|
Plagegeister aller Art und deren Bekämpfung: hd vid codec.com heruntergeladen. Wie entferne ich das?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
24.06.2013, 19:58 | #1 |
| hd vid codec.com heruntergeladen. Wie entferne ich das? Hallo zusammen, ich habe ähnliches Problem wie ein User vor mir. Ich habe mir den hdvidcodec.com heruntergeladen. Allerdings habe ich die .exe-Datei noch nicht ausgeführt. Nur löschen kann ich es auch nicht. Von einem Virenprogramm bekam ich noch keine Fehlermeldung, lediglich der Computer hat sich seit Download (ca. 4 Monate her) vor etwa 1 Woche nicht mehr ordnungsgemäß hochgefahren. Da stoß ich über Google auf dieses Forum mit der Hoffnung, dass auch meinem Notebook geholfen werden kann. Meine Frage also: Wie kann ich diese Datei löschen? Viele Grüße Stephanus |
24.06.2013, 20:57 | #2 |
/// the machine /// TB-Ausbilder | hd vid codec.com heruntergeladen. Wie entferne ich das? Hi,
__________________Systemscan mit FRST Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit (Wenn du nicht sicher bist: Start > Computer (Rechtsklick) > Eigenschaften)
__________________ |
27.06.2013, 21:00 | #3 |
| hd vid codec.com heruntergeladen. Wie entferne ich das? Hallo,
__________________danke für dein Hilfeangebot. Hier meine Logoffenbarung : FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 26-06-2013 02 Ran by xxxxx (administrator) on 27-06-2013 21:17:50 Running from C:\Users\xxxxx\Downloads Microsoft Windows 7 Starter Service Pack 1 (X86) OS Language: German Standard Internet Explorer Version 9 Boot Mode: Normal ==================== Processes (Whitelisted) =================== (AVG Technologies CZ, s.r.o.) C:\PROGRA~1\AVG\AVG2013\avgrsx.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgcsrvx.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgidsagent.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgwdsvc.exe (Dritek System Inc.) C:\Program Files\Launch Manager\dsiwmis.exe (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe (Microsoft Corporation) C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe (TuneUp Software) C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesService32.exe (AVG Secure Search) C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.3.0\ToolbarUpdater.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation) C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe () C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.3.0\loggingserver.exe (Safer Networking Ltd.) C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (TuneUp Software) C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesApp32.exe (Dritek System Inc.) C:\Program Files\Launch Manager\LManager.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Dritek System Inc.) C:\Program Files\Launch Manager\LMworker.exe (Intel Corporation) C:\Windows\system32\igfxsrvc.exe () C:\Windows\PLFSetI.exe (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe () C:\Program Files\AVG Secure Search\vprot.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgui.exe (Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe (Safer Networking Limited) C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Microsoft Corporation) C:\Windows\system32\wbem\unsecapp.exe (Samsung) C:\Program Files\Samsung\Kies\Kies.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgnsx.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgemcx.exe (Samsung) C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe (Intel Corporation) C:\Windows\system32\igfxext.exe (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Microsoft Corporation) C:\Windows\system32\wuauclt.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [LManager] C:\Program Files\Launch Manager\LManager.exe [975952 2010-08-10] (Dritek System Inc.) HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s [9398888 2010-08-03] (Realtek Semiconductor) HKLM\...\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [1692968 2010-02-05] (Synaptics Incorporated) HKLM\...\Run: [PLFSetI] C:\Windows\PLFSetI.exe [206208 2010-11-15] () HKLM\...\Run: [Acer ePower Management] C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [715296 2010-06-11] (Acer Incorporated) HKLM\...\Run: [] [x] HKLM\...\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) HKLM\...\Run: [vProt] "C:\Program Files\AVG Secure Search\vprot.exe" [2236080 2013-06-25] () HKLM\...\Run: [AVG_UI] "C:\Program Files\AVG\AVG2013\avgui.exe" /TRAYONLY [3147384 2012-12-11] (AVG Technologies CZ, s.r.o.) HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [919008 2012-07-27] (Adobe Systems Incorporated) HKLM\...\Run: [KiesTrayAgent] C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [310640 2013-03-28] (Samsung Electronics Co., Ltd.) HKLM\...\Run: [DivXMediaServer] C:\Program Files\DivX\DivX Media Server\DivXMediaServer.exe [x] HKLM\...\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" [253816 2013-03-12] (Oracle Corporation) HKCU\...\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2144088 2009-01-26] (Safer Networking Limited) HKCU\...\Run: [KiesPreload] C:\Program Files\Samsung\Kies\Kies.exe /preload [1511792 2013-03-28] (Samsung) HKCU\...\Run: [KiesAirMessage] C:\Program Files\Samsung\Kies\KiesAirMessage.exe -startup [x] HKCU\...\Run: [] C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [1106288 2013-03-28] (Samsung) MountPoints2: {02e7bb9c-6079-11e1-98ef-0026c7b15412} - F:\AutoRun.exe MountPoints2: {35afdf51-7ae0-11e0-9dfe-1c750834aa92} - E:\LaunchU3.exe -a MountPoints2: {5b3f8554-60c9-11e1-9536-1c750834aa92} - E:\AutoRun.exe MountPoints2: {9c4f17b6-61ec-11e0-8432-0026c7b15412} - E:\start.exe /auto MountPoints2: {abca7e4c-70ef-11e0-91b1-1c750834aa92} - E:\LaunchU3.exe -a HKU\Default\...\RunOnce: [ScrSav] C:\Program Files\Acer\Screensaver\run_Acer.exe /default [ 2010-01-15] () HKU\Default User\...\RunOnce: [ScrSav] C:\Program Files\Acer\Screensaver\run_Acer.exe /default [ 2010-01-15] () Startup: C:\Users\xxxxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> C:\Program Files\WISO\Steuersoftware 2013\mshaktuell.exe () ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://acer.msn.com HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com HKLM SearchScopes: DefaultScope {EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C} URL = hxxp://slirsredirect.search.aol.com/redirector/sredir?sredir=2685&query={searchTerms}&invocationType=tb50-ie-winamp-chromesbox-en-us&tb_uuid=20110410070928151&tb_oid=10-04-2011&tb_mrud=10-04-2011 SearchScopes: HKLM - {EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C} URL = hxxp://slirsredirect.search.aol.com/redirector/sredir?sredir=2685&query={searchTerms}&invocationType=tb50-ie-winamp-chromesbox-en-us&tb_uuid=20110410070928151&tb_oid=10-04-2011&tb_mrud=10-04-2011 HKCU SearchScopes: DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKCU - {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxp://isearch.avg.com/search?cid={663408AB-7943-4B62-A025-456B18CEA37B}&mid=c9a0d61284b247d1bde1cd3c4ed04361-bd8f9060f1f559b9ff3f94d4b86644e8bb3ac89b&lang=de&ds=AVG&pr=fr&d=2011-12-13 11:21:49&v=15.2.0.5&pid=avg&sg=46&sap=dsp&q={searchTerms} SearchScopes: HKCU - {EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C} URL = hxxp://slirsredirect.search.aol.com/redirector/sredir?sredir=2685&query={searchTerms}&invocationType=tb50-ie-winamp-chromesbox-en-us&tb_uuid=20110410070928151&tb_oid=10-04-2011&tb_mrud=10-04-2011 BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO: No Name - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No File BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\15.3.0.11\AVG Secure Search_toolbar.dll (AVG Secure Search) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.) Toolbar: HKLM - No Name - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File Toolbar: HKLM - AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\15.3.0.11\AVG Secure Search_toolbar.dll (AVG Secure Search) Toolbar: HKCU -No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No File Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - No File Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\15.3.0\ViProtocol.dll (AVG Secure Search) Tcpip\Parameters: [DhcpNameServer] 192.178.1.1 FireFox: ======== FF ProfilePath: C:\Users\xxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\4smgwsne.default FF user.js: detected! => C:\Users\xxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\4smgwsne.default\user.js FF SearchEngine: user_pref("browser.search.selectedEngine", ""); FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll () FF Plugin: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin - C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\15.3.0\\npsitesafety.dll (AVG Technologies) FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin: @java.com/DTPlugin,version=10.21.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.21.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @videolan.org/vlc,version=2.0.3 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Extension: ProxTube - Gesperrte YouTube Videos entsperren - C:\Users\xxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\4smgwsne.default\Extensions\ich@maltegoetz.de FF Extension: speedtest - C:\Users\xxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\4smgwsne.default\Extensions\speedtest@gotomyhelp.com.xpi FF Extension: No Name - C:\Users\xxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\4smgwsne.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi ========================== Services (Whitelisted) ================= S3 AVG Security Toolbar Service; C:\Program Files\AVG\AVG10\Toolbar\ToolbarBroker.exe [167264 2011-11-10] () R2 AVGIDSAgent; C:\Program Files\AVG\AVG2013\avgidsagent.exe [5814904 2012-11-16] (AVG Technologies CZ, s.r.o.) R2 avgwd; C:\Program Files\AVG\AVG2013\avgwdsvc.exe [196664 2012-10-22] (AVG Technologies CZ, s.r.o.) R2 ePowerSvc; C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe [735776 2010-06-11] (Acer Incorporated) S4 GREGService; C:\Program Files\Acer\Registration\GREGsvc.exe [23584 2010-01-08] (Acer Incorporated) S4 RS_Service; C:\Program Files\Acer\Acer VCM\RS_Service.exe [260640 2010-01-30] (Acer Incorporated) R2 SBSDWSCService; C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.) R2 TuneUp.UtilitiesSvc; C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesService32.exe [1529152 2012-04-05] (TuneUp Software) S4 Updater Service; C:\Program Files\Acer\Acer Updater\UpdaterService.exe [243232 2010-01-29] (Acer Group) R2 vToolbarUpdater15.3.0; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.3.0\ToolbarUpdater.exe [1598128 2013-06-25] (AVG Secure Search) ==================== Drivers (Whitelisted) ==================== R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdriverx.sys [179936 2012-10-22] (AVG Technologies CZ, s.r.o. ) R0 AVGIDSHX; C:\Windows\System32\DRIVERS\avgidshx.sys [55776 2012-10-15] (AVG Technologies CZ, s.r.o. ) R1 AVGIDSShim; C:\Windows\System32\DRIVERS\avgidsshimx.sys [19936 2012-09-21] (AVG Technologies CZ, s.r.o. ) R1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [159712 2012-10-02] (AVG Technologies CZ, s.r.o.) R0 Avglogx; C:\Windows\System32\DRIVERS\avglogx.sys [177376 2012-09-21] (AVG Technologies CZ, s.r.o.) R0 Avgmfx86; C:\Windows\System32\DRIVERS\avgmfx86.sys [94048 2012-11-16] (AVG Technologies CZ, s.r.o.) R0 Avgrkx86; C:\Windows\System32\DRIVERS\avgrkx86.sys [35552 2012-09-14] (AVG Technologies CZ, s.r.o.) R1 Avgtdix; C:\Windows\System32\DRIVERS\avgtdix.sys [164832 2012-09-21] (AVG Technologies CZ, s.r.o.) R1 avgtp; C:\Windows\system32\drivers\avgtpx86.sys [37664 2013-06-25] (AVG Technologies) S3 EUCR; C:\Windows\System32\DRIVERS\EUCR6SK.SYS [82768 2010-06-17] (ENE Technology Inc.) S3 FlashUSB; C:\Windows\System32\DRIVERS\FlashUSB.sys [16384 2013-01-31] (Intel Mobile Communications) S3 netr28u; C:\Windows\System32\DRIVERS\netr28u.sys [657408 2009-07-14] (Ralink Technology Corp.) S3 ssudserd; C:\Windows\System32\DRIVERS\ssudserd.sys [181912 2013-02-22] (DEVGURU Co., LTD.