Logfile bezüglich des Anchor.hss

electrostep · 29.06.2013, 10:50

Ich hoffe, dass ich das richtige Poste und nicht das ich in ein Unterforum müsste???

Nun ja, ich habe gestern bzw. heute Nacht meinen Spybot laufen lassen und habe die Meldung bekommen, dass ich dieses anchor-hss auf meinem Laptop habe.

Hab´s gegoogelt und bin auf eure Seite gestoßen und da der Fall schon einmal bei euch beschrieben wurde und ich bis zum Punkt Eset Smartinstaller und SecurityCheck alles befolgt habe ist mir aufgefallen, dass diese Logfiles ja spezifisches für jeden PC bzw. für jeden Recher sind (was ich erst zur späteren Stunde verstanden habe

) und ich beim nächsten Punkt, dass man TFC runterladen und den Code von der Box einfügen solle, ich gar nicht weiß, was ich da überhaupt löschen soll... Daher wollte ich hier mal meine Logfiles einfügen:

Logfile von ESET Online Scanner:

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=9100b45e26a1a24da64bd2ef68087bb9
# engine=14194
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-06-29 09:27:55
# local_time=2013-06-29 11:27:55 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=1039 16777213 100 92 56805 59632059 0 0
# compatibility_mode=5892 16776574 100 100 32920857 210030803 0 0
# scanned=194254
# found=1
# cleaned=0
# scan_time=7127
sh=9FA5CDE80424CBA9CC88A8DAA305320EB2DD553C ft=0 fh=0000000000000000 vn="a variant of Java/TrojanDownloader.Agent.NAB trojan" ac=I fn="C:\Users\Fatih\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6\4d64fe86-323d7150"

Textdokument von SecurityCheck:

Results of screen317's Security Check version 0.99.68
Windows Vista Service Pack 2 x86 (UAC is enabled)
Internet Explorer 9
``````````````Antivirus/Firewall Check:``````````````
AVG AntiVirus Free Edition 2013
Antivirus up to date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
CCleaner
JavaFX 2.1.1
Java(TM) 6 Update 30
Java 7 Update 21
Java(TM) 6 Update 2
Java version out of Date!
Adobe Flash Player 10 Flash Player out of Date!
Adobe Flash Player 11.7.700.224
Adobe Reader 8 Adobe Reader out of Date!
Mozilla Firefox 21.0 Firefox out of Date!
````````Process Check: objlist.exe by Laurent````````
AVG avgwdsvc.exe
AVG avgrsx.exe
AVG avgnsx.exe
AVG avgemc.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: %
````````````````````End of Log``````````````````````

frisches FRST Log:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 27-06-2013
Ran by Fatih (administrator) on 29-06-2013 11:46:32
Running from C:\Users\Fatih\Downloads
Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(AVG Technologies CZ, s.r.o.) C:\PROGRA~1\AVG\AVG2013\avgrsx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgcsrvx.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(Cisco Systems, Inc.) C:\Program Files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe
(Lexmark International, Inc.) C:\Windows\System32\LEXBCES.EXE
(Lexmark International, Inc.) C:\Windows\System32\LEXPPS.EXE
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgwdsvc.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
() C:\Windows\system32\PnkBstrA.exe
() C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
() C:\Program Files\CyberLink\Shared Files\RichVideo.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Conexant Systems, Inc.) C:\Windows\system32\DRIVERS\xaudio.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgnsx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgemcx.exe
(Hewlett-Packard) c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgcsrvx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgui.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe" [181544 2007-09-30] (CyberLink Corp.)
HKLM\...\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start [202032 2007-09-19] ( Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [OnScreenDisplay] C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe [554320 2007-09-04] ( Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0" [218408 2007-08-17] (CyberLink Corp.)
HKLM\...\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [49152 2005-02-17] (Hewlett-Packard Co.)
HKLM\...\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe [311296 2007-01-08] (Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart [86016 2007-09-19] (NVIDIA Corporation)
HKLM\...\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup [8497696 2007-09-19] (NVIDIA Corporation)
HKLM\...\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit [81920 2007-09-19] (NVIDIA Corporation)
HKLM\...\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [40368 2011-08-31] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [937920 2011-03-29] (Adobe Systems Incorporated)
HKLM\...\Run: [AVG_UI] "C:\Program Files\AVG\AVG2013\avgui.exe" /TRAYONLY [4408368 2013-04-29] (AVG Technologies CZ, s.r.o.)
HKLM\...\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" [253816 2013-03-12] (Oracle Corporation)
HKCU\...\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
HKCU\...\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun [357696 2010-04-01] (DT Soft Ltd)
HKCU\...\Policies\system: [DisableRegistryTools] 0
HKCU\...\Policies\system: [DisableTaskMgr] 0
HKU\Default\...\Run: [HPADVISOR] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autoRun [ 2007-10-01] (Hewlett-Packard)
HKU\Default User\...\Run: [HPADVISOR] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autoRun [ 2007-10-01] (Hewlett-Packard)
Startup: C:\ProgramData\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.0.318\SSScheduler.exe (McAfee, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} hxxp://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} hxxp://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
DPF: {5D6F45B3-9043-443D-A792-115447494D24} hxxp://messenger.zone.msn.com/DE-DE/a-UNO1/GAME_UNO1.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} hxxp://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} https://secure.gopetslive.com/dev/GoPetsWeb.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll No File
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Fatih\AppData\Roaming\Mozilla\Firefox\Profiles\2chizomu.default
FF Homepage: https://www.google.de/
FF NetworkProxy: "no_proxies_on", "localhost, 127.0.0.1, stealthy.co"
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF Plugin: @divx.com/DivX Player Plugin,version=1.0.0 - C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF Plugin: @java.com/DTPlugin,version=10.21.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.21.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Extension: No Name - C:\Users\Fatih\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
FF Extension: Microsoft .NET Framework Assistant - C:\Users\Fatih\AppData\Roaming\Mozilla\Firefox\Profiles\2chizomu.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF Extension: TabScroller - C:\Users\Fatih\AppData\Roaming\Mozilla\Firefox\Profiles\2chizomu.default\Extensions\{DDD48E21-B5C2-46da-9EAE-E2046AD5CC9E}
FF Extension: No Name - C:\Users\Fatih\AppData\Roaming\Mozilla\Firefox\Profiles\2chizomu.default\Extensions\{E6C1199F-E687-42da-8C24-E7770CC3AE66}.xpi
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF HKLM\...\Mozilla Firefox 21.0\Extensions: [Components] C:\Program Files\Mozilla Firefox\components
FF Extension: No Name - C:\Program Files\Mozilla Firefox\components
FF HKLM\...\Mozilla Firefox 21.0\Extensions: [Plugins] C:\Program Files\Mozilla Firefox\plugins
FF Extension: No Name - C:\Program Files\Mozilla Firefox\plugins
FF HKCU\...\Mozilla Firefox 21.0\Extensions: [Components] C:\Program Files\Mozilla Firefox\components
FF Extension: No Name - C:\Program Files\Mozilla Firefox\components
FF HKCU\...\Mozilla Firefox 21.0\Extensions: [Plugins] C:\Program Files\Mozilla Firefox\plugins
FF Extension: No Name - C:\Program Files\Mozilla Firefox\plugins

========================== Services (Whitelisted) =================

R2 AVGIDSAgent; C:\Program Files\AVG\AVG2013\avgidsagent.exe [4937264 2013-05-14] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files\AVG\AVG2013\avgwdsvc.exe [283136 2013-04-18] (AVG Technologies CZ, s.r.o.)
S3 Com4Qlb; C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe [110592 2007-03-05] (Hewlett-Packard Development Company, L.P.)
R2 HP Health Check Service; c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [65536 2007-09-19] (Hewlett-Packard)
R2 LexBceS; C:\Windows\System32\LEXBCES.EXE [300544 2002-03-08] (Lexmark International, Inc.)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.)
R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [66872 2008-09-22] ()
R2 QPCapSvc; C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe [271760 2007-09-30] ()
S2 QPSched; C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe [112016 2007-09-30] ()
R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [272024 2007-01-09] ()

==================== Drivers (Whitelisted) ====================

R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdriverx.sys [208184 2013-03-29] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHX; C:\Windows\System32\DRIVERS\avgidshx.sys [60216 2013-02-08] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSShim; C:\Windows\System32\DRIVERS\avgidsshimx.sys [22328 2013-03-01] (AVG Technologies CZ, s.r.o.)
R1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [170808 2013-02-08] (AVG Technologies CZ, s.r.o.)
R0 Avglogx; C:\Windows\System32\DRIVERS\avglogx.sys [245048 2013-02-08] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx86; C:\Windows\System32\DRIVERS\avgmfx86.sys [96568 2013-02-08] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx86; C:\Windows\System32\DRIVERS\avgrkx86.sys [39224 2013-02-08] (AVG Technologies CZ, s.r.o.)
R1 Avgtdix; C:\Windows\System32\DRIVERS\avgtdix.sys [182072 2013-03-21] (AVG Technologies CZ, s.r.o.)
R3 HdAudAddService; C:\Windows\System32\drivers\CHDART.sys [176640 2007-09-10] (Conexant Systems Inc.)
R3 HpqRemHid; C:\Windows\System32\DRIVERS\HpqRemHid.sys [7168 2007-07-11] (Hewlett-Packard Development Company, L.P.)
