Zitat:
Das hat keine Ergebnisse angezeigt, nur im addition wurde etwas angezeigt.
| Sry das ist Blödsinn, FRST erzeugt immer das Logfile "FRST.txt"
Das andere behandeln wir wenn wir durch sind |
| Fledermausi | 19.12.2013 08:48 |
Ja, hat es erzeugt, aber ohne Einträge. Code:
LastRegBack: 2013-10-01 19:42
==================== End Of Log ============================
|
| Fledermausi | 21.12.2013 21:56 |
FRST Logfile: Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 20-12-2013 02
Ran by Fledermausi (administrator) on PC on 21-12-2013 21:53:04
Running from C:\Users\Fledermausi\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Enigma Software Group USA, LLC.) C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Trend Micro Inc.) C:\Program Files\Trend Micro\Titanium\TiMiniService.exe
() C:\Program Files (x86)\T-Mobile Internet Manager 03\AssistantServices.exe
(Trend Micro Inc.) C:\Program Files\Trend Micro\Titanium\TiResumeSrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(AMD) C:\Windows\System32\atieclxx.exe
(ASUS) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(ASUSTeK) C:\Windows\SysWOW64\ACEngSvr.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(ASUS) C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVH.EXE
() C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\OFFICEVIRT.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Trend Micro Client Framework] - C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiWatchDog.exe [192520 2010-10-12] (Trend Micro Inc.)
HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2278504 2011-10-14] (Realtek Semiconductor)
HKCU\...\Run: [] - [x]
MountPoints2: F - F:\Install.exe
HKLM-x32\...\Run: [Wireless Console 3] - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe [2255360 2011-06-10] (ASUS)
HKLM-x32\...\Run: [SDTray] - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.facebook.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = https://apps.facebook.com/thesmurfsco-two/?fb_source=bookmark_apps&ref=bookmarks&count=4&fb_bmpos=3_4
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
SearchScopes: HKCU - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
BHO: TmIEPlugInBHO Class - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\module\20004\1.5.1381\6.5.1234\TmIEPlg.dll (Trend Micro Inc.)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: TmBpIeBHO Class - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\module\20002\6.5.1234\6.5.1234\TmBpIe64.dll (Trend Micro Inc.)
BHO-x32: TmIEPlugInBHO Class - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\module\20004\1.5.1381\6.5.1234\TmIEPlg32.dll (Trend Micro Inc.)
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: TmBpIeBHO Class - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\module\20002\6.5.1234\6.5.1234\TmBpIe32.dll (Trend Micro Inc.)
Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\module\20002\6.5.1234\6.5.1234\TmBpIe64.dll (Trend Micro Inc.)
Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\module\20004\1.5.1381\6.5.1234\TmIEPlg.dll (Trend Micro Inc.)
Handler-x32: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\module\20002\6.5.1234\6.5.1234\TmBpIe32.dll (Trend Micro Inc.)
