Trojaner-Board
Seite 2 von 3 1 2 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Proxy-Fehlermeldung 127.0.0.1:8897 (https://www.trojaner-board.de/163264-proxy-fehlermeldung-127-0-0-1-8897-a.html)

DannY_93 27.01.2015 12:42
Link 1 https://www.virustotal.com/de/file/f7efd480e6c95f5b6202eeb87f519a8a8187f7f26281fb3e302edd1ad5771025/analysis/1422358658/
Link 2 https://www.virustotal.com/de/file/bb18c63c1982f5cb99c9b65d2b801e8c1909ad7cd0171326dc0015d6b781b451/analysis/1422358740/

Warlord711 27.01.2015 13:24
Also im letzten Log war der Proxy noch erkennbar, machen wir noch einen Versuch, danach muss ich mir was anderes überlegen:

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:8897;https=127.0.0.1:8897
reboot:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.



Starte noch einmal FRST.
  • Ändere keine der Voreinstellungen und drücke auf Scan.
  • Wenn der Scan abgeschlossen ist, werden ein neues Logfile FRST.txt erstellt und auf dem Desktop gespeichert.
  • Poste den Inhalt dieses Logfiles bitte hier in deinen Thread.

DannY_93 27.01.2015 13:40
Fixlog.txt :
Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 24-01-2015 01
Ran by User at 2015-01-27 13:34:43 Run:5
Running from C:\Users\User\Desktop
Loaded Profiles: User (Available profiles: User)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:8897;https=127.0.0.1:8897
reboot:
*****************

HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => value deleted successfully.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value deleted successfully.


The system needed a reboot.

==== End of Fixlog 13:34:43 ====
FRST.txt


FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-01-2015 01
Ran by User (administrator) on USER-PC on 27-01-2015 13:36:34
Running from C:\Users\User\Desktop
Loaded Profiles: User (Available profiles: User)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BBSvc.EXE
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
() C:\ProgramData\DatacardService\HWDeviceService64.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Huawei Technologies Co., Ltd.) C:\Users\User\AppData\Roaming\tele.ring Verbindungsmanager\ouc.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [WirelessAssistant] => C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [498744 2009-07-23] (Hewlett-Packard)
HKLM-x32\...\Run: [DataCardMonitor] => C:\Program Files (x86)\tele.ring Verbindungsmanager\DataCardMonitor.exe [253952 2013-07-03] (Huawei Technologies Co., Ltd.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2015-01-27] (AVAST Software)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\Run: [HW_OPENEYE_OUC_tele.ring Verbindungsmanager] => C:\Program Files (x86)\tele.ring Verbindungsmanager\UpdateDog\ouc.exe [110592 2009-12-31] (Huawei Technologies Co., Ltd.)
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\Policies\system: [DisableChangePassword] 0
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: D - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: E - E:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {29de0f77-227c-11e2-8036-90004e63fc55} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {29de0f86-227c-11e2-8036-90004e63fc55} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {2bf70504-e3b9-11e2-8d2e-90004e63fc55} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {2bf70521-e3b9-11e2-8d2e-90004e63fc55} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {34c73ff9-2c16-11e2-9a50-90004e63fc55} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {356f63b6-4016-11e1-b766-b1570f61f5d9} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {356f63c7-4016-11e1-b766-b1570f61f5d9} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {5f6fac67-3f6e-11e1-a137-85ae9d686db3} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {5f6fac7e-3f6e-11e1-a137-85ae9d686db3} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {6e38b045-773e-11e1-9b43-e38defa8a60e} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {71060446-88c3-11e2-bd69-90004e63fc55} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {b3d5e5f9-2c6b-11e1-bc7d-806e6f6e6963} - F:\Setup.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {b56a49e9-826d-11e2-a311-90004e63fc55} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {b56a49f7-826d-11e2-a311-90004e63fc55} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {c661975b-e330-11e2-9294-90004e63fc55} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {c6619775-e330-11e2-9294-90004e63fc55} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {eac35ae9-3de2-11e1-a302-90004e63fc55} - D:\.\Autorun.exe AUTORUN=1
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {eac35af7-3de2-11e1-a302-90004e63fc55} - D:\.\Autorun.exe AUTORUN=1
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {f660393c-40de-11e1-af44-90004e63fc55} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {f83e50fe-e95d-11e2-829c-90004e63fc55} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {facf2493-2277-11e2-bb88-90004e63fc55} - D:\Data\setup.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {facf2499-2277-11e2-bb88-90004e63fc55} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {fb2a7ec3-3411-11e4-a467-90004e63fc55} - D:\AutoRun.exe
Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-982829961-422532093-1718007052-1000\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.at/?gws_rd=ssl
HKU\S-1-5-21-982829961-422532093-1718007052-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCON/1
SearchScopes: HKLM -> {E40F8372-A296-4395-92CB-F634CAC151B8} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {E40F8372-A296-4395-92CB-F634CAC151B8} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-982829961-422532093-1718007052-1000 -> {E40F8372-A296-4395-92CB-F634CAC151B8} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
BHO: Bing Bar Helper -> {1dad3af3-ef2f-4f64-ac4b-11789189fcb6} -> C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll (Microsoft Corporation.)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Bing Bar Helper -> {1dad3af3-ef2f-4f64-ac4b-11789189fcb6} -> C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll (Microsoft Corporation.)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - Bing Bar - {eec0f710-38b5-4aba-99bf-ec87564a4e13} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM-x32 - Bing Bar - {eec0f710-38b5-4aba-99bf-ec87564a4e13} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll (Microsoft Corporation.)
Toolbar: HKU\S-1-5-21-982829961-422532093-1718007052-1000 -> No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Toolbar: HKU\S-1-5-21-982829961-422532093-1718007052-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52272 2010-08-02] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 10.64.1.224 10.64.1.225

FireFox:
========
FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\gnj2wp5w.default
FF Homepage: https://www.google.at
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_70.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_70.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\2\NP_wtapp.dll ()
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012-03-21]
FF HKLM-x32\...\Firefox\Extensions: [ff-bmboc@bytemobile.com] - C:\Program Files\T-Mobile\InternetManager_H\OCx64\addon
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-01-26]
FF HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