S3 s0016bus; C:\Windows\System32\DRIVERS\s0016bus.sys [89256 2008-05-16] (MCCI Corporation)
S3 s0016mdfl; C:\Windows\System32\DRIVERS\s0016mdfl.sys [15016 2008-05-16] (MCCI Corporation)
S3 s0016mdm; C:\Windows\System32\DRIVERS\s0016mdm.sys [120744 2008-05-16] (MCCI Corporation)
S3 s0016mgmt; C:\Windows\System32\DRIVERS\s0016mgmt.sys [114216 2008-05-16] (MCCI Corporation)
S3 s0016nd5; C:\Windows\System32\DRIVERS\s0016nd5.sys [25512 2008-05-16] (MCCI Corporation)
S3 s0016obex; C:\Windows\System32\DRIVERS\s0016obex.sys [110632 2008-05-16] (MCCI Corporation)
S3 s0016unic; C:\Windows\System32\DRIVERS\s0016unic.sys [115752 2008-05-16] (MCCI Corporation)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [691696 2010-10-05] ()
U3 aegq55ud; C:\Windows\System32\Drivers\aegq55ud.sys [0 ] (Microsoft Corporation)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]
S3 catchme; \??\C:\Users\Fatih\AppData\Local\Temp\catchme.sys [x]
U1 eabfiltr;
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
S3 SymIM; system32\DRIVERS\SymIM.sys [x]
S3 SymIMMP; system32\DRIVERS\SymIM.sys [x]
S3 USBAAPL; System32\Drivers\usbaapl.sys [x]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-06-29 11:34 - 2013-06-29 11:34 - 00002071 ____A C:\Users\Fatih\Desktop\ttt.txt
2013-06-29 11:31 - 2013-06-29 11:31 - 00890988 ____A C:\Users\Fatih\Downloads\SecurityCheck.exe
2013-06-29 09:26 - 2013-06-29 09:26 - 02347384 ____A (ESET) C:\Users\Fatih\Downloads\esetsmartinstaller_enu(1).exe
2013-06-29 00:40 - 2013-06-29 00:40 - 02347384 ____A (ESET) C:\Users\Fatih\Downloads\esetsmartinstaller_enu.exe
2013-06-29 00:38 - 2013-06-29 00:38 - 00033587 ____A C:\Users\Fatih\Desktop\JRT.txt
2013-06-29 00:36 - 2013-06-29 00:36 - 00000000 ____D C:\Windows\ERUNT
2013-06-29 00:35 - 2013-06-29 00:35 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\Fatih\Downloads\JRT.exe
2013-06-29 00:35 - 2013-06-29 00:35 - 00000000 ____D C:\JRT
2013-06-29 00:32 - 2013-06-29 00:32 - 00000770 ____A C:\Windows\PFRO.log
2013-06-29 00:30 - 2013-06-29 00:30 - 00005554 ____A C:\AdwCleaner[S1].txt
2013-06-29 00:28 - 2013-06-29 00:28 - 00648201 ____A C:\Users\Fatih\Downloads\adwcleaner.exe
2013-06-29 00:25 - 2013-06-29 00:25 - 00008959 ____A C:\ComboFix.txt
2013-06-29 00:02 - 2011-06-26 08:45 - 00256000 ____A C:\Windows\PEV.exe
2013-06-29 00:02 - 2010-11-07 19:20 - 00208896 ____A C:\Windows\MBR.exe
2013-06-29 00:02 - 2009-04-20 06:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe
2013-06-29 00:02 - 2000-08-31 02:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe
2013-06-29 00:02 - 2000-08-31 02:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe
2013-06-29 00:02 - 2000-08-31 02:00 - 00098816 ____A C:\Windows\sed.exe
2013-06-29 00:02 - 2000-08-31 02:00 - 00080412 ____A C:\Windows\grep.exe
2013-06-29 00:02 - 2000-08-31 02:00 - 00068096 ____A C:\Windows\zip.exe
2013-06-29 00:01 - 2013-06-29 00:25 - 00000000 ____D C:\Qoobox
2013-06-29 00:01 - 2013-06-29 00:22 - 00000000 ____D C:\Windows\erdnt
2013-06-28 23:59 - 2013-06-29 00:00 - 00020117 ____A C:\Users\Fatih\Downloads\Addition.txt
2013-06-28 23:59 - 2013-06-28 23:59 - 05084379 ____R (Swearware) C:\Users\Fatih\Downloads\ComboFix.exe
2013-06-28 23:59 - 2013-06-28 23:59 - 00000000 ____D C:\FRST
2013-06-28 23:57 - 2013-06-28 23:57 - 01371463 ____A (Farbar) C:\Users\Fatih\Downloads\FRST.exe
2013-06-25 11:54 - 2013-06-25 11:56 - 43359164 ____A C:\Users\Fatih\Desktop\goekurs_hs.zip
2013-06-25 11:54 - 2013-06-25 11:54 - 02000290 ____A C:\Users\Fatih\Desktop\Chirurgie 20%.zip
2013-06-25 11:48 - 2013-06-25 11:48 - 00000000 ____D C:\Users\Fatih\Desktop\Umweltmedizin 15%
2013-06-25 11:48 - 2013-06-25 11:48 - 00000000 ____D C:\Users\Fatih\Desktop\Arbeitsmedizin 10%
2013-06-13 20:21 - 2013-05-17 01:08 - 12329984 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-13 20:21 - 2013-05-17 00:49 - 09738752 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-13 20:21 - 2013-05-17 00:39 - 01800704 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-13 20:21 - 2013-05-17 00:28 - 01129472 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-13 20:21 - 2013-05-17 00:28 - 01104384 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-13 20:21 - 2013-05-17 00:27 - 01427968 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-06-13 20:21 - 2013-05-17 00:26 - 00231936 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-06-13 20:21 - 2013-05-17 00:23 - 00065024 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-13 20:21 - 2013-05-17 00:21 - 00717824 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-13 20:21 - 2013-05-17 00:21 - 00142848 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-06-13 20:21 - 2013-05-17 00:20 - 00420864 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-06-13 20:21 - 2013-05-17 00:19 - 00607744 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-13 20:21 - 2013-05-17 00:17 - 01796096 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-13 20:21 - 2013-05-17 00:17 - 00073216 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-06-13 20:21 - 2013-05-17 00:16 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-13 20:21 - 2013-05-17 00:12 - 00176640 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-12 08:02 - 2013-05-08 06:37 - 00905576 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-12 08:02 - 2013-05-02 06:04 - 00443904 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-12 08:02 - 2013-05-02 06:03 - 00037376 ____A (Microsoft Corporation) C:\Windows\System32\printcom.dll
2013-06-12 08:02 - 2013-04-24 06:00 - 00985600 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-12 08:02 - 2013-04-24 06:00 - 00133120 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-12 08:02 - 2013-04-24 06:00 - 00098304 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-12 08:02 - 2013-04-24 06:00 - 00041984 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-12 08:02 - 2013-04-24 03:46 - 00812544 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-12 08:01 - 2013-05-03 00:03 - 03603832 ____A (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2013-06-12 08:01 - 2013-05-03 00:03 - 03551096 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe

==================== One Month Modified Files and Folders ========

2013-06-29 11:45 - 2013-04-18 16:07 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-29 11:40 - 2008-05-26 15:03 - 00177889 ____A C:\Users\Fatih\AppData\Roaming\nvModes.001
2013-06-29 11:40 - 2008-03-09 18:59 - 00000163 ____A C:\Users\Public\Documents\hpqp.ini
2013-06-29 11:34 - 2013-06-29 11:34 - 00002071 ____A C:\Users\Fatih\Desktop\ttt.txt
2013-06-29 11:31 - 2013-06-29 11:31 - 00890988 ____A C:\Users\Fatih\Downloads\SecurityCheck.exe
2013-06-29 11:22 - 2006-11-02 14:47 - 00003296 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-29 11:22 - 2006-11-02 14:47 - 00003296 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-29 10:00 - 2012-06-13 09:15 - 01440191 ____A C:\Windows\WindowsUpdate.log
2013-06-29 09:36 - 2012-06-13 08:58 - 00000000 ____D C:\ProgramData\MFAData
2013-06-29 09:26 - 2013-06-29 09:26 - 02347384 ____A (ESET) C:\Users\Fatih\Downloads\esetsmartinstaller_enu(1).exe
2013-06-29 00:40 - 2013-06-29 00:40 - 02347384 ____A (ESET) C:\Users\Fatih\Downloads\esetsmartinstaller_enu.exe
2013-06-29 00:38 - 2013-06-29 00:38 - 00033587 ____A C:\Users\Fatih\Desktop\JRT.txt
2013-06-29 00:36 - 2013-06-29 00:36 - 00000000 ____D C:\Windows\ERUNT
2013-06-29 00:35 - 2013-06-29 00:35 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\Fatih\Downloads\JRT.exe
2013-06-29 00:35 - 2013-06-29 00:35 - 00000000 ____D C:\JRT
2013-06-29 00:32 - 2013-06-29 00:32 - 00000770 ____A C:\Windows\PFRO.log
2013-06-29 00:32 - 2006-11-02 15:01 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-29 00:31 - 2006-11-02 15:01 - 00032514 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2013-06-29 00:30 - 2013-06-29 00:30 - 00005554 ____A C:\AdwCleaner[S1].txt
2013-06-29 00:30 - 2013-04-10 18:57 - 00000000 ____D C:\Program Files\Common Files\DVDVideoSoft
2013-06-29 00:30 - 2010-01-19 21:12 - 00000000 ____D C:\ProgramData\ICQ
2013-06-29 00:28 - 2013-06-29 00:28 - 00648201 ____A C:\Users\Fatih\Downloads\adwcleaner.exe
2013-06-29 00:25 - 2013-06-29 00:25 - 00008959 ____A C:\ComboFix.txt
2013-06-29 00:25 - 2013-06-29 00:01 - 00000000 ____D C:\Qoobox
2013-06-29 00:25 - 2006-11-02 13:18 - 00000000 __RHD C:\users\Default
2013-06-29 00:25 - 2006-11-02 13:18 - 00000000 ___RD C:\users\Public
2013-06-29 00:22 - 2013-06-29 00:01 - 00000000 ____D C:\Windows\erdnt
2013-06-29 00:15 - 2006-11-02 12:23 - 00000215 ____A C:\Windows\system.ini
2013-06-29 00:04 - 2009-01-31 18:08 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-06-29 00:04 - 2009-01-31 18:08 - 00000000 ____D C:\Program Files\Spybot - Search & Destroy
2013-06-29 00:00 - 2013-06-28 23:59 - 00020117 ____A C:\Users\Fatih\Downloads\Addition.txt
2013-06-28 23:59 - 2013-06-28 23:59 - 05084379 ____R (Swearware) C:\Users\Fatih\Downloads\ComboFix.exe
2013-06-28 23:59 - 2013-06-28 23:59 - 00000000 ____D C:\FRST
2013-06-28 23:57 - 2013-06-28 23:57 - 01371463 ____A (Farbar) C:\Users\Fatih\Downloads\FRST.exe
2013-06-28 23:16 - 2009-04-30 17:56 - 00000000 ____D C:\Users\Fatih\AppData\Roaming\Skype
