FoxTab und GPU Monitor deinstallieren. Deinstalliere mal Avira komplett und teste den Speed ohne AV Programm. |
sorry, komme erst jetzt dazu zu schreiben....bekomme nun auf dem Rechner gar keine Seite mehr geöffnet...es steht dort immer wieder: Diese Webseite ist nicht verfügbar. Bin über einen anderen Rechner drin, um hier zu schreiben...cookies und cache habe ich gelöscht, Neustart auch...bringt alles nichts :-/ was nun???? FRST Additions Logfile: FRST Additions Logfile: Code: Additional scan result of Farbar Recovery Scan Tool (x64) Version: 10-01-2014 FRST Logfile: Code: Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-01-2014 --- --- --- |
Downloade Dir bitte Malwarebytes Anti-Malware
Downloade Dir bitte AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte. |
Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2014.01.11.04 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 11.0.9600.16476 Erik :: ERIK-PC [Administrator] 11.01.2014 16:12:16 mbam-log-2014-01-11 (16-12-16).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 235838 Laufzeit: 4 Minute(n), 41 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 1 C:\Users\Erik\Downloads\DownloadAcceleratorSetup.exe (PUP.Optional.InstallCore) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) AdwCleaner Logfile: Code: # AdwCleaner v3.016 - Bericht erstellt am 11/01/2014 um 16:39:14 FRST Logfile: FRST Logfile: Code: Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-01-2014 03 --- --- --- |
JRT Log? Wurden die Funde mit AdwCLeaner auch gelöscht? |
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 6.1.0 (01.07.2014:1) OS: Windows 7 Home Premium x64 Ran by Erik on 12.01.2014 at 9:49:48,46 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services Failed to stop: [Service] update jump flip ~~~ Registry Values Successfully deleted: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\pc speed maximizer ~~~ Registry Keys Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3} Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23} Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\dsiteproducts Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\installcore Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\pc speed maximizer Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\caphyon Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\openit open it! Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6db9fdfe-b718-4962-be0c-0a5fce7f7f7b} Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{6db9fdfe-b718-4962-be0c-0a5fce7f7f7b} ~~~ Files Successfully deleted: [File] "C:\Users\Public\Desktop\open it!.lnk" ~~~ Folders Successfully deleted: [Folder] "C:\Users\Erik\AppData\Roaming\pc speed maximizer" Failed to delete: [Folder] "C:\Program Files (x86)\jump flip" Successfully deleted: [Folder] "C:\Program Files (x86)\openit" Failed to delete: [Folder] "C:\Program Files (x86)\pc speed maximizer" Successfully deleted: [Folder] "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\open it!" Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin" ~~~ FireFox Emptied folder: C:\Users\Erik\AppData\Roaming\mozilla\firefox\profiles\robpkzlr.default\minidumps [1 files] ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 12.01.2014 at 9:57:36,35 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ AdwCleaner Logfile: Code: # AdwCleaner v3.016 - Bericht erstellt am 12/01/2014 um 10:07:37 FRST Logfile: FRST Logfile: FRST Logfile: Code: Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-01-2014 05 --- --- --- --- --- --- FRST Additions Logfile: Code: Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-01-2014 05 |
ESET Online Scanner
Downloade Dir bitte SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? :) |