Chrome:
=======
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-01-26]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2015-01-26] (AVAST Software)
R2 ezSharedSvc; C:\Windows\SysWOW64\ezsvc7.dll [129584 2009-02-22] (EasyBits Sofware AS) [File not signed]
S3 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [254016 2014-10-10] (WildTangent)
R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] ()
S4 LightScribeService; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2009-10-16] (Hewlett-Packard Company) [File not signed]
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-01-18] (Hewlett-Packard) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-01-18] (Hewlett-Packard) [File not signed]
S4 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [247152 2009-07-06] ()
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5426448 2014-12-15] (TeamViewer GmbH)
S2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2015-01-26] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [87912 2015-01-26] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2015-01-26] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2015-01-26] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2015-01-26] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2015-01-26] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2015-01-26] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2015-01-26] ()
R0 BMLoad; C:\Windows\System32\drivers\BMLoad.sys [16512 2009-12-15] (Bytemobile, Inc.) [File not signed]
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-01-27] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)
S3 RSUSBSTOR; C:\Windows\SysWOW64\Drivers\RtsUStor.sys [225280 2009-09-23] (Realtek Semiconductor Corp.)
R1 tcpipBM; C:\Windows\system32\drivers\tcpipBM.sys [39552 2009-12-15] (Bytemobile, Inc.) [File not signed]
S3 cpuz135; \??\C:\Users\User\AppData\Local\Temp\cpuz135\cpuz135_x64.sys [X]
S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [X]
S3 zte_ecm_enum_filter; system32\DRIVERS\zte_ecm_enum_filter.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-27 13:36 - 2015-01-27 13:37 - 00016986 _____ () C:\Users\User\Desktop\FRST.txt
2015-01-27 11:26 - 2015-01-27 11:26 - 00000000 ____D () C:\Windows\ERUNT
2015-01-27 11:19 - 2015-01-27 11:22 - 00000000 ____D () C:\AdwCleaner
2015-01-27 11:18 - 2015-01-27 11:19 - 01707939 _____ (Thisisu) C:\Users\User\Desktop\JRT641.exe
2015-01-27 11:17 - 2015-01-27 11:17 - 02194432 _____ () C:\Users\User\Desktop\adwcleaner_4.109.exe
2015-01-27 09:23 - 2015-01-27 13:36 - 00000000 ____D () C:\FRST
2015-01-27 09:23 - 2015-01-27 09:23 - 02129920 _____ (Farbar) C:\Users\User\Desktop\FRST64.exe
2015-01-26 10:48 - 2015-01-26 10:48 - 00000000 ____D () C:\Users\User\AppData\Roaming\AVAST Software
2015-01-26 10:47 - 2015-01-26 10:47 - 00001964 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2015-01-26 10:47 - 2015-01-26 10:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2015-01-26 10:46 - 2015-01-27 13:37 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2015-01-26 10:46 - 2015-01-26 10:47 - 01050432 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2015-01-26 10:46 - 2015-01-26 10:47 - 00087912 _____ (AVAST Software) C:\Windows\system32\Drivers\aswmonflt.sys
2015-01-26 10:46 - 2015-01-26 10:46 - 00436624 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2015-01-26 10:46 - 2015-01-26 10:46 - 00364512 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2015-01-26 10:46 - 2015-01-26 10:46 - 00267632 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2015-01-26 10:46 - 2015-01-26 10:46 - 00116728 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2015-01-26 10:46 - 2015-01-26 10:46 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2015-01-26 10:46 - 2015-01-26 10:46 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2015-01-26 10:46 - 2015-01-26 10:46 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2015-01-26 10:46 - 2015-01-26 10:46 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2015-01-26 10:45 - 2015-01-26 10:45 - 00000000 ____D () C:\Program Files\AVAST Software
2015-01-26 10:44 - 2015-01-26 10:45 - 00000000 ____D () C:\ProgramData\AVAST Software
2015-01-26 10:40 - 2015-01-26 10:43 - 132469808 _____ (AVAST Software) C:\Users\User\Downloads\avast_free_antivirus_setup.exe
2015-01-26 09:59 - 2015-01-27 13:37 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-01-26 09:58 - 2015-01-26 09:58 - 00001062 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-01-26 09:58 - 2015-01-26 09:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-01-26 09:58 - 2015-01-26 09:58 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-01-26 09:58 - 2015-01-26 09:58 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-01-26 09:58 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-01-26 09:58 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-01-26 09:58 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-01-26 09:56 - 2015-01-26 09:57 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\User\Downloads\mbam-setup-2.0.4.1028.exe
2015-01-24 14:18 - 2015-01-24 14:18 - 00000000 ____D () C:\Users\User\Documents\Neuer Ordner (3)
2015-01-23 06:17 - 2015-01-27 13:35 - 00001749 _____ () C:\Windows\setupact.log
2015-01-23 06:17 - 2015-01-27 11:22 - 00016262 _____ () C:\Windows\PFRO.log
2015-01-23 06:17 - 2015-01-23 06:17 - 00000000 _____ () C:\Windows\setuperr.log
2015-01-22 18:19 - 2015-01-27 13:31 - 00353515 _____ () C:\Windows\WindowsUpdate.log
2015-01-19 15:14 - 2015-01-19 15:14 - 00001003 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 10.lnk
2015-01-19 15:14 - 2015-01-19 15:14 - 00000991 _____ () C:\Users\Public\Desktop\TeamViewer 10.lnk
2015-01-19 15:14 - 2015-01-19 15:14 - 00000000 ____D () C:\Program Files (x86)\TeamViewer
2015-01-19 15:13 - 2015-01-19 15:13 - 07718224 _____ (TeamViewer GmbH) C:\Users\User\Downloads\TeamViewer_Setup_de-ckc.exe
2015-01-14 19:09 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-14 19:09 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-14 19:09 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-01-14 19:09 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-01-14 19:09 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-01-14 19:09 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-01-14 19:09 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-01-14 19:09 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-01-14 19:09 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-01-14 19:09 - 2014-12-11 18:47 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-14 19:09 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-14 19:09 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2015-01-14 19:09 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2015-01-13 16:35 - 2015-01-13 16:35 - 00000000 ____H () C:\Users\User\AppData\Local\BIT53EA.tmp
2015-01-13 16:35 - 2015-01-13 16:35 - 00000000 _____ () C:\Users\User\AppData\Local\{4B22D22B-3BA4-40E7-B6BC-98DD75627F4A}
2015-01-01 17:54 - 2015-01-01 17:54 - 00000000 __SHD () C:\Users\User\AppData\Local\EmieBrowserModeList

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-27 13:35 - 2013-03-01 12:20 - 00000420 _____ () C:\Windows\Tasks\Wise Care 365.job
2015-01-27 13:35 - 2012-11-08 10:09 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-27 13:35 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-27 13:27 - 2012-11-08 10:09 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-01-27 12:41 - 2010-01-20 11:41 - 11483908 _____ () C:\Windows\system32\perfh007.dat
2015-01-27 12:41 - 2010-01-20 11:41 - 03633360 _____ () C:\Windows\system32\perfc007.dat
2015-01-27 12:41 - 2009-07-14 06:13 - 00006268 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-01-27 11:51 - 2009-07-14 05:45 - 00023248 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-27 11:51 - 2009-07-14 05:45 - 00023248 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-27 11:42 - 2011-12-23 08:48 - 00003922 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{DB32AAC0-AE95-47E6-8D2E-C7CA58C9B8C0}
2015-01-27 11:12 - 2012-11-08 10:48 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-27 10:54 - 2012-03-05 10:21 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-27 10:36 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing
2015-01-27 10:34 - 2009-07-14 06:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-01-26 10:50 - 2012-11-08 09:30 - 00001912 _____ () C:\Windows\epplauncher.mif
2015-01-22 13:18 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2015-01-19 17:47 - 2009-07-14 05:45 - 00374152 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-01-19 15:19 - 2011-12-22 08:16 - 00091216 _____ () C:\Users\User\AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-14 20:15 - 2013-07-12 17:57 - 00000000 ____D () C:\Windows\system32\MRT
2015-01-14 20:12 - 2011-12-23 10:36 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-01-08 09:55 - 2011-12-23 08:50 - 00298120 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