2013-06-28 12:58 - 2013-05-08 17:20 - 00000000 ____D C:\Users\Fatih\Desktop\Pharma
2013-06-26 18:06 - 2011-09-16 20:14 - 00000000 ____D C:\Users\Fatih\AppData\Local\CrashDumps
2013-06-25 17:24 - 2008-12-24 22:56 - 00000000 ____D C:\Users\Fatih\AppData\Roaming\DAEMON Tools Lite
2013-06-25 11:56 - 2013-06-25 11:54 - 43359164 ____A C:\Users\Fatih\Desktop\goekurs_hs.zip
2013-06-25 11:54 - 2013-06-25 11:54 - 02000290 ____A C:\Users\Fatih\Desktop\Chirurgie 20%.zip
2013-06-25 11:48 - 2013-06-25 11:48 - 00000000 ____D C:\Users\Fatih\Desktop\Umweltmedizin 15%
2013-06-25 11:48 - 2013-06-25 11:48 - 00000000 ____D C:\Users\Fatih\Desktop\Arbeitsmedizin 10%
2013-06-24 11:26 - 2006-11-02 12:33 - 00004930 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-23 21:48 - 2009-05-10 19:56 - 00000000 ____D C:\Users\Fatih\AppData\Roaming\Winamp
2013-06-17 18:16 - 2009-07-01 00:24 - 00007592 ____A C:\Users\Fatih\AppData\Local\d3d9caps.dat
2013-06-17 12:48 - 2008-05-26 15:03 - 00177889 ____A C:\Users\Fatih\AppData\Roaming\nvModes.dat
2013-06-13 20:44 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\rescache
2013-06-13 20:24 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\System32\de-DE
2013-06-13 20:17 - 2006-11-02 12:24 - 73381792 ____A (Microsoft Corporation) C:\Windows\System32\mrt.exe
2013-06-12 13:45 - 2012-07-17 17:33 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-06-12 13:45 - 2011-12-05 15:37 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

LastRegBack: 2013-06-29 00:39

==================== End Of Log ============================

--------------------------------------

Könnte mir bitte jemand weiterhelfen und mir sagen, was ich nun machen soll?
Wäre echt spitze von euch und bitte eine kurze Rückmeldung geben, wenn der Post hier fehl am Platz ist.

Merci im Voraus!

schrauber · 29.06.2013, 10:57

Hi,

Systemscan mit FRST
Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Start > Computer (Rechtsklick) > Eigenschaften)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Scan.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

electrostep · 29.06.2013, 11:07

FRST:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 29-06-2013
Ran by Fatih (administrator) on 29-06-2013 12:03:32
Running from C:\Users\Fatih\Downloads
Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(AVG Technologies CZ, s.r.o.) C:\PROGRA~1\AVG\AVG2013\avgrsx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgcsrvx.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(Cisco Systems, Inc.) C:\Program Files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe
(Lexmark International, Inc.) C:\Windows\System32\LEXBCES.EXE
(Lexmark International, Inc.) C:\Windows\System32\LEXPPS.EXE
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgwdsvc.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
() C:\Windows\system32\PnkBstrA.exe
() C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
() C:\Program Files\CyberLink\Shared Files\RichVideo.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Conexant Systems, Inc.) C:\Windows\system32\DRIVERS\xaudio.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgnsx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgemcx.exe
(Hewlett-Packard) c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgcsrvx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgui.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe
(Farbar) C:\Users\Fatih\Downloads\FRST(1).exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe" [181544 2007-09-30] (CyberLink Corp.)
HKLM\...\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start [202032 2007-09-19] ( Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [OnScreenDisplay] C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe [554320 2007-09-04] ( Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0" [218408 2007-08-17] (CyberLink Corp.)
HKLM\...\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [49152 2005-02-17] (Hewlett-Packard Co.)
HKLM\...\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe [311296 2007-01-08] (Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart [86016 2007-09-19] (NVIDIA Corporation)
HKLM\...\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup [8497696 2007-09-19] (NVIDIA Corporation)
HKLM\...\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit [81920 2007-09-19] (NVIDIA Corporation)
HKLM\...\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [40368 2011-08-31] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [937920 2011-03-29] (Adobe Systems Incorporated)
HKLM\...\Run: [AVG_UI] "C:\Program Files\AVG\AVG2013\avgui.exe" /TRAYONLY [4408368 2013-04-29] (AVG Technologies CZ, s.r.o.)
HKLM\...\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" [253816 2013-03-12] (Oracle Corporation)
HKCU\...\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
HKCU\...\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun [357696 2010-04-01] (DT Soft Ltd)
HKCU\...\Policies\system: [DisableRegistryTools] 0
HKCU\...\Policies\system: [DisableTaskMgr] 0
HKU\Default\...\Run: [HPADVISOR] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autoRun [ 2007-10-01] (Hewlett-Packard)
HKU\Default User\...\Run: [HPADVISOR] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autoRun [ 2007-10-01] (Hewlett-Packard)
Startup: C:\ProgramData\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.0.318\SSScheduler.exe (McAfee, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} hxxp://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} hxxp://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
DPF: {5D6F45B3-9043-443D-A792-115447494D24} hxxp://messenger.zone.msn.com/DE-DE/a-UNO1/GAME_UNO1.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} hxxp://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} https://secure.gopetslive.com/dev/GoPetsWeb.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll No File
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Fatih\AppData\Roaming\Mozilla\Firefox\Profiles\2chizomu.default
FF Homepage: https://www.google.de/
FF NetworkProxy: "no_proxies_on", "localhost, 127.0.0.1, stealthy.co"
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF Plugin: @divx.com/DivX Player Plugin,version=1.0.0 - C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF Plugin: @java.com/DTPlugin,version=10.21.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.21.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Extension: No Name - C:\Users\Fatih\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
FF Extension: Microsoft .NET Framework Assistant - C:\Users\Fatih\AppData\Roaming\Mozilla\Firefox\Profiles\2chizomu.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF Extension: TabScroller - C:\Users\Fatih\AppData\Roaming\Mozilla\Firefox\Profiles\2chizomu.default\Extensions\{DDD48E21-B5C2-46da-9EAE-E2046AD5CC9E}
FF Extension: No Name - C:\Users\Fatih\AppData\Roaming\Mozilla\Firefox\Profiles\2chizomu.default\Extensions\{E6C1199F-E687-42da-8C24-E7770CC3AE66}.xpi
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

========================== Services (Whitelisted) =================

R2 AVGIDSAgent; C:\Program Files\AVG\AVG2013\avgidsagent.exe [4937264 2013-05-14] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files\AVG\AVG2013\avgwdsvc.exe [283136 2013-04-18] (AVG Technologies CZ, s.r.o.)
S3 Com4Qlb; C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe [110592 2007-03-05] (Hewlett-Packard Development Company, L.P.)
R2 HP Health Check Service; c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [65536 2007-09-19] (Hewlett-Packard)
R2 LexBceS; C:\Windows\System32\LEXBCES.EXE [300544 2002-03-08] (Lexmark International, Inc.)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.)
R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [66872 2008-09-22] ()
R2 QPCapSvc; C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe [271760 2007-09-30] ()
S2 QPSched; C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe [112016 2007-09-30] ()
R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [272024 2007-01-09] ()

==================== Drivers (Whitelisted) ====================

R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdriverx.sys [208184 2013-03-29] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHX; C:\Windows\System32\DRIVERS\avgidshx.sys [60216 2013-02-08] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSShim; C:\Windows\System32\DRIVERS\avgidsshimx.sys [22328 2013-03-01] (AVG Technologies CZ, s.r.o.)
R1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [170808 2013-02-08] (AVG Technologies CZ, s.r.o.)
R0 Avglogx; C:\Windows\System32\DRIVERS\avglogx.sys [245048 2013-02-08] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx86; C:\Windows\System32\DRIVERS\avgmfx86.sys [96568 2013-02-08] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx86; C:\Windows\System32\DRIVERS\avgrkx86.sys [39224 2013-02-08] (AVG Technologies CZ, s.r.o.)
R1 Avgtdix; C:\Windows\System32\DRIVERS\avgtdix.sys [182072 2013-03-21] (AVG Technologies CZ, s.r.o.)
R3 HdAudAddService; C:\Windows\System32\drivers\CHDART.sys [176640 2007-09-10] (Conexant Systems Inc.)