ESETSmartInstaller@High as downloader log: all ok # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6920 # api_version=3.0.2 # EOSSerial=9c92169265f9e545bb30558381d64dc8 # engine=16649 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=false # unsafe_checked=false # antistealth_checked=true # utc_time=2014-01-14 09:16:04 # local_time=2014-01-14 10:16:04 (+0100, Mitteleuropäische Zeit) # country="Germany" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=1799 16775165 100 96 33007 255157454 25770 0 # compatibility_mode=5893 16776573 100 94 214888 141364014 0 0 # scanned=263222 # found=12 # cleaned=0 # scan_time=10635 sh=29A36C963FD0D62BAE30D36EBAB93B8F52AC1091 ft=0 fh=0000000000000000 vn="JS/Adware.ShoppingSuggestion.A application" ac=I fn="C:\Program Files (x86)\Shopping Suggestion\{D394D188-BAC7-4e03-8FAF-389A4D7EC6F4}.xpi" sh=3AEF532A0211CE7869F0EB51E940D9E0C7CAE321 ft=1 fh=c7560653d3ee2314 vn="a variant of Win32/Adware.Yontoo.B application" ac=I fn="C:\System Volume Information\SystemRestore\FRStaging\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setupx.dll" sh=84D1A91CBA423DB0B87CC0CAD639359A0CD5F385 ft=1 fh=abac503da7c4e71f vn="a variant of Win32/SpeedingUpMyPC.B application" ac=I fn="C:\System Volume Information\SystemRestore\FRStaging\Users\Erik\AppData\Local\Temp\DM\Minecraft_027\software\OptimizerPro.exe" sh=63D8A233223061D42538AD5F8A1552A86C0420CA ft=1 fh=0b75d8cb754ba137 vn="multiple threats" ac=I fn="C:\System Volume Information\SystemRestore\FRStaging\Users\Erik\AppData\Local\Temp\DM\Minecraft_027\software\Yontoo.exe" sh=CF747DEF541DA5E7518724DA07D664D30AE2C15C ft=0 fh=0000000000000000 vn="JS/Adware.ShoppingSuggestion.A application" ac=I fn="C:\Users\Erik\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejbpjlaagejfakeobljhgplbgklgemll\1.0.0_0\background.js" sh=1CFD41ED728411F65A995351F69C15E75EFF1AA8 ft=0 fh=0000000000000000 vn="JS/Adware.ShoppingSuggestion.A application" ac=I fn="C:\Users\Erik\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejbpjlaagejfakeobljhgplbgklgemll\1.0.0_0\scriptinjector.js" sh=29A36C963FD0D62BAE30D36EBAB93B8F52AC1091 ft=0 fh=0000000000000000 vn="JS/Adware.ShoppingSuggestion.A application" ac=I fn="C:\Users\Erik\AppData\Roaming\Mozilla\Firefox\Profiles\robpkzlr.default\extensions\{D394D188-BAC7-4e03-8FAF-389A4D7EC6F4}.xpi" sh=85C115494567F5D51C17069FD54A0F96CE09BEFC ft=0 fh=0000000000000000 vn="a variant of Win32/Skintrim.LJ trojan" ac=I fn="D:\ERIK-PC\Backup Set 2013-09-22 070032\Backup Files 2013-11-03 192749\Backup files 2.zip" sh=5FA7CCE46D9C12EC54E2916DE758C109A0F8D703 ft=0 fh=0000000000000000 vn="a variant of Win32/Skintrim.LJ trojan" ac=I fn="D:\ERIK-PC\Backup Set 2013-11-10 190005\Backup Files 2013-11-10 190005\Backup files 2.zip" sh=4C36D3D196FA7E27B7BBB61DBE5796A4EBFAB41E ft=0 fh=0000000000000000 vn="JS/Adware.ShoppingSuggestion.A application" ac=I fn="D:\ERIK-PC\Backup Set 2013-11-10 190005\Backup Files 2013-12-15 190002\Backup files 1.zip" sh=1FB24285C34A19834EC1FB0C0A10FCD352A96E86 ft=0 fh=0000000000000000 vn="JS/Adware.ShoppingSuggestion.A application" ac=I fn="D:\ERIK-PC\Backup Set 2014-01-06 112426\Backup Files 2014-01-06 112426\Backup files 1.zip" sh=0DA5CF6F0EB0D47249A97F32F9C4D10C5C0EBAA8 ft=0 fh=0000000000000000 vn="JS/Adware.ShoppingSuggestion.A application" ac=I fn="D:\ERIK-PC\Backup Set 2014-01-06 112426\Backup Files 2014-01-06 112426\Backup files 3.zip" Results of screen317's Security Check version 0.99.78 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 11 ``````````````Antivirus/Firewall Check:`````````````` Avira Desktop Antivirus up to date! (On Access scanning disabled!) `````````Anti-malware/Other Utilities Check:````````` Out of date HijackThis installed! Spybot - Search & Destroy Malwarebytes Anti-Malware Version 1.75.0.1300 HijackThis 2.0.2 Java 7 Update 10 Java version out of Date! Adobe Flash Player 11.9.900.170 Adobe Reader XI Mozilla Firefox 23.0.1 Firefox out of Date! Google Chrome 31.0.1650.63 Google Chrome 32.0.1700.41 ````````Process Check: objlist.exe by Laurent```````` Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbamgui.exe Spybot Teatimer.exe is disabled! Avira Antivir avgnt.exe Avira Antivir avguard.exe mbamscheduler.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` FRST Logfile: FRST Logfile: FRST Logfile: Code: Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-01-2014 --- --- --- --- --- --- FRST Additions Logfile: Code: Additional scan result of Farbar Recovery Scan Tool (x64) Version: 15-01-2014 |