(www.devguru.co.kr)) R3 TuneUpUtilitiesDrv; C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesDriver32.sys [10064 2012-03-29] (TuneUp Software) S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [x] S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [x] S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [x] S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-06-27 21:16 - 2013-06-27 21:17 - 00000000 ____D C:\Users\xxxxx\Desktop\Desktop1 2013-06-27 21:16 - 2013-06-27 21:16 - 00000000 ____D C:\FRST 2013-06-27 21:11 - 2013-06-27 21:11 - 01370369 ____A (Farbar) C:\Users\xxxxx\Downloads\FRST.exe 2013-06-27 09:07 - 2013-06-27 09:07 - 00000000 ____D C:\Users\xxxxx\Desktop\Neuer Ordner 2013-06-27 09:07 - 2013-06-27 09:07 - 00000000 ____D C:\Users\xxxxx\Desktop\ 2013-06-27 09:00 - 2013-06-27 09:04 - 565470125 ____A C:\Users\xxxxx\Downloads\ 2013-06-23 17:17 - 2013-06-23 17:17 - 00002005 ____A C:\Users\xxxxx\Desktop\WISO Steuer-Sparbuch 2013.lnk 2013-06-23 17:12 - 2013-06-23 17:12 - 00000000 ____D C:\Users\xxxxx\AppData\Roaming\InstallShield Installation Information 2013-06-03 09:24 - 2013-06-26 19:13 - 00000350 ____A C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job ==================== One Month Modified Files and Folders ======== 2013-06-27 21:17 - 2013-06-27 21:16 - 00000000 ____D C:\Users\xxxxx\Desktop\Desktop1 2013-06-27 21:16 - 2013-06-27 21:16 - 00000000 ____D C:\FRST 2013-06-27 21:11 - 2013-06-27 21:11 - 01370369 ____A (Farbar) C:\Users\xxxxx\Downloads\FRST.exe 2013-06-27 21:01 - 2012-04-28 19:03 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-06-27 09:07 - 2013-06-27 09:07 - 00000000 ____D C:\Users\xxxxx\Desktop\Neuer Ordner 2013-06-27 09:07 - 2013-06-27 09:07 - 00000000 ____D C:\Users\xxxxx\Desktop\ 2013-06-27 09:04 - 2013-06-27 09:00 - 565470125 ____A C:\Users\xxxxx\Downloads\ 2013-06-27 08:56 - 2009-07-14 06:34 - 00009696 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-06-27 08:56 - 2009-07-14 06:34 - 00009696 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-06-27 08:44 - 2011-06-09 17:19 - 00000000 ____D C:\ProgramData\MFAData 2013-06-27 08:38 - 2010-11-15 19:54 - 01616553 ____A C:\Windows\WindowsUpdate.log 2013-06-27 00:00 - 2012-04-18 00:11 - 00000000 ____D C:\Users\xxxxxx\AppData\Local\PokerStars.NET 2013-06-26 19:16 - 2012-06-14 16:37 - 00000000 ____D C:\Users\xxxxx\AppData\Local\AVG Secure Search 2013-06-26 19:13 - 2013-06-03 09:24 - 00000350 ____A C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job 2013-06-26 19:12 - 2013-02-24 10:45 - 00009902 ____A C:\Windows\setupact.log 2013-06-26 19:12 - 2009-07-14 06:53 - 00000006 ___AH C:\Windows\Tasks\SA.DAT 2013-06-25 22:01 - 2012-08-30 22:37 - 00037664 ____A (AVG Technologies) C:\Windows\System32\Drivers\avgtpx86.sys 2013-06-25 22:01 - 2011-12-13 12:25 - 00000000 ____D C:\ProgramData\AVG Secure Search 2013-06-25 22:01 - 2011-12-13 12:24 - 00000000 ____D C:\Program Files\AVG Secure Search 2013-06-23 17:18 - 2012-07-31 13:46 - 00000966 ____A C:\Windows\wiso.ini 2013-06-23 17:17 - 2013-06-23 17:17 - 00002005 ____A C:\Users\xxxxx\Desktop\WISO Steuer-Sparbuch 2013.lnk 2013-06-23 17:17 - 2012-07-31 13:46 - 00000000 ____D C:\Users\xxxxx\AppData\Local\Buhl 2013-06-23 17:12 - 2013-06-23 17:12 - 00000000 ____D C:\Users\xxxxx\AppData\Roaming\InstallShield Installation Information 2013-06-23 17:12 - 2012-07-31 13:35 - 00000000 ____D C:\Program Files\WISO 2013-06-18 01:27 - 2012-04-28 19:03 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe 2013-06-18 01:27 - 2011-07-28 12:15 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl 2013-06-17 00:51 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\NDF 2013-06-15 06:53 - 2012-04-12 22:20 - 00000000 ____D C:\Users\xxxxx\.compeople 2013-06-15 06:53 - 2012-03-04 00:26 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy 2013-06-15 06:53 - 2011-12-13 12:24 - 00000000 ____D C:\Program Files\Common Files\AVG Secure Search 2013-06-15 06:53 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\wfp 2013-06-15 06:53 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\DriverStore 2013-06-15 06:53 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\registration 2013-06-15 06:53 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\AppCompat 2013-06-15 06:49 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\LogFiles 2013-06-14 20:55 - 2011-04-08 09:26 - 00000000 ____D C:\users\xxxxx 2013-05-28 09:26 - 2013-05-02 09:53 - 00000000 ____D C:\Users\xxxxx\.tfo4 2013-05-28 00:21 - 2013-03-24 21:56 - 00000000 ____D C:\Program Files\hdvidcodec.com Files to move or delete: ==================== C:\ProgramData\FullRemove.exe ==================== Bamital & volsnap Check ================= C:\Windows\explorer.exe => MD5 is legit C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-06-23 01:17 ==================== End Of Log ============================ und noch: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 26-06-2013 02 Ran by xxxx at 2013-06-27 21:21:18 Running from C:\Users\xxxxx\Downloads Boot Mode: Normal ========================================================== ==================== Installed Programs ======================= 7-Zip 9.20 Acer Crystal Eye webcam Ver:1.1.192.810 (Version: 1.1.192.810) Acer ePower Management (Version: 5.00.3005) Acer eRecovery Management (Version: 4.05.3013) Acer Registration (Version: 1.03.3003) Acer ScreenSaver (Version: 1.1.0624.2010) Acer Updater (Version: 1.02.3001) Acer VCM (Version: 4.05.3002) Adobe Flash Player 11 ActiveX (Version: 11.7.700.224) Adobe Flash Player 11 Plugin (Version: 11.7.700.224) Adobe Photoshop CS5 (Version: 12.0) Adobe Reader X (10.1.4) - Deutsch (Version: 10.1.4) AndroidInstaller (Version: 1.00.022) Apple Application Support (Version: 2.0.1) Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (Version: 1.0.0.35) AVG 2013 (Version: 13.0.2904) AVG 2013 (Version: 13.0.3204) AVG 2013 (Version: 2013.0.2904) AVG Security Toolbar (Version: 15.3.0.11) Brutal Chess CCleaner (Version: 3.17) D3DX10 (Version: 15.4.2368.0902) DesignPro Business Cards SE (Version: 5.3.705) ENE USB Card Reader Driver (Version: 5.89.0.70) EuroPoker Tournament Director's Poker Clock Free YouTube to MP3 Converter version 3.12.2.430 (Version: 3.12.2.430) Google Earth Plug-in (Version: 7.0.3.8542) Google Update Helper (Version: 1.3.21.145) HDVidCodec (Version: 2.1 Build 26473) HP Deskjet 3050 J610 series - Grundlegende Software für das Gerät (Version: 22.50.231.0) HP Deskjet 3050 J610 series Hilfe (Version: 140.0.63.63) HP Officejet 6500 E710a-f - Grundlegende Software für das Gerät (Version: 22.0.334.0) HP Officejet 6500 E710a-f Hilfe (Version: 140.0.2.2) HP Update (Version: 5.002.005.003) I.R.I.S. OCR (Version: 12.3.4) Identity Card (Version: 1.00.3003) Intel(R) Graphics Media Accelerator Driver (Version: 8.14.10.2117) Intel(R) Rapid Storage Technology (Version: 9.6.4.1002) Java 7 Update 21 (Version: 7.0.210) Java Auto Updater (Version: 2.1.9.5) Junk Mail filter update (Version: 15.4.3502.0922) Launch Manager (Version: 4.0.14) Marketsplash Schnellzugriffe (Version: 1.0.0.9) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30320) Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30320) Microsoft Application Error Reporting (Version: 12.0.6012.5000) Microsoft Office 2010 (Version: 14.0.4763.1000) Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000) Microsoft Office Starter 2010 - Deutsch (Version: 14.0.4763.1000) Microsoft PowerPoint Viewer (Version: 14.0.6029.1000) Microsoft Silverlight (Version: 5.1.10411.0) Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000) Microsoft Visual C++ 2005 Redistributable (Version: 8.0.56336) Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001) Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (Version: 9.0.30729.5570) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 (Version: 9.0.30411) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (Version: 10.0.40219) Microsoft_VC80_ATL_x86 (Version: 8.0.50727.4053) Microsoft_VC80_CRT_x86 (Version: 8.0.50727.4053) Microsoft_VC80_MFC_x86 (Version: 8.0.50727.4053) Microsoft_VC80_MFCLOC_x86 (Version: 8.0.50727.4053) Microsoft_VC90_ATL_x86 (Version: 1.00.0000) Microsoft_VC90_CRT_x86 (Version: 1.00.0000) Microsoft_VC90_MFC_x86 (Version: 1.00.0000) Mozilla Firefox 20.0.1 (x86 de) (Version: 20.0.1) Mozilla Maintenance Service (Version: 20.0.1) MSVCRT (Version: 15.4.2862.0708) MyFreeCodec OpenOffice.org 3.4 (Version: 3.4.9590) PDF Settings CS5 (Version: 10.0) PDFCreator (Version: 1.3.2) PokerStars.net Realtek High Definition Audio Driver (Version: 6.0.1.6171) Samsung Kies (Version: 2.5.2.13021_10) SAMSUNG USB Driver for Mobile Phones (Version: 1.5.22.0) Skype™ 5.9 (Version: 5.9.115) Spybot - Search & Destroy (Version: 1.6.2) Synaptics Pointing Device Driver (Version: 15.0.7.0) Tinypic 3.18 (Version: Tinypic 3.18) TuneUp Utilities 2012 (Version: 12.0.3500.13) TuneUp Utilities Language Pack (de-DE) (Version: 12.0.3500.13) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1) VC80CRTRedist - 8.0.50727.6195 (Version: 1.2.0) VLC media player 2.0.3 (Version: 2.0.3) Welcome Center (Version: 1.02.3004) Windows Live Communications Platform (Version: 15.4.3502.0922) Windows Live Essentials (Version: 15.4.3502.0922) Windows Live Essentials (Version: 15.4.3508.1109) Windows Live Fotogalerie (Version: 15.4.3502.0922) Windows Live ID Sign-in Assistant (Version: 7.250.4225.0) Windows Live Installer (Version: 15.4.3502.0922) Windows Live Mail (Version: 15.4.3502.0922) Windows Live MIME IFilter (Version: 15.4.3502.0922) Windows Live Movie Maker (Version: 15.4.3502.0922) Windows Live Photo Common (Version: 15.4.3502.0922) Windows Live Photo Gallery (Version: 15.4.3502.0922) Windows Live PIMT Platform (Version: 15.4.3508.1109) Windows Live SOXE (Version: 15.4.3502.0922) Windows Live SOXE Definitions (Version: 15.4.3502.0922) Windows Live Sync (Version: 14.0.8117.416) Windows Live UX Platform (Version: 15.4.3502.0922) Windows Live UX Platform Language Pack (Version: 15.4.3508.1109) Windows Live Writer (Version: 15.4.3502.0922) Windows Live Writer Resources (Version: 15.4.3502.0922) WinZip 14.5 (Version: 14.5.9095) WISO Steuer-Sparbuch 2012 (Version: 19.00.7303) WISO Steuer-Sparbuch 2013 (HKCU Version: 20.00.8137) ==================== Restore Points ========================= 30-04-2013 13:44:14 Geplanter Prüfpunkt 02-05-2013 07:16:21 Installed Java 7 Update 21 19-05-2013 14:12:32 Uniblue SpeedUpMyPC installation 28-05-2013 06:13:59 Geplanter Prüfpunkt 06-06-2013 13:05:11 Geplanter Prüfpunkt 14-06-2013 19:26:13 Geplanter Prüfpunkt 22-06-2013 07:46:16 