R3 HpqRemHid; C:\Windows\System32\DRIVERS\HpqRemHid.sys [7168 2007-07-11] (Hewlett-Packard Development Company, L.P.)
S3 s0016bus; C:\Windows\System32\DRIVERS\s0016bus.sys [89256 2008-05-16] (MCCI Corporation)
S3 s0016mdfl; C:\Windows\System32\DRIVERS\s0016mdfl.sys [15016 2008-05-16] (MCCI Corporation)
S3 s0016mdm; C:\Windows\System32\DRIVERS\s0016mdm.sys [120744 2008-05-16] (MCCI Corporation)
S3 s0016mgmt; C:\Windows\System32\DRIVERS\s0016mgmt.sys [114216 2008-05-16] (MCCI Corporation)
S3 s0016nd5; C:\Windows\System32\DRIVERS\s0016nd5.sys [25512 2008-05-16] (MCCI Corporation)
S3 s0016obex; C:\Windows\System32\DRIVERS\s0016obex.sys [110632 2008-05-16] (MCCI Corporation)
S3 s0016unic; C:\Windows\System32\DRIVERS\s0016unic.sys [115752 2008-05-16] (MCCI Corporation)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [691696 2010-10-05] ()
U3 aegq55ud; C:\Windows\System32\Drivers\aegq55ud.sys [0 ] (Microsoft Corporation)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]
S3 catchme; \??\C:\Users\Fatih\AppData\Local\Temp\catchme.sys [x]
U1 eabfiltr; 
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
S3 SymIM; system32\DRIVERS\SymIM.sys [x]
S3 SymIMMP; system32\DRIVERS\SymIM.sys [x]
S3 USBAAPL; System32\Drivers\usbaapl.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-06-29 12:01 - 2013-06-29 12:01 - 01372101 ____A (Farbar) C:\Users\Fatih\Downloads\FRST(1).exe
2013-06-29 11:34 - 2013-06-29 11:52 - 00028346 ____A C:\Users\Fatih\Desktop\ttt.txt
2013-06-29 11:31 - 2013-06-29 11:31 - 00890988 ____A C:\Users\Fatih\Downloads\SecurityCheck.exe
2013-06-29 09:26 - 2013-06-29 09:26 - 02347384 ____A (ESET) C:\Users\Fatih\Downloads\esetsmartinstaller_enu(1).exe
2013-06-29 00:40 - 2013-06-29 00:40 - 02347384 ____A (ESET) C:\Users\Fatih\Downloads\esetsmartinstaller_enu.exe
2013-06-29 00:38 - 2013-06-29 00:38 - 00033587 ____A C:\Users\Fatih\Desktop\JRT.txt
2013-06-29 00:36 - 2013-06-29 00:36 - 00000000 ____D C:\Windows\ERUNT
2013-06-29 00:35 - 2013-06-29 00:35 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\Fatih\Downloads\JRT.exe
2013-06-29 00:35 - 2013-06-29 00:35 - 00000000 ____D C:\JRT
2013-06-29 00:32 - 2013-06-29 00:32 - 00000770 ____A C:\Windows\PFRO.log
2013-06-29 00:30 - 2013-06-29 00:30 - 00005554 ____A C:\AdwCleaner[S1].txt
2013-06-29 00:28 - 2013-06-29 00:28 - 00648201 ____A C:\Users\Fatih\Downloads\adwcleaner.exe
2013-06-29 00:25 - 2013-06-29 00:25 - 00008959 ____A C:\ComboFix.txt
2013-06-29 00:02 - 2011-06-26 08:45 - 00256000 ____A C:\Windows\PEV.exe
2013-06-29 00:02 - 2010-11-07 19:20 - 00208896 ____A C:\Windows\MBR.exe
2013-06-29 00:02 - 2009-04-20 06:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe
2013-06-29 00:02 - 2000-08-31 02:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe
2013-06-29 00:02 - 2000-08-31 02:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe
2013-06-29 00:02 - 2000-08-31 02:00 - 00098816 ____A C:\Windows\sed.exe
2013-06-29 00:02 - 2000-08-31 02:00 - 00080412 ____A C:\Windows\grep.exe
2013-06-29 00:02 - 2000-08-31 02:00 - 00068096 ____A C:\Windows\zip.exe
2013-06-29 00:01 - 2013-06-29 00:25 - 00000000 ____D C:\Qoobox
2013-06-29 00:01 - 2013-06-29 00:22 - 00000000 ____D C:\Windows\erdnt
2013-06-28 23:59 - 2013-06-29 00:00 - 00020117 ____A C:\Users\Fatih\Downloads\Addition.txt
2013-06-28 23:59 - 2013-06-28 23:59 - 05084379 ____R (Swearware) C:\Users\Fatih\Downloads\ComboFix.exe
2013-06-28 23:59 - 2013-06-28 23:59 - 00000000 ____D C:\FRST
2013-06-28 23:57 - 2013-06-28 23:57 - 01371463 ____A (Farbar) C:\Users\Fatih\Downloads\FRST.exe
2013-06-25 11:54 - 2013-06-25 11:56 - 43359164 ____A C:\Users\Fatih\Desktop\goekurs_hs.zip
2013-06-25 11:54 - 2013-06-25 11:54 - 02000290 ____A C:\Users\Fatih\Desktop\Chirurgie 20%.zip
2013-06-25 11:48 - 2013-06-25 11:48 - 00000000 ____D C:\Users\Fatih\Desktop\Umweltmedizin 15%
2013-06-25 11:48 - 2013-06-25 11:48 - 00000000 ____D C:\Users\Fatih\Desktop\Arbeitsmedizin 10%
2013-06-13 20:21 - 2013-05-17 01:08 - 12329984 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-13 20:21 - 2013-05-17 00:49 - 09738752 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-13 20:21 - 2013-05-17 00:39 - 01800704 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-13 20:21 - 2013-05-17 00:28 - 01129472 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-13 20:21 - 2013-05-17 00:28 - 01104384 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-13 20:21 - 2013-05-17 00:27 - 01427968 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-06-13 20:21 - 2013-05-17 00:26 - 00231936 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-06-13 20:21 - 2013-05-17 00:23 - 00065024 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-13 20:21 - 2013-05-17 00:21 - 00717824 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-13 20:21 - 2013-05-17 00:21 - 00142848 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-06-13 20:21 - 2013-05-17 00:20 - 00420864 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-06-13 20:21 - 2013-05-17 00:19 - 00607744 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-13 20:21 - 2013-05-17 00:17 - 01796096 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-13 20:21 - 2013-05-17 00:17 - 00073216 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-06-13 20:21 - 2013-05-17 00:16 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-13 20:21 - 2013-05-17 00:12 - 00176640 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-12 08:02 - 2013-05-08 06:37 - 00905576 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-12 08:02 - 2013-05-02 06:04 - 00443904 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-12 08:02 - 2013-05-02 06:03 - 00037376 ____A (Microsoft Corporation) C:\Windows\System32\printcom.dll
2013-06-12 08:02 - 2013-04-24 06:00 - 00985600 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-12 08:02 - 2013-04-24 06:00 - 00133120 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-12 08:02 - 2013-04-24 06:00 - 00098304 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-12 08:02 - 2013-04-24 06:00 - 00041984 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-12 08:02 - 2013-04-24 03:46 - 00812544 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-12 08:01 - 2013-05-03 00:03 - 03603832 ____A (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2013-06-12 08:01 - 2013-05-03 00:03 - 03551096 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe

==================== One Month Modified Files and Folders ========

2013-06-29 12:01 - 2013-06-29 12:01 - 01372101 ____A (Farbar) C:\Users\Fatih\Downloads\FRST(1).exe
2013-06-29 11:55 - 2012-06-13 09:15 - 01440361 ____A C:\Windows\WindowsUpdate.log
2013-06-29 11:52 - 2013-06-29 11:34 - 00028346 ____A C:\Users\Fatih\Desktop\ttt.txt
2013-06-29 11:45 - 2013-04-18 16:07 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-29 11:40 - 2008-05-26 15:03 - 00177889 ____A C:\Users\Fatih\AppData\Roaming\nvModes.001
2013-06-29 11:40 - 2008-03-09 18:59 - 00000163 ____A C:\Users\Public\Documents\hpqp.ini
2013-06-29 11:31 - 2013-06-29 11:31 - 00890988 ____A C:\Users\Fatih\Downloads\SecurityCheck.exe
2013-06-29 11:22 - 2006-11-02 14:47 - 00003296 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-29 11:22 - 2006-11-02 14:47 - 00003296 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-29 09:36 - 2012-06-13 08:58 - 00000000 ____D C:\ProgramData\MFAData
2013-06-29 09:26 - 2013-06-29 09:26 - 02347384 ____A (ESET) C:\Users\Fatih\Downloads\esetsmartinstaller_enu(1).exe
2013-06-29 00:40 - 2013-06-29 00:40 - 02347384 ____A (ESET) C:\Users\Fatih\Downloads\esetsmartinstaller_enu.exe
2013-06-29 00:38 - 2013-06-29 00:38 - 00033587 ____A C:\Users\Fatih\Desktop\JRT.txt
2013-06-29 00:36 - 2013-06-29 00:36 - 00000000 ____D C:\Windows\ERUNT
2013-06-29 00:35 - 2013-06-29 00:35 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\Fatih\Downloads\JRT.exe
2013-06-29 00:35 - 2013-06-29 00:35 - 00000000 ____D C:\JRT
2013-06-29 00:32 - 2013-06-29 00:32 - 00000770 ____A C:\Windows\PFRO.log
2013-06-29 00:32 - 2006-11-02 15:01 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-29 00:31 - 2006-11-02 15:01 - 00032514 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2013-06-29 00:30 - 2013-06-29 00:30 - 00005554 ____A C:\AdwCleaner[S1].txt
2013-06-29 00:30 - 2013-04-10 18:57 - 00000000 ____D C:\Program Files\Common Files\DVDVideoSoft
2013-06-29 00:30 - 2010-01-19 21:12 - 00000000 ____D C:\ProgramData\ICQ
2013-06-29 00:28 - 2013-06-29 00:28 - 00648201 ____A C:\Users\Fatih\Downloads\adwcleaner.exe
