Nationzoom Hallo... unzwar liegt folgendes Problem vor. Ich hatte vor etwa einer Woche Skype runtergeladen und am nächsten Tag konnte ich nicht mehr übers Wlan ins Internet. Ich musster übers Ethernetkabel ins Netz gehen. Dann habe ich in der Systemsteuerung gesehen, dass mit Skype so einiges mit installiert wurde. Nachdem ich davon etwas nicht löschen konnte habe ich eine Systemwiederherstellung gemacht, aber die Programme sind immernoch drauf :heulen: Jedes mal wenn ich mein Internet geöffnet habe um hilfe zu finden hat sich nationzoom geöffnet und ich habe mehrfach versucht google wieder als startseite einzustellen aber es hat nicht geklappt. also habe ich mal geschaut was nationzoom so ist und bin dann darauf gestoßen, dass es ein trojaner ist und bin hier gelandet. nun bräuchte ich dringend hilfe um den trojaner wieder loszwerden. allerdings habe ich keine ahnung von irgendwelchen fachchinesisch was die pc-sprache anbelangt, also wäre ich sehr dankbar über eine idiotensichere anleitung :crazy: danke schonmal! |
hi, Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit (Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
|
#Ran by Admin (administrator) on SAMSUNG on 20-12-2013 21:21:20 Running from C:\Users\Admin\Desktop\Downloads Windows 8 (X64) OS Language: German Standard Internet Explorer Version 10 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (AMD) C:\Windows\System32\atiesrxx.exe (AMD) C:\Windows\System32\atieclxx.exe (IvoSoft) C:\Program Files\Classic Shell\ClassicShellService.exe (337 Technology Limited.) C:\Program Files (x86)\Desk 365\deskSvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe (IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe (Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\Settings\CmdServer\EasyLauncher.exe (Microsoft Corporation) C:\Windows\System32\dasHost.exe () C:\Program Files (x86)\Samsung\Settings\CmdServer\EasySettingsCmdServer.exe (pdfforge GbR) C:\Program Files (x86)\PDF Architect\HelperService.exe (pdfforge GbR) C:\Program Files (x86)\PDF Architect\ConversionService.exe (Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe (Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe (Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\Settings\sSettings.exe (Samsung Electronics CO., LTD.) C:\Program Files\Samsung\S Agent\CommonAgent.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe (OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Nullsoft, Inc.) C:\Program Files (x86)\Winamp\winampa.exe (Samsung Electronics CO., LTD.) C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe () C:\Program Files\Samsung\Support Center\GuaranaAgent.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13191312 2012-08-07] (Realtek Semiconductor) HKLM\...\Run: [BtTray] - C:\Program Files (x86)\Bluetooth Suite\BtTray.exe [764032 2012-08-10] (Qualcomm Atheros) HKLM\...\Run: [BtvStack] - C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [127616 2012-08-10] (Atheros Communications) HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2862448 2012-08-06] (ELAN Microelectronics Corp.) HKLM\...\Run: [Logitech Download Assistant] - C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch HKCU\...\Run: [DriverScanner] - C:\Program Files (x86)\Uniblue\DriverScanner\Launcher.exe [338848 2012-07-10] (Uniblue Systems Limited) HKCU\...\Run: [Desk 365] - C:\Program Files (x86)\Desk 365\desk365.exe [1013840 2013-12-14] (337 Technology Limited.) MountPoints2: {54d2409c-a864-11e2-be7d-50b7c3af327b} - "D:\DWIZARD.exe" HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642216 2012-08-08] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-20] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [WinampAgent] - C:\Program Files (x86)\Winamp\winampa.exe [74752 2012-06-20] (Nullsoft, Inc.) Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nationzoom.com/?type=hp&ts=1387047812&from=adks&uid=ST500LT012-9WS142_W0V3FN8LXXXXW0V3FN8L HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nationzoom.com/?type=hp&ts=1387047812&from=adks&uid=ST500LT012-9WS142_W0V3FN8LXXXXW0V3FN8L HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1387047812&from=adks&uid=ST500LT012-9WS142_W0V3FN8LXXXXW0V3FN8L&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nationzoom.com/?type=hp&ts=1387047812&from=adks&uid=ST500LT012-9WS142_W0V3FN8LXXXXW0V3FN8L HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nationzoom.com/?type=hp&ts=1387047812&from=adks&uid=ST500LT012-9WS142_W0V3FN8LXXXXW0V3FN8L HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.nationzoom.com/web/?type=ds&ts=1387047812&from=adks&uid=ST500LT012-9WS142_W0V3FN8LXXXXW0V3FN8L&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1387047812&from=adks&uid=ST500LT012-9WS142_W0V3FN8LXXXXW0V3FN8L&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nationzoom.com/?type=hp&ts=1387047812&from=adks&uid=ST500LT012-9WS142_W0V3FN8LXXXXW0V3FN8L HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nationzoom.com/?type=hp&ts=1387047812&from=adks&uid=ST500LT012-9WS142_W0V3FN8LXXXXW0V3FN8L HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.nationzoom.com/web/?type=ds&ts=1387047812&from=adks&uid=ST500LT012-9WS142_W0V3FN8LXXXXW0V3FN8L&q={searchTerms} StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.nationzoom.com/?type=sc&ts=1387047812&from=adks&uid=ST500LT012-9WS142_W0V3FN8LXXXXW0V3FN8L SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1387047812&from=adks&uid=ST500LT012-9WS142_W0V3FN8LXXXXW0V3FN8L&q={searchTerms} SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1387047812&from=adks&uid=ST500LT012-9WS142_W0V3FN8LXXXXW0V3FN8L&q={searchTerms} SearchScopes: HKLM - {CE5A0938-A9F2-4A8B-B1A8-3A688B23C7DF} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MASMJS SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1387047812&from=adks&uid=ST500LT012-9WS142_W0V3FN8LXXXXW0V3FN8L&q={searchTerms} SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1387047812&from=adks&uid=ST500LT012-9WS142_W0V3FN8LXXXXW0V3FN8L&q={searchTerms} SearchScopes: HKLM-x32 - {CE5A0938-A9F2-4A8B-B1A8-3A688B23C7DF} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MASMJS SearchScopes: HKCU - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1387047812&from=adks&uid=ST500LT012-9WS142_W0V3FN8LXXXXW0V3FN8L&q={searchTerms} SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1387047812&from=adks&uid=ST500LT012-9WS142_W0V3FN8LXXXXW0V3FN8L&q={searchTerms} SearchScopes: HKCU - {CE5A0938-A9F2-4A8B-B1A8-3A688B23C7DF} URL = BHO: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft) BHO: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Qualcomm Atheros Commnucations) BHO: ClassicIE9BHO Class - {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIE9DLL_64.dll (IvoSoft) BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GbR) BHO-x32: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft) BHO-x32: ClassicIE9BHO Class - {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIE9DLL_32.dll (IvoSoft) Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft) Toolbar: HKLM-x32 - PDF Architect Toolbar - {25A3A431-30BB-47C8-AD6A-E1063801134F} - C:\Program Files (x86)\PDF Architect\PDFIEPlugin.dll (pdfforge GbR) Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft) Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 FireFox: ======== FF ProfilePath: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0l51f59s.default FF user.js: detected! => C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0l51f59s.default\user.js FF NewTab: hxxp://www.nationzoom.com/newtab/?type=nt&ts=1387047812&from=adks&uid=ST500LT012-9WS142_W0V3FN8LXXXXW0V3FN8L FF Homepage: hxxp://www.google.de/ FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll () FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll () FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3503.0728 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\nationzoom.