==================== Files in the root of some directories =======

2011-12-22 08:15 - 2011-12-22 08:15 - 0000000 _____ () C:\Users\User\AppData\Local\AtStart.txt
2015-01-13 16:35 - 2015-01-13 16:35 - 0000000 ____H () C:\Users\User\AppData\Local\BIT53EA.tmp
2013-04-07 17:14 - 2013-05-24 17:48 - 0005632 _____ () C:\Users\User\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2011-12-22 08:15 - 2011-12-22 08:15 - 0000000 _____ () C:\Users\User\AppData\Local\DSwitch.txt
2011-12-22 08:15 - 2011-12-22 08:15 - 0000000 _____ () C:\Users\User\AppData\Local\QSwitch.txt
2015-01-13 16:35 - 2015-01-13 16:35 - 0000000 _____ () C:\Users\User\AppData\Local\{4B22D22B-3BA4-40E7-B6BC-98DD75627F4A}
2012-12-30 10:55 - 2015-01-27 13:36 - 0000509 _____ () C:\ProgramData\HPWALog.txt
2012-03-21 15:20 - 2012-03-21 15:40 - 0003039 _____ () C:\ProgramData\hpzinstall.log
2010-08-02 13:15 - 2010-08-02 13:15 - 0000032 _____ () C:\ProgramData\{051B9612-4D82-42AC-8C63-CD2DCEDC1CB3}.log
2010-01-20 04:59 - 2010-01-20 04:59 - 0000109 _____ () C:\ProgramData\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}.log
2010-08-02 13:15 - 2010-08-02 13:15 - 0000032 _____ () C:\ProgramData\{23F3DA62-2D9E-4A69-B8D5-BE8E9E148092}.log
2010-01-20 04:55 - 2010-01-20 04:56 - 0000105 _____ () C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log
2010-08-02 13:14 - 2010-08-02 13:14 - 0000032 _____ () C:\ProgramData\{4FC670EB-5F02-4B07-90DB-022B86BFEFD0}.log
2010-08-02 13:15 - 2010-08-02 13:15 - 0000032 _____ () C:\ProgramData\{9867824A-C86D-4A83-8F3C-E7A86BE0AFD3}.log
2010-01-20 04:54 - 2010-01-20 04:55 - 0000107 _____ () C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
2010-01-20 04:56 - 2010-01-20 04:58 - 0000110 _____ () C:\ProgramData\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}.log
2010-08-02 13:15 - 2010-08-02 13:15 - 0000105 _____ () C:\ProgramData\{d36dd326-7280-11d8-97c8-000129760cbe}.log

Some content of TEMP:
====================
C:\Users\User\AppData\Local\Temp\Quarantine.exe
C:\Users\User\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-26 13:28

==================== End Of Log ============================
--- --- ---

Warlord711 27.01.2015 13:46
Fein, das hat geklappt. Der ESET Scan wird einige Zeit brauchen:

Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.



ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


DannY_93 27.01.2015 13:58
Securitycheck:

Code:
Results of screen317's Security Check version 0.99.95 
 Windows 7 Service Pack 1 x64 (UAC is enabled) 
 Internet Explorer 11 
``````````````Antivirus/Firewall Check:``````````````
avast! Antivirus 
 Antivirus up to date!  (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
 Java(TM) 6 Update 22 
 Java version 32-bit out of Date!
 Adobe Flash Player 10 Flash Player out of Date!
  Java 64-bit 8 Update 31 
  Adobe Flash Player 12.0.0.70 Flash Player out of Date! 
 Adobe Reader 9 Adobe Reader out of Date!
 Mozilla Firefox (35.0.1)
````````Process Check: objlist.exe by Laurent```````` 
 AVAST Software Avast AvastSvc.exe 
 AVAST Software Avast avastui.exe 
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 
````````````````````End of Log``````````````````````

Warlord711 27.01.2015 14:36
Zitat:
Java(TM) 6 Update 22
Adobe Flash Player 10 Flash Player out of Date!
Adobe Flash Player 12.0.0.70 Flash Player out of Date!
Adobe Reader 9 Adobe Reader out of Date!
Bitte die veralteten Versionen komplett deinstallieren und mit aktuellen Ersetzen !

Dein Java ist nicht mehr aktuell.
Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.
  • Downloade dir bitte die neueste Java-Version von hier
  • Speichere die jxpiinstall.exe
  • Schließe alle laufenden Programme. Speziell deinen Browser.
  • Starte die jxpiinstall.exe. Diese wird den Installer für die neueste Java Version ( Java 8 Update 25 ) herunter laden.
  • Entferne den Haken bei "Installieren Sie die Ask-Toolbar ..." während der Installation.
  • Wenn die Installation beendet wurde
    Start --> Systemsteuerung --> Programme und deinstalliere alle älteren Java Versionen.
  • Starte deinen Rechner neu sobald alle älteren Versionen deinstalliert wurden.
Nach dem Neustart
  • Öffne erneut die Systemsteuerung --> Programme und klicke auf das Java Symbol.
  • Im Reiter Allgemein, klicke unter Temporäre Internetdateien auf Einstellungen.
  • Klicke auf Dateien löschen....
  • Gehe sicher das überall ein Haken gesetzt ist und klicke OK.
  • Klicke erneut OK.
schneller Plugin-Test: PluginCheck

Flash Player veraltet !

Deinstalliere bitte deine aktuelle Version von Adobe Player

Start--> Systemsteuerung--> Software--> Adobe Player und lade dir die neue Version von Hier herunter-
Entferne den Haken für den McAfee SecurityScan bzw. Google Chrome.

Update: Adobe Reader
Deinstalliere bitte deine aktuelle Version von Adobe Reader
Start--> Systemsteuerung--> Software--> Adobe Reader
und lade dir die neue Version von Hier herunter-
Entferne den Haken für den McAfee SecurityScan bzw. Google Chrome.

Warlord711 27.01.2015 14:38
Achja, und wenn es dir nichts ausmacht, ich würd gern wg. dem Proxy nochmal nen FRST Log haben wollen.

Danke ;-)

DannY_93 27.01.2015 15:33
Das mit der Software habe ich mir auch gleich gedacht als ich das gesehen habe, :)

Mache ich alles gleich, ESET läuft noch ;)

ESET Scan
Code:
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=b479f5e8dc67e24d8157470c23c4d979
# engine=22170
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-01-27 02:23:49
# local_time=2015-01-27 03:23:49 (+0100, Mitteleuropäische Zeit)
# country="Austria"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='avast! Antivirus'
# compatibility_mode=783 16777213 71 94 20966 106760 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 12990 173998479 0 0
# scanned=245997
# found=0
# cleaned=0
# scan_time=5078
FRST Log:


FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-01-2015 01
Ran by User (administrator) on USER-PC on 27-01-2015 15:30:04
Running from C:\Users\User\Desktop
Loaded Profiles: User (Available profiles: User)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BBSvc.EXE
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
() C:\ProgramData\DatacardService\HWDeviceService64.exe
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Huawei Technologies Co., Ltd.) C:\Users\User\AppData\Roaming\tele.ring Verbindungsmanager\ouc.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [WirelessAssistant] => C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [498744 2009-07-23] (Hewlett-Packard)
HKLM-x32\...\Run: [DataCardMonitor] => C:\Program Files (x86)\tele.ring Verbindungsmanager\DataCardMonitor.exe [253952 2013-07-03] (Huawei Technologies Co., Ltd.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2015-01-27] (AVAST Software)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\Run: [HW_OPENEYE_OUC_tele.ring Verbindungsmanager] => C:\Program Files (x86)\tele.ring Verbindungsmanager\UpdateDog\ouc.exe [110592 2009-12-31] (Huawei Technologies Co., Ltd.)
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\Policies\system: [DisableChangePassword] 0
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: D - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: E - E:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {29de0f77-227c-11e2-8036-90004e63fc55} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {29de0f86-227c-11e2-8036-90004e63fc55} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {2bf70504-e3b9-11e2-8d2e-90004e63fc55} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {2bf70521-e3b9-11e2-8d2e-90004e63fc55} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {34c73ff9-2c16-11e2-9a50-90004e63fc55} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {356f63b6-4016-11e1-b766-b1570f61f5d9} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {356f63c7-4016-11e1-b766-b1570f61f5d9} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {5f6fac67-3f6e-11e1-a137-85ae9d686db3} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {5f6fac7e-3f6e-11e1-a137-85ae9d686db3} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {6e38b045-773e-11e1-9b43-e38defa8a60e} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {71060446-88c3-11e2-bd69-90004e63fc55} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {b3d5e5f9-2c6b-11e1-bc7d-806e6f6e6963} - F:\Setup.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {b56a49e9-826d-11e2-a311-90004e63fc55} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {b56a49f7-826d-11e2-a311-90004e63fc55} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {c661975b-e330-11e2-9294-90004e63fc55} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {c6619775-e330-11e2-9294-90004e63fc55} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {eac35ae9-3de2-11e1-a302-90004e63fc55} - D:\.\Autorun.exe AUTORUN=1
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {eac35af7-3de2-11e1-a302-90004e63fc55} - D:\.\Autorun.exe AUTORUN=1
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {f660393c-40de-11e1-af44-90004e63fc55} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {f83e50fe-e95d-11e2-829c-90004e63fc55} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {facf2493-2277-11e2-bb88-90004e63fc55} - D:\Data\setup.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {facf2499-2277-11e2-bb88-90004e63fc55} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {fb2a7ec3-3411-11e4-a467-90004e63fc55} - D:\AutoRun.exe
Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:8897;https=127.0.0.1:8897
HKU\S-1-5-21-982829961-422532093-1718007052-1000\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.at/?gws_rd=ssl
HKU\S-1-5-21-982829961-422532093-1718007052-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCON/1
SearchScopes: HKLM -> {E40F8372-A296-4395-92CB-F634CAC151B8} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {E40F8372-A296-4395-92CB-F634CAC151B8} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-982829961-422532093-1718007052-1000 -> {E40F8372-A296-4395-92CB-F634CAC151B8} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
BHO: Bing Bar Helper -> {1dad3af3-ef2f-4f64-ac4b-11789189fcb6} -> C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll (Microsoft Corporation.)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Bing Bar Helper -> {1dad3af3-ef2f-4f64-ac4b-11789189fcb6} -> C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll (Microsoft Corporation.)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - Bing Bar - {eec0f710-38b5-4aba-99bf-ec87564a4e13} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM-x32 - Bing Bar - {eec0f710-38b5-4aba-99bf-ec87564a4e13} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll (Microsoft Corporation.)
Toolbar: HKU\S-1-5-21-982829961-422532093-1718007052-1000 -> No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Toolbar: HKU\S-1-5-21-982829961-422532093-1718007052-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52272 2010-08-02] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 10.64.1.224 10.64.1.225

FireFox:
========
FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\gnj2wp5w.default
FF Homepage: https://www.google.at
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_70.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_70.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\2\NP_wtapp.dll ()