Handler-x32: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\module\20004\1.5.1381\6.5.1234\TmIEPlg32.dll (Trend Micro Inc.)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Fledermausi\AppData\Roaming\Mozilla\Firefox\Profiles\1y2ugmmk.default-1354467891266
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.7 - C:\Program Files\VideoLAN\VLC\npvlc.dll No File
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: ZEON/PDF,version=2.0 - C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll (Zeon Corporation)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101727.dll (Amazon.com, Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\do-search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF HKLM-x32\...\Firefox\Extensions: [{22C7F6C6-8D67-4534-92B5-529A0EC09405}] - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\firefoxextension\
FF Extension: Trend Micro NSC Firefox Extension - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\firefoxextension\
FF HKLM-x32\...\Firefox\Extensions: [fe_9.0@nokia.com] - C:\Program Files (x86)\Nokia\Nokia Suite\Connectors\Bookmarks Connector\FirefoxExtension_9.0
FF Extension: Firefox Synchronisation Extension - C:\Program Files (x86)\Nokia\Nokia Suite\Connectors\Bookmarks Connector\FirefoxExtension_9.0
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF HKLM-x32\...\Thunderbird\Extensions: [te_9.0@nokia.com] - C:\Program Files (x86)\Nokia\Nokia Suite\Connectors\Thunderbird Connector\ThunderbirdExtension_9.0
FF Extension: Thunderbird Address Book Synchronisation Extension - C:\Program Files (x86)\Nokia\Nokia Suite\Connectors\Thunderbird Connector\ThunderbirdExtension_9.0
Chrome:
=======
CHR HomePage:
CHR RestoreOnStartup: "hxxp://www.google.com"
CHR DefaultSearchKeyword: google.de
CHR DefaultSearchProvider: Google
CHR DefaultSearchURL: {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR Plugin: (Shockwave Flash) - C:\Users\Fledermausi\AppData\Local\Google\Chrome\User Data\PepperFlash\11.7.700.202\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Fledermausi\AppData\Local\Google\Chrome\Application\26.0.1410.43\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Fledermausi\AppData\Local\Google\Chrome\Application\26.0.1410.43\pdf.dll ()
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (AmazonMP3DownloaderPlugin) - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101727.dll (Amazon.com, Inc.)
CHR Plugin: (DivX VOD Helper Plug-in) - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
CHR Plugin: (DivX Plus Web Player) - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll No File
CHR Plugin: (Zeon Plus) - C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll (Zeon Corporation)
CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll No File
CHR Extension: (YouTube) - C:\Users\Fledermausi\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\Fledermausi\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Gmail) - C:\Users\Fledermausi\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1
==================== Services (Whitelisted) =================
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2011-07-14] (Advanced Micro Devices, Inc.)
R2 Atheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [138400 2011-03-13] (Atheros)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1817560 2013-05-16] (Safer-Networking Ltd.)
S2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1033688 2013-05-16] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2013-05-15] (Safer-Networking Ltd.)
R2 SpyHunter 4 Service; C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe [1024384 2013-01-14] (Enigma Software Group USA, LLC.)
R2 TiMiniService; C:\Program Files\Trend Micro\Titanium\TiMiniService.exe [241488 2010-09-17] (Trend Micro Inc.)
R2 UI Assistant Service; C:\Program Files (x86)\T-Mobile Internet Manager 03\AssistantServices.exe [241664 2009-03-30] ()
S3 Amsp; "C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe" coreFrameworkHost.exe -m=rb -dt=60000 [x]
==================== Drivers (Whitelisted) ====================
S3 esgiguard; C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [13088 2011-03-02] ()
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2012-06-22] ()
R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )
S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2013-04-24] (Anchorfree Inc.)
R2 tmactmon; C:\Windows\System32\DRIVERS\tmactmon.sys [90704 2010-09-17] (Trend Micro Inc.)
R2 tmcomm; C:\Windows\System32\DRIVERS\tmcomm.sys [144464 2010-09-17] (Trend Micro Inc.)
R2 tmevtmgr; C:\Windows\System32\DRIVERS\tmevtmgr.sys [67664 2010-09-17] (Trend Micro Inc.)