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: 20-20 3D Viewer - IKEA - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0l51f59s.default\Extensions\2020Player_IKEA@2020Technologies.com FF Extension: Foxtab Speed Dial - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0l51f59s.default\Extensions\{5ebdca98-43b3-45bb-87e0-716029fb42ab} FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt FF StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Mozilla Firefox\firefox.exe hxxp://www.nationzoom.com/?type=sc&ts=1387047812&from=adks&uid=ST500LT012-9WS142_W0V3FN8LXXXXW0V3FN8L ==================== Services (Whitelisted) ================= R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-20] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-12-20] (Avira Operations GmbH & Co. KG) R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [211584 2012-08-10] (Qualcomm Atheros Commnucations) R2 ClassicShellService; C:\Program Files\Classic Shell\ClassicShellService.exe [68608 2013-04-12] (IvoSoft) R2 desksvc; C:\Program Files (x86)\Desk 365\deskSvc.exe [422312 2013-12-14] (337 Technology Limited.) R2 Easy Launcher; C:\Program Files (x86)\Samsung\Settings\CmdServer\EasyLauncher.exe [1593976 2012-08-26] (Samsung Electronics CO., LTD.) R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1324104 2013-01-09] (pdfforge GbR) R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [795208 2013-01-09] (pdfforge GbR) R2 SWUpdateService; C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe [3018800 2013-10-21] (Samsung Electronics CO., LTD.) R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation) R2 ZAtheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [323584 2012-08-10] (Atheros) ==================== Drivers (Whitelisted) ==================== R2 APXACC; C:\Windows\system32\DRIVERS\appexDrv.sys [199008 2012-06-22] (AppEx Networks Corporation) R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [98472 2012-07-18] (Advanced Micro Devices) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-20] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131576 2013-12-20] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-12-20] (Avira Operations GmbH & Co. KG) R3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [76952 2012-08-10] (Qualcomm Atheros) R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation) S1 ccSet_NARA; C:\Windows\system32\drivers\NARAx64\0401000.00B\ccSetx64.sys [168608 2012-05-26] (Symantec Corporation) R3 RadioHIDMini; C:\Windows\System32\drivers\RadioHIDMini.sys [23408 2012-07-27] (Windows (R) Win 7 DDK provider) S3 rtport; C:\windows\SysWOW64\drivers\rtport.sys [15144 2012-11-10] (Windows (R) 2003 DDK 3790 provider) S3 SBIOSIO; \??\C:\MfgDiag\DiagTools\AMDAutoOnClear\SBIOSIO64.SYS [x] S3 TVICPORT; \??\C:\windows\system32\DRIVERS\TVICPORT.SYS [x] S3 UCORESYS; \??\C:\MfgDiag\DiagTools\ReadDMI8\UCORESYS.sys [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-12-20 21:20 - 2013-12-20 21:20 - 00000000 ____D C:\FRST 2013-12-20 14:56 - 2013-12-20 14:56 - 00000000 ___RD C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices 2013-12-20 14:46 - 2013-12-20 14:46 - 00003088 _____ C:\windows\System32\Tasks\{91841A19-F92E-46C7-91DD-8DFB014BCC86} 2013-12-15 18:46 - 2013-12-15 18:46 - 00307904 _____ C:\windows\system32\FNTCACHE.DAT 2013-12-15 18:28 - 2013-12-15 18:41 - 00000000 ____D C:\Users\Admin\AppData\Roaming\DivX 2013-12-15 18:28 - 2013-12-15 18:41 - 00000000 ____D C:\Program Files\DivX 2013-12-15 18:24 - 2013-12-15 18:42 - 00000000 ____D C:\Program Files (x86)\DivX 2013-12-15 18:24 - 2013-12-15 18:41 - 00000000 ____D C:\Program Files (x86)\Xvid 2013-12-15 18:23 - 2013-12-15 18:41 - 00000000 ____D C:\Users\Admin\AppData\Roaming\LavFilters 2013-12-15 18:23 - 2013-12-15 18:41 - 00000000 ____D C:\Users\Admin\AppData\Roaming\CDXReader 2013-12-15 18:23 - 2013-12-15 