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012-03-21]
FF HKLM-x32\...\Firefox\Extensions: [ff-bmboc@bytemobile.com] - C:\Program Files\T-Mobile\InternetManager_H\OCx64\addon
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-01-26]
FF HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

Chrome:
=======
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-01-26]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2015-01-26] (AVAST Software)
R2 ezSharedSvc; C:\Windows\SysWOW64\ezsvc7.dll [129584 2009-02-22] (EasyBits Sofware AS) [File not signed]
S3 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [254016 2014-10-10] (WildTangent)
R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] ()
S4 LightScribeService; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2009-10-16] (Hewlett-Packard Company) [File not signed]
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-01-18] (Hewlett-Packard) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-01-18] (Hewlett-Packard) [File not signed]
S4 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [247152 2009-07-06] ()
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5426448 2014-12-15] (TeamViewer GmbH)
S2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2015-01-26] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [87912 2015-01-26] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2015-01-26] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2015-01-26] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2015-01-26] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2015-01-26] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2015-01-26] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2015-01-26] ()
R0 BMLoad; C:\Windows\System32\drivers\BMLoad.sys [16512 2009-12-15] (Bytemobile, Inc.) [File not signed]
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-01-27] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)
S3 RSUSBSTOR; C:\Windows\SysWOW64\Drivers\RtsUStor.sys [225280 2009-09-23] (Realtek Semiconductor Corp.)
R1 tcpipBM; C:\Windows\system32\drivers\tcpipBM.sys [39552 2009-12-15] (Bytemobile, Inc.) [File not signed]
S3 cpuz135; \??\C:\Users\User\AppData\Local\Temp\cpuz135\cpuz135_x64.sys [X]
S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [X]
S3 zte_ecm_enum_filter; system32\DRIVERS\zte_ecm_enum_filter.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-27 15:30 - 2015-01-27 15:30 - 00017187 _____ () C:\Users\User\Desktop\FRST.txt
2015-01-27 13:55 - 2015-01-27 13:56 - 02347384 _____ (ESET) C:\Users\User\Downloads\esetsmartinstaller_deu.exe
2015-01-27 13:52 - 2015-01-27 15:28 - 00065536 _____ () C:\Windows\system32\Ikeext.etl
2015-01-27 13:50 - 2015-01-27 13:51 - 00852573 _____ () C:\Users\User\Desktop\SecurityCheck.exe
2015-01-27 11:26 - 2015-01-27 11:26 - 00000000 ____D () C:\Windows\ERUNT
2015-01-27 11:19 - 2015-01-27 11:22 - 00000000 ____D () C:\AdwCleaner
2015-01-27 11:18 - 2015-01-27 11:19 - 01707939 _____ (Thisisu) C:\Users\User\Desktop\JRT641.exe
2015-01-27 11:17 - 2015-01-27 11:17 - 02194432 _____ () C:\Users\User\Desktop\adwcleaner_4.109.exe
2015-01-27 09:23 - 2015-01-27 15:30 - 00000000 ____D () C:\FRST
2015-01-27 09:23 - 2015-01-27 09:23 - 02129920 _____ (Farbar) C:\Users\User\Desktop\FRST64.exe
2015-01-26 10:48 - 2015-01-26 10:48 - 00000000 ____D () C:\Users\User\AppData\Roaming\AVAST Software
2015-01-26 10:47 - 2015-01-26 10:47 - 00001964 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2015-01-26 10:47 - 2015-01-26 10:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2015-01-26 10:46 - 2015-01-27 15:30 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2015-01-26 10:46 - 2015-01-26 10:47 - 01050432 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2015-01-26 10:46 - 2015-01-26 10:47 - 00087912 _____ (AVAST Software) C:\Windows\system32\Drivers\aswmonflt.sys
2015-01-26 10:46 - 2015-01-26 10:46 - 00436624 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2015-01-26 10:46 - 2015-01-26 10:46 - 00364512 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2015-01-26 10:46 - 2015-01-26 10:46 - 00267632 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2015-01-26 10:46 - 2015-01-26 10:46 - 00116728 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2015-01-26 10:46 - 2015-01-26 10:46 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2015-01-26 10:46 - 2015-01-26 10:46 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2015-01-26 10:46 - 2015-01-26 10:46 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2015-01-26 10:46 - 2015-01-26 10:46 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2015-01-26 10:45 - 2015-01-26 10:45 - 00000000 ____D () C:\Program Files\AVAST Software
2015-01-26 10:44 - 2015-01-26 10:45 - 00000000 ____D () C:\ProgramData\AVAST Software
2015-01-26 10:40 - 2015-01-26 10:43 - 132469808 _____ (AVAST Software) C:\Users\User\Downloads\avast_free_antivirus_setup.exe
2015-01-26 09:59 - 2015-01-27 15:29 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-01-26 09:58 - 2015-01-26 09:58 - 00001062 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-01-26 09:58 - 2015-01-26 09:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-01-26 09:58 - 2015-01-26 09:58 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-01-26 09:58 - 2015-01-26 09:58 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-01-26 09:58 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-01-26 09:58 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-01-26 09:58 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-01-26 09:56 - 2015-01-26 09:57 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\User\Downloads\mbam-setup-2.0.4.1028.exe
2015-01-24 14:18 - 2015-01-24 14:18 - 00000000 ____D () C:\Users\User\Documents\Neuer Ordner (3)
2015-01-23 06:17 - 2015-01-27 15:28 - 00001805 _____ () C:\Windows\setupact.log
2015-01-23 06:17 - 2015-01-27 11:22 - 00016262 _____ () C:\Windows\PFRO.log
2015-01-23 06:17 - 2015-01-23 06:17 - 00000000 _____ () C:\Windows\setuperr.log
2015-01-22 18:19 - 2015-01-27 15:27 - 00357380 _____ () C:\Windows\WindowsUpdate.log
2015-01-19 15:14 - 2015-01-19 15:14 - 00001003 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 10.lnk
2015-01-19 15:14 - 2015-01-19 15:14 - 00000991 _____ () C:\Users\Public\Desktop\TeamViewer 10.lnk
2015-01-19 15:14 - 2015-01-19 15:14 - 00000000 ____D () C:\Program Files (x86)\TeamViewer
2015-01-19 15:13 - 2015-01-19 15:13 - 07718224 _____ (TeamViewer GmbH) C:\Users\User\Downloads\TeamViewer_Setup_de-ckc.exe
2015-01-14 19:09 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-14 19:09 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-14 19:09 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-01-14 19:09 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-01-14 19:09 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-01-14 19:09 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-01-14 19:09 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-01-14 19:09 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-01-14 19:09 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-01-14 19:09 - 2014-12-11 18:47 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-14 19:09 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-14 19:09 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2015-01-14 19:09 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2015-01-13 16:35 - 2015-01-13 16:35 - 00000000 ____H () C:\Users\User\AppData\Local\BIT53EA.tmp
2015-01-13 16:35 - 2015-01-13 16:35 - 00000000 _____ () C:\Users\User\AppData\Local\{4B22D22B-3BA4-40E7-B6BC-98DD75627F4A}
2015-01-01 17:54 - 2015-01-01 17:54 - 00000000 __SHD () C:\Users\User\AppData\Local\EmieBrowserModeList

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-27 15:28 - 2013-03-01 12:20 - 00000420 _____ () C:\Windows\Tasks\Wise Care 365.job
2015-01-27 15:28 - 2012-11-08 10:09 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-27 15:28 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-27 15:27 - 2012-11-08 10:09 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-01-27 15:18 - 2011-12-23 08:48 - 00003922 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{DB32AAC0-AE95-47E6-8D2E-C7CA58C9B8C0}
2015-01-27 13:57 - 2010-01-20 11:41 - 11513852 _____ () C:\Windows\system32\perfh007.dat
2015-01-27 13:57 - 2010-01-20 11:41 - 03643192 _____ () C:\Windows\system32\perfc007.dat
2015-01-27 13:57 - 2009-07-14 06:13 - 00006268 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-01-27 13:43 - 2009-07-14 05:45 - 00023248 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-27 13:43 - 2009-07-14 05:45 - 00023248 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-27 11:12 - 2012-11-08 10:48 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-27 10:54 - 2012-03-05 10:21 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-27 10:36 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing
2015-01-27 10:34 - 2009-07-14 06:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-01-26 10:50 - 2012-11-08 09:30 - 00001912 _____ () C:\Windows\epplauncher.mif
2015-01-22 13:18 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2015-01-19 17:47 - 2009-07-14 05:45 - 00374152 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-01-19 15:19 - 2011-12-22 08:16 - 00091216 _____ () C:\Users\User\AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-14 20:15 - 2013-07-12 17:57 - 00000000 ____D () C:\Windows\system32\MRT
2015-01-14 20:12 - 2011-12-23 10:36 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-01-08 09:55 - 2011-12-23 08:50 - 00298120 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

==================== Files in the root of some directories =======

2011-12-22 08:15 - 2011-12-22 08:15 - 0000000 _____ () C:\Users\User\AppData\Local\AtStart.txt
2015-01-13 16:35 - 2015-01-13 16:35 - 0000000 ____H () C:\Users\User\AppData\Local\BIT53EA.tmp
2013-04-07 17:14 - 2013-05-24 17:48 - 0005632 _____ () C:\Users\User\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2011-12-22 08:15 - 2011-12-22 08:15 - 0000000 _____ () C:\Users\User\AppData\Local\DSwitch.txt
2011-12-22 08:15 - 2011-12-22 08:15 - 0000000 _____ () C:\Users\User\AppData\Local\QSwitch.txt
2015-01-13 16:35 - 2015-01-13 16:35 - 0000000 _____ () C:\Users\User\AppData\Local\{4B22D22B-3BA4-40E7-B6BC-98DD75627F4A}
2012-12-30 10:55 - 2015-01-27 15:29 - 0000509 _____ () C:\ProgramData\HPWALog.txt
2012-03-21 15:20 - 2012-03-21 15:40 - 0003039 _____ () C:\ProgramData\hpzinstall.log
2010-08-02 13:15 - 2010-08-02 13:15 - 0000032 _____ () C:\ProgramData\{051B9612-4D82-42AC-8C63-CD2DCEDC1CB3}.log
2010-01-20 04:59 - 2010-01-20 04:59 - 0000109 _____ () C:\ProgramData\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}.log
2010-08-02 13:15 - 2010-08-02 13:15 - 0000032 _____ () C:\ProgramData\{23F3DA62-2D9E-4A69-B8D5-BE8E9E148092}.log
2010-01-20 04:55 - 2010-01-20 04:56 - 0000105 _____ () C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log
2010-08-02 13:14 - 2010-08-02 13:14 - 0000032 _____ () C:\ProgramData\{4FC670EB-5F02-4B07-90DB-022B86BFEFD0}.log
2010-08-02 13:15 - 2010-08-02 13:15 - 0000032 _____ () C:\ProgramData\{9867824A-C86D-4A83-8F3C-E7A86BE0AFD3}.log
2010-01-20 04:54 - 2010-01-20 04:55 - 0000107 _____ () C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
2010-01-20 04:56 - 2010-01-20 04:58 - 0000110 _____ () C:\ProgramData\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}.log
2010-08-02 13:15 - 2010-08-02 13:15 - 0000105 _____ () C:\ProgramData\{d36dd326-7280-11d8-97c8-000129760cbe}.log

Some content of TEMP:
====================
C:\Users\User\AppData\Local\Temp\Quarantine.exe
C:\Users\User\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-26 13:28

==================== End Of Log ============================
--- --- ---

--- --- ---

Warlord711 27.01.2015 15:39
Also die Logs sind sauber, der .DEFAULT Proxy ist gut verankert.
Wenn du grad Zeit und Lust hast, würd ich gern 1,2 Sachen testen, bitte:

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
cmd: reg query "HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" /s

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.


DannY_93 27.01.2015 15:55
Noch habe ich Zeit daher gerne ;) , die aktuellste Version von Java scheint aber Java 8 Update 31 zu sein wenn ich mich nicht irre

Hier die Log-Datei:

Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 24-01-2015 01
Ran by User at 2015-01-27 15:54:23 Run:6
Running from C:\Users\User\Desktop
Loaded Profiles: User (Available profiles: User)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
cmd: reg query "HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" /s
*****************


=========  reg query "HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" /s =========


HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
    SavedLegacySettings    REG_BINARY    46000000BD2500000300000028000000687474703D3132372E302E302E313A383839373B68747470733D3132372E302E302E313A383839371B0000003C2D6C6F6F706261636B3E3B7777772E6A6F6F736F66742E636F6D000000000000000000000000FD88CB080F20CE0100000000000000000000000000000000
    DefaultConnectionSettings    REG_BINARY    46000000131100000300000028000000687474703D3132372E302E302E313A383839373B68747470733D3132372E302E302E313A383839371B0000003C2D6C6F6F706261636B3E3B7777772E6A6F6F736F66742E636F6D000000000000000000000000FD88CB080F20CE0100000000000000000000000000000000
    tele.ring    REG_BINARY    4600000002000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000


========= End of CMD: =========


==== End of Fixlog 15:54:23 ====

Warlord711 27.01.2015 16:08
Start--> ausführen--> notepad (reinschreiben)--> ok Kopiere nun bitte folgenden Text aus der Code-Box in das leere Textdokument
Code:
Windows Registry Editor Version 5.00

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings"=hex:46,00,00,00,66,00,00,00,09,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00
"DefaultConnectionSettings"=hex:46,00,00,00,02,00,00,00,09,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
  • Speichere es nun unter regfix.reg
  • achte darauf, dass bei Datei-Typ "Alle Dateien" angegeben ist
  • nun sollte http://image.hijackthis.eu/upload/regfix_kl.jpg auf Deinem Desktop erscheinen
  • Mache nun einen Doppelklick auf die Datei regfix.reg
  • Bestätige mit Ja, dann drücke OK
  • Starte den Rechner neu auf
Hier findest Du eine bebilderte Anleitung

Dann bitte nochmal nen FRST Log, tausend Dank !

DannY_93 27.01.2015 16:43
So hier ist es :

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-01-2015 01
Ran by User (administrator) on USER-PC on 27-01-2015 16:15:29
Running from C:\Users\User\Desktop
Loaded Profiles: User (Available profiles: User)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BBSvc.EXE
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
() C:\ProgramData\DatacardService\HWDeviceService64.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
(Huawei Technologies Co., Ltd.) C:\Users\User\AppData\Roaming\tele.ring Verbindungsmanager\ouc.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [WirelessAssistant] => C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [498744 2009-07-23] (Hewlett-Packard)
HKLM-x32\...\Run: [DataCardMonitor] => C:\Program Files (x86)\tele.ring Verbindungsmanager\DataCardMonitor.exe [253952 2013-07-03] (Huawei Technologies Co., Ltd.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2015-01-27] (AVAST Software)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [508800 2014-12-17] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\Run: [HW_OPENEYE_OUC_tele.ring Verbindungsmanager] => C:\Program Files (x86)\tele.ring Verbindungsmanager\UpdateDog\ouc.exe [110592 2009-12-31] (Huawei Technologies Co., Ltd.)
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\Policies\system: [DisableChangePassword] 0
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: D - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: E - E:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {29de0f77-227c-11e2-8036-90004e63fc55} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {29de0f86-227c-11e2-8036-90004e63fc55} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {2bf70504-e3b9-11e2-8d2e-90004e63fc55} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {2bf70521-e3b9-11e2-8d2e-90004e63fc55} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {34c73ff9-2c16-11e2-9a50-90004e63fc55} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {356f63b6-4016-11e1-b766-b1570f61f5d9} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {356f63c7-4016-11e1-b766-b1570f61f5d9} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {5f6fac67-3f6e-11e1-a137-85ae9d686db3} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {5f6fac7e-3f6e-11e1-a137-85ae9d686db3} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {6e38b045-773e-11e1-9b43-e38defa8a60e} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {71060446-88c3-11e2-bd69-90004e63fc55} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {b3d5e5f9-2c6b-11e1-bc7d-806e6f6e6963} - F:\Setup.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {b56a49e9-826d-11e2-a311-90004e63fc55} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {b56a49f7-826d-11e2-a311-90004e63fc55} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {c661975b-e330-11e2-9294-90004e63fc55} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {c6619775-e330-11e2-9294-90004e63fc55} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {eac35ae9-3de2-11e1-a302-90004e63fc55} - D:\.\Autorun.exe AUTORUN=1
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {eac35af7-3de2-11e1-a302-90004e63fc55} - D:\.\Autorun.exe AUTORUN=1
