Trojaner-Board - Topliste infiziert von bösartiger Website

Ja dieser Aufforderung von dir bin ich bereits in diesem Thema nachgegangen: http://www.trojaner-board.de/155823-...ml#post1323003

Hier das Ergebnis des neuen Scans | FRST.txt:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 28-06-2014 02

Ran by Basti (administrator) on BASTI-PC on 01-07-2014 14:25:45

Running from C:\Users\Basti\Downloads

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11

Boot Mode: Normal
 
 

==================== Processes (Whitelisted) =================
 

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Nero AG) C:\Program Files (x86)\HTC\HTC Sync Manager\HSMServiceEntry.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe

() C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\tv_w32.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\tv_x64.exe

() C:\Program Files (x86)\HTC\HTC Sync Manager\HTC Sync\adb.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(PC Drivers Headquarters) C:\Program Files (x86)\DriverBoost\DriverBoost\DriverBoost.exe

(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe

(Intel Corporation) C:\Windows\System32\igfxsrvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(PortableAppZ.blogspot.com) C:\Users\Basti\Desktop\PhotoshopPortable\PhotoshopCS5Portable.exe

(Adobe Systems, Incorporated) C:\Users\Basti\Desktop\PhotoshopPortable\App\PhotoshopCS5\Photoshop.exe

(Systemberatung Gregor Schommer) C:\Program Files (x86)\phase5\htmledit.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_14_0_0_125.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_14_0_0_125.exe

(Google Inc.) C:\Users\Basti\AppData\Local\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Users\Basti\AppData\Local\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Users\Basti\AppData\Local\Google\Chrome\Application\chrome.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [SpywareTerminatorShield] => C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe

HKLM\...\Run: [SpywareTerminatorUpdater] => C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [750160 2014-06-24] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [Adobe ARM] => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]

HKU\S-1-5-21-887015318-538487465-2359642672-1000\...\Run: [Google Update] => C:\Users\Basti\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-07-11] (Google Inc.)

HKU\S-1-5-21-887015318-538487465-2359642672-1000\...\Run: [RapidDrive] => C:\Program Files (x86)\RAPIDSHARE AG\RapidDrive\VirtualDrive.exe -autostart

HKU\S-1-5-21-887015318-538487465-2359642672-1000\...\Run: [DriverBoost] => C:\Program Files (x86)\DriverBoost\DriverBoost\DriverBoost.exe [3986288 2013-10-10] (PC Drivers Headquarters)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk

ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)

SSODL: EldosMountNotificator-cbfs4-0 - {D4E7728C-9284-4497-8AA7-AA866AFD9F28} - C:\Program Files (x86)\Common Files\CBFS\cbfsMntNtf4.dll (EldoS Corporation)

SSODL-x32: EldosMountNotificator-cbfs4-0 - {D4E7728C-9284-4497-8AA7-AA866AFD9F28} - C:\Program Files (x86)\Common Files\CBFS\WOW64\cbfsMntNtf4.dll (EldoS Corporation)

ShellIconOverlayIdentifiers: 1EldosIconOverlay-cbfs4-0 -> {086F6187-F172-4B72-A812-8424E415BEA2} => C:\Program Files (x86)\Common Files\CBFS\cbfsMntNtf4.dll (EldoS Corporation)

ShellIconOverlayIdentifiers: EldosIconOverlay-cbfs4-0 -> {22C88B54-D19A-4290-AF34-E36A5593848B} => C:\Program Files (x86)\Common Files\CBFS\cbfsMntNtf4.dll (EldoS Corporation)

ShellIconOverlayIdentifiers-x32: 1EldosIconOverlay-cbfs4-0 -> {086F6187-F172-4B72-A812-8424E415BEA2} => C:\Program Files (x86)\Common Files\CBFS\WOW64\cbfsMntNtf4.dll (EldoS Corporation)

ShellIconOverlayIdentifiers-x32: EldosIconOverlay-cbfs4-0 -> {22C88B54-D19A-4290-AF34-E36A5593848B} => C:\Program Files (x86)\Common Files\CBFS\WOW64\cbfsMntNtf4.dll (EldoS Corporation)

BootExecute: autocheck autochk * sdnclean64.exe
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.de/

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x57B6B505547ECE01

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

SearchScopes: HKLM - DefaultScope value is missing.