R1 tmtdi; C:\Windows\System32\DRIVERS\tmtdi.sys [105552 2010-09-17] (Trend Micro Inc.)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-12-21 21:52 - 2013-12-21 21:52 - 02193141 _____ (Farbar) C:\Users\Fledermausi\Desktop\FRST64.exe
2013-12-21 21:52 - 2013-12-21 21:52 - 00000000 ____D C:\Users\Fledermausi\Desktop\FRST-OlderVersion
2013-12-17 13:15 - 2013-12-21 21:53 - 00014270 _____ C:\Users\Fledermausi\Desktop\FRST.txt
2013-12-17 13:14 - 2013-12-17 13:15 - 00026060 _____ C:\Users\Fledermausi\Desktop\Addition.txt
2013-12-15 15:45 - 2013-12-20 22:26 - 00003930 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{44ACDA38-7963-4853-9E46-5FFBC543F332}
2013-12-15 11:50 - 2013-10-19 03:18 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2013-12-15 11:50 - 2013-10-19 02:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2013-12-15 10:12 - 2013-05-10 06:56 - 14631424 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2013-12-15 10:12 - 2013-05-10 06:56 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2013-12-15 10:12 - 2013-05-10 05:56 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2013-12-15 10:12 - 2013-05-10 05:56 - 11410432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2013-12-15 10:08 - 2013-11-26 12:54 - 23183360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-12-15 10:08 - 2013-11-26 11:19 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-12-15 10:08 - 2013-11-26 11:18 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-12-15 10:08 - 2013-11-26 11:11 - 17112576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-12-15 10:08 - 2013-11-26 10:48 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-12-15 10:08 - 2013-11-26 10:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-12-15 10:08 - 2013-11-26 10:41 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-12-15 10:08 - 2013-11-26 10:29 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-12-15 10:08 - 2013-11-26 10:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-12-15 10:08 - 2013-11-26 10:23 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-12-15 10:08 - 2013-11-26 10:21 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-12-15 10:08 - 2013-11-26 10:18 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-12-15 10:08 - 2013-11-26 10:18 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-12-15 10:08 - 2013-11-26 10:16 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-12-15 10:08 - 2013-11-26 09:57 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-12-15 10:08 - 2013-11-26 09:38 - 02166784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-12-15 10:08 - 2013-11-26 09:38 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-12-15 10:08 - 2013-11-26 09:35 - 05769216 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-12-15 10:08 - 2013-11-26 09:32 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-12-15 10:08 - 2013-11-26 09:28 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2013-12-15 10:08 - 2013-11-26 09:16 - 04243968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-12-15 10:08 - 2013-11-26 09:02 - 01995264 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-12-15 10:08 - 2013-11-26 08:48 - 12996608 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-12-15 10:08 - 2013-11-26 08:32 - 01928192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-12-15 10:08 - 2013-11-26 08:26 - 11221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-12-15 10:08 - 2013-11-26 08:07 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-12-15 10:08 - 2013-11-26 07:40 - 01395200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-12-15 10:08 - 2013-11-26 07:34 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-12-15 10:08 - 2013-11-26 07:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-12-15 10:08 - 2013-11-26 07:33 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-12-15 10:08 - 2013-11-26 07:27 - 01157632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-12-14 18:12 - 2013-11-23 19:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-12-14 18:12 - 2013-11-23 18:47 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-12-14 18:12 - 2013-11-12 03:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-12-14 18:12 - 2013-11-12 03:07 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-12-14 18:12 - 2013-10-30 03:32 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2013-12-14 18:12 - 2013-10-30 03:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll
2013-12-14 18:12 - 2013-10-30 02:24 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-12-14 18:09 - 2013-10-12 03:32 - 00150016 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2013-12-14 18:09 - 2013-10-12 03:31 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2013-12-14 18:09 - 2013-10-12 03:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshom.ocx
2013-12-14 18:09 - 2013-10-12 03:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll
2013-12-14 18:09 - 2013-10-12 02:33 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2013-12-14 18:09 - 2013-10-12 02:33 - 00156160 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2013-12-14 18:09 - 2013-10-12 02:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscript.exe
2013-12-14 18:09 - 2013-10-12 02:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe
2013-12-14 18:09 - 2013-10-04 03:16 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys
2013-12-14 18:09 - 2013-10-04 02:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2013-12-14 00:46 - 2013-12-14 10:17 - 00000000 ____D C:\Users\Fledermausi\AppData\Roaming\Skype
2013-12-14 00:45 - 2013-12-14 10:17 - 00000000 ____D C:\ProgramData\Skype
2013-12-14 00:45 - 2013-12-14 10:17 - 00000000 ____D C:\Program Files (x86)\Skype
2013-12-09 20:58 - 2013-12-09 20:58 - 00000000 ____D C:\Users\Fledermausi\AppData\Local\{929A8ABF-E6E1-43F1-BECA-86CA57C79C5F}
2013-12-08 21:20 - 2013-12-08 21:22 - 00000000 ____D C:\Users\Fledermausi\Documents\frst
2013-12-08 21:15 - 2013-12-08 21:15 - 01927772 _____ (Farbar) C:\Users\Fledermausi\Downloads\FRST64.exe
2013-12-02 20:21 - 2013-12-02 20:21 - 00000000 ____D C:\Windows\ERUNT
2013-12-02 20:07 - 2013-12-02 20:07 - 01110034 _____ C:\Users\Fledermausi\Desktop\adwcleaner.exe
2013-12-02 20:03 - 2013-12-02 20:04 - 01034531 _____ (Thisisu) C:\Users\Fledermausi\Desktop\JRT.exe
2013-11-24 14:40 - 2013-11-24 15:08 - 00116440 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2013-11-24 14:40 - 2013-11-24 14:40 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-24 14:38 - 2013-11-24 15:07 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-11-24 14:36 - 2013-11-24 14:37 - 12576792 _____ (Malwarebytes Corp.) C:\Users\Fledermausi\Desktop\mbar-1.07.0.1007.exe
2013-11-23 11:09 - 2013-11-23 11:09 - 00000000 ____D C:\Users\Fledermausi\AppData\Roaming\dvdcss
==================== One Month Modified Files and Folders =======
2013-12-21 21:54 - 2013-12-17 13:15 - 00014270 _____ C:\Users\Fledermausi\Desktop\FRST.txt
2013-12-21 21:52 - 2013-12-21 21:52 - 02193141 _____ (Farbar) C:\Users\Fledermausi\Desktop\FRST64.exe
2013-12-21 21:52 - 2013-12-21 21:52 - 00000000 ____D C:\Users\Fledermausi\Desktop\FRST-OlderVersion
2013-12-21 21:52 - 2013-11-18 14:19 - 00000000 ____D C:\FRST
2013-12-21 19:47 - 2011-02-19 05:24 - 00666264 _____ C:\Windows\system32\perfh007.dat
2013-12-21 19:47 - 2011-02-19 05:24 - 00134186 _____ C:\Windows\system32\perfc007.dat
2013-12-21 19:47 - 2009-07-14 06:13 - 01531258 _____ C:\Windows\system32\PerfStringBackup.INI
2013-12-21 19:43 - 2011-11-02 01:00 - 01544550 _____ C:\Windows\WindowsUpdate.log
2013-12-20 22:26 - 2013-12-15 15:45 - 00003930 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{44ACDA38-7963-4853-9E46-5FFBC543F332}
2013-12-20 08:57 - 2009-07-14 05:51 - 00110958 _____ C:\Windows\setupact.log
2013-12-18 21:04 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\NDF
2013-12-18 20:48 - 2009-07-14 05:45 - 00009696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-12-18 20:48 - 2009-07-14 05:45 - 00009696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-12-17 13:15 - 2013-12-17 13:14 - 00026060 _____ C:\Users\Fledermausi\Desktop\Addition.txt
2013-12-17 13:06 - 2011-12-23 19:30 - 00045056 _____ C:\Windows\system32\acovcnt.exe
2013-12-17 13:05 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-12-16 08:46 - 2013-08-16 05:41 - 00000000 ____D C:\Windows\system32\MRT