Geplanter Prüfpunkt 23-06-2013 15:11:13 Installiert WISO Steuer-Sparbuch 2013 ==================== Scheduled Tasks (whitelisted) ============= Task: {1BEFE732-6343-4EAE-92AD-4E61A07F9761} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-11] (Microsoft Corporation) Task: {1BFEC5B7-64DD-4AEC-9643-566BF536FD3A} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task Task: {1DB9D5DA-2BB7-4732-A04E-52FB5618E805} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2011-04-11] (Google Inc.) Task: {2A322A1C-D817-4E38-84C4-BA62C680197B} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-07-27] (Adobe Systems Incorporated) Task: {30F8B7DB-EA30-4200-9E9F-093DD976FE0E} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-18] (Adobe Systems Incorporated) Task: {74971A17-D71E-4D05-8EC2-68671C77F3EB} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2011-04-11] (Google Inc.) Task: {7789725D-F5CB-41B5-94C7-86637F8526D1} - System32\Tasks\AdobeAAMUpdater-1.0-xxxxx-PC-xxxxx=> C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2010-03-06] (Adobe Systems Incorporated) Task: {7F60B287-222C-4593-A522-A78B267DD157} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2012 => C:\Program Files\TuneUp Utilities 2012\OneClick.exe [2012-04-05] (TuneUp Software) Task: {8CA85D15-3E98-428F-A19A-06764C70C4F8} - System32\Tasks\hpwebreg_CN0BJ221FT05JZ => C:\Program Files\HP\HP Officejet 6500 E710a-f\Bin\hpwebreg.exe [2010-06-14] (Hewlett-Packard Co.) Task: {A82992C7-8A4D-4E55-97F7-1A128DDD92D7} - System32\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv => C:\Windows\TEMP\{4F265E72-57EB-48EF-8F1F-8846A364A42E}.exe No File Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job => C:\Windows\TEMP\{4F265E72-57EB-48EF-8F1F-8846A364A42E}.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\hpwebreg_CN0BJ221FT05JZ.job => C:\Program Files\HP\HP Officejet 6500 E710a-f\Bin\HpWebReg.exe ==================== Faulty Device Manager Devices ============= Name: Microsoft-Adapter für Miniports virtueller WiFis Description: Microsoft-Adapter für Miniports virtueller WiFis Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318} Manufacturer: Microsoft Service: vwifimp Problem: : This device is disabled. (Code 22) Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions. ==================== Event log errors: ========================= Application errors: ================== Error: (06/25/2013 10:48:56 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3. Der Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig. Error: (06/23/2013 01:24:48 AM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3. Der Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig. Error: (06/22/2013 09:50:53 AM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3. Der Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig. Error: (06/18/2013 01:37:55 AM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3. Der Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig. Error: (06/17/2013 00:40:17 AM) (Source: Application Hang) (User: ) Description: Programm iexplore.exe, Version 9.0.8112.16457 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 109c Startzeit: 01ce6ae263d5f9be Endzeit: 0 Anwendungspfad: C:\Program Files\Internet Explorer\iexplore.exe Berichts-ID: Error: (06/14/2013 09:40:58 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3. Der Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig. Error: (06/13/2013 11:02:08 AM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3. Der Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig. Error: (06/10/2013 09:45:23 PM) (Source: Application Hang) (User: ) Description: Programm sump.exe, Version 5.3.4.4 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: ed8 Startzeit: 01ce66125b31004c Endzeit: 500 Anwendungspfad: C:\Program Files\Uniblue\SpeedUpMyPC\sump.exe Berichts-ID: 3492090a-d206-11e2-9fb0-1c750834aa92 Error: (06/06/2013 03:05:29 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3. Der Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig. Error: (06/02/2013 06:47:21 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3. Der Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig. System errors: ============= Error: (06/27/2013 09:00:28 PM) (Source: Service Control Manager) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst NlaSvc erreicht. Error: (06/27/2013 09:00:28 PM) (Source: Service Control Manager) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst lmhosts erreicht. Error: (06/26/2013 07:13:23 PM) (Source: Service Control Manager) (User: ) Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: cdrom Error: (06/26/2013 07:12:51 PM) (Source: Service Control Manager) (User: ) Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen: %%5 Error: (06/26/2013 07:11:48 PM) (Source: Service Control Manager) (User: ) Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen: %%5 Error: (06/26/2013 06:53:03 PM) (Source: Service Control Manager) (User: ) Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: cdrom Error: (06/26/2013 06:52:55 PM) (Source: Service Control Manager) (User: ) Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen: %%5 Error: (06/26/2013 06:52:41 PM) (Source: Service Control Manager) (User: ) Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen: %%5 Error: (06/26/2013 00:12:03 PM) (Source: Service Control Manager) (User: ) Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen: %%5 Error: (06/26/2013 08:34:28 AM) (Source: Service Control Manager) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst Netman erreicht. Microsoft Office Sessions: ========================= Error: (06/25/2013 10:48:56 PM) (Source: SideBySide)(User: ) Description: assemblyIdentitylanguage*c:\program files\spybot - search & destroy\DelZip179.dllc:\program files\spybot - search & destroy\DelZip179.dll8 Error: (06/23/2013 01:24:48 AM) (Source: SideBySide)(User: ) Description: assemblyIdentitylanguage*c:\program files\spybot - search & destroy\DelZip179.dllc:\program files\spybot - search & destroy\DelZip179.dll8 Error: (06/22/2013 09:50:53 AM) (Source: SideBySide)(User: ) Description: assemblyIdentitylanguage*c:\program files\spybot - search & destroy\DelZip179.dllc:\program files\spybot - search & destroy\DelZip179.dll8 Error: (06/18/2013 01:37:55 AM) (Source: SideBySide)(User: ) Description: assemblyIdentitylanguage*c:\program files\spybot - search & destroy\DelZip179.dllc:\program files\spybot - search & destroy\DelZip179.dll8 Error: (06/17/2013 00:40:17 AM) (Source: Application Hang)(User: ) Description: iexplore.exe9.0.8112.16457109c01ce6ae263d5f9be0C:\Program Files\Internet Explorer\iexplore.exe Error: (06/14/2013 09:40:58 PM) (Source: SideBySide)(User: ) Description: assemblyIdentitylanguage*c:\program files\spybot - search & destroy\DelZip179.dllc:\program files\spybot - search & destroy\DelZip179.dll8 Error: (06/13/2013 11:02:08 AM) (Source: SideBySide)(User: ) Description: assemblyIdentitylanguage*c:\program files\spybot - search & destroy\DelZip179.dllc:\program files\spybot - search & destroy\DelZip179.dll8 Error: (06/10/2013 09:45:23 PM) (Source: Application Hang)(User: ) Description: sump.exe5.3.4.4ed801ce66125b31004c500C:\Program Files\Uniblue\SpeedUpMyPC\sump.exe3492090a-d206-11e2-9fb0-1c750834aa92 Error: (06/06/2013 03:05:29 PM) (Source: SideBySide)(User: ) Description: assemblyIdentitylanguage*c:\program files\spybot - search & destroy\DelZip179.dllc:\program files\spybot - search & destroy\DelZip179.dll8 Error: (06/02/2013 06:47:21 PM) (Source: SideBySide)(User: ) Description: assemblyIdentitylanguage*c:\program files\spybot - search & destroy\DelZip179.dllc:\program files\spybot - search & destroy\DelZip179.dll8 ==================== Memory info =========================== Percentage of memory in use: 89% Total physical RAM: 1013.09 MB Available physical RAM: 101.57 MB Total Pagefile: 2037.09 MB Available Pagefile: 562.47 MB Total Virtual: 2047.88 MB Available Virtual: 1898.12 MB ==================== Drives ================================ Drive c: (Acer) (Fixed) (Total:215.79 GB) (Free:153.36 GB) NTFS Drive d: () (Fixed) (Total:4 GB) (Free:2.63 GB) FAT32 ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: 2FB22E62) Partition 1: (Not Active) - (Size=13 GB) - (Type=27) Partition 2: (Not Active) - (Size=4 GB) - (Type=0C) Partition 3: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 4: (Not Active) - (Size=216 GB) - (Type=OF Extended) ==================== End Of Log ============================ |
28.06.2013, 06:28 | #4 | |
/// the machine /// TB-Ausbilder | hd vid codec.com heruntergeladen. Wie entferne ich das?Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!Downloade dir bitte Combofix vom folgenden Downloadspiegel Link 1 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
28.06.2013, 07:56 | #5 |
| hd vid codec.com heruntergeladen. Wie entferne ich das? Ich hab jetzt den Empfehlungen folge geleistet und anbei das Ergebnis gepostet: Code:
ATTFilter ComboFix 13-06-28.01 - xxxxx 28.06.2013 8:24.1.2 - x86 Microsoft Windows 7 Starter 6.1.7601.1.1252.49.1031.18.1013.146 [GMT 2:00] ausgeführt von:: c:\users\xxxxx\Downloads\ComboFix.exe AV: AVG AntiVirus Free Edition 2013 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9} SP: AVG AntiVirus Free Edition 2013 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . (((((((((((((((((((((((((((((((((((( Weitere Löschungen )))))))))))))))))))))))))))))))))))))))))))))))) . . C:\Install.exe c:\programdata\FullRemove.exe c:\windows\system32\muzapp.exe . . ((((((((((((((((((((((( Dateien erstellt von 2013-05-28 bis 2013-06-28 )))))))))))))))))))))))))))))) . . 2013-06-28 06:42 . 2013-06-28 06:42 -------- d-----w- c:\users\Default\AppData\Local\temp 2013-06-27 19:16 . 2013-06-27 19:16 -------- d-----w- C:\FRST 2013-06-23 15:12 . 2013-06-23 15:12 -------- d-----w- c:\users\xxxxx\AppData\Roaming\InstallShield Installation Information . . . (((((((((((((((((((((((((((((((((((( Find3M Bericht )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-06-25 20:01 . 2012-08-30 20:37 37664 ----a-w- c:\windows\system32\drivers\avgtpx86.sys 2013-06-17 23:27 . 2012-04-28 17:03 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2013-06-17 23:27 . 2011-07-28 10:15 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2013-05-17 07:29 . 2010-06-24 09:33 22240 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll 2013-05-02 07:18 . 2013-05-02 07:19 94112 ----a-w- c:\windows\system32\WindowsAccessBridge.dll 2013-05-02 07:18 . 2013-05-02 07:20 788896 ----a-w- c:\windows\system32\deployJava1.dll 2013-05-02 07:18 . 2013-05-02 07:20 866720 ----a-w- c:\windows\system32\npDeployJava1.dll 2013-04-12 02:05 . 2013-04-12 02:04 263064 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . (((((((((((((((((((((((((((( Autostartpunkte der Registrierung )))))))))))))))))))))))))))))))))))))))) . . *Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. REGEDIT4 . [HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}] 2013-06-25 20:01 3055280 ----a-w- c:\program files\AVG Secure Search\15.3.0.11\AVG Secure Search_toolbar.