SearchScopes: HKLM-x32 - DefaultScope value is missing.

BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)

BHO-x32: No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM-x32 - No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File

Toolbar: HKCU - No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
 

FireFox:

========

FF ProfilePath: C:\Users\Basti\AppData\Roaming\Mozilla\Firefox\Profiles\luamk2he.default-1397239196294

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_125.dll ()

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_125.dll ()

FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @videolan.org/vlc,version=2.0.8 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Basti\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Basti\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF HKCU\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff

FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-04-23]

FF HKCU\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi

FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
 

Chrome: 

=======

CHR HomePage: 

CHR Extension: (Google Wallet) - C:\Users\Basti\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-17]
 

==================== Services (Whitelisted) =================
 

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-06-24] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-06-24] (Avira Operations GmbH & Co. KG)

R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1028688 2014-06-24] (Avira Operations GmbH & Co. KG)

S3 FirebirdServerMAGIXInstance; C:\Program Files (x86)\MAGIX\Common\Database\bin\fbserver.exe [1527900 2005-11-17] (MAGIX®) [File not signed]

R2 HTCMonitorService; C:\Program Files (x86)\HTC\HTC Sync Manager\HSMServiceEntry.exe [87368 2013-04-12] (Nero AG)

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)

S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)

R2 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [167424 2012-12-07] () [File not signed]

R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.)

S2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.)

R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.)

S2 AdobeARMservice; "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe" [X]
 

==================== Drivers (Whitelisted) ====================
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-06-24] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-04-29] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-19] (Avira Operations GmbH & Co. KG)

R1 cbfs4-0; C:\Program Files (x86)\Common Files\CBFS\cbfs4.sys [385728 2013-03-01] (EldoS Corporation)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)

R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-07-01] (Malwarebytes Corporation)

R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-07-01 10:18 - 2014-07-01 10:18 - 00000000 ____D () C:\Users\Basti\AppData\Roaming\Adobe

2014-07-01 10:18 - 2014-07-01 10:18 - 00000000 ____D () C:\Users\Basti\AppData\Local\Adobe

2014-07-01 10:18 - 2014-07-01 10:18 - 00000000 ____D () C:\ProgramData\Adobe

2014-07-01 10:13 - 2014-07-01 10:13 - 00000562 _____ () C:\Windows\PFRO.log

2014-07-01 10:13 - 2014-07-01 10:13 - 00000056 _____ () C:\Windows\setupact.log

2014-07-01 10:13 - 2014-07-01 10:13 - 00000000 _____ () C:\Windows\setuperr.log

2014-06-30 22:18 - 2014-06-30 22:18 - 00002772 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC

2014-06-30 22:18 - 2014-06-30 22:18 - 00000828 _____ () C:\Users\Public\Desktop\CCleaner.lnk

2014-06-30 22:18 - 2014-06-30 22:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

2014-06-30 22:18 - 2014-06-30 22:18 - 00000000 ____D () C:\Program Files\CCleaner

2014-06-30 22:16 - 2014-06-30 22:17 - 03736040 _____ (Piriform Ltd) C:\Users\Basti\Downloads\ccsetup415_slim.exe

2014-06-30 21:44 - 2014-06-30 21:44 - 01016261 _____ (Thisisu) C:\Users\Basti\Downloads\JRT.exe

2014-06-30 21:44 - 2014-06-30 21:44 - 00000000 ____D () C:\Windows\ERUNT

2014-06-30 21:36 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll

2014-06-30 21:34 - 2014-06-30 21:37 - 00000000 ____D () C:\AdwCleaner

2014-06-30 21:34 - 2014-06-30 21:34 - 01346519 _____ () C:\Users\Basti\Downloads\adwcleaner_3.214.exe

2014-06-30 21:00 - 2014-07-01 12:19 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-06-30 21:00 - 2014-06-30 21:00 - 00001108 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-06-30 21:00 - 2014-06-30 21:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-06-30 21:00 - 2014-06-30 21:00 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-06-30 21:00 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-06-30 21:00 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-06-30 21:00 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-06-30 20:59 - 2014-06-30 20:59 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Basti\Downloads\mbam-setup-2.0.2.1012.exe