2013-12-16 08:32 - 2011-12-28 23:03 - 90708896 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-12-15 14:37 - 2012-10-03 19:45 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-12-15 14:37 - 2012-10-03 19:45 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-12-15 14:34 - 2009-07-14 06:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2013-12-15 14:33 - 2009-07-14 05:45 - 00276600 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-14 10:18 - 2011-12-23 19:30 - 00000000 ____D C:\Users\Fledermausi
2013-12-14 10:17 - 2013-12-14 00:46 - 00000000 ____D C:\Users\Fledermausi\AppData\Roaming\Skype
2013-12-14 10:17 - 2013-12-14 00:45 - 00000000 ____D C:\ProgramData\Skype
2013-12-14 10:17 - 2013-12-14 00:45 - 00000000 ____D C:\Program Files (x86)\Skype
2013-12-14 10:17 - 2011-12-23 20:31 - 00000000 ____D C:\Program Files (x86)\T-Mobile Internet Manager 03
2013-12-14 10:17 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\registration
2013-12-14 10:16 - 2012-01-13 20:46 - 00000000 ____D C:\Users\Fledermausi\AppData\Roaming\SoftGrid Client
2013-12-13 08:03 - 2012-01-06 22:17 - 00000000 ____D C:\Users\Fledermausi\AppData\Local\CrashDumps
2013-12-09 20:58 - 2013-12-09 20:58 - 00000000 ____D C:\Users\Fledermausi\AppData\Local\{929A8ABF-E6E1-43F1-BECA-86CA57C79C5F}
2013-12-08 21:28 - 2013-07-12 05:49 - 00000000 ____D C:\Users\Fledermausi\AppData\Local\Adobe
2013-12-08 21:22 - 2013-12-08 21:20 - 00000000 ____D C:\Users\Fledermausi\Documents\frst
2013-12-08 21:15 - 2013-12-08 21:15 - 01927772 _____ (Farbar) C:\Users\Fledermausi\Downloads\FRST64.exe
2013-12-02 20:21 - 2013-12-02 20:21 - 00000000 ____D C:\Windows\ERUNT
2013-12-02 20:18 - 2012-03-10 08:46 - 00001551 _____ C:\Users\Fledermausi\Desktop\Google Chrome.lnk
2013-12-02 20:12 - 2013-11-17 20:07 - 00000000 ____D C:\AdwCleaner
2013-12-02 20:12 - 2013-05-13 14:53 - 00000965 _____ C:\Users\Public\Desktop\Opera.lnk
2013-12-02 20:12 - 2012-03-10 08:46 - 00000000 ____D C:\Users\Fledermausi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
2013-12-02 20:12 - 2012-01-13 20:56 - 00001009 _____ C:\Users\Fledermausi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-12-02 20:12 - 2011-12-23 21:26 - 00001051 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-12-02 20:11 - 2012-10-07 21:35 - 00000000 ____D C:\Users\Fledermausi\AppData\Roaming\Uniblue
2013-12-02 20:11 - 2012-10-07 21:35 - 00000000 ____D C:\Program Files (x86)\Uniblue
2013-12-02 20:07 - 2013-12-02 20:07 - 01110034 _____ C:\Users\Fledermausi\Desktop\adwcleaner.exe
2013-12-02 20:04 - 2013-12-02 20:03 - 01034531 _____ (Thisisu) C:\Users\Fledermausi\Desktop\JRT.exe
2013-11-26 12:54 - 2013-12-15 10:08 - 23183360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-26 11:19 - 2013-12-15 10:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-26 11:18 - 2013-12-15 10:08 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-11-26 11:11 - 2013-12-15 10:08 - 17112576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-26 10:48 - 2013-12-15 10:08 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-26 10:46 - 2013-12-15 10:08 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-11-26 10:41 - 2013-12-15 10:08 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-26 10:29 - 2013-12-15 10:08 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-26 10:27 - 2013-12-15 10:08 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-26 10:23 - 2013-12-15 10:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-11-26 10:21 - 2013-12-15 10:08 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-26 10:18 - 2013-12-15 10:08 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-11-26 10:18 - 2013-12-15 10:08 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-11-26 10:16 - 2013-12-15 10:08 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-11-26 09:57 - 2013-12-15 10:08 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-26 09:38 - 2013-12-15 10:08 - 02166784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-26 09:38 - 2013-12-15 10:08 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-11-26 09:35 - 2013-12-15 10:08 - 05769216 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-26 09:32 - 2013-12-15 10:08 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-11-26 