18:41 - 00000000 ____D C:\ProgramData\DivX 2013-12-15 18:23 - 2013-12-15 18:26 - 00000000 ____D C:\Program Files (x86)\DSP-worx 2013-12-15 18:21 - 2013-12-15 18:41 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Systweak 2013-12-15 18:21 - 2013-12-15 18:21 - 00000000 ____D C:\Users\Admin\AppData\Roaming\FoxTab 2013-12-15 18:21 - 2013-12-15 18:21 - 00000000 ____D C:\Program Files (x86)\RegClean Pro 2013-12-15 18:20 - 2013-12-15 18:21 - 00000000 ____D C:\Program Files (x86)\Foxtab 2013-12-15 18:15 - 2013-12-20 14:53 - 00003106 _____ C:\windows\PFRO.log 2013-12-15 17:39 - 2013-12-20 15:11 - 00444630 _____ C:\windows\WindowsUpdate.log 2013-12-15 17:16 - 2013-12-15 17:16 - 00000000 ____D C:\Users\Admin\AppData\Roaming\eCyber 2013-12-15 17:08 - 2013-12-15 18:41 - 00000000 ____D C:\Users\Admin\AppData\Roaming\iSafe 2013-12-15 17:08 - 2013-12-15 17:25 - 00000000 ____D C:\Program Files (x86)\iSafe 2013-12-15 17:08 - 2013-12-15 17:08 - 00000000 ____D C:\windows\system32\log 2013-12-15 17:07 - 2013-12-15 17:34 - 00000000 ____D C:\Program Files (x86)\WinZipper 2013-12-15 17:07 - 2013-12-15 17:07 - 00000000 ____D C:\Users\Admin\AppData\Roaming\WinZipper 2013-12-14 20:15 - 2013-12-15 18:41 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Skype 2013-12-14 20:14 - 2013-12-15 17:20 - 00000000 ____D C:\ProgramData\Skype 2013-12-14 20:07 - 2013-12-20 14:49 - 00000000 ____D C:\Users\Admin\AppData\Local\VisualBeeExe 2013-12-14 20:07 - 2013-12-14 20:11 - 00000000 ____D C:\ProgramData\VisualBee 2013-12-14 20:07 - 2013-12-14 20:07 - 00001224 _____ C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Create Amazing Presentations.lnk 2013-12-14 20:07 - 2013-12-14 20:07 - 00000000 ____D C:\Users\Admin\AppData\Local\emaze 2013-12-14 20:06 - 2013-12-20 14:41 - 00000000 ____D C:\Program Files (x86)\MyPC Backup 2013-12-14 20:04 - 2013-12-20 14:56 - 00000000 ____D C:\Program Files (x86)\Desk 365 2013-12-14 20:04 - 2013-12-20 14:49 - 00000000 ____D C:\ProgramData\WPM 2013-12-14 20:04 - 2013-12-20 14:23 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Desk 365 2013-12-10 19:07 - 2013-12-10 19:08 - 00000000 ____D C:\Users\Admin\Desktop\Amy 2013-12-07 19:28 - 2013-12-07 19:28 - 105743348 _____ C:\windows\SysWOW64\᯾瞥㲐ęʭ 2013-11-21 14:46 - 2013-11-05 23:58 - 00694232 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe 2013-11-21 14:46 - 2013-11-05 23:58 - 00078296 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl ==================== One Month Modified Files and Folders ======= 2013-12-20 21:20 - 2013-12-20 21:20 - 00000000 ____D C:\FRST 2013-12-20 21:18 - 2012-07-26 09:12 - 00000000 ____D C:\windows\system32\sru 2013-12-20 15:20 - 2012-07-26 09:12 - 00000000 ____D C:\windows\AUInstallAgent 2013-12-20 15:11 - 2013-12-15 17:39 - 00444630 _____ C:\windows\WindowsUpdate.log 2013-12-20 15:01 - 2013-05-06 10:11 - 00000000 ____D C:\Program Files (x86)\Google 2013-12-20 14:58 - 2013-03-02 17:45 - 00003592 _____ C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-484924946-752710417-643280108-1001 2013-12-20 14:57 - 2012-08-29 04:43 - 00000000 ____D C:\ProgramData\WinClon 2013-12-20 14:56 - 2013-12-20 14:56 - 00000000 ___RD C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices 2013-12-20 14:56 - 2013-12-14 20:04 - 00000000 ____D C:\Program Files (x86)\Desk 365 2013-12-20 14:53 - 2013-12-15 18:15 - 00003106 _____ C:\windows\PFRO.log 2013-12-20 14:53 - 2013-05-06 10:11 - 00001120 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job 2013-12-20 14:53 - 2013-04-18 21:22 - 00000356 _____ C:\windows\Tasks\DriverScanner.job 2013-12-20 14:53 - 2013-04-01 16:33 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job 2013-12-20 14:53 - 2012-07-26 08:22 - 00000006 ____H C:\windows\Tasks\SA.DAT 2013-12-20 14:52 - 2012-07-26 06:26 - 00262144 ___SH C:\windows\system32\config\BBI 2013-12-20 14:49 - 2013-12-14 20:07 - 00000000 ____D C:\Users\Admin\AppData\Local\VisualBeeExe 