2014-06-30 14:23 - 2014-06-30 14:23 - 00001270 _____ () C:\Users\Basti\Desktop\Revo Uninstaller.lnk

2014-06-30 14:23 - 2014-06-30 14:23 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-06-30 14:22 - 2014-06-30 14:22 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Basti\Downloads\revosetup95.exe

2014-06-28 22:09 - 2014-06-28 22:09 - 00000000 ____D () C:\Users\Basti\AppData\Roaming\Adobe-BackupByPhotoshopCS5Portable

2014-06-28 22:09 - 2014-06-28 22:09 - 00000000 ____D () C:\Users\Basti\AppData\Local\Adobe-BackupByPhotoshopCS5Portable

2014-06-28 22:09 - 2014-06-28 22:09 - 00000000 ____D () C:\ProgramData\Adobe-BackupByPhotoshopCS5Portable

2014-06-28 20:44 - 2014-06-28 20:45 - 00030597 _____ () C:\Users\Basti\Downloads\Addition.txt

2014-06-28 20:42 - 2014-07-01 14:25 - 00013629 _____ () C:\Users\Basti\Downloads\FRST.txt

2014-06-28 20:42 - 2014-07-01 14:25 - 00000000 ____D () C:\FRST

2014-06-28 20:42 - 2014-06-28 20:42 - 02083328 _____ (Farbar) C:\Users\Basti\Downloads\FRST64.exe

2014-06-26 14:01 - 2014-06-26 14:01 - 00003840 _____ () C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1373561767

2014-06-22 03:45 - 2014-06-22 04:26 - 00000000 ____D () C:\Users\Basti\AppData\Roaming\tor

2014-06-22 03:39 - 2014-06-22 03:39 - 07646425 _____ () C:\Users\Basti\Downloads\torchat-windows-0.9.9.550.zip

2014-06-22 03:35 - 2014-06-22 03:36 - 07794602 _____ () C:\Users\Basti\Downloads\torchat-windows-0.9.9.553.zip

2014-06-21 16:36 - 2014-06-22 03:38 - 00000000 ____D () C:\Users\Basti\Desktop\Tor Browser

2014-06-21 16:36 - 2014-06-21 16:36 - 00001464 _____ () C:\Users\Basti\Desktop\amazon.de.lnk

2014-06-21 16:36 - 2014-06-21 16:36 - 00000000 ____D () C:\Users\Basti\AppData\Roaming\DesktopIconAmazon

2014-06-21 16:32 - 2014-06-21 16:32 - 00961360 _____ (Chip Digital GmbH) C:\Users\Basti\Downloads\Tor Browser Paket - CHIP-Installer.exe

2014-06-18 10:40 - 2014-06-18 10:40 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-06-16 12:17 - 2014-06-16 12:18 - 86298992 _____ () C:\Users\Basti\Downloads\1401045104341.rar

2014-06-12 00:09 - 2014-05-30 12:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-06-12 00:09 - 2014-05-30 11:38 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-06-12 00:09 - 2014-05-30 11:18 - 17271296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-06-12 00:09 - 2014-05-30 10:55 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-06-12 00:09 - 2014-05-30 10:43 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-06-12 00:09 - 2014-05-30 10:42 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-06-12 00:09 - 2014-05-30 10:27 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-06-12 00:09 - 2014-05-30 10:16 - 00368128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-06-12 00:09 - 2014-05-30 10:10 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-06-12 00:09 - 2014-05-30 10:04 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-06-12 00:09 - 2014-05-30 09:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-06-12 00:09 - 2014-05-30 09:49 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-06-12 00:09 - 2014-05-30 09:15 - 01143296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-06-12 00:09 - 2014-05-08 11:32 - 03178496 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll

2014-06-12 00:09 - 2014-05-08 11:32 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll

2014-06-12 00:09 - 2014-04-25 04:34 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll

2014-06-12 00:09 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll

2014-06-12 00:09 - 2014-04-05 04:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2014-06-12 00:09 - 2014-04-05 04:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS

2014-06-12 00:09 - 2014-03-26 16:44 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll

2014-06-12 00:09 - 2014-03-26 16:44 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll

2014-06-12 00:09 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll

2014-06-12 00:09 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll

2014-06-12 00:09 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll

2014-06-12 00:09 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll

2014-06-12 00:09 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll

2014-06-12 00:09 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll

2014-06-12 00:09 - 2013-11-26 13:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys

2014-06-12 00:08 - 2014-05-30 12:21 - 23414784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-06-12 00:08 - 2014-05-30 12:02 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-06-12 00:08 - 2014-05-30 11:45 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-06-12 00:08 - 2014-05-30 11:39 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-06-12 00:08 - 2014-05-30 11:39 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-06-12 00:08 - 2014-05-30 11:28 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-06-12 00:08 - 2014-05-30 11:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-06-12 00:08 - 2014-05-30 11:24 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-06-12 00:08 - 2014-05-30 11:21 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-06-12 00:08 - 2014-05-30 11:21 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-06-12 00:08 - 2014-05-30 11:20 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-06-12 00:08 - 2014-05-30 11:11 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-06-12 00:08 - 2014-05-30 11:08 - 05782528 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-06-12 00:08 - 2014-05-30 11:06 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-06-12 00:08 - 2014-05-30 11:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-06-12 00:08 - 2014-05-30 10:49 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-06-12 00:08 - 2014-05-30 10:46 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-06-12 00:08 - 2014-05-30 10:44 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-06-12 00:08 - 2014-05-30 10:44 - 00295424 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-06-12 00:08 - 2014-05-30 10:38 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-06-12 00:08 - 2014-05-30 10:35 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-06-12 00:08 - 2014-05-30 10:34 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-06-12 00:08 - 2014-05-30 10:33 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-06-12 00:08 - 2014-05-30 10:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-06-12 00:08 - 2014-05-30 10:29 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-06-12 00:08 - 2014-05-30 10:28 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-06-12 00:08 - 2014-05-30 10:24 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-06-12 00:08 - 2014-05-30 10:23 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-06-12 00:08 - 2014-05-30 10:06 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-06-12 00:08 - 2014-05-30 10:02 - 00242688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-06-12 00:08 - 2014-05-30 09:56 - 04244992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-06-12 00:08 - 2014-05-30 09:56 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-06-12 00:08 - 2014-05-30 09:50 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2014-06-12 00:08 - 2014-05-30 09:43 - 13522944 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-06-12 00:08 - 2014-05-30 09:40 - 11725312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-06-12 00:08 - 2014-05-30 09:30 - 01398272 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-06-12 00:08 - 2014-05-30 09:21 - 01790976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-06-12 00:08 - 2014-05-30 09:13 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-06-12 00:08 - 2014-05-30 09:13 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-06-09 20:23 - 2014-06-09 20:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus

2014-06-09 20:23 - 2014-06-09 20:23 - 00000000 ____D () C:\Program Files\McAfee Security Scan
 

==================== One Month Modified Files and Folders =======
 

2014-07-01 14:26 - 2014-06-28 20:42 - 00013629 _____ () C:\Users\Basti\Downloads\FRST.txt

2014-07-01 14:25 - 2014-06-28 20:42 - 00000000 ____D () C:\FRST

2014-07-01 14:14 - 2009-07-14 06:45 - 00016640 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-07-01 14:14 - 2009-07-14 06:45 - 00016640 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-07-01 14:06 - 2013-07-12 20:19 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-07-01 13:33 - 2013-07-11 18:50 - 00001120 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-887015318-538487465-2359642672-1000UA.job

2014-07-01 12:19 - 2014-06-30 21:00 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-07-01 10:50 - 2013-07-12 19:40 - 00000132 _____ () C:\Users\Basti\AppData\Roaming\Adobe PNG Format CS5 Prefs

2014-07-01 10:19 - 2013-07-11 18:46 - 00000000 ____D () C:\Program Files (x86)\phase5

2014-07-01 10:18 - 2014-07-01 10:18 - 00000000 ____D () C:\Users\Basti\AppData\Roaming\Adobe

2014-07-01 10:18 - 2014-07-01 10:18 - 00000000 ____D () C:\Users\Basti\AppData\Local\Adobe