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}] 2013-04-30 16:55 280736 ----a-w- c:\program files\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files\AVG Secure Search\15.3.0.11\AVG Secure Search_toolbar.dll" [2013-06-25 3055280] . [HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}] [HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1] [HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088] "KiesPreload"="c:\program files\Samsung\Kies\Kies.exe" [2013-03-28 1511792] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "LManager"="c:\program files\Launch Manager\LManager.exe" [2010-08-10 975952] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2010-08-03 9398888] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-06-16 173592] "Persistence"="c:\windows\system32\igfxpers.exe" [2010-06-16 150552] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-02-05 1692968] "PLFSetI"="c:\windows\PLFSetI.exe" [2010-11-15 206208] "Acer ePower Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2010-06-11 715296] "SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-06-16 141848] "vProt"="c:\program files\AVG Secure Search\vprot.exe" [2013-06-25 2236080] "AVG_UI"="c:\program files\AVG\AVG2013\avgui.exe" [2012-12-11 3147384] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008] "KiesTrayAgent"="c:\program files\Samsung\Kies\KiesTrayAgent.exe" [2013-03-28 310640] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816] . c:\users\xxxxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ WISO Mein Steuer-Sparbuch heute.lnk - c:\program files\WISO\Steuersoftware 2013\mshaktuell.exe [2013-6-23 1386136] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WISO Mein Steuer-Sparbuch heute.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk backup=c:\windows\pss\WISO Mein Steuer-Sparbuch heute.lnk.CommonStartup backupExtension=.CommonStartup . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM] 2012-07-27 20:51 919008 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeAAMUpdater-1.0] 2010-03-06 01:44 500208 ------w- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS5ServiceManager] 2010-02-22 02:57 406992 ----a-w- c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AndroidManager] 2010-01-08 09:47 508280 ----a-w- c:\program files\Acer\Android Manager\AML.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] 2010-03-12 11:08 49208 ----a-w- c:\program files\HP\HP Software Update\hpwuschd2.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iPatchData] 2010-11-30 02:13 489848 ----a-w- c:\program files\Acer\Updater\iUpdate.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iSyncData] 2010-01-08 09:53 407416 ----a-w- c:\program files\Acer\Android Manager\iSync.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] 2012-05-03 06:36 17355912 ----a-r- c:\program files\Skype\Phone\Skype.exe . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "IAStorIcon"=c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe "ROC_roc_dec12"="c:\program files\AVG Secure Search\ROC_roc_dec12.exe" /PROMPT /CMPID=roc_dec12 "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" . R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2012-05-03 158856] R3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\AVG\AVG10\Toolbar\ToolbarBroker.exe [2011-11-10 167264] R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [2013-02-22 83864] R3 EUCR;EUCR;c:\windows\system32\DRIVERS\EUCR6SK.SYS [2010-06-17 82768] R3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys [x] R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [x] R3 FlashUSB;FlashUSB;c:\windows\system32\DRIVERS\FlashUSB.sys [2013-01-31 16384] R3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys [x] R3 netr28u;RT2870-USB-Drahtlos-LAN-Kartentreiber für Vista;c:\windows\system32\DRIVERS\netr28u.sys [2009-07-13 657408] R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [2013-02-22 181784] R3 ssudserd;SAMSUNG Mobile USB Diagnostic Serial Port(DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudserd.sys [2013-02-22 181912] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224] R4 cvhsvc;Client Virtualization Handler;c:\program files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624] R4 GREGService;GREGService;c:\program files\Acer\Registration\GREGsvc.exe [2010-01-08 23584] R4 RS_Service;Raw Socket Service;c:\program files\Acer\Acer VCM\RS_Service.exe [2010-01-29 260640] R4 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096] R4 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2010-01-28 243232] S0 AVGIDSHX;AVGIDSHX;c:\windows\system32\DRIVERS\avgidshx.sys [2012-10-15 55776] S0 Avglogx;AVG Logging Driver;c:\windows\system32\DRIVERS\avglogx.sys [2012-09-21 177376] S0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx86.sys [2012-09-14 35552] S1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdriverx.sys [2012-10-22 179936] S1 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\avgidsshimx.sys [2012-09-21 19936] S1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx86.sys [2012-10-02 159712] S1 Avgtdix;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdix.sys [2012-09-21 164832] S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx86.sys [2013-06-25 37664] S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2013\avgidsagent.exe [2012-11-15 5814904] S2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2013\avgwdsvc.exe [2012-10-22 196664] S2 DsiWMIService;Dritek WMI Service;c:\program files\Launch Manager\dsiwmis.exe [2010-08-10 321104] S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [2010-06-11 735776] S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-06-08 13336] S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368] S2 sftlist;Application Virtualization Client;c:\program files\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776] S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2012\TuneUpUtilitiesService32.exe [2012-04-05 1529152] S2 vToolbarUpdater15.3.0;vToolbarUpdater15.3.0;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\15.3.0\ToolbarUpdater.exe [2013-06-25 1598128] S3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys [2011-05-18 40320] S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x86.sys [2010-08-24 68208] S3 NETw5s32;Intel(R) Wireless WiFi Link der Serie 5000 Adaptertreiber für Windows 7 32-Bit;c:\windows\system32\DRIVERS\NETw5s32.sys [2010-05-31 6766080] S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 579944] S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 194408] S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 21864] S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 19304] S3 sftvsa;Application Virtualization Service Agent;c:\program files\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496] S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2012\TuneUpUtilitiesDriver32.sys [2012-03-29 10064] . . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr TBS FontCache fdrespub AppIDSvc QWAVE wcncsvc . Inhalt des "geplante Tasks" Ordners . 2013-06-28 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-28 23:27] . 2013-05-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2011-04-11 21:04] . 2013-05-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2011-04-11 21:04] . 2012-04-16 c:\windows\Tasks\hpwebreg_CN0BJ221FT05JZ.job - c:\program files\HP\HP Officejet 6500 E710a-f\Bin\hpwebreg.exe [2010-06-14 14:10] . . ------- Zusätzlicher Suchlauf ------- . uStart Page = hxxp://www.myfd.com/ mStart Page = hxxp://acer.msn.com IE: Free YouTube to MP3 Converter - c:\program files\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm IE: {{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - c:\program files\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll TCP: DhcpNameServer = 192.168.1.1 Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\15.3.0\ViProtocol.dll FF - ProfilePath - c:\users\xxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\4smgwsne.default\ FF - prefs.js: browser.search.selectedEngine - FF - ExtSQL: 2013-05-19 16:11; {ACAA314B-EEBA-48e4-AD47-84E31C44796C}; c:\program files\Common Files\DVDVideoSoft\plugins\ff user_pref('extensions.autoDisableScopes', 0);user_pref('security.csp.enable', false);user_pref('security.OCSP.enabled', 0); . - - - - Entfernte verwaiste Registrierungseinträge - - - - . Toolbar-Locked - (no file) Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file) HKCU-Run-KiesAirMessage - c:\program files\Samsung\Kies\KiesAirMessage.exe HKLM-Run-DivXMediaServer - c:\program files\DivX\DivX Media Server\DivXMediaServer.exe MSConfigStartUp-Adobe Reader Speed Launcher - c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe MSConfigStartUp-EgisTecPMMUpdate - c:\program files\EgisTec IPS\PmmUpdate.exe MSConfigStartUp-EgisUpdate - c:\program files\EgisTec IPS\EgisUpdate.exe MSConfigStartUp-Norton Online Backup - c:\program files\Symantec\Norton Online Backup\NOBuClient.exe MSConfigStartUp-QuickTime Task - c:\program files\QuickTime\QTTask.exe MSConfigStartUp-WinampAgent - c:\program files\Winamp\winampa.exe AddRemove-1ClickDownload - c:\program files\hdvidcodec.com\uninst.exe AddRemove-01_Simmental - c:\program files\Samsung\USB Drivers\01_Simmental\Uninstall.exe AddRemove-02_Siberian - c:\program files\Samsung\USB Drivers\02_Siberian\Uninstall.exe AddRemove-03_Swallowtail - c:\program files\Samsung\USB Drivers\03_Swallowtail\Uninstall.exe AddRemove-04_semseyite - c:\program files\Samsung\USB Drivers\04_semseyite\Uninstall.exe AddRemove-07_Schorl - c:\program files\Samsung\USB Drivers\07_Schorl\Uninstall.exe AddRemove-09_Hsp - c:\program files\Samsung\USB Drivers\09_Hsp\Uninstall.exe AddRemove-11_HSP_Plus_Default - c:\program files\Samsung\USB Drivers\11_HSP_Plus_Default\Uninstall.exe AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe AddRemove-20_NXP_Driver - c:\program files\Samsung\USB Drivers\20_NXP_Driver\Uninstall.exe AddRemove-24_flashusbdriver - c:\program files\Samsung\USB Drivers\24_flashusbdriver\Uninstall.exe AddRemove-25_escape - c:\program files\Samsung\USB Drivers\25_escape\Uninstall.exe . . . --------------------- Gesperrte Registrierungsschluessel --------------------- . [HKEY_USERS\S-1-5-21-3192098169-3561414539-348523876-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice] @Denied: (2) (LocalSystem) "Progid"="WindowsLiveMail.Email.1" . [HKEY_USERS\S-1-5-21-3192098169-3561414539-348523876-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice] @Denied: (2) (LocalSystem) "Progid"="WindowsLiveMail.VCard.1" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Zeit der Fertigstellung: 2013-06-28 08:49:49 ComboFix-quarantined-files.txt 2013-06-28 06:49 . Vor Suchlauf: 9 Verzeichnis(se), 164.347.850.752 Bytes frei Nach Suchlauf: 17 Verzeichnis(se), 167.525.117.952 Bytes frei . - - End Of File - - E2224A41A8D85BB587F87876B695418D A36C5E4F47E84449FF07ED3517B43A31 Ausserdem wird die Seite trojaner-board nicht mehr angezeigt wie vorher z.b. ist sie nicht mehr gelb, sondern weiß. Viele Grüße Rechts unten am Bildschrim, neben der Uhr "ausgeblendete Symbole" einblenden, habe ich jetzt auch nur noch 2 Punkte, Speakers und PC-Probleme lösen... Wahscheinlich würde ich es ganz normal finden, wüsste ich was combofix so macht und was das ist |
28.06.2013, 08:14 | #6 |
/// the machine /// TB-Ausbilder | hd vid codec.com heruntergeladen. Wie entferne ich das? In welchem Brower? Wenn IE, diesen resetten. Downloade Dir bitte AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST Log bitte.