09:28 - 2013-12-15 10:08 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2013-11-26 09:16 - 2013-12-15 10:08 - 04243968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-26 09:02 - 2013-12-15 10:08 - 01995264 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-11-26 08:48 - 2013-12-15 10:08 - 12996608 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-26 08:32 - 2013-12-15 10:08 - 01928192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-11-26 08:26 - 2013-12-15 10:08 - 11221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-26 08:07 - 2013-12-15 10:08 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-26 07:40 - 2013-12-15 10:08 - 01395200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-26 07:34 - 2013-12-15 10:08 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-11-26 07:34 - 2013-12-15 10:08 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-11-26 07:33 - 2013-12-15 10:08 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-26 07:27 - 2013-12-15 10:08 - 01157632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-11-24 20:05 - 2011-12-24 08:08 - 00000000 ____D C:\Program Files (x86)\Avant Browser
2013-11-24 15:08 - 2013-11-24 14:40 - 00116440 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2013-11-24 15:07 - 2013-11-24 14:38 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-11-24 15:05 - 2011-04-13 02:39 - 00619468 _____ C:\Windows\PFRO.log
2013-11-24 14:40 - 2013-11-24 14:40 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-24 14:37 - 2013-11-24 14:36 - 12576792 _____ (Malwarebytes Corp.) C:\Users\Fledermausi\Desktop\mbar-1.07.0.1007.exe
2013-11-23 19:26 - 2013-12-14 18:12 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-11-23 18:47 - 2013-12-14 18:12 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-11-23 11:10 - 2011-12-24 17:26 - 00000000 ____D C:\Users\Fledermausi\AppData\Roaming\vlc
2013-11-23 11:09 - 2013-11-23 11:09 - 00000000 ____D C:\Users\Fledermausi\AppData\Roaming\dvdcss
2013-11-23 11:09 - 2012-04-04 21:23 - 00000000 ____D C:\Users\Fledermausi\AppData\Roaming\DivX
2013-11-21 20:00 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\PolicyDefinitions
Some content of TEMP:
====================
C:\Users\Fledermausi\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-10-01 19:42
==================== End Of Log ============================
--- --- --- |
Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle einen Quickscan mit Malwarebytes Anti-Malware (MBAM) Hinweis: Denk bitte vorher daran, Malwarebytes Anti-Malware über den Updatebutton zu aktualisieren!
Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt: ESET Online Scanner - Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
- Lade und starte
Eset Online Scanner - Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
- Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
- Klicke auf Starten.
- Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
- Klicke am Ende des Suchlaufs auf Fertig stellen.
- Schließe das Fenster von ESET.
- Explorer öffnen.
- C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
- Logfile hier posten.
- Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
- Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset
|
| Fledermausi | 29.12.2013 13:14 |
Der mbam hat noch einiges gefunden. Code:
Malwarebytes Anti-Malware (Test) 1.75.0.1300
www.malwarebytes.org
Datenbank Version: v2013.12.29.03
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16476
Fledermausi :: PC [Administrator]
Schutz: Aktiviert
29.12.2013 12:54:21
MBAM-log-2013-12-29 (13-13-38).txt
Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 212196
Laufzeit: 19 Minute(n), 5 Sekunde(n)
Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse: 22
C:\Windows\System32\config\systemprofile\AppData\Roaming\DealPly (PUP.Optional.DealPly.A) -> Keine Aktion durchgeführt.
C:\Windows\System32\config\systemprofile\AppData\Roaming\DealPly\UpdateProc (PUP.Optional.DealPly.A) -> Keine Aktion durchgeführt.
C:\Users\Fledermausi\AppData\Local\Temp\mt_ffx\Delta (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt.
C:\Users\Fledermausi\AppData\Local\Temp\mt_ffx\Delta\delta (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt.