2014-07-01 10:18 - 2014-07-01 10:18 - 00000000 ____D () C:\ProgramData\Adobe

2014-07-01 10:15 - 2013-09-06 11:38 - 00000000 ____D () C:\Users\Basti\AppData\Local\HTC MediaHub

2014-07-01 10:13 - 2014-07-01 10:13 - 00000562 _____ () C:\Windows\PFRO.log

2014-07-01 10:13 - 2014-07-01 10:13 - 00000056 _____ () C:\Windows\setupact.log

2014-07-01 10:13 - 2014-07-01 10:13 - 00000000 _____ () C:\Windows\setuperr.log

2014-07-01 10:13 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-07-01 02:59 - 2013-07-11 18:11 - 01501402 _____ () C:\Windows\WindowsUpdate.log

2014-07-01 00:33 - 2013-07-11 18:50 - 00001068 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-887015318-538487465-2359642672-1000Core.job

2014-06-30 22:18 - 2014-06-30 22:18 - 00002772 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC

2014-06-30 22:18 - 2014-06-30 22:18 - 00000828 _____ () C:\Users\Public\Desktop\CCleaner.lnk

2014-06-30 22:18 - 2014-06-30 22:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

2014-06-30 22:18 - 2014-06-30 22:18 - 00000000 ____D () C:\Program Files\CCleaner

2014-06-30 22:17 - 2014-06-30 22:16 - 03736040 _____ (Piriform Ltd) C:\Users\Basti\Downloads\ccsetup415_slim.exe

2014-06-30 21:44 - 2014-06-30 21:44 - 01016261 _____ (Thisisu) C:\Users\Basti\Downloads\JRT.exe

2014-06-30 21:44 - 2014-06-30 21:44 - 00000000 ____D () C:\Windows\ERUNT

2014-06-30 21:37 - 2014-06-30 21:34 - 00000000 ____D () C:\AdwCleaner

2014-06-30 21:37 - 2013-07-11 18:29 - 00000000 ____D () C:\Users\Basti

2014-06-30 21:34 - 2014-06-30 21:34 - 01346519 _____ () C:\Users\Basti\Downloads\adwcleaner_3.214.exe

2014-06-30 21:24 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Help

2014-06-30 21:00 - 2014-06-30 21:00 - 00001108 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-06-30 21:00 - 2014-06-30 21:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-06-30 21:00 - 2014-06-30 21:00 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-06-30 21:00 - 2013-07-20 12:09 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-06-30 20:59 - 2014-06-30 20:59 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Basti\Downloads\mbam-setup-2.0.2.1012.exe

2014-06-30 14:23 - 2014-06-30 14:23 - 00001270 _____ () C:\Users\Basti\Desktop\Revo Uninstaller.lnk

2014-06-30 14:23 - 2014-06-30 14:23 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-06-30 14:22 - 2014-06-30 14:22 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Basti\Downloads\revosetup95.exe

2014-06-28 22:09 - 2014-06-28 22:09 - 00000000 ____D () C:\Users\Basti\AppData\Roaming\Adobe-BackupByPhotoshopCS5Portable

2014-06-28 22:09 - 2014-06-28 22:09 - 00000000 ____D () C:\Users\Basti\AppData\Local\Adobe-BackupByPhotoshopCS5Portable

2014-06-28 22:09 - 2014-06-28 22:09 - 00000000 ____D () C:\ProgramData\Adobe-BackupByPhotoshopCS5Portable

2014-06-28 20:45 - 2014-06-28 20:44 - 00030597 _____ () C:\Users\Basti\Downloads\Addition.txt

2014-06-28 20:42 - 2014-06-28 20:42 - 02083328 _____ (Farbar) C:\Users\Basti\Downloads\FRST64.exe

2014-06-28 02:36 - 2013-08-11 15:11 - 00000000 ____D () C:\Users\Basti\Desktop\XOXO

2014-06-26 14:01 - 2014-06-26 14:01 - 00003840 _____ () C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1373561767

2014-06-26 14:01 - 2013-07-11 18:56 - 00000000 ____D () C:\Program Files (x86)\Opera