2013-06-29 00:25 - 2013-06-29 00:25 - 00008959 ____A C:\ComboFix.txt
2013-06-29 00:25 - 2013-06-29 00:01 - 00000000 ____D C:\Qoobox
2013-06-29 00:25 - 2006-11-02 13:18 - 00000000 __RHD C:\users\Default
2013-06-29 00:25 - 2006-11-02 13:18 - 00000000 ___RD C:\users\Public
2013-06-29 00:22 - 2013-06-29 00:01 - 00000000 ____D C:\Windows\erdnt
2013-06-29 00:15 - 2006-11-02 12:23 - 00000215 ____A C:\Windows\system.ini
2013-06-29 00:04 - 2009-01-31 18:08 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-06-29 00:04 - 2009-01-31 18:08 - 00000000 ____D C:\Program Files\Spybot - Search & Destroy
2013-06-29 00:00 - 2013-06-28 23:59 - 00020117 ____A C:\Users\Fatih\Downloads\Addition.txt
2013-06-28 23:59 - 2013-06-28 23:59 - 05084379 ____R (Swearware) C:\Users\Fatih\Downloads\ComboFix.exe
2013-06-28 23:59 - 2013-06-28 23:59 - 00000000 ____D C:\FRST
2013-06-28 23:57 - 2013-06-28 23:57 - 01371463 ____A (Farbar) C:\Users\Fatih\Downloads\FRST.exe
2013-06-28 23:16 - 2009-04-30 17:56 - 00000000 ____D C:\Users\Fatih\AppData\Roaming\Skype
2013-06-28 12:58 - 2013-05-08 17:20 - 00000000 ____D C:\Users\Fatih\Desktop\Pharma
2013-06-26 18:06 - 2011-09-16 20:14 - 00000000 ____D C:\Users\Fatih\AppData\Local\CrashDumps
2013-06-25 17:24 - 2008-12-24 22:56 - 00000000 ____D C:\Users\Fatih\AppData\Roaming\DAEMON Tools Lite
2013-06-25 11:56 - 2013-06-25 11:54 - 43359164 ____A C:\Users\Fatih\Desktop\goekurs_hs.zip
2013-06-25 11:54 - 2013-06-25 11:54 - 02000290 ____A C:\Users\Fatih\Desktop\Chirurgie 20%.zip
2013-06-25 11:48 - 2013-06-25 11:48 - 00000000 ____D C:\Users\Fatih\Desktop\Umweltmedizin 15%
2013-06-25 11:48 - 2013-06-25 11:48 - 00000000 ____D C:\Users\Fatih\Desktop\Arbeitsmedizin 10%
2013-06-24 11:26 - 2006-11-02 12:33 - 00004930 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-23 21:48 - 2009-05-10 19:56 - 00000000 ____D C:\Users\Fatih\AppData\Roaming\Winamp
2013-06-17 18:16 - 2009-07-01 00:24 - 00007592 ____A C:\Users\Fatih\AppData\Local\d3d9caps.dat
2013-06-17 12:48 - 2008-05-26 15:03 - 00177889 ____A C:\Users\Fatih\AppData\Roaming\nvModes.dat
2013-06-13 20:44 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\rescache
2013-06-13 20:24 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\System32\de-DE
2013-06-13 20:17 - 2006-11-02 12:24 - 73381792 ____A (Microsoft Corporation) C:\Windows\System32\mrt.exe
2013-06-12 13:45 - 2012-07-17 17:33 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-06-12 13:45 - 2011-12-05 15:37 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-06-29 00:39

==================== End Of Log ============================

--- --- ---

--- --- ---

Addition:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 29-06-2013
Ran by Fatih at 2013-06-29 12:03:53
Running from C:\Users\Fatih\Downloads
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

 Update for Microsoft Office 2007 (KB2508958)
7-Zip 4.57
Activation Assistant for the 2007 Microsoft Office suites
Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0)
Adobe Flash Player 10 ActiveX (Version: 10.0.45.2)
Adobe Flash Player 11 Plugin (Version: 11.7.700.224)
Adobe Reader 8.3.1 - Deutsch (Version: 8.3.1)
Adobe Shockwave Player (Version: 10.2.0.023)
Adobe Shockwave Player 11.5 (Version: 11.5)
Ashampoo ClipFinder HD 2.03 (Version: 2.0.3)
Atheros Driver Installation Program (Version: 7.1)
aTube Catcher 1.0 (Version: 1.0.228)
AVG 2013 (Version: 13.0.3204)
AVG 2013 (Version: 13.0.3345)
AVG 2013 (Version: 2013.0.3345)
CCleaner (Version: 4.01)
Cisco AnyConnect VPN Client (Version: 2.5.3046)
Compatibility Pack für 2007 Office System (Version: 12.0.6612.1000)
Conexant HD Audio (Version: 4.31.0.50)
CyberLink YouCam (Version: 1.0.1002)
D3DX10 (Version: 15.4.2368.0902)
DivX Codec (Version: 6.8.3)
DivX Converter (Version: 6.6.1)
DivX Player (Version: 6.8.2)
DivX Web Player (Version: 1.4.0)
DVD Suite (Version: 5.5.0928)
EA Link (Version: 3.1.1.4)
ESU for Microsoft Vista (Version: 2.0.11.1)
Facebook Video Calling 1.2.0.287 (Version: 1.2.287)
Feedback Tool (Version: 1.2.0)
ffdshow [rev 1953] [2008-05-04] (Version: 1.0)
Free YouTube to MP3 Converter version 3.12.1.320 (Version: 3.12.1.320)
Hauppauge MCE XP/Vista Software Encoder (2.0.25149) (Version: 2.0.25149)
HDAUDIO Soft Data Fax Modem with SmartCP
Hewlett-Packard Active Check (Version: 1.1.11.0)
Hewlett-Packard Asset Agent for Health Check (Version: 2.0.62.5)
HP Active Support Library (Version: 2.3.0.2)
HP Customer Experience Enhancements (Version: 5.4.0.2430)
HP Doc Viewer (Version: 1.02.0001)
HP Easy Setup - Frontend (Version: 5.4.0.2430)
HP Help and Support (Version: 1.5.1)
HP Quick Launch Buttons 6.30 E1 (Version: 6.30 E1)
HP QuickPlay 3.6
HP QuickTouch 1.00 C4 (Version: 1.0.7)
HP Total Care Advisor (Version: 1.4.19.2433)
HP Update (Version: 4.000.006.003)
HP User Guides 0087 (Version: 1.02.0000)
HP Wireless Assistant (Version: 3.00 H2)
Java 7 Update 21 (Version: 7.0.210)
Java Auto Updater (Version: 2.1.9.5)
Java(TM) 6 Update 2 (Version: 1.6.0.20)
Java(TM) 6 Update 30 (Version: 6.0.300)
JavaFX 2.1.1 (Version: 2.1.1)
Junk Mail filter update (Version: 15.4.3502.0922)
K-Lite Codec Pack 3.9.0 Full (Version: 3.9.0)
LabelPrint (Version: 2.20.2128)
LightScribe System Software  1.10.13.1 (Version: 1.10.13.1)
McAfee Security Scan Plus (Version: 3.0.318.3)
Mediscript-CD GK1
Microsoft .NET Framework 3.5 Language Pack - DEU
Microsoft .NET Framework 3.5 Language Pack - deu (Version: 3.5.21022)
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729)
Microsoft Application Error Reporting (Version: 12.0.6012.5000)
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003)
Microsoft Office Home and Student 2007 (Version: 12.0.6612.1000)
Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1)
Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office PowerPoint Viewer 2007 (German) (Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Silverlight (Version: 5.1.20125.0)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Works (Version: 9.7.0621)
Mozilla Firefox 21.0 (x86 de) (Version: 21.0)
Mozilla Maintenance Service (Version: 21.0)
MSVCRT (Version: 15.4.2862.0708)
MSXML 4.0 SP2 (KB936181) (Version: 4.20.9848.0)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
Norton Bootable Recovery Tool Wizard (Version: 3.5.0.23)
NVIDIA Drivers
Power2Go (Version: 5.6.3327)
PowerDirector (Version: 6.5.2129)
QuickPlay SlingPlayer 0.4.4 (Version: 0.4.4)
RICOH R5C83x/84x Flash Media Controller Driver Ver.3.51.01 (Version: 3.51.01)
Segoe UI (Version: 15.4.2271.0615)
Skype Click to Call (Version: 5.9.9216)
Skype™ 6.3 (Version: 6.3.107)
Sony Ericsson Update Engine (Version: 2.11.12.9)
SopCast 3.0.3 (Version: 3.0.3)
Spelling Dictionaries Support For Adobe Reader 8 (Version: 8.0.0)
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
VideoLAN VLC media player 0.8.6f (Version: 0.8.6f)
Vuze
Winamp (Version: 5.56 )
Windows Live Communications Platform (Version: 15.4.3502.0922)
Windows Live Essentials (Version: 15.4.3502.0922)
Windows Live Essentials (Version: 15.4.3555.0308)
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0)
Windows Live Installer (Version: 15.4.3502.0922)
Windows Live Mail (Version: 15.4.3502.0922)
Windows Live Messenger (Version: 15.4.3538.0513)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Photo Common (Version: 15.4.3502.0922)
Windows Live PIMT Platform (Version: 15.4.3508.1109)
Windows Live SOXE (Version: 15.4.3502.0922)
Windows Live SOXE Definitions (Version: 15.4.3502.0922)
Windows Live UX Platform (Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (Version: 15.4.3508.1109)
Windows Live Writer (Version: 15.4.3502.0922)
Windows Live Writer Resources (Version: 15.4.3502.0922)
Windows Media Player Firefox Plugin (Version: 1.0.0.8)
Xvid 1.1.3 final uninstall (Version: 1.1)

==================== Restore Points  =========================

13-06-2013 18:12:58 Windows Update
17-06-2013 18:53:05 Geplanter Prüfpunkt
18-06-2013 08:31:04 Geplanter Prüfpunkt
20-06-2013 16:09:04 Geplanter Prüfpunkt
21-06-2013 18:31:15 Geplanter Prüfpunkt
24-06-2013 15:53:20 Geplanter Prüfpunkt
25-06-2013 16:46:47 Geplanter Prüfpunkt
26-06-2013 12:53:06 Geplanter Prüfpunkt
27-06-2013 12:14:17 Geplanter Prüfpunkt
28-06-2013 19:54:39 Geplanter Prüfpunkt
29-06-2013 09:54:59 Entfernt Atheros Driver Installation Program

==================== Scheduled Tasks (whitelisted) =============

Task: {01031604-84BA-4A14-B807-271F5F324570} - System32\Tasks\{755FC50F-2114-4C81-A921-E84487EBF2F7} => C:\Program Files\Skype\Phone\Skype.exe [2013-04-19] (Skype Technologies S.A.)