__________________ --> hd vid codec.com heruntergeladen. Wie entferne ich das? |
28.06.2013, 21:33 | #7 |
| hd vid codec.com heruntergeladen. Wie entferne ich das? und hier der Inhalt von Advware Cleaner, mit all den gelöschten Dingen. Ist da auch was dabei gewesen, was ich vielleicht noch hätte gebraucht? Code:
ATTFilter # Benutzer : xxxxx - xxxxx-PC # Bootmodus : Normal # Ausgeführt unter : C:\Users\xxxxx\Downloads\adwcleaner.exe # Option [Löschen] **** [Dienste] **** ***** [Dateien / Ordner] ***** Datei Gelöscht : C:\Program Files\Mozilla Firefox\searchplugins\avg-secure-search.xml Datei Gelöscht : C:\Users\xxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\4smgwsne.default\foxydeal.sqlite Datei Gelöscht : C:\Users\xxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\4smgwsne.default\searchplugins\aol-web-search.xml Datei Gelöscht : C:\Users\xxxxx\Desktop\HDVidCodec.lnk Gelöscht mit Neustart : C:\Program Files\Common Files\AVG Secure Search Ordner Gelöscht : C:\Program Files\AVG Secure Search Ordner Gelöscht : C:\Program Files\HDvidCodec.com Ordner Gelöscht : C:\Program Files\Movie2KDownloader.com Ordner Gelöscht : C:\ProgramData\AVG Secure Search Ordner Gelöscht : C:\ProgramData\AVG Security Toolbar Ordner Gelöscht : C:\ProgramData\boost_interprocess Ordner Gelöscht : C:\Users\xxxxx\AppData\Local\AVG Secure Search Ordner Gelöscht : C:\Users\xxxxx\AppData\Local\AVG Security Toolbar Ordner Gelöscht : C:\Users\xxxxx\AppData\LocalLow\AVG Secure Search Ordner Gelöscht : C:\Users\xxxxx\AppData\Roaming\dvdvideosoftiehelpers Ordner Gelöscht : C:\Users\xxxxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HDvidCodec.com Ordner Gelöscht : C:\Users\xxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\4smgwsne.default\jetpack Ordner Gelöscht : C:\Users\xxxxx\AppData\Roaming\OpenCandy Ordner Gelöscht : C:\Users\xxxxx\AppData\Roaming\pdfforge ***** [Registrierungsdatenbank] ***** Schlüssel Gelöscht : HKCU\Software\1ClickDownload Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\AVG Security Toolbar Schlüssel Gelöscht : HKCU\Software\AVG Secure Search Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233} Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE7E0A3-AE64-4DC8-84D1-F5D7BAF2DB0C} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706} Schlüssel Gelöscht : HKCU\Software\Softonic Schlüssel Gelöscht : HKLM\Software\AVG Secure Search Schlüssel Gelöscht : HKLM\Software\AVG Security Toolbar Schlüssel Gelöscht : HKLM\Software\Bandoo Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{1301A8A5-3DFB-4731-A162-B357D00C9644} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\BandooCore.EXE Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\secman.DLL Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj.1 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\BandooCore.BandooCore Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\BandooCore.BandooCore.1 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\BandooCore.ResourcesMngr Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\BandooCore.ResourcesMngr.1 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\BandooCore.SettingsMngr Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\BandooCore.SettingsMngr.1 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\BandooCore.StatisticMngr Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\BandooCore.StatisticMngr.1 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{02054E11-5113-4BE3-8153-AA8DFB5D3761} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{94496571-6AC5-4836-82D5-D46260C44B17} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{BC9FD17D-30F6-4464-9E53-596A90AFF023} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{06DE5702-44CF-4B79-B4EF-3DDF653358F5} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{477F210A-2A86-4666-9C4B-1189634D2C84} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FF871E51-2655-4D06-AED5-745962A96B32} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\viprotocol Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{13ABD093-D46F-40DF-A608-47E162EC799D} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{2BF2028E-3F3C-4C05-AB45-B2F1DCFE0759} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{DB538320-D3C5-433C-BCA9-C4081A054FCF} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1 Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\blaofbhgbmeikidhlkmjhbkbfohpgekf Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof Schlüssel Gelöscht : HKLM\Software\Iminent Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{424624F4-C5DD-4E1D-BDD0-1E9C9B7799CC} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7F000001-DB8E-F89C-2FEC-49BF726F8C12} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C8A3CA5-889E-4554-BEEC-EC0876E4E96A} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48D2-9061-8BBD4899EB08} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F9189560-573A-4FDE-B055-AE7B0F4CF080} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE7E0A3-AE64-4DC8-84D1-F5D7BAF2DB0C} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\IminentSetup_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\IminentSetup_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706} Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0238BBE24EA3A70408B81E4BB89C15E5 Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\29799DE249E7DBC459FC6C8F07EB8375 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG Secure Search Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchTheWebARP Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}] Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [vProt] Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{acaa314b-eeba-48e4-ad47-84e31c44796c}] Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [Avg@toolbar] ***** [Internet Browser] ***** -\\ Internet Explorer v9.0.8112.16457 [OK] Die Registrierungsdatenbank ist sauber. -\\ Mozilla Firefox v20.0.1 (de) Datei : C:\Users\xxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\4smgwsne.default\prefs.js C:\Users\xxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\4smgwsne.default\user.js ... Gelöscht ! Gelöscht : user_pref("avg.install.installDirPath", "C:\\ProgramData\\AVG Secure Search\\FireFoxExt\\15.3.0.11")[...] ************************* AdwCleaner[R1].txt - [15808 octets] - [28/06/2013 22:08:09] AdwCleaner[S1].txt - [15523 octets] - [28/06/2013 22:19:24] ########## EOF - C:\AdwCleaner[S1].txt - [15584 octets] ########## Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 4.9.4 (05.06.2013:1) OS: Windows 7 Starter x86 Ran by xxxxx on 28.06.2013 at 22:35:51,76 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\sweetim Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\sweetim ~~~ Files Successfully deleted: [File] C:\Windows\system32\sho141C.tmp Successfully deleted: [File] C:\Windows\system32\sho4C99.tmp Successfully deleted: [File] C:\Windows\system32\sho764.tmp Successfully deleted: [File] C:\Windows\system32\sho8BCA.tmp Successfully deleted: [File] "C:\Windows\system32\turegopt.exe" Successfully deleted: [File] C:\eula.1028.txt Successfully deleted: [File] C:\eula.1031.txt Successfully deleted: [File] C:\eula.1033.txt Successfully deleted: [File] C:\eula.1036.txt Successfully deleted: [File] C:\eula.1040.txt Successfully deleted: [File] C:\eula.1041.txt Successfully deleted: [File] C:\eula.1042.txt Successfully deleted: [File] C:\eula.1049.txt Successfully deleted: [File] C:\eula.2052.txt Successfully deleted: [File] C:\install.res.1028.dll Successfully deleted: [File] C:\install.res.1031.dll Successfully deleted: [File] C:\install.res.1033.dll Successfully deleted: [File] C:\install.res.1036.dll Successfully deleted: [File] C:\install.res.1040.dll Successfully deleted: [File] C:\install.res.1041.dll Successfully deleted: [File] C:\install.res.1042.dll Successfully deleted: [File] C:\install.res.1049.dll Successfully deleted: [File] C:\install.res.2052.dll Successfully deleted: [File] C:\install.res.3082.dll ~~~ Folders Successfully deleted: [Empty Folder] C:\Users\xxxxx\appdata\local\{05BC3D55-55A0-4328-BBF0-5A41FF205707} Successfully deleted: [Empty Folder] C:\Users\xxxxx\appdata\local\{1294234D-AD2B-4863-AE31-E7CF375FFB5F} Successfully deleted: [Empty Folder] C:\Users\xxxxx\appdata\local\{160D7680-B8CC-4D33-A02B-957CB81028E4} Successfully deleted: [Empty Folder] C:\Users\xxxxx\appdata\local\{49850AA7-7D65-4192-AC6D-2936F7147E45} Successfully deleted: [Empty Folder] C:\Users\xxxxx\appdata\local\{6E35FCC8-CDC2-4562-9929-DB9231AD95BF} Successfully deleted: [Empty Folder] C:\Users\xxxxx\appdata\local\{7FE3F318-F9A4-4B89-8192-526BBF618DB9} Successfully deleted: [Empty Folder] C:\Users\xxxxx\appdata\local\{802CE8AB-CC3D-4117-9025-CEC932C6ACF1} Successfully deleted: [Empty Folder] C:\Users\xxxxx\appdata\local\{BECD12FD-5462-4ED3-8331-00E1D0950287} Successfully deleted: [Empty Folder] C:\Users\xxxxx\appdata\local\{D40BD0FC-79E0-4ABB-9C6E-C1E670B27A7A} Successfully deleted: [Empty Folder] C:\Users\xxxxx\appdata\local\{D6642AFF-2065-4B22-BEEF-198B648BA599} Successfully deleted: [Empty Folder] C:\Users\xxxxx\appdata\local\{DE2E1B09-D588-4943-B01D-35E69341A71B} ~~~ FireFox Emptied folder: C:\Users\xxxxx\AppData\Roaming\mozilla\firefox\profiles\4smgwsne.default\minidumps [103 files] ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 28.06.2013 at 22:39:35,01 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 26-06-2013 02 Ran by xxxxx (administrator) on 28-06-2013 22:45:05 Running from C:\User\xxxxx\Downloads Microsoft Windows 7 Starter Service Pack 1 (X86) OS Language: German Standard Internet Explorer Version 9 Boot Mode: Normal ==================== Processes (Whitelisted) =================== (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgwdsvc.exe (Dritek System Inc.) C:\Program Files\Launch Manager\dsiwmis.exe (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe (Microsoft Corporation) C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe (TuneUp Software) C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesService32.exe (AVG Secure Search) C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.3.0\ToolbarUpdater.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation) C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe (Safer Networking Ltd.) C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (TuneUp Software) C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesApp32.exe (Dritek System Inc.) C:\Program Files\Launch Manager\LManager.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe () C:\Windows\PLFSetI.exe (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe (Dritek System Inc.) C:\Program Files\Launch Manager\LMworker.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgui.exe (Intel Corporation) C:\Windows\system32\igfxsrvc.exe (Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe (Safer Networking Limited) C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Samsung) C:\Program Files\Samsung\Kies\Kies.exe (Microsoft Corporation) C:\Windows\system32\wbem\unsecapp.