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {f660393c-40de-11e1-af44-90004e63fc55} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {f83e50fe-e95d-11e2-829c-90004e63fc55} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {facf2493-2277-11e2-bb88-90004e63fc55} - D:\Data\setup.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {facf2499-2277-11e2-bb88-90004e63fc55} - D:\AutoRun.exe
HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {fb2a7ec3-3411-11e4-a467-90004e63fc55} - D:\AutoRun.exe
Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:8897;https=127.0.0.1:8897
HKU\S-1-5-21-982829961-422532093-1718007052-1000\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.at/?gws_rd=ssl
HKU\S-1-5-21-982829961-422532093-1718007052-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCON/1
SearchScopes: HKLM -> {E40F8372-A296-4395-92CB-F634CAC151B8} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {E40F8372-A296-4395-92CB-F634CAC151B8} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-982829961-422532093-1718007052-1000 -> {E40F8372-A296-4395-92CB-F634CAC151B8} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
BHO: Bing Bar Helper -> {1dad3af3-ef2f-4f64-ac4b-11789189fcb6} -> C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll (Microsoft Corporation.)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll No File
BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: Bing Bar Helper -> {1dad3af3-ef2f-4f64-ac4b-11789189fcb6} -> C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll (Microsoft Corporation.)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - Bing Bar - {eec0f710-38b5-4aba-99bf-ec87564a4e13} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM-x32 - Bing Bar - {eec0f710-38b5-4aba-99bf-ec87564a4e13} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll (Microsoft Corporation.)
Toolbar: HKU\S-1-5-21-982829961-422532093-1718007052-1000 -> No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Toolbar: HKU\S-1-5-21-982829961-422532093-1718007052-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52272 2010-08-02] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 10.64.1.224 10.64.1.225

FireFox:
========
FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\gnj2wp5w.default
FF Homepage: https://www.google.at
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_296.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_296.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\2\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012-03-21]
FF HKLM-x32\...\Firefox\Extensions: [ff-bmboc@bytemobile.com] - C:\Program Files\T-Mobile\InternetManager_H\OCx64\addon
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-01-26]
FF HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

Chrome:
=======
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-01-26]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2015-01-26] (AVAST Software)
R2 ezSharedSvc; C:\Windows\SysWOW64\ezsvc7.dll [129584 2009-02-22] (EasyBits Sofware AS) [File not signed]
S3 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [254016 2014-10-10] (WildTangent)
R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] ()
S4 LightScribeService; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2009-10-16] (Hewlett-Packard Company) [File not signed]
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-01-18] (Hewlett-Packard) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-01-18] (Hewlett-Packard) [File not signed]
S4 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [247152 2009-07-06] ()
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5426448 2014-12-15] (TeamViewer GmbH)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2015-01-26] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [87912 2015-01-26] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2015-01-26] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2015-01-26] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2015-01-26] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2015-01-26] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2015-01-26] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2015-01-26] ()
R0 BMLoad; C:\Windows\System32\drivers\BMLoad.sys [16512 2009-12-15] (Bytemobile, Inc.) [File not signed]
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-01-27] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)
S3 RSUSBSTOR; C:\Windows\SysWOW64\Drivers\RtsUStor.sys [225280 2009-09-23] (Realtek Semiconductor Corp.)
R1 tcpipBM; C:\Windows\system32\drivers\tcpipBM.sys [39552 2009-12-15] (Bytemobile, Inc.) [File not signed]
S3 cpuz135; \??\C:\Users\User\AppData\Local\Temp\cpuz135\cpuz135_x64.sys [X]
S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [X]
S3 zte_ecm_enum_filter; system32\DRIVERS\zte_ecm_enum_filter.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-27 16:15 - 2015-01-27 16:16 - 00017874 _____ () C:\Users\User\Desktop\FRST.txt
2015-01-27 16:12 - 2015-01-27 16:12 - 00000549 _____ () C:\Users\User\Desktop\regfix.reg
2015-01-27 15:54 - 2015-01-27 15:54 - 00003886 _____ () C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2015-01-27 15:50 - 2015-01-27 15:50 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-01-27 15:50 - 2015-01-27 15:50 - 00000000 ____D () C:\ProgramData\Oracle
2015-01-27 15:50 - 2015-01-27 15:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-01-27 15:50 - 2015-01-27 15:50 - 00000000 ____D () C:\Program Files (x86)\Java
2015-01-27 15:48 - 2015-01-27 15:48 - 00639912 _____ (Oracle Corporation) C:\Users\User\Downloads\jxpiinstall.exe
2015-01-27 15:43 - 2015-01-27 15:52 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-01-27 15:43 - 2015-01-27 15:43 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-01-27 15:43 - 2015-01-27 15:43 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-27 15:43 - 2015-01-27 15:43 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-01-27 15:41 - 2015-01-27 15:41 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-01-27 15:41 - 2015-01-27 15:41 - 00001979 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk
2015-01-27 15:41 - 2015-01-27 15:41 - 00000000 ____D () C:\Program Files (x86)\Adobe
2015-01-27 13:55 - 2015-01-27 13:56 - 02347384 _____ (ESET) C:\Users\User\Downloads\esetsmartinstaller_deu.exe
2015-01-27 13:52 - 2015-01-27 16:13 - 00065536 _____ () C:\Windows\system32\Ikeext.etl
2015-01-27 13:50 - 2015-01-27 13:51 - 00852573 _____ () C:\Users\User\Desktop\SecurityCheck.exe
2015-01-27 11:26 - 2015-01-27 11:26 - 00000000 ____D () C:\Windows\ERUNT
2015-01-27 11:19 - 2015-01-27 11:22 - 00000000 ____D () C:\AdwCleaner
2015-01-27 11:18 - 2015-01-27 11:19 - 01707939 _____ (Thisisu) C:\Users\User\Desktop\JRT641.exe
2015-01-27 11:17 - 2015-01-27 11:17 - 02194432 _____ () C:\Users\User\Desktop\adwcleaner_4.109.exe
2015-01-27 09:23 - 2015-01-27 16:15 - 00000000 ____D () C:\FRST
2015-01-27 09:23 - 2015-01-27 09:23 - 02129920 _____ (Farbar) C:\Users\User\Desktop\FRST64.exe
2015-01-26 10:48 - 2015-01-26 10:48 - 00000000 ____D () C:\Users\User\AppData\Roaming\AVAST Software
2015-01-26 10:47 - 2015-01-26 10:47 - 00001964 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2015-01-26 10:47 - 2015-01-26 10:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2015-01-26 10:46 - 2015-01-27 16:07 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2015-01-26 10:46 - 2015-01-26 10:47 - 01050432 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2015-01-26 10:46 - 2015-01-26 10:47 - 00087912 _____ (AVAST Software) C:\Windows\system32\Drivers\aswmonflt.sys
2015-01-26 10:46 - 2015-01-26 10:46 - 00436624 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2015-01-26 10:46 - 2015-01-26 10:46 - 00364512 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2015-01-26 10:46 - 2015-01-26 10:46 - 00267632 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2015-01-26 10:46 - 2015-01-26 10:46 - 00116728 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2015-01-26 10:46 - 2015-01-26 10:46 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2015-01-26 10:46 - 2015-01-26 10:46 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2015-01-26 10:46 - 2015-01-26 10:46 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2015-01-26 10:46 - 2015-01-26 10:46 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2015-01-26 10:45 - 2015-01-26 10:45 - 00000000 ____D () C:\Program Files\AVAST Software
2015-01-26 10:44 - 2015-01-26 10:45 - 00000000 ____D () C:\ProgramData\AVAST Software
2015-01-26 10:40 - 2015-01-26 10:43 - 132469808 _____ (AVAST Software) C:\Users\User\Downloads\avast_free_antivirus_setup.exe
2015-01-26 09:59 - 2015-01-27 16:15 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-01-26 09:58 - 2015-01-26 09:58 - 00001062 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-01-26 09:58 - 2015-01-26 09:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-01-26 09:58 - 2015-01-26 09:58 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-01-26 09:58 - 2015-01-26 09:58 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-01-26 09:58 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-01-26 09:58 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-01-26 09:58 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-01-26 09:56 - 2015-01-26 09:57 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\User\Downloads\mbam-setup-2.0.4.1028.exe
