exe.vir"

sh=12EBF6FC8AD543662053CA101C2D5DA175137EB2 ft=1 fh=c71c00119e5c1a87 vn="Win32/Thinknice.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\Loader32.exe.vir"

sh=4139F95644E13A650D4827C943BCC9F2F0F6AA93 ft=1 fh=3b96e1736604b8bc vn="Win32/Thinknice.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\uninstall.exe.vir"

sh=79C9BD304C93AB8FD0544108656A899993DB14EF ft=1 fh=e6f80544d6e8089f vn="Variante von Win32/Thinknice.F evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\WindowsSupportDll32.dll.vir"

sh=96B85214CD9E4FF85AC6144E7EF3DDF9E0F215E6 ft=1 fh=098a6735f96a550a vn="Variante von Win32/Thinknice.F evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\WindowsSupportDll64.dll.vir"

sh=E5A7495A72C831F09821085D756B242A942A5FDF ft=1 fh=804f01a09b205968 vn="Variante von Win32/Adware.AdService.A Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Hüseyin Kapsuk\AppData\Local\ConvertAd\CASrv.exe.vir"

sh=93F7035C466E3BB5A109405C599A8FACB0FBCAFC ft=1 fh=255ca423823d4757 vn="Variante von Win32/Adware.ConvertAd.H Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Hüseyin Kapsuk\AppData\Local\ConvertAd\ConvertAd.exe.vir"

sh=C7BE330F0743652C69C7A35BC02359864360B3D3 ft=1 fh=6c649a255e4ff0ed vn="Variante von Win32/Adware.EoRezo.AJ Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Hüseyin Kapsuk\AppData\Local\gmsd_de_40\upgmsd_de_40.exe.vir"

sh=AA6ACB491219EED7A23869BC1BF9CA30ECACE068 ft=1 fh=04baf25a86693757 vn="Variante von Win32/VOPackage.BE evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Hüseyin Kapsuk\AppData\Roaming\VOPackage\VOsrv.exe.vir"

sh=BF1BB92E7F48C564B774815B9390DFA478AD483C ft=1 fh=0c47f480955462d2 vn="Variante von Win32/Agent.WGA Trojaner" ac=I fn="C:\AdwCleaner\Quarantine\C\Windows\rcore.exe.vir"

sh=B7C722576E340B33362B753B2A82246D80C62D97 ft=1 fh=aecc075c8b73a942 vn="Win64/Adware.AddLyrics.E Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Windows\System32\drivers\webinstrNewH.sys.vir"

sh=805E6371B9F07A101C18E7F00DC5704A67E3ACD9 ft=1 fh=3a1c2d56c618c06f vn="Variante von Win64/BrowseFox.CG evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Windows\System32\drivers\{9cdb05d3-a225-439b-a302-3c928fc40412}Gw64.sys.vir"

sh=E97486CB7882E26AA8C0EF3914E104BBAE7CDC38 ft=0 fh=0000000000000000 vn="Win32/BrowseFox.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Hüseyin Kapsuk\AppData\Local\Google\Chrome\User Data\Default\Extensions\lgjlhdhfnbiepeegkmkjaeblhhcdping\1.0.1_0\background.js"

sh=6F1EC52E1B7B39E5DE4E3F510F7AD1631FD91AB7 ft=0 fh=0000000000000000 vn="Win32/BrowseFox.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Hüseyin Kapsuk\AppData\Local\Google\Chrome\User Data\Default\Extensions\lgjlhdhfnbiepeegkmkjaeblhhcdping\1.0.1_0\content.js"

sh=DDD7E789E67132CF6C5D8169B2F46E3498FCA60F ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Hüseyin Kapsuk\AppData\Roaming\MWDGAUNT"

sh=248BD3403636B3D956E286239E1A583F249A3A7F ft=1 fh=0d120e749ee8d563 vn="Variante von Win32/MediaMagnet.D evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Hüseyin Kapsuk\AppData\Roaming\newSI_618\s_inst.exe"