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Intel Corporation) C:\Windows\system32\igfxext.exe (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Microsoft Corporation) C:\Windows\system32\wuauclt.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgcfgex.exe (Microsoft Corporation) C:\Windows\system32\cmd.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [LManager] C:\Program Files\Launch Manager\LManager.exe [975952 2010-08-10] (Dritek System Inc.) HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s [9398888 2010-08-03] (Realtek Semiconductor) HKLM\...\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [1692968 2010-02-05] (Synaptics Incorporated) HKLM\...\Run: [PLFSetI] C:\Windows\PLFSetI.exe [206208 2010-11-15] () HKLM\...\Run: [Acer ePower Management] C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [715296 2010-06-11] (Acer Incorporated) HKLM\...\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) HKLM\...\Run: [AVG_UI] "C:\Program Files\AVG\AVG2013\avgui.exe" /TRAYONLY [3147384 2012-12-11] (AVG Technologies CZ, s.r.o.) HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [919008 2012-07-27] (Adobe Systems Incorporated) HKLM\...\Run: [KiesTrayAgent] C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [310640 2013-03-28] (Samsung Electronics Co., Ltd.) HKLM\...\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" [253816 2013-03-12] (Oracle Corporation) HKCU\...\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2144088 2009-01-26] (Safer Networking Limited) HKCU\...\Run: [KiesPreload] C:\Program Files\Samsung\Kies\Kies.exe /preload [1511792 2013-03-28] (Samsung) HKCU\...\Policies\system: [disableregistrytools] 0 HKCU\...\Policies\system: [DisableTaskMgr] 0 HKU\Default\...\RunOnce: [ScrSav] C:\Program Files\Acer\Screensaver\run_Acer.exe /default [ 2010-01-15] () HKU\Default User\...\RunOnce: [ScrSav] C:\Program Files\Acer\Screensaver\run_Acer.exe /default [ 2010-01-15] () Startup: C:\Users\xxxxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> C:\Program Files\WISO\Steuersoftware 2013\mshaktuell.exe () ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.my.com/ HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://acer.msn.com BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - No File Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 FireFox: ======== FF ProfilePath: C:\Users\xxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\4smgwsne.default FF SearchEngine: user_pref("browser.search.selectedEngine", ""); FF Homepage: www.google.de FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll () FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin: @java.com/DTPlugin,version=10.21.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.21.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @videolan.org/vlc,version=2.0.3 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Extension: ProxTube - Gesperrte YouTube Videos entsperren - C:\Users\xxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\4smgwsne.default\Extensions\ich@maltegoetz.de FF Extension: speedtest - C:\Users\xxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\4smgwsne.default\Extensions\speedtest@gotomyhelp.com.xpi FF Extension: No Name - C:\Users\xxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\4smgwsne.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi ========================== Services (Whitelisted) ================= S3 AVG Security Toolbar Service; C:\Program Files\AVG\AVG10\Toolbar\ToolbarBroker.exe [167264 2011-11-10] () S2 AVGIDSAgent; C:\Program Files\AVG\AVG2013\avgidsagent.exe [5814904 2012-11-16] (AVG Technologies CZ, s.r.o.) R2 avgwd; C:\Program Files\AVG\AVG2013\avgwdsvc.exe [196664 2012-10-22] (AVG Technologies CZ, s.r.o.) R2 ePowerSvc; C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe [735776 2010-06-11] (Acer Incorporated) S4 GREGService; C:\Program Files\Acer\Registration\GREGsvc.exe [23584 2010-01-08] (Acer Incorporated) S4 RS_Service; C:\Program Files\Acer\Acer VCM\RS_Service.exe [260640 2010-01-30] (Acer Incorporated) R2 SBSDWSCService; C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.) R2 TuneUp.UtilitiesSvc; C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesService32.exe [1529152 2012-04-05] (TuneUp Software) S4 Updater Service; C:\Program Files\Acer\Acer Updater\UpdaterService.exe [243232 2010-01-29] (Acer Group) R2 vToolbarUpdater15.3.0; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.3.0\ToolbarUpdater.exe [1598128 2013-06-25] (AVG Secure Search) ==================== Drivers (Whitelisted) ==================== R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdriverx.sys [179936 2012-10-22] (AVG Technologies CZ, s.r.o. ) R0 AVGIDSHX; C:\Windows\System32\DRIVERS\avgidshx.sys [55776 2012-10-15] (AVG Technologies CZ, s.r.o. ) R1 AVGIDSShim; C:\Windows\System32\DRIVERS\avgidsshimx.sys [19936 2012-09-21] (AVG Technologies CZ, s.r.o. ) R1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [159712 2012-10-02] (AVG Technologies CZ, s.r.o.) R0 Avglogx; C:\Windows\System32\DRIVERS\avglogx.sys [177376 2012-09-21] (AVG Technologies CZ, s.r.o.) R0 Avgmfx86; C:\Windows\System32\DRIVERS\avgmfx86.sys [94048 2012-11-16] (AVG Technologies CZ, s.r.o.) R0 Avgrkx86; C:\Windows\System32\DRIVERS\avgrkx86.sys [35552 2012-09-14] (AVG Technologies CZ, s.r.o.) R1 Avgtdix; C:\Windows\System32\DRIVERS\avgtdix.sys [164832 2012-09-21] (AVG Technologies CZ, s.r.o.) R1 avgtp; C:\Windows\system32\drivers\avgtpx86.sys [37664 2013-06-25] (AVG Technologies) S3 EUCR; C:\Windows\System32\DRIVERS\EUCR6SK.SYS [82768 2010-06-17] (ENE Technology Inc.) S3 FlashUSB; C:\Windows\System32\DRIVERS\FlashUSB.sys [16384 2013-01-31] (Intel Mobile Communications) S3 netr28u; C:\Windows\System32\DRIVERS\netr28u.sys [657408 2009-07-14] (Ralink Technology Corp.) S3 ssudserd; C:\Windows\System32\DRIVERS\ssudserd.sys [181912 2013-02-22] (DEVGURU Co., LTD.(www.devguru.co.kr)) R3 TuneUpUtilitiesDrv; C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesDriver32.sys [10064 2012-03-29] (TuneUp Software) S3 catchme; \??\C:\Users\xxxxx\AppData\Local\Temp\catchme.sys [x] S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [x] S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [x] S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [x] S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-06-28 22:46 - 2013-06-28 22:46 - 00003347 ____A C:\Users\xxxxx\Downloads\JRT.txt 2013-06-28 22:39 - 2013-06-28 22:39 - 00003347 ____A C:\Users\xxxxx\Desktop\JRT.txt 2013-06-28 22:35 - 2013-06-28 22:35 - 00000000 ____D C:\Windows\ERUNT 2013-06-28 22:35 - 2013-06-28 22:35 - 00000000 ____D C:\JRT 2013-06-28 22:34 - 2013-06-28 22:34 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\xxxxx\Downloads\JRT.exe 2013-06-28 22:34 - 2013-06-28 22:34 - 00015654 ____A C:\Users\xxxxx\Downloads\AdwCleaner_nachher.txt 2013-06-28 22:19 - 2013-06-28 22:20 - 00015654 ____A C:\AdwCleaner[S1].txt 2013-06-28 22:19 - 2013-06-28 22:19 - 00015808 ____A C:\Users\xxxxx\Downloads\AdwCleaner[R1].txt 2013-06-28 22:08 - 2013-06-28 22:08 - 00015808 ____A C:\AdwCleaner[R1].txt 2013-06-28 22:07 - 2013-06-28 22:07 - 00648201 ____A C:\Users\xxxxx\Downloads\adwcleaner.exe 2013-06-28 22:04 - 2013-06-28 22:04 - 00000000 ____D C:\ComboFix 2013-06-28 08:49 - 2013-06-28 08:49 - 00016427 ____A C:\ComboFix.txt 2013-06-28 08:20 - 2011-06-26 08:45 - 00256000 ____A C:\Windows\PEV.exe 2013-06-28 08:20 - 2010-11-07 19:20 - 00208896 ____A C:\Windows\MBR.exe 2013-06-28 08:20 - 2009-04-20 06:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe 2013-06-28 08:20 - 2000-08-31 02:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe 2013-06-28 08:20 - 2000-08-31 02:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe 2013-06-28 08:20 - 2000-08-31 02:00 - 00098816 ____A C:\Windows\sed.exe 2013-06-28 08:20 - 2000-08-31 02:00 - 00080412 ____A C:\Windows\grep.exe 2013-06-28 08:20 - 2000-08-31 02:00 - 00068096 ____A C:\Windows\zip.exe 2013-06-28 08:16 - 2013-06-28 08:50 - 00000000 ____D C:\Qoobox 2013-06-28 08:15 - 2013-06-28 08:46 - 00000000 ____D C:\Windows\erdnt 2013-06-28 08:14 - 2013-06-28 08:14 - 05083661 ____R (Swearware) C:\Users\xxxxx\Downloads\ComboFix.exe 2013-06-27 21:21 - 2013-06-27 22:25 - 00018242 ____A C:\Users\xxxxx\Downloads\Addition.txt 2013-06-27 21:16 - 2013-06-27 21:17 - 00000000 ____D C:\Users\xxxxx\Desktop\Desktop1 2013-06-27 21:16 - 2013-06-27 21:16 - 00000000 ____D C:\FRST 2013-06-27 21:11 - 2013-06-27 21:11 - 01370369 ____A (Farbar) C:\Users\xxxxx\Downloads\FRST.exe 2013-06-27 09:07 - 2013-06-27 09:07 - 00000000 ____D C:\Users\xxxxx\Desktop\Neuer Ordner 2013-06-27 09:00 - 2013-06-27 09:04 - 565470125 ____A C:\Users\xxxxx\Downloads\Online-System_Vers.6.44.0.exe 2013-06-23 17:17 - 2013-06-23 17:17 - 00002005 ____A C:\Users\xxxxx\Desktop\WISO Steuer-Sparbuch 2013.lnk 2013-06-23 17:12 - 2013-06-23 17:12 - 00000000 ____D C:\Users\xxxxx\AppData\Roaming\InstallShield Installation Information ==================== One Month Modified Files and Folders ======== 2013-06-28 22:46 - 2013-06-28 22:46 - 00003347 ____A C:\Users\xxxxx\Downloads\JRT.txt 2013-06-28 22:39 - 2013-06-28 22:39 - 00003347 ____A C:\Users\xxxxx\Desktop\JRT.txt 2013-06-28 22:35 - 2013-06-28 22:35 - 00000000 ____D C:\Windows\ERUNT 2013-06-28 22:35 - 2013-06-28 22:35 - 00000000 ____D C:\JRT 2013-06-28 22:34 - 2013-06-28 22:34 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\xxxxx\Downloads\JRT.exe 2013-06-28 22:34 - 2013-06-28 22:34 - 00015654 ____A C:\Users\xxxxx\Downloads\AdwCleaner_nachher.txt 2013-06-28 22:33 - 2009-07-14 06:34 - 00009696 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-06-28 22:33 - 2009-07-14 06:34 - 00009696 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-06-28 22:27 - 2012-04-28 19:03 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-06-28 22:25 - 2013-02-24 10:45 - 00010014 ____A C:\Windows\setupact.log 2013-06-28 22:25 - 2009-07-14 06:53 - 00000006 ___AH C:\Windows\Tasks\SA.DAT 2013-06-28 22:23 - 2010-11-15 19:54 - 01652226 ____A C:\Windows\WindowsUpdate.log 2013-06-28 22:20 - 2013-06-28 22:19 - 00015654 ____A C:\AdwCleaner[S1].txt 2013-06-28 22:20 - 2011-12-13 12:24 - 00000000 ____D C:\Program Files\Common Files\AVG Secure Search 2013-06-28 22:19 - 2013-06-28 22:19 - 00015808 ____A C:\Users\xxxxx\Downloads\AdwCleaner[R1].txt 2013-06-28 22:08 - 2013-06-28 22:08 - 00015808 ____A C:\AdwCleaner[R1].txt 2013-06-28 22:07 - 2013-06-28 22:07 - 00648201 ____A C:\Users\xxxxx\Downloads\adwcleaner.exe 2013-06-28 22:04 - 2013-06-28 22:04 - 00000000 ____D C:\ComboFix 2013-06-28 21:49 - 2011-06-09 17:19 - 00000000 ____D C:\ProgramData\MFAData 2013-06-28 21:38 - 2013-03-25 23:30 - 00001430 ____A C:\Windows\PFRO.log 2013-06-28 08:50 - 2013-06-28 08:16 - 00000000 ____D C:\Qoobox 2013-06-28 08:49 - 2013-06-28 08:49 - 00016427 ____A C:\ComboFix.txt 2013-06-28 08:49 - 2009-07-14 04:37 - 00000000 ___RD C:\users\Public 2013-06-28 08:46 - 2013-06-28 08:15 - 00000000 ____D C:\Windows\erdnt 