Task: {0A9B337E-BDDC-4E80-B275-6F03D5E9053E} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {20B757EE-512F-4E91-8C51-2AFF71EC188E} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\schtasks.exe [2008-01-19] (Microsoft Corporation)
Task: {2854D3C1-7021-416E-99F1-DFF75F241DA6} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-04-23] (Piriform Ltd)
Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {3FC4630B-8BF0-41D5-B9A1-8409A54514FD} - System32\Tasks\Microsoft\Windows\Defrag\ManualDefrag => C:\Windows\system32\defrag.exe [2008-01-19] (Microsoft Corp.)
Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-19] (Microsoft Corporation)
Task: {5FC7E538-046F-4FFC-9FCB-2ED7C070F28F} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task
Task: {A61555D3-7840-45C1-A5A9-0D49851DE37A} - System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\OptinNotification => C:\Windows\System32\wsqmcons.exe [2008-01-19] (Microsoft Corporation)
Task: {B4B48438-85A7-4A20-81AE-B2DBAC74D148} - System32\Tasks\Microsoft\Windows\WindowsCalendar\Reminders - Fatih => C:\Program Files\Windows Calendar\wincal.exe [2009-04-11] (Microsoft Corporation)
Task: {B720A4C0-9472-425C-B119-62604BC8E635} - System32\Tasks\User_Feed_Synchronization-{EF21F685-C85A-4E55-9808-FAC53ABE9FDE} => C:\Windows\system32\msfeedssync.exe [2011-07-06] (Microsoft Corporation)
Task: {CAD32029-BF2C-4808-9D32-9851C00E680A} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-12] (Adobe Systems Incorporated)
Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-05] ()
Task: {FC0408FB-1EFB-485C-9038-A9897FA93633} - System32\Tasks\ROC_REG_JAN_DELETE => C:\ProgramData\AVG January 2013 Campaign\ROC.exe [2013-01-16] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\ROC_REG_JAN_DELETE.job => C:\ProgramData\AVG January 2013 Campaign\ROC.exe

==================== Faulty Device Manager Devices =============

Name: Cisco AnyConnect VPN Virtual Miniport Adapter for Windows
Description: Cisco AnyConnect VPN Virtual Miniport Adapter for Windows
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: vpnva
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (06/29/2013 11:54:56 AM) (Source: VSS) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.


Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {ace151c2-bbb9-4d66-8710-2042e9134896}

Error: (06/29/2013 02:15:49 AM) (Source: Application Error) (User: )
Description: Fehlerhafte Anwendung QPSched.exe, Version 5.0.0.3327, Zeitstempel 0x46fbc733, fehlerhaftes Modul QPSched.exe, Version 5.0.0.3327, Zeitstempel 0x46fbc733, Ausnahmecode 0xc0000005, Fehleroffset 0x000075bd,
Prozess-ID 0xb4c, Anwendungsstartzeit QPSched.exe0.


System errors:
=============
Error: (06/29/2013 09:25:12 AM) (Source: bowser) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "EASYBOX",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{BD4A3A4B-9C67-4637-99C6-12F03D934E-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.

Error: (06/29/2013 02:16:00 AM) (Source: Service Control Manager) (User: )
Description: QuickPlay Task Scheduler (QTS)1


Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2013-06-29 12:03:37.976
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\avgidshx.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-06-29 12:03:37.570
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\avgidshx.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-06-29 12:03:37.180
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\avgidshx.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-06-29 12:03:36.790
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\avgidshx.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-06-29 12:03:36.353
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\avgidsdriverx.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-06-29 12:03:35.948
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\avgidsdriverx.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-06-29 12:03:35.558
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\avgidsdriverx.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-06-29 12:03:35.152
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\avgidsdriverx.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-06-29 12:01:43.097
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\avgidshx.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-06-29 12:01:42.704
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\avgidshx.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Percentage of memory in use: 49%
Total physical RAM: 3070.23 MB
Available physical RAM: 1565.19 MB
Total Pagefile: 6366.92 MB
Available Pagefile: 5047.52 MB
Total Virtual: 2047.88 MB
Available Virtual: 1901.28 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:221.47 GB) (Free:125.41 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (HP_RECOVERY) (Fixed) (Total:11.41 GB) (Free:2.14 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 233 GB) (Disk ID: F02BF02B)
Partition 1: (Active) - (Size=221 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=11 GB) - (Type=07 NTFS)

==================== End Of Log ============================

schrauber · 29.06.2013, 11:47

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST Log bitte.

electrostep · 29.06.2013, 12:00

AdwCleaner Logfile:

Code:

ATTFilter

# AdwCleaner v2.303 - Datei am 29/06/2013 um 12:49:47 erstellt
# Aktualisiert am 08/06/2013 von Xplode
# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Benutzer : Fatih - FATIH-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Fatih\Downloads\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****


***** [Registrierungsdatenbank] *****


***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16490

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v21.0 (de)

Datei : C:\Users\Fatih\AppData\Roaming\Mozilla\Firefox\Profiles\2chizomu.default\prefs.js

[OK] Die Datei ist sauber.

*************************

AdwCleaner[S1].txt - [5554 octets] - [29/06/2013 00:30:22]
AdwCleaner[S2].txt - [794 octets] - [29/06/2013 12:49:47]

########## EOF - C:\AdwCleaner[S2].txt - [853 octets] ##########

--- --- ---

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.9.4 (05.06.2013:1)
OS: Windows Vista (TM) Home Premium x86
Ran by Fatih on 29.06.2013 at 12:54:56,61
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ FireFox

Emptied folder: C:\Users\Fatih\AppData\Roaming\mozilla\firefox\profiles\2chizomu.default\minidumps [1 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 29.06.2013 at 12:57:32,76
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 29-06-2013
Ran by Fatih (administrator) on 29-06-2013 12:58:44
Running from C:\Users\Fatih\Downloads
Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(AVG Technologies CZ, s.r.o.) C:\PROGRA~1\AVG\AVG2013\avgrsx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgcsrvx.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(Cisco Systems, Inc.) C:\Program Files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe
(Lexmark International, Inc.) C:\Windows\System32\LEXBCES.EXE
(Lexmark International, Inc.) C:\Windows\System32\LEXPPS.EXE
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgwdsvc.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
() C:\Windows\system32\PnkBstrA.exe
() C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgnsx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgemcx.exe
() C:\Program Files\CyberLink\Shared Files\RichVideo.exe
(CyberLink Corp.) C:\Program Files\Hp\QuickPlay\QPService.exe
( Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
( Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgui.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(DT Soft Ltd) C:\Program Files\DAEMON Tools Lite\DTLite.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.0.318\SSScheduler.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Conexant Systems, Inc.) C:\Windows\system32\DRIVERS\xaudio.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe
(Hewlett-Packard) c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
(Microsoft Corporation) C:\Windows\system32\wbem\unsecapp.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Farbar) C:\Users\Fatih\Downloads\FRST(1).exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe" [181544 2007-09-30] (CyberLink Corp.)
HKLM\...\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start [202032 2007-09-19] ( Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [OnScreenDisplay] C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe [554320 2007-09-04] ( Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0" [218408 2007-08-17] (CyberLink Corp.)
HKLM\...\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe [311296 2007-01-08] (Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart [86016 2007-09-19] (NVIDIA Corporation)
HKLM\...\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup [8497696 2007-09-19] (NVIDIA Corporation)
HKLM\...\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit [81920 2007-09-19] (NVIDIA Corporation)
HKLM\...\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [40368 2011-08-31] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [937920 2011-03-29] (Adobe Systems Incorporated)
HKLM\...\Run: [AVG_UI] "C:\Program Files\AVG\AVG2013\avgui.exe" /TRAYONLY [4408368 2013-04-29] (AVG Technologies CZ, s.r.o.)