Backup auf D löschen. Java und Firefox updaten. Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop. Schließe nun alle offenen Programme und trenne Dich von dem Internet. Doppelklick auf die TFC.exe und drücke auf Start. Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen. Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code: C:\Program Files (x86)\Shopping Suggestion Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Fertig :) Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun :) Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann. |
sorry, hatte total vergessen, Dir eine Nachricht zu schicken, dass Du dieses Thema aus Deinen Abos löschst...:-/ kann ich diese ganze Prozedur nochmals durchspielen??? Mittlerweile ist der PC wieder sooooo lahm und ständig Werbeeinblendungen :-/ LG, Karen |
Was haste denn gemacht? Poste einfach mal frische FRST logs. |
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X] HKU\S-1-5-21-1954896351-3050078566-3604981563-1000\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [18642024 2013-02-28] (Skype Technologies S.A.) HKU\S-1-5-21-1954896351-3050078566-3604981563-1000\...\Run: [Spybot-S&D Cleaning] - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe [3713032 2012-11-13] (Safer-Networking Ltd.) HKU\S-1-5-21-1954896351-3050078566-3604981563-1000\...\Run: [KPeerNexonEU] - C:\Nexon\NEXON_EU_Downloader\nxEULauncher.exe [438272 2013-11-03] (NEXON Inc.) Startup: C:\Users\Erik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () GroupPolicy: Group Policy on Chrome detected <======= ATTENTION ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Sign In StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKLM - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: ImageToPung - {C23013E9-0738-4FF2-0706-B720247CC971} - C:\ProgramData\ImageToPung\J.x64.dll No File BHO: dealpeak - {FCF67B1D-0514-1E00-ACF8-B6A63CAE2B7B} - C:\ProgramData\dealpeak\GoEX8rog.x64.dll No File BHO-x32: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHelper.dll (Safer-Networking Ltd.) BHO-x32: bloson.addon - {58307a99-7813-45f1-ac6c-06ff1617a20d} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation) Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\Erik\AppData\Roaming\Mozilla\Firefox\Profiles\robpkzlr.default FF DefaultSearchEngine: user_pref("browser.search.defaultenginename", ""); FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_70.dll () FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_70.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1207148.dll (Adobe Systems, Inc.) FF Plugin-x32: @java.com/DTPlugin,version=10.10.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.10.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin-x32: ZEON/PDF,version=2.0 - C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll (Zeon Corporation) FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Erik\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll No File FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Erik\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF SearchPlugin: C:\Users\Erik\AppData\Roaming\Mozilla\Firefox\Profiles\robpkzlr.default\searchplugins\wiseconvert-13-customized-web-search.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: ImageToPung - C:\Users\Erik\AppData\Roaming\Mozilla\Firefox\Profiles\robpkzlr.default\Extensions\1kwn_8rzbo@hflnr-awt.co.uk [2014-02-16] FF Extension: Amazon-Icon - C:\Users\Erik\AppData\Roaming\Mozilla\Firefox\Profiles\robpkzlr.default\Extensions\amazon-icon@giga.de [2013-11-03] FF Extension: dealpeak - C:\Users\Erik\AppData\Roaming\Mozilla\Firefox\Profiles\robpkzlr.default\Extensions\xgx.sxnl@mfkwaosl.org [2014-02-16] FF Extension: SaltarSmart - C:\Users\Erik\AppData\Roaming\Mozilla\Firefox\Profiles\robpkzlr.default\Extensions\firefox@saltarsmart.biz.xpi [2013-08-23] FF Extension: ReloadEvery - C:\Users\Erik\AppData\Roaming\Mozilla\Firefox\Profiles\robpkzlr.default\Extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644}.xpi [2013-04-20] FF Extension: Shopping Suggestion - C:\Users\Erik\AppData\Roaming\Mozilla\Firefox\Profiles\robpkzlr.default\Extensions\{D394D188-BAC7-4e03-8FAF-389A4D7EC6F4}.xpi [2013-12-15] FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-01-03] Chrome: ======= CHR HomePage: hxxp://www.google.com CHR DefaultSearchKeyword: conduit.search CHR DefaultSearchProvider: Conduit Search CHR DefaultSearchURL: hxxp://search.conduit.com/Results.aspx?ctid=CT3315513&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=2&UP=SP6CAC28EC-B3B6-4941-8009-5F40393AF2E3&q={searchTerms}&SSPV= CHR DefaultNewTabURL: CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.107\PepperFlash\pepflashplayer.dll () CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.107\ppGoogleNaClPluginChrome.dll () CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.107\pdf.dll () CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll No File CHR Plugin: (Java(TM) Platform SE 7 U10) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll No File CHR Plugin: (Zeon Plus) - C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll (Zeon Corporation) CHR Plugin: (Windows Live0099 Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) CHR Plugin: (Unity Player) - C:\Users\Erik\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) CHR Plugin: (Shockwave for Director) - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1204144.dll No File CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll No File CHR Plugin: (Java Deployment Toolkit 7.0.100.18) - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) CHR Extension: (Foxtab Speed Dial) - C:\Users\Erik\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchmpbaclbiioedakpcldenooikekokm [2013-12-15] CHR Extension: (ImageToPung) - C:\Users\Erik\AppData\Local\Google\Chrome\User Data\Default\Extensions\ebheioiffnjfhfejjepoglnkhgjimmmm [2014-02-05] CHR Extension: (Shopping Suggestion) - C:\Users\Erik\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejbpjlaagejfakeobljhgplbgklgemll [2013-12-15] CHR Extension: (dealpeak) - C:\Users\Erik\AppData\Local\Google\Chrome\User Data\Default\Extensions\imlnfdepjomkffmlbnophhkdmpongmlj [2014-02-13] CHR Extension: (Bloson) - C:\Users\Erik\AppData\Local\Google\Chrome\User Data\Default\Extensions\jimlgadlmmpnoagdcbciogmhpoeejhon [2013-05-18] CHR Extension: (Skype Click to Call) - C:\Users\Erik\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2013-05-18] CHR Extension: (Amazon-Icon) - C:\Users\Erik\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkcedibhemacmilmkpndpkoidlnmgngg [2013-11-03] CHR Extension: (FastestFox – Schneller browsen) - C:\Users\Erik\AppData\Local\Google\Chrome\User Data\Default\Extensions\mmffncokckfccddfenhkhnllmlobdahm [2013-12-15] CHR Extension: (Google Wallet) - C:\Users\Erik\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-24] CHR HKLM\...\Chrome\Extension: [dchmpbaclbiioedakpcldenooikekokm] - C:\Users\Erik\AppData\Local\foxtab_speeddial.crx [2013-12-15] CHR HKCU\...\Chrome\Extension: [dchmpbaclbiioedakpcldenooikekokm] - C:\Users\Erik\AppData\Local\foxtab_speeddial.crx [2013-12-15] CHR HKLM-x32\...\Chrome\Extension: [dchmpbaclbiioedakpcldenooikekokm] - C:\Users\Erik\AppData\Local\foxtab_speeddial.crx [2013-12-15] CHR HKLM-x32\...\Chrome\Extension: [hphehadppenpmajgnkjdcopcfijjegaf] - C:\Program Files (x86)\Jump Flip\hphehadppenpmajgnkjdcopcfijjegaf.crx [2013-12-15] CHR HKLM-x32\...\Chrome\Extension: [jimlgadlmmpnoagdcbciogmhpoeejhon] - C:\Users\Erik\AppData\Roaming\Bloson\bloson_cr_1.0b1.crx [2012-09-03] CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-01-03] CHR HKLM-x32\...\Chrome\Extension: [mkcedibhemacmilmkpndpkoidlnmgngg] - C:\Users\Erik\ChromeExtensions\mkcedibhemacmilmkpndpkoidlnmgngg\amazon.crx [2013-11-03] CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ==================== Services (Whitelisted) ================= R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG) R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1363616 2014-01-03] (Microsoft Corporation) R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1748640 2014-01-03] (Microsoft Corporation) R2 MBAMScheduler; D:\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation) R2 MBAMService; D:\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation) R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1103392 2012-11-13] (Safer-Networking Ltd.) R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1369624 2012-11-13] (Safer-Networking Ltd.) R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [168384 2012-11-13] (Safer-Networking Ltd.) ==================== Drivers (Whitelisted) ==================== R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-17] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-17] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-12-10] (Avira Operations GmbH & Co. KG) R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( ) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) S3 catchme; \??