2013-06-28 08:43 - 2009-07-14 04:04 - 00000215 ____A C:\Windows\system.ini 2013-06-28 08:14 - 2013-06-28 08:14 - 05083661 ____R (Swearware) C:\Users\xxxxx\Downloads\ComboFix.exe 2013-06-27 22:25 - 2013-06-27 21:21 - 00018242 ____A C:\Users\xxxxx\Downloads\Addition.txt 2013-06-27 21:17 - 2013-06-27 21:16 - 00000000 ____D C:\Users\xxxxx\Desktop\Desktop1 2013-06-27 21:16 - 2013-06-27 21:16 - 00000000 ____D C:\FRST 2013-06-27 21:11 - 2013-06-27 21:11 - 01370369 ____A (Farbar) C:\Users\xxxxx\Downloads\FRST.exe 2013-06-27 09:07 - 2013-06-27 09:07 - 00000000 ____D C:\Users\xxxxx\Desktop\Neuer Ordner 2013-06-27 09:04 - 2013-06-27 09:00 - 565470125 ____A C:\Users\xxxxx\Downloads\Online-System_Vers.6.44.0.exe 2013-06-27 00:00 - 2012-04-18 00:11 - 00000000 ____D C:\Users\xxxxx\AppData\Local\PokerStars.NET 2013-06-25 22:01 - 2012-08-30 22:37 - 00037664 ____A (AVG Technologies) C:\Windows\System32\Drivers\avgtpx86.sys 2013-06-23 17:18 - 2012-07-31 13:46 - 00000966 ____A C:\Windows\wiso.ini 2013-06-23 17:17 - 2013-06-23 17:17 - 00002005 ____A C:\Users\xxxxx\Desktop\WISO Steuer-Sparbuch 2013.lnk 2013-06-23 17:17 - 2012-07-31 13:46 - 00000000 ____D C:\Users\xxxxx\AppData\Local\Buhl 2013-06-23 17:12 - 2013-06-23 17:12 - 00000000 ____D C:\Users\xxxxx\AppData\Roaming\InstallShield Installation Information 2013-06-23 17:12 - 2012-07-31 13:35 - 00000000 ____D C:\Program Files\WISO 2013-06-18 01:27 - 2012-04-28 19:03 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe 2013-06-18 01:27 - 2011-07-28 12:15 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl 2013-06-17 00:51 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\NDF 2013-06-15 06:53 - 2012-04-12 22:20 - 00000000 ____D C:\Users\xxxxx\.compeople 2013-06-15 06:53 - 2012-03-04 00:26 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy 2013-06-15 06:53 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\wfp 2013-06-15 06:53 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\DriverStore 2013-06-15 06:53 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\registration 2013-06-15 06:53 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\AppCompat 2013-06-15 06:49 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\LogFiles 2013-06-14 20:55 - 2011-04-08 09:26 - 00000000 ____D C:\users\xxxxx ==================== Bamital & volsnap Check ================= C:\Windows\explorer.exe => MD5 is legit C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-06-23 01:17 ==================== End Of Log ============================ --- --- --- |
29.06.2013, 08:29 | #8 |
/// the machine /// TB-Ausbilder | hd vid codec.com heruntergeladen. Wie entferne ich das? Nö das war alles Adware. ESET Online Scanner
Downloade Dir bitte SecurityCheck und:
und ein frisches FRST Log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
02.07.2013, 06:42 | #9 |
| hd vid codec.com heruntergeladen. Wie entferne ich das? das dauert noch, Eset ist seit ca. 10 Stunden beschäftigt. Sicher dass der scant und nicht kopiert? |
02.07.2013, 08:01 | #10 |
/// the machine /// TB-Ausbilder | hd vid codec.com heruntergeladen. Wie entferne ich das? Hehe, ja
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
05.07.2013, 06:48 | #11 |
| hd vid codec.com heruntergeladen. Wie entferne ich das? Hallo,hat leider etwas gedauert und kam dann auch nicht gleich dazu es zu posten, hat aber eine Adware (Trojaner???): Eset: Code:
ATTFilter martInstaller@High as downloader log: all ok # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6920 # api_version=3.0.2 # EOSSerial=492dcfd9335a404ea6b35bf39da0d42e # engine=14224 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=false # unsafe_checked=false # antistealth_checked=true # utc_time=2013-07-02 10:29:53 # local_time=2013-07-03 12:29:53 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=1039 16777213 100 99 100481 59938177 0 0 # compatibility_mode=5893 16776574 100 94 37283974 124435384 0 0 # scanned=138340 # found=1 # cleaned=0 # scan_time=10895 sh=A4550164D62D167BFA860A3AAE1D71967E3E190A ft=1 fh=a37de8242b1cfc91 vn="Win32/Adware.1ClickDownload.W application" ac=I fn="C:\Users\stewo\Downloads\codec_pack_firefox_source.exe" Code:
ATTFilter Results of screen317's Security Check version 0.99.68 Windows 7 Service Pack 1 x86 (UAC is enabled) Internet Explorer 10 ``````````````Antivirus/Firewall Check:`````````````` AVG AntiVirus Free Edition 2013 Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` Spybot - Search & Destroy TuneUp Utilities 2012 TuneUp Utilities Language Pack (de-DE) CCleaner Java 7 Update 21 Java version out of Date! Adobe Flash Player 11.7.700.224 Adobe Reader 10.1.4 Adobe Reader out of Date! Mozilla Firefox 20.0.1 Firefox out of Date! ````````Process Check: objlist.exe by Laurent```````` AVG avgwdsvc.exe AVG avgrsx.exe AVG avgnsx.exe AVG avgemc.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` |
05.07.2013, 09:32 | #12 |
/// the machine /// TB-Ausbilder | hd vid codec.com heruntergeladen. Wie entferne ich das? Den angemeckerten Download löschen. Java, Adobe und Firefox updaten. Frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
05.07.2013, 23:55 | #13 |
| hd vid codec.com heruntergeladen. Wie entferne ich das? FRST LOG vor dem ich den Download gelöscht habe und die drei Sachen Up to Date brahcte. FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 26-06-2013 02 (ATTENTION: FRST version is 9 days old) Ran by xxxxx (administrator) on 05-07-2013 08:05:11 Running from C:\Users\xxxxx\Downloads Microsoft Windows 7 Starter Service Pack 1 (X86) OS Language: German Standard Internet Explorer Version 9 Boot Mode: Normal ==================== Processes (Whitelisted) =================== (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgwdsvc.exe (Dritek System Inc.) C:\Program Files\Launch Manager\dsiwmis.exe (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe (Microsoft Corporation) C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe (TuneUp Software) C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesService32.exe (AVG Secure Search) C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.3.0\ToolbarUpdater.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Dritek System Inc.) C:\Program Files\Launch Manager\LManager.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Intel Corporation) C:\Windows\system32\igfxsrvc.exe () C:\Windows\PLFSetI.exe (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgui.exe (Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe (Safer Networking Limited) C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Samsung) C:\Program Files\Samsung\Kies\Kies.exe (Dritek System Inc.) C:\Program Files\Launch Manager\LMworker.exe (TuneUp Software) C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesApp32.exe (Microsoft Corporation) C:\Windows\system32\wbem\unsecapp.exe (Intel Corporation) C:\Windows\system32\igfxext.exe (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe (Microsoft Corporation) C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Microsoft Corporation) C:\Windows\system32\wuauclt.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgcfgex.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgidsagent.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgemcx.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgnsx.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgrsx.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgcsrvx.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe (Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe (Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [LManager] C:\Program Files\Launch Manager\LManager.exe [975952 2010-08-10] (Dritek System Inc.) HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s [9398888 2010-08-03] (Realtek Semiconductor) HKLM\...\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [1692968 2010-02-05] (Synaptics Incorporated) HKLM\...\Run: [PLFSetI] C:\Windows\PLFSetI.exe [206208 2010-11-15] () HKLM\...\Run: [Acer ePower Management] C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [715296 2010-06-11] (Acer Incorporated) HKLM\...\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) HKLM\...\Run: [AVG_UI] "C:\Program Files\AVG\AVG2013\avgui.exe" /TRAYONLY [3147384 2012-12-11] (AVG Technologies CZ, s.r.o.) HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [919008 2012-07-27] (Adobe Systems Incorporated) HKLM\...\Run: [KiesTrayAgent] C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [310640 2013-03-28] (Samsung Electronics Co., Ltd.) HKLM\...\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" [253816 2013-03-12] (Oracle Corporation) HKCU\...\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2144088 2009-01-26] (Safer Networking Limited) HKCU\...\Run: [KiesPreload] C:\Program Files\Samsung\Kies\Kies.exe /preload [1511792 2013-03-28] (Samsung) HKCU\...\Policies\system: [disableregistrytools] 0 HKCU\...\Policies\system: [DisableTaskMgr] 0 HKU\Default\...\RunOnce: [ScrSav] C:\Program Files\Acer\Screensaver\run_Acer.exe /default [ 2010-01-15] () HKU\Default User\...\RunOnce: [ScrSav] C:\Program Files\Acer\Screensaver\run_Acer.exe /default [ 2010-01-15] () Startup: C:\Users\xxxxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> C:\Program Files\WISO\Steuersoftware 2013\mshaktuell.exe () ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.my.com/ HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://acer.msn.com BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - No File Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 FireFox: ======== FF ProfilePath: C:\Users\xxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\4smgwsne.default FF SearchEngine: user_pref("browser.search.selectedEngine", ""); FF Homepage: www.google.de FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll () FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin: @java.com/DTPlugin,version=10.21.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.21.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @videolan.org/vlc,version=2.0.3 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Extension: ProxTube - Gesperrte YouTube Videos entsperren - C:\Users\xxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\4smgwsne.default\Extensions\ich@maltegoetz.de FF Extension: speedtest - C:\Users\xxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\4smgwsne.default\Extensions\speedtest@gotomyhelp.com.xpi FF Extension: No Name - C:\Users\xxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\4smgwsne.