2015-01-24 14:18 - 2015-01-24 14:18 - 00000000 ____D () C:\Users\User\Documents\Neuer Ordner (3)
2015-01-23 06:17 - 2015-01-27 16:13 - 00001973 _____ () C:\Windows\setupact.log
2015-01-23 06:17 - 2015-01-27 15:51 - 00016880 _____ () C:\Windows\PFRO.log
2015-01-23 06:17 - 2015-01-23 06:17 - 00000000 _____ () C:\Windows\setuperr.log
2015-01-22 18:19 - 2015-01-27 16:12 - 00375144 _____ () C:\Windows\WindowsUpdate.log
2015-01-19 15:14 - 2015-01-19 15:14 - 00001003 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 10.lnk
2015-01-19 15:14 - 2015-01-19 15:14 - 00000991 _____ () C:\Users\Public\Desktop\TeamViewer 10.lnk
2015-01-19 15:14 - 2015-01-19 15:14 - 00000000 ____D () C:\Program Files (x86)\TeamViewer
2015-01-19 15:13 - 2015-01-19 15:13 - 07718224 _____ (TeamViewer GmbH) C:\Users\User\Downloads\TeamViewer_Setup_de-ckc.exe
2015-01-14 19:09 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-14 19:09 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-14 19:09 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-01-14 19:09 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-01-14 19:09 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-01-14 19:09 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-01-14 19:09 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-01-14 19:09 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-01-14 19:09 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-01-14 19:09 - 2014-12-11 18:47 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-14 19:09 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-14 19:09 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2015-01-14 19:09 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2015-01-13 16:35 - 2015-01-13 16:35 - 00000000 ____H () C:\Users\User\AppData\Local\BIT53EA.tmp
2015-01-13 16:35 - 2015-01-13 16:35 - 00000000 _____ () C:\Users\User\AppData\Local\{4B22D22B-3BA4-40E7-B6BC-98DD75627F4A}
2015-01-01 17:54 - 2015-01-01 17:54 - 00000000 __SHD () C:\Users\User\AppData\Local\EmieBrowserModeList

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-27 16:13 - 2013-03-01 12:20 - 00000420 _____ () C:\Windows\Tasks\Wise Care 365.job
2015-01-27 16:13 - 2012-11-08 10:09 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-27 16:13 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-27 16:12 - 2009-07-14 05:45 - 00023248 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-27 16:12 - 2009-07-14 05:45 - 00023248 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-27 16:10 - 2010-01-20 11:41 - 11573740 _____ () C:\Windows\system32\perfh007.dat
2015-01-27 16:10 - 2010-01-20 11:41 - 03662856 _____ () C:\Windows\system32\perfc007.dat
2015-01-27 16:10 - 2009-07-14 06:13 - 00006268 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-01-27 15:52 - 2010-01-20 04:33 - 00000000 ____D () C:\ProgramData\Adobe
2015-01-27 15:46 - 2012-03-05 10:21 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-27 15:43 - 2011-12-23 08:51 - 00000000 ____D () C:\Users\User\AppData\Local\Adobe
2015-01-27 15:27 - 2012-11-08 10:09 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-01-27 15:18 - 2011-12-23 08:48 - 00003922 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{DB32AAC0-AE95-47E6-8D2E-C7CA58C9B8C0}
2015-01-27 11:12 - 2012-11-08 10:48 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-27 10:36 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing
2015-01-27 10:34 - 2009-07-14 06:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-01-26 10:50 - 2012-11-08 09:30 - 00001912 _____ () C:\Windows\epplauncher.mif
2015-01-22 13:18 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2015-01-19 17:47 - 2009-07-14 05:45 - 00374152 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-01-19 15:19 - 2011-12-22 08:16 - 00091216 _____ () C:\Users\User\AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-14 20:15 - 2013-07-12 17:57 - 00000000 ____D () C:\Windows\system32\MRT
2015-01-14 20:12 - 2011-12-23 10:36 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-01-08 09:55 - 2011-12-23 08:50 - 00298120 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

==================== Files in the root of some directories =======

2011-12-22 08:15 - 2011-12-22 08:15 - 0000000 _____ () C:\Users\User\AppData\Local\AtStart.txt
2015-01-13 16:35 - 2015-01-13 16:35 - 0000000 ____H () C:\Users\User\AppData\Local\BIT53EA.tmp
2013-04-07 17:14 - 2013-05-24 17:48 - 0005632 _____ () C:\Users\User\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2011-12-22 08:15 - 2011-12-22 08:15 - 0000000 _____ () C:\Users\User\AppData\Local\DSwitch.txt
2011-12-22 08:15 - 2011-12-22 08:15 - 0000000 _____ () C:\Users\User\AppData\Local\QSwitch.txt
2015-01-13 16:35 - 2015-01-13 16:35 - 0000000 _____ () C:\Users\User\AppData\Local\{4B22D22B-3BA4-40E7-B6BC-98DD75627F4A}
2012-12-30 10:55 - 2015-01-27 16:14 - 0000509 _____ () C:\ProgramData\HPWALog.txt
2012-03-21 15:20 - 2012-03-21 15:40 - 0003039 _____ () C:\ProgramData\hpzinstall.log
2010-08-02 13:15 - 2010-08-02 13:15 - 0000032 _____ () C:\ProgramData\{051B9612-4D82-42AC-8C63-CD2DCEDC1CB3}.log
2010-01-20 04:59 - 2010-01-20 04:59 - 0000109 _____ () C:\ProgramData\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}.log
2010-08-02 13:15 - 2010-08-02 13:15 - 0000032 _____ () C:\ProgramData\{23F3DA62-2D9E-4A69-B8D5-BE8E9E148092}.log
2010-01-20 04:55 - 2010-01-20 04:56 - 0000105 _____ () C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log
2010-08-02 13:14 - 2010-08-02 13:14 - 0000032 _____ () C:\ProgramData\{4FC670EB-5F02-4B07-90DB-022B86BFEFD0}.log
2010-08-02 13:15 - 2010-08-02 13:15 - 0000032 _____ () C:\ProgramData\{9867824A-C86D-4A83-8F3C-E7A86BE0AFD3}.log
2010-01-20 04:54 - 2010-01-20 04:55 - 0000107 _____ () C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
2010-01-20 04:56 - 2010-01-20 04:58 - 0000110 _____ () C:\ProgramData\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}.log
2010-08-02 13:15 - 2010-08-02 13:15 - 0000105 _____ () C:\ProgramData\{d36dd326-7280-11d8-97c8-000129760cbe}.log

Some content of TEMP:
====================
C:\Users\User\AppData\Local\Temp\Quarantine.exe
C:\Users\User\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-26 13:28

==================== End Of Log ============================
--- --- ---

--- --- ---


Ich bin für heute dann mal weg, jetzt schon mal VIELEN DANK! Du warst echt eine große Hilfe. Morgen werde ich nochmal hier vorbei schauen falls du noch etwas vor hast :)

Schönen Abend noch :)

Warlord711 27.01.2015 17:13
Dir vielen Dank fürs Testen.

Wäre cool wenn du morgen nochmal diesen Fix machen könntest:

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
cmd: reg query "HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" /s
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:8897;https=127.0.0.1:8897

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.


DannY_93 28.01.2015 09:21
Guten Morgen,

du brauchst dich doch nicht bedanken ;)

Hier der Fixlog:
Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 24-01-2015 01
Ran by User at 2015-01-28 09:14:57 Run:7
Running from C:\Users\User\Desktop
Loaded Profiles: User (Available profiles: User)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
cmd: reg query "HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" /s
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:8897;https=127.0.0.1:8897
*****************


=========  reg query "HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" /s =========


HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
    SavedLegacySettings    REG_BINARY    4600000069000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000A400440000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    DefaultConnectionSettings    REG_BINARY    4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000A400440000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    tele.ring    REG_BINARY    4600000002000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000


========= End of CMD: =========

HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => value deleted successfully.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => Value not found.

==== End of Fixlog 09:14:57 ====
Das Problem ist wieder aufgetaucht, sobald ich den Telering-Stick anstecke und mich mit dem ins Internet verbinde, taucht das Problem wieder auf

Warlord711 28.01.2015 10:00
D.h. wenn der Stick eingesteckt wird, werden die Proxies gesetzt und bleiben danach auch beständig ?


Alle Zeitangaben in WEZ +1. Es ist jetzt 15:00 Uhr.
Seite 2 von 3 1 2 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131