2013-12-20 14:49 - 2013-12-14 20:04 - 00000000 ____D C:\ProgramData\WPM 2013-12-20 14:49 - 2013-05-06 10:07 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avnetflt.sys 2013-12-20 14:49 - 2013-04-01 16:26 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys 2013-12-20 14:49 - 2013-04-01 16:26 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys 2013-12-20 14:49 - 2013-04-01 16:26 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avkmgr.sys 2013-12-20 14:46 - 2013-12-20 14:46 - 00003088 _____ C:\windows\System32\Tasks\{91841A19-F92E-46C7-91DD-8DFB014BCC86} 2013-12-20 14:41 - 2013-12-14 20:06 - 00000000 ____D C:\Program Files (x86)\MyPC Backup 2013-12-20 14:41 - 2013-03-02 17:39 - 00000000 ___RD C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2013-12-20 14:39 - 2013-04-01 16:33 - 00003772 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater 2013-12-20 14:33 - 2013-05-06 10:11 - 00001124 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job 2013-12-20 14:25 - 2013-03-02 18:22 - 00000000 ____D C:\Users\Admin\AppData\Local\CrashDumps 2013-12-20 14:23 - 2013-12-14 20:04 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Desk 365 2013-12-15 18:46 - 2013-12-15 18:46 - 00307904 _____ C:\windows\system32\FNTCACHE.DAT 2013-12-15 18:46 - 2013-03-02 17:36 - 00000000 ____D C:\Users\Admin 2013-12-15 18:44 - 2013-03-03 13:57 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2013-12-15 18:44 - 2012-08-29 04:49 - 00000000 ____D C:\Program Files (x86)\PopCap Games 2013-12-15 18:44 - 2012-08-29 04:38 - 00000000 ____D C:\Program Files (x86)\Norton Online Backup ARA 2013-12-15 18:44 - 2012-07-26 09:12 - 00000000 ____D C:\windows\system32\SecureBootUpdates 2013-12-15 18:42 - 2013-12-15 18:24 - 00000000 ____D C:\Program Files (x86)\DivX 2013-12-15 18:41 - 2013-12-15 18:28 - 00000000 ____D C:\Users\Admin\AppData\Roaming\DivX 2013-12-15 18:41 - 2013-12-15 18:28 - 00000000 ____D C:\Program Files\DivX 2013-12-15 18:41 - 2013-12-15 18:24 - 00000000 ____D C:\Program Files (x86)\Xvid 2013-12-15 18:41 - 2013-12-15 18:23 - 00000000 ____D C:\Users\Admin\AppData\Roaming\LavFilters 2013-12-15 18:41 - 2013-12-15 18:23 - 00000000 ____D C:\Users\Admin\AppData\Roaming\CDXReader 2013-12-15 18:41 - 2013-12-15 18:23 - 00000000 ____D C:\ProgramData\DivX 2013-12-15 18:41 - 2013-12-15 18:21 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Systweak 2013-12-15 18:41 - 2013-12-15 17:08 - 00000000 ____D C:\Users\Admin\AppData\Roaming\iSafe 2013-12-15 18:41 - 2013-12-14 20:15 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Skype 2013-12-15 18:41 - 2012-07-26 09:12 - 00000000 ____D C:\windows\registration 2013-12-15 18:40 - 2013-04-18 21:22 - 00000000 ____D C:\Program Files (x86)\Uniblue 2013-12-15 18:40 - 2013-03-03 15:18 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Winamp 2013-12-15 18:40 - 2012-08-29 04:38 - 00000000 ____D C:\windows\system32\Drivers\NARAx64 2013-12-15 18:40 - 2012-08-29 04:38 - 00000000 ____D C:\Program Files (x86)\Symantec 2013-12-15 18:40 - 2012-08-29 04:37 - 00000000 ____D C:\ProgramData\Norton 2013-12-15 18:40 - 2012-08-29 03:55 - 00000000 ____D C:\Program Files (x86)\Samsung 2013-12-15 18:40 - 2012-08-29 03:54 - 00000000 ____D C:\Program Files (x86)\Qualcomm Atheros 2013-12-15 18:40 - 2012-08-29 03:53 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information 2013-12-15 18:40 - 2012-07-26 06:38 - 00000000 ____D C:\windows\system32\Sysprep 2013-12-15 18:26 - 2013-12-15 18:23 - 00000000 ____D C:\Program Files (x86)\DSP-worx 2013-12-15 18:21 - 2013-12-15 18:21 - 00000000 ____D C:\Users\Admin\AppData\Roaming\FoxTab 2013-12-15 18:21 - 2013-12-15 18:21 - 00000000 ____D C:\Program Files (x86)\RegClean Pro 2013-12-15 18:21 - 2013-12-15 18:20 - 00000000 ____D C:\Program Files (x86)\Foxtab 2013-12-15 18:12 - 2012-07-26 09:12 - 00000000 ____D C:\windows\system32\NDF 2013-12-15 17:34 - 2013-12-15 17:07 - 00000000 ____D C:\Program Files (x86)\WinZipper 2013-12-15 17:25 - 2013-12-15 17:08 - 00000000 ____D C:\Program Files (x86)\iSafe 2013-12-15 17:20 - 2013-12-14 20:14 - 00000000 ____D C:\ProgramData\Skype 2013-12-15 17:18 - 2012-08-29 04:49 - 00000000 ____D C:\ProgramData\PopCap Games 2013-12-15 17:16 - 2013-12-15 17:16 - 00000000 ____D C:\Users\Admin\AppData\Roaming\eCyber 2013-12-15 17:08 - 2013-12-15 17:08 - 00000000 ____D C:\windows\system32\log 2013-12-15 17:07 - 2013-12-15 17:07 - 00000000 ____D C:\Users\Admin\AppData\Roaming\WinZipper 2013-12-14 20:11 - 2013-12-14 20:07 - 00000000 ____D C:\ProgramData\VisualBee 2013-12-14 20:07 - 2013-12-14 20:07 - 00001224 _____ C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Create Amazing Presentations.lnk 2013-12-14 20:07 - 2013-12-14 20:07 - 00000000 ____D C:\Users\Admin\AppData\Local\emaze 2013-12-14 20:03 - 2013-03-02 17:39 - 00001662 _____ C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2013-12-10 19:08 - 2013-12-10 19:07 - 00000000 ____D C:\Users\Admin\Desktop\Amy 2013-12-10 19:07 - 2012-08-29 20:12 - 00753134 _____ C:\windows\system32\perfh007.dat 2013-12-10 19:07 - 2012-08-29 20:12 - 00155826 _____ C:\windows\system32\perfc007.dat 2013-12-10 19:07 - 2012-07-26 08:28 - 01745416 _____ C:\windows\system32\PerfStringBackup.INI 2013-12-07 19:28 - 2013-12-07 19:28 - 105743348 _____ C:\windows\SysWOW64\᯾瞥㲐ęʭ 2013-12-07 19:26 - 2013-05-06 10:11 - 00004096 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA 2013-12-07 19:26 - 2013-05-06 10:11 - 00003860 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore 2013-11-21 14:39 - 2012-07-26 09:12 - 00000000 ____D C:\windows\WinStore Files to move or delete: ==================== C:\ProgramData\MakeMarkerFile.exe Some content of TEMP: ==================== C:\Users\Admin\AppData\Local\Temp\adks_NationZoom.exe C:\Users\Admin\AppData\Local\Temp\avgnt.exe C:\Users\Admin\AppData\Local\Temp\BackupSetup.exe C:\Users\Admin\AppData\Local\Temp\Cloud_Backup_Setup.exe C:\Users\Admin\AppData\Local\Temp\plus-hd-2-5.exe C:\Users\Admin\AppData\Local\Temp\springsmart_ad.exe C:\Users\Admin\AppData\Local\Temp\vbmz10.exe C:\Users\Admin\AppData\Local\Temp\vcredist_x64.exe C:\Users\Admin\AppData\Local\Temp\VisualBeeSilent.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-11-21 15:30 ==================== End Of Log ============================ FRST Additions Logfile: Code: Additional scan result of Farbar Recovery Scan Tool (x64) Version: 20-12-2013 02 |
So funktioniert es: Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
Downloade Dir bitte Malwarebytes Anti-Malware
Downloade Dir bitte AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Downloade dir bitte Shortcut Cleaner (by Grinler) auf deinen Desktop.
und ein frisches FRST log bitte. |
hallo, hier die daten: Code: Malwarebytes Anti-Malware (Test) 1.75.0.1300 Code: # AdwCleaner v3.015 - Bericht erstellt am 21/12/2013 um 23:04:56 Code: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Code: Shortcut Cleaner 1.2.6 by Lawrence Abrams (Grinler) und zu guter letzt das frische frst: FRST Logfile: Code: Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 20-12-2013 02 Ich hoffe ich hab alles richtig gemacht? Liebe Grüße |
ESET Online Scanner
Downloade Dir bitte SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? :) |
hallo, Code: ESETSmartInstaller@High as downloader log: Code: Results of screen317's Security Check version 0.99.77 FRST Logfile: Code: Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-12-2013 01 ist jetzt alles gut? :/ Liebe Grüße |
Fertig :) Falls Du Lob oder Kritik loswerden möchtest kannst Du das hier tun :) Die Reihenfolge ist hier entscheidend.
Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann. |
Huhu, vielen lieben Dank für die schnelle Hilfe!!! toll, dass es so ein forum für leute wie mich gibt :D |
Gern Geschehen :) |
Alle Zeitangaben in WEZ +1. Es ist jetzt 02:47 Uhr. |
Copyright ©2000-2024, Trojaner-Board