HKLM\...\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" [253816 2013-03-12] (Oracle Corporation)
HKCU\...\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
HKCU\...\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun [357696 2010-04-01] (DT Soft Ltd)
HKCU\...\Policies\system: [DisableRegistryTools] 0
HKCU\...\Policies\system: [DisableTaskMgr] 0
HKU\Default\...\Run: [HPADVISOR] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autoRun [ 2007-10-01] (Hewlett-Packard)
HKU\Default User\...\Run: [HPADVISOR] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autoRun [ 2007-10-01] (Hewlett-Packard)
Startup: C:\ProgramData\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.0.318\SSScheduler.exe (McAfee, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} hxxp://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} hxxp://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
DPF: {5D6F45B3-9043-443D-A792-115447494D24} hxxp://messenger.zone.msn.com/DE-DE/a-UNO1/GAME_UNO1.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} hxxp://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} https://secure.gopetslive.com/dev/GoPetsWeb.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll No File
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Fatih\AppData\Roaming\Mozilla\Firefox\Profiles\2chizomu.default
FF Homepage: https://www.google.de/
FF NetworkProxy: "no_proxies_on", "localhost, 127.0.0.1, stealthy.co"
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF Plugin: @divx.com/DivX Player Plugin,version=1.0.0 - C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF Plugin: @java.com/DTPlugin,version=10.21.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.21.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Extension: No Name - C:\Users\Fatih\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
FF Extension: Microsoft .NET Framework Assistant - C:\Users\Fatih\AppData\Roaming\Mozilla\Firefox\Profiles\2chizomu.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF Extension: TabScroller - C:\Users\Fatih\AppData\Roaming\Mozilla\Firefox\Profiles\2chizomu.default\Extensions\{DDD48E21-B5C2-46da-9EAE-E2046AD5CC9E}
FF Extension: No Name - C:\Users\Fatih\AppData\Roaming\Mozilla\Firefox\Profiles\2chizomu.default\Extensions\{E6C1199F-E687-42da-8C24-E7770CC3AE66}.xpi
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

========================== Services (Whitelisted) =================

R2 AVGIDSAgent; C:\Program Files\AVG\AVG2013\avgidsagent.exe [4937264 2013-05-14] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files\AVG\AVG2013\avgwdsvc.exe [283136 2013-04-18] (AVG Technologies CZ, s.r.o.)
S3 Com4Qlb; C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe [110592 2007-03-05] (Hewlett-Packard Development Company, L.P.)
R2 HP Health Check Service; c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [65536 2007-09-19] (Hewlett-Packard)
R2 LexBceS; C:\Windows\System32\LEXBCES.EXE [300544 2002-03-08] (Lexmark International, Inc.)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.)
R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [66872 2008-09-22] ()
R2 QPCapSvc; C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe [271760 2007-09-30] ()
S2 QPSched; C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe [112016 2007-09-30] ()
R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [272024 2007-01-09] ()

==================== Drivers (Whitelisted) ====================

R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdriverx.sys [208184 2013-03-29] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHX; C:\Windows\System32\DRIVERS\avgidshx.sys [60216 2013-02-08] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSShim; C:\Windows\System32\DRIVERS\avgidsshimx.sys [22328 2013-03-01] (AVG Technologies CZ, s.r.o.)
R1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [170808 2013-02-08] (AVG Technologies CZ, s.r.o.)
R0 Avglogx; C:\Windows\System32\DRIVERS\avglogx.sys [245048 2013-02-08] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx86; C:\Windows\System32\DRIVERS\avgmfx86.sys [96568 2013-02-08] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx86; C:\Windows\System32\DRIVERS\avgrkx86.sys [39224 2013-02-08] (AVG Technologies CZ, s.r.o.)
R1 Avgtdix; C:\Windows\System32\DRIVERS\avgtdix.sys [182072 2013-03-21] (AVG Technologies CZ, s.r.o.)
R3 HdAudAddService; C:\Windows\System32\drivers\CHDART.sys [176640 2007-09-10] (Conexant Systems Inc.)
R3 HpqRemHid; C:\Windows\System32\DRIVERS\HpqRemHid.sys [7168 2007-07-11] (Hewlett-Packard Development Company, L.P.)
S3 s0016bus; C:\Windows\System32\DRIVERS\s0016bus.sys [89256 2008-05-16] (MCCI Corporation)
S3 s0016mdfl; C:\Windows\System32\DRIVERS\s0016mdfl.sys [15016 2008-05-16] (MCCI Corporation)
S3 s0016mdm; C:\Windows\System32\DRIVERS\s0016mdm.sys [120744 2008-05-16] (MCCI Corporation)
S3 s0016mgmt; C:\Windows\System32\DRIVERS\s0016mgmt.sys [114216 2008-05-16] (MCCI Corporation)
S3 s0016nd5; C:\Windows\System32\DRIVERS\s0016nd5.sys [25512 2008-05-16] (MCCI Corporation)
S3 s0016obex; C:\Windows\System32\DRIVERS\s0016obex.sys [110632 2008-05-16] (MCCI Corporation)
S3 s0016unic; C:\Windows\System32\DRIVERS\s0016unic.sys [115752 2008-05-16] (MCCI Corporation)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [691696 2010-10-05] ()
U3 a67g551c; C:\Windows\System32\Drivers\a67g551c.sys [0 ] (Microsoft Corporation)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]
S3 catchme; \??\C:\Users\Fatih\AppData\Local\Temp\catchme.sys [x]
U1 eabfiltr; 
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
S3 SymIM; system32\DRIVERS\SymIM.sys [x]
S3 SymIMMP; system32\DRIVERS\SymIM.sys [x]
S3 USBAAPL; System32\Drivers\usbaapl.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-06-29 12:57 - 2013-06-29 12:57 - 00000765 ____A C:\Users\Fatih\Desktop\JRT.txt
2013-06-29 12:49 - 2013-06-29 12:49 - 00000921 ____A C:\AdwCleaner[S2].txt
2013-06-29 12:01 - 2013-06-29 12:01 - 01372101 ____A (Farbar) C:\Users\Fatih\Downloads\FRST(1).exe
2013-06-29 11:34 - 2013-06-29 11:52 - 00028346 ____A C:\Users\Fatih\Desktop\ttt.txt
2013-06-29 11:31 - 2013-06-29 11:31 - 00890988 ____A C:\Users\Fatih\Downloads\SecurityCheck.exe
2013-06-29 09:26 - 2013-06-29 09:26 - 02347384 ____A (ESET) C:\Users\Fatih\Downloads\esetsmartinstaller_enu(1).exe
2013-06-29 00:40 - 2013-06-29 00:40 - 02347384 ____A (ESET) C:\Users\Fatih\Downloads\esetsmartinstaller_enu.exe
2013-06-29 00:36 - 2013-06-29 00:36 - 00000000 ____D C:\Windows\ERUNT
2013-06-29 00:35 - 2013-06-29 12:54 - 00000000 ____D C:\JRT
2013-06-29 00:35 - 2013-06-29 00:35 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\Fatih\Downloads\JRT.exe
2013-06-29 00:32 - 2013-06-29 12:51 - 00002260 ____A C:\Windows\PFRO.log
2013-06-29 00:30 - 2013-06-29 00:30 - 00005554 ____A C:\AdwCleaner[S1].txt
2013-06-29 00:28 - 2013-06-29 00:28 - 00648201 ____A C:\Users\Fatih\Downloads\adwcleaner.exe
2013-06-29 00:25 - 2013-06-29 00:25 - 00008959 ____A C:\ComboFix.txt
2013-06-29 00:02 - 2011-06-26 08:45 - 00256000 ____A C:\Windows\PEV.exe
2013-06-29 00:02 - 2010-11-07 19:20 - 00208896 ____A C:\Windows\MBR.exe
2013-06-29 00:02 - 2009-04-20 06:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe
2013-06-29 00:02 - 2000-08-31 02:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe
2013-06-29 00:02 - 2000-08-31 02:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe
2013-06-29 00:02 - 2000-08-31 02:00 - 00098816 ____A C:\Windows\sed.exe
2013-06-29 00:02 - 2000-08-31 02:00 - 00080412 ____A C:\Windows\grep.exe
2013-06-29 00:02 - 2000-08-31 02:00 - 00068096 ____A C:\Windows\zip.exe
2013-06-29 00:01 - 2013-06-29 00:25 - 00000000 ____D C:\Qoobox
2013-06-29 00:01 - 2013-06-29 00:22 - 00000000 ____D C:\Windows\erdnt
2013-06-28 23:59 - 2013-06-29 12:04 - 00015744 ____A C:\Users\Fatih\Downloads\Addition.txt
2013-06-28 23:59 - 2013-06-28 23:59 - 05084379 ____R (Swearware) C:\Users\Fatih\Downloads\ComboFix.exe
2013-06-28 23:59 - 2013-06-28 23:59 - 00000000 ____D C:\FRST
2013-06-28 23:57 - 2013-06-28 23:57 - 01371463 ____A (Farbar) C:\Users\Fatih\Downloads\FRST.exe
2013-06-25 11:54 - 2013-06-25 11:56 - 43359164 ____A C:\Users\Fatih\Desktop\goekurs_hs.zip
2013-06-25 11:54 - 2013-06-25 11:54 - 02000290 ____A C:\Users\Fatih\Desktop\Chirurgie 20%.zip
2013-06-25 11:48 - 2013-06-25 11:48 - 00000000 ____D C:\Users\Fatih\Desktop\Umweltmedizin 15%
2013-06-25 11:48 - 2013-06-25 11:48 - 00000000 ____D C:\Users\Fatih\Desktop\Arbeitsmedizin 10%