\C:\ComboFix\catchme.sys [X] S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [X] S3 X6va015; \??\C:\Windows\SysWOW64\Drivers\X6va015 [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-03-07 06:17 - 2014-03-07 06:17 - 00020742 _____ () C:\Users\Erik\Desktop\FRST.txt 2014-03-07 06:17 - 2014-03-07 06:17 - 00000000 ____D () C:\Users\Erik\Desktop\FRST-OlderVersion 2014-03-05 17:42 - 2014-03-05 17:42 - 00000753 _____ () C:\Users\Erik\Desktop\JRT.txt 2014-03-05 16:49 - 2014-03-05 16:50 - 00000000 ___SD () C:\ComboFix 2014-02-13 20:13 - 2014-03-05 17:06 - 00000000 ____D () C:\ProgramData\dealpeak 2014-02-12 03:02 - 2013-12-21 10:53 - 00548864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-02-12 03:02 - 2013-12-21 09:56 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-02-12 03:01 - 2014-02-06 13:16 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-02-12 03:01 - 2014-02-06 12:30 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-02-12 03:01 - 2014-02-06 12:30 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-02-12 03:01 - 2014-02-06 12:07 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-02-12 03:01 - 2014-02-06 12:06 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-02-12 03:01 - 2014-02-06 11:57 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-02-12 03:01 - 2014-02-06 11:56 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-02-12 03:01 - 2014-02-06 11:52 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-02-12 03:01 - 2014-02-06 11:49 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-02-12 03:01 - 2014-02-06 11:48 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-02-12 03:01 - 2014-02-06 11:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-02-12 03:01 - 2014-02-06 11:32 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-02-12 03:01 - 2014-02-06 11:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-02-12 03:01 - 2014-02-06 11:17 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-02-12 03:01 - 2014-02-06 11:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-02-12 03:01 - 2014-02-06 11:00 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-02-12 03:01 - 2014-02-06 10:57 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-02-12 03:01 - 2014-02-06 10:52 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-02-12 03:01 - 2014-02-06 10:52 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-02-12 03:01 - 2014-02-06 10:49 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-02-12 03:01 - 2014-02-06 10:47 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-02-12 03:01 - 2014-02-06 10:46 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-02-12 03:01 - 2014-02-06 10:25 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-02-12 03:01 - 2014-02-06 10:13 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-02-12 03:01 - 2014-02-06 09:40 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-02-12 03:01 - 2014-02-06 09:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-02-12 03:00 - 2014-02-06 12:12 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-02-12 03:00 - 2014-02-06 11:38 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-02-12 03:00 - 2014-02-06 11:11 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-02-12 03:00 - 2014-02-06 10:57 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-02-12 03:00 - 2014-02-06 10:50 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-02-12 03:00 - 2014-02-06 10:25 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-02-12 03:00 - 2014-02-06 10:24 