C:\Users\Fledermausi\AppData\Local\Temp\mt_ffx\Delta\delta\1.8.10.0 (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt.
C:\Users\Fledermausi\AppData\Local\Temp\CT3241949 (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.
C:\Users\Fledermausi\AppData\Local\Temp\CT3297969 (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.
C:\Users\Fledermausi\AppData\Local\Temp\DM\bin (PUP.Optional.BundleInstaller.A) -> Keine Aktion durchgeführt.
C:\Users\Fledermausi\AppData\Local\Temp\DM\bin\Aartemis (PUP.Optional.BundleInstaller.A) -> Keine Aktion durchgeführt.
C:\Users\Fledermausi\AppData\Local\Temp\DM\bin\css (PUP.Optional.BundleInstaller.A) -> Keine Aktion durchgeführt.
C:\Users\Fledermausi\AppData\Local\Temp\DM\bin\css\images (PUP.Optional.BundleInstaller.A) -> Keine Aktion durchgeführt.
C:\Users\Fledermausi\AppData\Local\Temp\DM\bin\Dealply (PUP.Optional.BundleInstaller.A) -> Keine Aktion durchgeführt.
C:\Users\Fledermausi\AppData\Local\Temp\DM\bin\Driverpro (PUP.Optional.BundleInstaller.A) -> Keine Aktion durchgeführt.
C:\Users\Fledermausi\AppData\Local\Temp\DM\bin\exe (PUP.Optional.BundleInstaller.A) -> Keine Aktion durchgeführt.
C:\Users\Fledermausi\AppData\Local\Temp\DM\bin\Feven DE (PUP.Optional.BundleInstaller.A) -> Keine Aktion durchgeführt.
C:\Users\Fledermausi\AppData\Local\Temp\DM\bin\MyBackupPc (PUP.Optional.BundleInstaller.A) -> Keine Aktion durchgeführt.
C:\Users\Fledermausi\AppData\Local\Temp\DM\bin\OptimizerPro (PUP.Optional.BundleInstaller.A) -> Keine Aktion durchgeführt.
C:\Users\Fledermausi\AppData\Local\Temp\DM\bin\Pricepeep2 (PUP.Optional.BundleInstaller.A) -> Keine Aktion durchgeführt.
C:\Users\Fledermausi\AppData\Local\Temp\DM\bin\Qone8 (PUP.Optional.BundleInstaller.A) -> Keine Aktion durchgeführt.
C:\Users\Fledermausi\AppData\Local\Temp\DM\bin\Re-Markit (PUP.Optional.BundleInstaller.A) -> Keine Aktion durchgeführt.
C:\Users\Fledermausi\AppData\Local\Temp\DM\bin\SaltarSmart (PUP.Optional.BundleInstaller.A) -> Keine Aktion durchgeführt.
C:\Users\Fledermausi\AppData\Local\Temp\DM\bin\Wajam (PUP.Optional.BundleInstaller.A) -> Keine Aktion durchgeführt.
Infizierte Dateien: 9
C:\Users\Fledermausi\Downloads\FileConverter_1.3.exe (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.
C:\Users\Fledermausi\Downloads\iLividSetupV1.exe (PUP.Optional.Bandoo) -> Keine Aktion durchgeführt.
C:\Users\Fledermausi\Downloads\rcpsetup_3335_new.exe (PUP.Optional.RegCleanerPro) -> Keine Aktion durchgeführt.
C:\Users\Fledermausi\Downloads\setup_codec_3dx.exe (PUP.LoadTubes) -> Keine Aktion durchgeführt.
C:\Users\Fledermausi\Downloads\SoftonicDownloader_fuer_advanced-system-optimizer.exe (PUP.Optional.Softonic.A) -> Keine Aktion durchgeführt.
C:\Users\Fledermausi\AppData\Roaming\Mozilla\Extensions\{1FD91A9C-410C-4090-BBCC-55D3450EF433} (PUP.Optional.Searchqu.A) -> Keine Aktion durchgeführt.