2014-06-25 13:46 - 2013-07-26 19:49 - 00000132 _____ () C:\Users\Basti\AppData\Roaming\Adobe GIF Format CS5 Prefs

2014-06-24 12:15 - 2013-07-11 18:37 - 00117712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

2014-06-22 04:26 - 2014-06-22 03:45 - 00000000 ____D () C:\Users\Basti\AppData\Roaming\tor

2014-06-22 03:39 - 2014-06-22 03:39 - 07646425 _____ () C:\Users\Basti\Downloads\torchat-windows-0.9.9.550.zip

2014-06-22 03:38 - 2014-06-21 16:36 - 00000000 ____D () C:\Users\Basti\Desktop\Tor Browser

2014-06-22 03:36 - 2014-06-22 03:35 - 07794602 _____ () C:\Users\Basti\Downloads\torchat-windows-0.9.9.553.zip

2014-06-21 19:50 - 2011-03-20 11:08 - 00696620 _____ () C:\Windows\system32\perfh007.dat

2014-06-21 19:50 - 2011-03-20 11:08 - 00147916 _____ () C:\Windows\system32\perfc007.dat

2014-06-21 19:50 - 2009-07-14 07:13 - 01612484 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-06-21 16:50 - 2013-07-11 18:33 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2014-06-21 16:36 - 2014-06-21 16:36 - 00001464 _____ () C:\Users\Basti\Desktop\amazon.de.lnk

2014-06-21 16:36 - 2014-06-21 16:36 - 00000000 ____D () C:\Users\Basti\AppData\Roaming\DesktopIconAmazon

2014-06-21 16:32 - 2014-06-21 16:32 - 00961360 _____ (Chip Digital GmbH) C:\Users\Basti\Downloads\Tor Browser Paket - CHIP-Installer.exe

2014-06-20 00:28 - 2013-07-11 18:50 - 00004090 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-887015318-538487465-2359642672-1000UA

2014-06-20 00:28 - 2013-07-11 18:50 - 00003694 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-887015318-538487465-2359642672-1000Core

2014-06-18 10:40 - 2014-06-18 10:40 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-06-16 12:18 - 2014-06-16 12:17 - 86298992 _____ () C:\Users\Basti\Downloads\1401045104341.rar

2014-06-12 13:15 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache

2014-06-12 03:08 - 2013-07-24 16:01 - 00000000 ____D () C:\Windows\system32\MRT

2014-06-12 03:05 - 2013-07-12 12:51 - 95414520 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-06-11 22:36 - 2013-07-11 18:51 - 00002364 _____ () C:\Users\Basti\Desktop\Google Chrome.lnk

2014-06-11 07:50 - 2013-07-12 20:19 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-06-11 07:50 - 2013-07-12 20:19 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-06-11 07:50 - 2013-07-12 20:19 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-06-09 20:23 - 2014-06-09 20:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus

2014-06-09 20:23 - 2014-06-09 20:23 - 00000000 ____D () C:\Program Files\McAfee Security Scan

2014-06-09 20:23 - 2013-11-19 11:54 - 00001937 _____ () C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk

2014-06-09 20:23 - 2013-07-12 20:19 - 00000000 ____D () C:\ProgramData\McAfee Security Scan

2014-06-09 14:44 - 2014-04-26 19:02 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2

2014-06-07 23:27 - 2014-01-04 19:57 - 00000000 ____D () C:\Users\Basti\AppData\Roaming\AbiSuite

2014-06-07 15:13 - 2013-07-11 18:44 - 00000000 ____D () C:\Users\Basti\AppData\Roaming\vlc

2014-06-06 00:37 - 2013-10-13 14:23 - 00000000 ____D () C:\Users\Basti\AppData\Local\Windows Live
 

Some content of TEMP:

====================

C:\Users\Basti\AppData\Local\Temp\avgnt.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-06-28 01:52
 

==================== End Of Log ============================
--- --- ---

wo finde ich die Addition.txt?

Gibt es eine Möglichkeit, diesen Schädling von meiner Toplsite zu entfernen? Ich habe auf die Site einen Warnhinweis gestellt und einen Link zu Anit-Malware gesetzt, weil ich nicht will, dass sich Besucher infizieren. Jedoch macht das auch irgendwie keinen guten Eindruck.