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-02-12 03:00 - 2014-02-06 10:22 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-02-12 03:00 - 2014-02-06 10:09 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-02-12 03:00 - 2014-02-06 10:03 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-02-12 03:00 - 2014-02-06 09:55 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-02-12 03:00 - 2014-02-06 09:41 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-02-12 03:00 - 2014-02-06 09:36 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-02-12 01:17 - 2014-01-01 00:05 - 00420008 _____ () C:\Windows\SysWOW64\locale.nls 2014-02-12 01:17 - 2014-01-01 00:04 - 00420008 _____ () C:\Windows\system32\locale.nls 2014-02-12 01:17 - 2013-12-25 00:09 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll 2014-02-12 01:17 - 2013-12-24 23:48 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll 2014-02-12 01:17 - 2013-12-06 03:30 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll 2014-02-12 01:17 - 2013-12-06 03:30 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll 2014-02-12 01:17 - 2013-12-06 03:02 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll 2014-02-12 01:17 - 2013-12-06 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll 2014-02-12 01:17 - 2013-12-04 03:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll 2014-02-12 01:17 - 2013-12-04 03:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll 2014-02-12 01:17 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll 2014-02-12 01:17 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll 2014-02-12 01:17 - 2013-12-04 03:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll 2014-02-12 01:17 - 2013-12-04 03:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe 2014-02-12 01:17 - 2013-12-04 03:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe 2014-02-12 01:17 - 2013-12-04 03:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe 2014-02-12 01:17 - 2013-12-04 03:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe 2014-02-12 01:17 - 2013-12-04 03:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll 2014-02-12 01:17 - 2013-12-04 03:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll 2014-02-12 01:17 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll 2014-02-12 01:17 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll 2014-02-12 01:17 - 2013-12-04 03:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll 2014-02-12 01:17 - 2013-12-04 02:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe 2014-02-12 01:17 - 2013-12-04 02:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe 2014-02-12 01:17 - 2013-12-04 02:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe 2014-02-12 01:17 - 2013-12-04 02:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 2014-02-12 01:17 - 2013-11-26 09:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll 2014-02-12 01:17 - 2013-11-22 23:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll 2014-02-05 14:46 - 2014-03-05 17:06 - 00000000 ____D () C:\ProgramData\ImageToPung 2014-02-05 14:46 - 2014-02-13 20:13 - 00000000 ____D () C:\ProgramData\726a9a91e9097b86 2014-02-05 14:46 - 2014-02-05 14:46 - 00000306 __RSH () C:\ProgramData\ntuser.pol 2014-02-05 14:46 - 2014-02-05 14:46 - 00000000 ____D () C:\Users\Erik\AppData\Local\Packages 2014-02-05 14:46 - 2014-02-05 14:46 - 00000000 ____D () C:\ProgramData\ebheioiffnjfhfejjepoglnkhgjimmmm ==================== One Month Modified Files and Folders ======= 2014-03-07 06:18 - 2014-03-07 06:17 - 00020742 _____ () C:\Users\Erik\Desktop\FRST.txt 2014-03-07 06:17 - 2014-03-07 06:17 - 00000000 ____D () C:\Users\Erik\Desktop\FRST-OlderVersion 2014-03-07 06:17 - 2013-12-15 08:42 - 00000000 ____D () C:\FRST 2014-03-07 06:17 - 2013-12-15 08:41 - 02156544 _____ (Farbar) C:\Users\Erik\Desktop\FRST64.exe 2014-03-07 06:12 - 2014-01-12 09:46 - 00000288 _____ () C:\Windows\Tasks\Digital Sites.job 2014-03-07 06:12 - 2013-05-18 06:03 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-03-07 06:12 - 2013-05-12 10:49 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-03-07 06:12 - 2012-08-10 21:13 - 00000000 ____D () C:\Users\Erik\AppData\Roaming\Skype 2014-03-06 06:38 - 2009-07-14 05:45 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-03-06 06:38 - 2009-07-14 05:45 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-03-06 06:31 - 2013-05-18 06:03 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-03-06 06:31 - 2012-07-16 16:05 - 00000000 ___HD () C:\ASUS.DAT 2014-03-06 06:30 - 2013-12-15 02:55 - 00001288 _____ () C:\Windows\setupact.log 2014-03-06 06:30 - 2012-03-05 02:33 - 02012721 _____ () C:\Windows\WindowsUpdate.log 2014-03-06 06:30 - 2009-07-14 06:08 - 00032604 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-03-06 06:30 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-03-06 06:21 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF 2014-03-06 06:10 - 2012-07-16 16:20 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-03-05 17:42 - 2014-03-05 17:42 - 00000753 _____ () C:\Users\Erik\Desktop\JRT.txt 2014-03-05 17:30 - 2012-07-16 16:05 - 00045056 _____ () C:\Windows\SysWOW64\acovcnt.exe 2014-03-05 17:29 - 2013-09-20 19:35 - 00000000 ____D () C:\AdwCleaner 2014-03-05 17:07 - 2011-10-19 04:20 - 00734972 _____ () C:\Windows\PFRO.log 2014-03-05 17:06 - 2014-02-13 20:13 - 00000000 ____D () C:\ProgramData\dealpeak 2014-03-05 17:06 - 2014-02-05 14:46 - 00000000 ____D () C:\ProgramData\ImageToPung 2014-03-05 17:06 - 2014-01-15 18:35 - 00000000 ____D () C:\Users\Erik\AppData\Local\genienext 2014-03-05 17:06 - 2014-01-12 09:46 - 00000000 ____D () C:\Users\Erik\AppData\Roaming\DigitalSites 2014-03-05 16:50 - 2014-03-05 16:49 - 00000000 ___SD () C:\ComboFix 2014-03-05 16:49 - 2013-12-15 09:20 - 00000000 ____D () C:\Qoobox 2014-03-05 06:11 - 2014-01-12 09:47 - 00000172 _____ () C:\Users\Erik\AppData\Roaming\WB.CFG 2014-02-28 06:11 - 2011-10-19 05:11 - 01625652 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI 2014-02-28 06:11 - 2011-02-19 05:24 - 00711078 _____ () C:\Windows\system32\perfh007.dat 2014-02-28 06:11 - 2011-02-19 05:24 - 00153526 _____ () C:\Windows\system32\perfc007.dat 2014-02-28 06:11 - 2009-07-14 06:13 - 01625652 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-02-24 06:05 - 2012-08-10 21:13 - 00000000 ___RD () C:\Program Files (x86)\Skype 2014-02-24 06:05 - 2012-08-10 21:13 - 00000000 ____D () C:\ProgramData\Skype 2014-02-21 16:37 - 2013-03-28 00:48 - 00000000 ____D () C:\BrickForce 2014-02-21 12:02 - 2013-05-12 10:49 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-02-21 12:01 - 2013-05-12 10:49 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-02-21 12:01 - 2013-05-12 10:49 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-02-20 07:33 - 2014-01-12 09:48 - 01037734 _____ (Thisisu) C:\Users\Erik\Desktop\JRT_NEW.exe 2014-02-18 17:25 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache 2014-02-17 16:42 - 2014-01-06 11:21 - 00000000 ____D () C:\Users\Erik\AppData\Local\PMB Files 2014-02-16 03:04 - 2013-08-14 02:01 - 00000000 ____D () C:\Windows\system32\MRT 2014-02-16 03:00 - 2013-05-18 05:29 - 88567024 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-02-13 20:13 - 2014-02-05 14:46 - 00000000 ____D () C:\ProgramData\726a9a91e9097b86 2014-02-13 00:55 - 2014-01-12 09:46 - 00003224 _____ () C:\Windows\System32\Tasks\Digital Sites 2014-02-06 13:16 - 2014-02-12 03:01 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-02-06 12:30 - 2014-02-12 03:01 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-02-06 12:30 - 2014-02-12 03:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-02-06 12:12 - 2014-02-12 03:00 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-02-06 12:07 - 2014-02-12 03:01 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-02-06 12:06 - 2014-02-12 03:01 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-02-06 11:57 - 2014-02-12 03:01 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-02-06 11:56 - 2014-02-12 03:01 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-02-06 11:52 - 2014-02-12 03:01 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-02-06 11:49 - 2014-02-12 03:01 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-02-06 11:48 - 2014-02-12 03:01 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-02-06 