C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\do-search.xml (PUP.Optional.DoSearch.A) -> Keine Aktion durchgeführt.
C:\Windows\System32\config\systemprofile\AppData\Roaming\DealPly\UpdateProc\config.dat (PUP.Optional.DealPly.A) -> Keine Aktion durchgeführt.
C:\Windows\System32\config\systemprofile\AppData\Roaming\DealPly\UpdateProc\UpdateTask.exe (PUP.Optional.DealPly.A) -> Keine Aktion durchgeführt.
(Ende)
|
Die Funde bitte auch entfernen.
Was ist mit ESET? |
| Fledermausi | 10.01.2014 06:58 |
Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=89de54ebdde8ff4cbe5cbc576c5c9fd4
# engine=16592
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-01-10 01:47:45
# local_time=2014-01-10 02:47:45 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776573 100 94 236899 140948315 0 0
# scanned=192257
# found=5
# cleaned=0
# scan_time=18290
sh=003E08E57F7AB3363372569443F9B08DEB334511 ft=1 fh=c75606536b2b7d6c vn="a variant of Win32/Adware.Yontoo.B application" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setupx.dll.vir"
sh=1F69871321674FD72959382D3C5FB07B1BCC0A2E ft=1 fh=b2548ffe04190c5a vn="a variant of Win64/Mediyes.B trojan" ac=I fn="C:\FRST\Quarantine\poua6jp2s.dll"
sh=346C7E19DFFB62A9BD851931C618789BB7599F55 ft=1 fh=c1da49d1959b79e9 vn="multiple threats" ac=I fn="C:\Users\Fledermausi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8QTYY4J5\Setup-C73[1].exe"
sh=EBB45E278EA69CDC6CB45489DB2E97FCC4D43827 ft=1 fh=c71c00112c65f794 vn="a variant of Win32/Mediyes.I trojan" ac=I fn="C:\Windows\System32\d3dysi3ti.dll"
sh=EBB45E278EA69CDC6CB45489DB2E97FCC4D43827 ft=1 fh=c71c00112c65f794 vn="a variant of Win32/Mediyes.I trojan" ac=I fn="C:\Windows\SysWOW64\d3dysi3ti.dll"
|
Oh du hast offensichtlich noch ein mediyes drauf, der ist mir durch die Lappen gegangen :(
Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop (falls noch nicht vorhanden). - Starte bitte die OTL.exe.
- Oben findest Du ein Kästchen mit Ausgabe. Wähle bitte Standard Ausgabe.
- Setze einen Haken bei Scanne alle Benutzer.
- Unter Extra Registry, wähle bitte Use SafeList.
- Kopiere nun den Inhalt aus der Codebox in die http://larusso.trojaner-board.de/Images/otlfix.jpg Textbox.
Code:
HKEY_LOCAL_MACHINE\software\microsoft\Windows\CurrentVersion\Telephony\Providers
HKEY_LOCAL_MACHINE\software\microsoft\Windows\CurrentVersion\Telephony\Providers /64
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation /S /64
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Dnscache /S /64
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost /64
HKEY_LOCAL_MACHINE\SOFTWARE\Joosoft.com
HKEY_LOCAL_MACHINE\SOFTWARE\Joosoft.com /64
%SystemRoot%\system32\*.tsp
%SystemRoot%\system32\*.tsp /64
C:\Windows\system32\*.dll /800
C:\Windows\system32\*.dll /800 /64
CREATERESTOREPOINT
- Schließe bitte nun alle Programme. (Wichtig)
- Klicke nun bitte auf den Scan Button.
- Am Ende des Suchlaufs werden 2 Logdateien erstellt.
- Kopiere nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread
|
| Alle Zeitangaben in WEZ +1. Es ist jetzt 19:25 Uhr. | |
Copyright ©2000-2025, Trojaner-Board
Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.