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi ========================== Services (Whitelisted) ================= S3 AVG Security Toolbar Service; C:\Program Files\AVG\AVG10\Toolbar\ToolbarBroker.exe [167264 2011-11-10] () R2 AVGIDSAgent; C:\Program Files\AVG\AVG2013\avgidsagent.exe [5814904 2012-11-16] (AVG Technologies CZ, s.r.o.) R2 avgwd; C:\Program Files\AVG\AVG2013\avgwdsvc.exe [196664 2012-10-22] (AVG Technologies CZ, s.r.o.) R2 ePowerSvc; C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe [735776 2010-06-11] (Acer Incorporated) S4 GREGService; C:\Program Files\Acer\Registration\GREGsvc.exe [23584 2010-01-08] (Acer Incorporated) S4 RS_Service; C:\Program Files\Acer\Acer VCM\RS_Service.exe [260640 2010-01-30] (Acer Incorporated) S2 SBSDWSCService; C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.) R2 TuneUp.UtilitiesSvc; C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesService32.exe [1529152 2012-04-05] (TuneUp Software) S4 Updater Service; C:\Program Files\Acer\Acer Updater\UpdaterService.exe [243232 2010-01-29] (Acer Group) R2 vToolbarUpdater15.3.0; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.3.0\ToolbarUpdater.exe [1598128 2013-06-25] (AVG Secure Search) ==================== Drivers (Whitelisted) ==================== R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdriverx.sys [179936 2012-10-22] (AVG Technologies CZ, s.r.o. ) R0 AVGIDSHX; C:\Windows\System32\DRIVERS\avgidshx.sys [55776 2012-10-15] (AVG Technologies CZ, s.r.o. ) R1 AVGIDSShim; C:\Windows\System32\DRIVERS\avgidsshimx.sys [19936 2012-09-21] (AVG Technologies CZ, s.r.o. ) R1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [159712 2012-10-02] (AVG Technologies CZ, s.r.o.) R0 Avglogx; C:\Windows\System32\DRIVERS\avglogx.sys [177376 2012-09-21] (AVG Technologies CZ, s.r.o.) R0 Avgmfx86; C:\Windows\System32\DRIVERS\avgmfx86.sys [94048 2012-11-16] (AVG Technologies CZ, s.r.o.) R0 Avgrkx86; C:\Windows\System32\DRIVERS\avgrkx86.sys [35552 2012-09-14] (AVG Technologies CZ, s.r.o.) R1 Avgtdix; C:\Windows\System32\DRIVERS\avgtdix.sys [164832 2012-09-21] (AVG Technologies CZ, s.r.o.) R1 avgtp; C:\Windows\system32\drivers\avgtpx86.sys [37664 2013-06-25] (AVG Technologies) S3 EUCR; C:\Windows\System32\DRIVERS\EUCR6SK.SYS [82768 2010-06-17] (ENE Technology Inc.) S3 FlashUSB; C:\Windows\System32\DRIVERS\FlashUSB.sys [16384 2013-01-31] (Intel Mobile Communications) S3 netr28u; C:\Windows\System32\DRIVERS\netr28u.sys [657408 2009-07-14] (Ralink Technology Corp.) S3 ssudserd; C:\Windows\System32\DRIVERS\ssudserd.sys [181912 2013-02-22] (DEVGURU Co., LTD.(www.devguru.co.kr)) R3 TuneUpUtilitiesDrv; C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesDriver32.sys [10064 2012-03-29] (TuneUp Software) S3 catchme; \??\C:\Users\xxxxx\AppData\Local\Temp\catchme.sys [x] S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [x] S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [x] S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [x] S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-07-05 07:51 - 2013-07-05 07:51 - 00890988 ____A C:\Users\xxxxx\Downloads\SecurityCheck.exe 2013-07-01 21:24 - 2013-07-01 21:24 - 02347384 ____A (ESET) C:\Users\xxxxx\Downloads\esetsmartinstaller_enu.exe 2013-06-28 22:51 - 2013-06-28 22:51 - 00019774 ____A C:\Users\xxxxx\Downloads\FRST2.txt 2013-06-28 22:46 - 2013-06-28 22:46 - 00003347 ____A C:\Users\xxxxx\Downloads\JRT.txt 2013-06-28 22:39 - 2013-06-28 22:39 - 00003347 ____A C:\Users\xxxxx\Desktop\JRT.txt 2013-06-28 22:35 - 2013-06-28 22:35 - 00000000 ____D C:\Windows\ERUNT 2013-06-28 22:35 - 2013-06-28 22:35 - 00000000 ____D C:\JRT 2013-06-28 22:34 - 2013-06-28 22:34 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\xxxxx\Downloads\JRT.exe 2013-06-28 22:34 - 2013-06-28 22:34 - 00015654 ____A C:\Users\xxxxx\Downloads\AdwCleaner_nachher.txt 2013-06-28 22:19 - 2013-06-28 22:20 - 00015654 ____A C:\AdwCleaner[S1].txt 2013-06-28 22:19 - 2013-06-28 22:19 - 00015808 ____A C:\Users\xxxxx\Downloads\AdwCleaner[R1].txt 2013-06-28 22:08 - 2013-06-28 22:08 - 00015808 ____A C:\AdwCleaner[R1].txt 2013-06-28 22:07 - 2013-06-28 22:07 - 00648201 ____A C:\Users\xxxxx\Downloads\adwcleaner.exe 2013-06-28 22:04 - 2013-06-28 22:04 - 00000000 ____D C:\ComboFix 2013-06-28 08:49 - 2013-06-28 08:49 - 00016427 ____A C:\ComboFix.txt 2013-06-28 08:20 - 2011-06-26 08:45 - 00256000 ____A C:\Windows\PEV.exe 2013-06-28 08:20 - 2010-11-07 19:20 - 00208896 ____A C:\Windows\MBR.exe 2013-06-28 08:20 - 2009-04-20 06:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe 2013-06-28 08:20 - 2000-08-31 02:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe 2013-06-28 08:20 - 2000-08-31 02:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe 2013-06-28 08:20 - 2000-08-31 02:00 - 00098816 ____A C:\Windows\sed.exe 2013-06-28 08:20 - 2000-08-31 02:00 - 00080412 ____A C:\Windows\grep.exe 2013-06-28 08:20 - 2000-08-31 02:00 - 00068096 ____A C:\Windows\zip.exe 2013-06-28 08:16 - 2013-06-28 08:50 - 00000000 ____D C:\Qoobox 2013-06-28 08:15 - 2013-06-28 08:46 - 00000000 ____D C:\Windows\erdnt 2013-06-28 08:14 - 2013-06-28 08:14 - 05083661 ____R (Swearware) C:\Users\xxxxx\Downloads\ComboFix.exe 2013-06-27 21:21 - 2013-06-27 22:25 - 00018242 ____A C:\Users\xxxxx\Downloads\Addition.txt 2013-06-27 21:16 - 2013-06-27 21:17 - 00000000 ____D C:\Users\xxxxx\Desktop\Desktop1 2013-06-27 21:16 - 2013-06-27 21:16 - 00000000 ____D C:\FRST 2013-06-27 21:11 - 2013-06-27 21:11 - 01370369 ____A (Farbar) C:\Users\xxxxx\Downloads\FRST.exe 2013-06-27 09:07 - 2013-06-27 09:07 - 00000000 ____D C:\Users\xxxxx\Desktop\Neuer Ordner 2013-06-27 09:00 - 2013-06-27 09:04 - 565470125 ____A C:\Users\xxxxx\Downloads\System_Vers.6.44.0.exe 2013-06-23 17:17 - 2013-06-23 17:17 - 00002005 ____A C:\Users\xxxxx\Desktop\WISO Steuer-Sparbuch 2013.lnk 2013-06-23 17:12 - 2013-06-23 17:12 - 00000000 ____D C:\Users\xxxxx\AppData\Roaming\InstallShield Installation Information ==================== One Month Modified Files and Folders ======== 2013-07-05 07:51 - 2013-07-05 07:51 - 00890988 ____A C:\Users\xxxxx\Downloads\SecurityCheck.exe 2013-07-05 07:41 - 2010-11-15 19:54 - 01746647 ____A C:\Windows\WindowsUpdate.log 2013-07-05 07:34 - 2011-06-09 17:19 - 00000000 ____D C:\ProgramData\MFAData 2013-07-05 07:29 - 2012-04-28 19:03 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-07-03 00:05 - 2013-02-24 10:45 - 00010294 ____A C:\Windows\setupact.log 2013-07-02 22:53 - 2010-09-17 08:37 - 01500018 ____A C:\Windows\System32\PerfStringBackup.INI 2013-07-01 21:40 - 2012-04-18 00:11 - 00000000 ____D C:\Users\xxxxx\AppData\Local\PokerStars.NET 2013-07-01 21:24 - 2013-07-01 21:24 - 02347384 ____A (ESET) C:\Users\xxxxx\Downloads\esetsmartinstaller_enu.exe 2013-07-01 20:33 - 2009-07-14 06:34 - 00009696 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-07-01 20:33 - 2009-07-14 06:34 - 00009696 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-07-01 20:24 - 2009-07-14 06:53 - 00000006 ___AH C:\Windows\Tasks\SA.DAT 2013-06-28 22:51 - 2013-06-28 22:51 - 00019774 ____A C:\Users\xxxxx\Downloads\FRST2.txt 2013-06-28 22:46 - 2013-06-28 22:46 - 00003347 ____A C:\Users\xxxxx\Downloads\JRT.txt 2013-06-28 22:39 - 2013-06-28 22:39 - 00003347 ____A C:\Users\xxxxx\Desktop\JRT.txt 2013-06-28 22:35 - 2013-06-28 22:35 - 00000000 ____D C:\Windows\ERUNT 2013-06-28 22:35 - 2013-06-28 22:35 - 00000000 ____D C:\JRT 2013-06-28 22:34 - 2013-06-28 22:34 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\xxxxx\Downloads\JRT.exe 2013-06-28 22:34 - 2013-06-28 22:34 - 00015654 ____A C:\Users\xxxxx\Downloads\AdwCleaner_nachher.txt 2013-06-28 22:20 - 2013-06-28 22:19 - 00015654 ____A C:\AdwCleaner[S1].txt 2013-06-28 22:20 - 2011-12-13 12:24 - 00000000 ____D C:\Program Files\Common Files\AVG Secure Search 2013-06-28 22:19 - 2013-06-28 22:19 - 00015808 ____A C:\Users\xxxxx\Downloads\AdwCleaner[R1].txt 2013-06-28 22:08 - 2013-06-28 22:08 - 00015808 ____A C:\AdwCleaner[R1].txt 2013-06-28 22:07 - 2013-06-28 22:07 - 00648201 ____A C:\Users\xxxxx\Downloads\adwcleaner.exe 2013-06-28 22:04 - 2013-06-28 22:04 - 00000000 ____D C:\ComboFix 2013-06-28 21:38 - 2013-03-25 23:30 - 00001430 ____A C:\Windows\PFRO.log 2013-06-28 08:50 - 2013-06-28 08:16 - 00000000 ____D C:\Qoobox 2013-06-28 08:49 - 2013-06-28 08:49 - 00016427 ____A C:\ComboFix.txt 2013-06-28 08:49 - 2009-07-14 04:37 - 00000000 ___RD C:\users\Public 2013-06-28 08:46 - 2013-06-28 08:15 - 00000000 ____D C:\Windows\erdnt 2013-06-28 08:43 - 2009-07-14 04:04 - 00000215 ____A C:\Windows\system.ini 2013-06-28 08:14 - 2013-06-28 08:14 - 05083661 ____R (Swearware) C:\Users\xxxxx\Downloads\ComboFix.exe 2013-06-27 22:25 - 2013-06-27 21:21 - 00018242 ____A C:\Users\xxxxx\Downloads\Addition.txt 2013-06-27 21:17 - 2013-06-27 21:16 - 00000000 ____D C:\Users\xxxxx\Desktop\Desktop1 2013-06-27 21:16 - 2013-06-27 21:16 - 00000000 ____D C:\FRST 2013-06-27 21:11 - 2013-06-27 21:11 - 01370369 ____A (Farbar) C:\Users\xxxxx\Downloads\FRST.exe 2013-06-27 09:07 - 2013-06-27 09:07 - 00000000 ____D C:\Users\xxxxx\Desktop\Neuer Ordner 2013-06-27 09:04 - 2013-06-27 09:00 - 565470125 ____A C:\Users\xxxxx\Downloads\System_Vers.6.44.0.exe 2013-06-25 22:01 - 2012-08-30 22:37 - 00037664 ____A (AVG Technologies) C:\Windows\System32\Drivers\avgtpx86.sys 2013-06-23 17:18 - 2012-07-31 13:46 - 00000966 ____A C:\Windows\wiso.ini 2013-06-23 17:17 - 2013-06-23 17:17 - 00002005 ____A C:\Users\xxxxx\Desktop\WISO Steuer-Sparbuch 2013.lnk 2013-06-23 17:17 - 2012-07-31 13:46 - 00000000 ____D C:\Users\xxxxx\AppData\Local\Buhl 2013-06-23 17:12 - 2013-06-23 17:12 - 00000000 ____D C:\Users\xxxxx\AppData\Roaming\InstallShield Installation Information 2013-06-23 17:12 - 2012-07-31 13:35 - 00000000 ____D C:\Program Files\WISO 2013-06-18 01:27 - 2012-04-28 19:03 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe 2013-06-18 01:27 - 2011-07-28 12:15 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl 2013-06-17 00:51 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\NDF 2013-06-15 06:53 - 2012-04-12 22:20 - 00000000 ____D C:\Users\xxxxx\.compeople 2013-06-15 06:53 - 2012-03-04 00:26 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy 2013-06-15 06:53 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\wfp 2013-06-15 06:53 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\DriverStore 2013-06-15 06:53 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\registration 2013-06-15 06:53 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\AppCompat 2013-06-15 06:49 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\LogFiles 2013-06-14 20:55 - 2011-04-08 09:26 - 00000000 ____D C:\users\xxxxx ==================== Bamital & volsnap Check ================= C:\Windows\explorer.exe => MD5 is legit C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-07-03 01:24 ==================== End Of Log ============================ --- --- --- wie kann man den eigentlich in diesem forum seine beiträge nochmal korriegieren? z. B. bei Schreibfehlern? |
06.07.2013, 08:59 | #14 |
/// the machine /// TB-Ausbilder | hd vid codec.com heruntergeladen. Wie entferne ich das? NUr die erste Stunde. Wir sind fertig Die Reihenfolge ist hier entscheidend.
Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
Themen zu hd vid codec.com heruntergeladen. Wie entferne ich das? |
compu, computer, download, ebook, entferne, fehlermeldung, forum, frage, geholfen, google, hallo zusammen, hdvidcodec.com, hoffnung, keine fehlermeldung, löschen, monate, nicht mehr, notebook, problem, programm, virenprogramm, virus, woche, zusammen, ähnliches |