11:48 - 2014-02-12 03:01 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-02-06 11:38 - 2014-02-12 03:00 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-02-06 11:32 - 2014-02-12 03:01 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-02-06 11:20 - 2014-02-12 03:01 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-02-06 11:17 - 2014-02-12 03:01 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-02-06 11:11 - 2014-02-12 03:00 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-02-06 11:01 - 2014-02-12 03:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-02-06 11:00 - 2014-02-12 03:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-02-06 10:57 - 2014-02-12 03:01 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-02-06 10:57 - 2014-02-12 03:00 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-02-06 10:52 - 2014-02-12 03:01 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-02-06 10:52 - 2014-02-12 03:01 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-02-06 10:50 - 2014-02-12 03:00 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-02-06 10:49 - 2014-02-12 03:01 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-02-06 10:47 - 2014-02-12 03:01 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-02-06 10:46 - 2014-02-12 03:01 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-02-06 10:25 - 2014-02-12 03:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-02-06 10:25 - 2014-02-12 03:00 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-02-06 10:24 - 2014-02-12 03:00 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-02-06 10:22 - 2014-02-12 03:00 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-02-06 10:13 - 2014-02-12 03:01 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-02-06 10:09 - 2014-02-12 03:00 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-02-06 10:03 - 2014-02-12 03:00 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-02-06 09:55 - 2014-02-12 03:00 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-02-06 09:41 - 2014-02-12 03:00 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-02-06 09:40 - 2014-02-12 03:01 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-02-06 09:36 - 2014-02-12 03:00 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-02-06 09:34 - 2014-02-12 03:01 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-02-05 14:46 - 2014-02-05 14:46 - 00000306 __RSH () C:\ProgramData\ntuser.pol 2014-02-05 14:46 - 2014-02-05 14:46 - 00000000 ____D () C:\Users\Erik\AppData\Local\Packages 2014-02-05 14:46 - 2014-02-05 14:46 - 00000000 ____D () C:\ProgramData\ebheioiffnjfhfejjepoglnkhgjimmmm 2014-02-05 14:46 - 2009-07-14 04:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy 2014-02-05 14:46 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\GroupPolicy Some content of TEMP: ==================== C:\Users\Erik\AppData\Local\Temp\avgnt.exe C:\Users\Erik\AppData\Local\Temp\Quarantine.exe C:\Users\Erik\AppData\Local\Temp\SCC.dll C:\Users\Erik\AppData\Local\Temp\swt-win32-3349.dll ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-02-28 18:58 ==================== End Of Log ============================ FRST Additions Logfile: Code: Additional scan result of Farbar Recovery Scan Tool (x64) Version: 06-03-2014 |
FRST bitte nochmal, unvollständig und nicht in Codetags. In welchem Browser hast Du die Probleme? |
FRST Logfile: FRST Logfile: Code: Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-03-2014 01 --- --- --- mein Sohn benutzt hauptsächlich Chrome, aber auch beim Firefox sind ständig Werbeeinblendungen. Teilweise geht gar keine Seite auf oder man befindet sich gerade auf einer Seite und wird automatisch zu einer anderen geführt. |
Revo Uninstaller - Download - Filepony damit Firefox und Chrome komplett deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren. Dann für Firefox: https://support.mozilla.org/de/kb/fi...einfach-loesen Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code: HKLM-x32\...\Run: [AnyProtect] - C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
|
Alle Zeitangaben in WEZ +1. Es ist jetzt 07:13 Uhr. |
Copyright ©2000-2024, Trojaner-Board