2013-06-13 20:21 - 2013-05-17 01:08 - 12329984 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-13 20:21 - 2013-05-17 00:49 - 09738752 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-13 20:21 - 2013-05-17 00:39 - 01800704 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-13 20:21 - 2013-05-17 00:28 - 01129472 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-13 20:21 - 2013-05-17 00:28 - 01104384 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-13 20:21 - 2013-05-17 00:27 - 01427968 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-06-13 20:21 - 2013-05-17 00:26 - 00231936 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-06-13 20:21 - 2013-05-17 00:23 - 00065024 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-13 20:21 - 2013-05-17 00:21 - 00717824 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-13 20:21 - 2013-05-17 00:21 - 00142848 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-06-13 20:21 - 2013-05-17 00:20 - 00420864 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-06-13 20:21 - 2013-05-17 00:19 - 00607744 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-13 20:21 - 2013-05-17 00:17 - 01796096 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-13 20:21 - 2013-05-17 00:17 - 00073216 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-06-13 20:21 - 2013-05-17 00:16 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-13 20:21 - 2013-05-17 00:12 - 00176640 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-12 08:02 - 2013-05-08 06:37 - 00905576 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-12 08:02 - 2013-05-02 06:04 - 00443904 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-12 08:02 - 2013-05-02 06:03 - 00037376 ____A (Microsoft Corporation) C:\Windows\System32\printcom.dll
2013-06-12 08:02 - 2013-04-24 06:00 - 00985600 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-12 08:02 - 2013-04-24 06:00 - 00133120 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-12 08:02 - 2013-04-24 06:00 - 00098304 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-12 08:02 - 2013-04-24 06:00 - 00041984 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-12 08:02 - 2013-04-24 03:46 - 00812544 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-12 08:01 - 2013-05-03 00:03 - 03603832 ____A (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2013-06-12 08:01 - 2013-05-03 00:03 - 03551096 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe

==================== One Month Modified Files and Folders ========

2013-06-29 12:58 - 2012-06-13 09:15 - 01452159 ____A C:\Windows\WindowsUpdate.log
2013-06-29 12:57 - 2013-06-29 12:57 - 00000765 ____A C:\Users\Fatih\Desktop\JRT.txt
2013-06-29 12:54 - 2013-06-29 00:35 - 00000000 ____D C:\JRT
2013-06-29 12:52 - 2008-05-26 15:03 - 00177889 ____A C:\Users\Fatih\AppData\Roaming\nvModes.001
2013-06-29 12:52 - 2008-03-09 18:59 - 00000163 ____A C:\Users\Public\Documents\hpqp.ini
2013-06-29 12:51 - 2013-06-29 00:32 - 00002260 ____A C:\Windows\PFRO.log
2013-06-29 12:51 - 2006-11-02 15:01 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-29 12:51 - 2006-11-02 14:47 - 00309376 ____A C:\Windows\System32\FNTCACHE.DAT
2013-06-29 12:51 - 2006-11-02 14:47 - 00003296 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-29 12:51 - 2006-11-02 14:47 - 00003296 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-29 12:50 - 2006-11-02 15:01 - 00032514 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2013-06-29 12:49 - 2013-06-29 12:49 - 00000921 ____A C:\AdwCleaner[S2].txt
2013-06-29 12:45 - 2013-04-18 16:07 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-29 12:31 - 2008-02-22 17:27 - 00000000 ____D C:\Program Files\Hp
2013-06-29 12:04 - 2013-06-28 23:59 - 00015744 ____A C:\Users\Fatih\Downloads\Addition.txt
2013-06-29 12:01 - 2013-06-29 12:01 - 01372101 ____A (Farbar) C:\Users\Fatih\Downloads\FRST(1).exe
2013-06-29 11:52 - 2013-06-29 11:34 - 00028346 ____A C:\Users\Fatih\Desktop\ttt.txt
2013-06-29 11:31 - 2013-06-29 11:31 - 00890988 ____A C:\Users\Fatih\Downloads\SecurityCheck.exe
2013-06-29 09:36 - 2012-06-13 08:58 - 00000000 ____D C:\ProgramData\MFAData
2013-06-29 09:26 - 2013-06-29 09:26 - 02347384 ____A (ESET) C:\Users\Fatih\Downloads\esetsmartinstaller_enu(1).exe
2013-06-29 00:40 - 2013-06-29 00:40 - 02347384 ____A (ESET) C:\Users\Fatih\Downloads\esetsmartinstaller_enu.exe
2013-06-29 00:36 - 2013-06-29 00:36 - 00000000 ____D C:\Windows\ERUNT
2013-06-29 00:35 - 2013-06-29 00:35 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\Fatih\Downloads\JRT.exe
2013-06-29 00:30 - 2013-06-29 00:30 - 00005554 ____A C:\AdwCleaner[S1].txt
2013-06-29 00:30 - 2013-04-10 18:57 - 00000000 ____D C:\Program Files\Common Files\DVDVideoSoft
2013-06-29 00:30 - 2010-01-19 21:12 - 00000000 ____D C:\ProgramData\ICQ
2013-06-29 00:28 - 2013-06-29 00:28 - 00648201 ____A C:\Users\Fatih\Downloads\adwcleaner.exe
2013-06-29 00:25 - 2013-06-29 00:25 - 00008959 ____A C:\ComboFix.txt
2013-06-29 00:25 - 2013-06-29 00:01 - 00000000 ____D C:\Qoobox
2013-06-29 00:25 - 2006-11-02 13:18 - 00000000 __RHD C:\users\Default
2013-06-29 00:25 - 2006-11-02 13:18 - 00000000 ___RD C:\users\Public
2013-06-29 00:22 - 2013-06-29 00:01 - 00000000 ____D C:\Windows\erdnt
2013-06-29 00:15 - 2006-11-02 12:23 - 00000215 ____A C:\Windows\system.ini
2013-06-29 00:04 - 2009-01-31 18:08 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-06-29 00:04 - 2009-01-31 18:08 - 00000000 ____D C:\Program Files\Spybot - Search & Destroy
2013-06-28 23:59 - 2013-06-28 23:59 - 05084379 ____R (Swearware) C:\Users\Fatih\Downloads\ComboFix.exe
2013-06-28 23:59 - 2013-06-28 23:59 - 00000000 ____D C:\FRST
2013-06-28 23:57 - 2013-06-28 23:57 - 01371463 ____A (Farbar) C:\Users\Fatih\Downloads\FRST.exe
2013-06-28 23:16 - 2009-04-30 17:56 - 00000000 ____D C:\Users\Fatih\AppData\Roaming\Skype
2013-06-28 12:58 - 2013-05-08 17:20 - 00000000 ____D C:\Users\Fatih\Desktop\Pharma
2013-06-26 18:06 - 2011-09-16 20:14 - 00000000 ____D C:\Users\Fatih\AppData\Local\CrashDumps
2013-06-25 17:24 - 2008-12-24 22:56 - 00000000 ____D C:\Users\Fatih\AppData\Roaming\DAEMON Tools Lite
2013-06-25 11:56 - 2013-06-25 11:54 - 43359164 ____A C:\Users\Fatih\Desktop\goekurs_hs.zip
2013-06-25 11:54 - 2013-06-25 11:54 - 02000290 ____A C:\Users\Fatih\Desktop\Chirurgie 20%.zip
2013-06-25 11:48 - 2013-06-25 11:48 - 00000000 ____D C:\Users\Fatih\Desktop\Umweltmedizin 15%
2013-06-25 11:48 - 2013-06-25 11:48 - 00000000 ____D C:\Users\Fatih\Desktop\Arbeitsmedizin 10%
2013-06-24 11:26 - 2006-11-02 12:33 - 00004930 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-23 21:48 - 2009-05-10 19:56 - 00000000 ____D C:\Users\Fatih\AppData\Roaming\Winamp
2013-06-17 18:16 - 2009-07-01 00:24 - 00007592 ____A C:\Users\Fatih\AppData\Local\d3d9caps.dat
2013-06-17 12:48 - 2008-05-26 15:03 - 00177889 ____A C:\Users\Fatih\AppData\Roaming\nvModes.dat
2013-06-13 20:44 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\rescache
2013-06-13 20:24 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\System32\de-DE
2013-06-13 20:17 - 2006-11-02 12:24 - 73381792 ____A (Microsoft Corporation) C:\Windows\System32\mrt.exe
2013-06-12 13:45 - 2012-07-17 17:33 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-06-12 13:45 - 2011-12-05 15:37 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-06-29 12:46

==================== End Of Log ============================

--- --- ---

--- --- ---

schrauber · 29.06.2013, 12:16

Supi

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST Log. Noch Probleme?

electrostep · 29.06.2013, 14:36

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=9100b45e26a1a24da64bd2ef68087bb9
# engine=14197
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-06-29 01:23:02
# local_time=2013-06-29 03:23:02 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=1039 16777213 100 92 20789 59646166 0 0
# compatibility_mode=5892 16776574 100 100 32934964 210044910 0 0
# scanned=194193
# found=1
# cleaned=0
# scan_time=7382
sh=9FA5CDE80424CBA9CC88A8DAA305320EB2DD553C ft=0 fh=0000000000000000 vn="a variant of Java/TrojanDownloader.Agent.NAB trojan" ac=I fn="C:\Users\Fatih\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6\4d64fe86-323d7150"

Code:

ATTFilter

Results of screen317's Security Check version 0.99.68  
 Windows Vista Service Pack 2 x86 (UAC is enabled)  
 Internet Explorer 9  
``````````````Antivirus/Firewall Check:`````````````` 
AVG AntiVirus Free Edition 2013   
 Antivirus up to date!  (On Access scanning disabled!) 
`````````Anti-malware/Other Utilities Check:````````` 
 CCleaner     
 JavaFX 2.1.1    
 Java(TM) 6 Update 30  
 Java 7 Update 21  
 Java(TM) 6 Update 2  
 Java version out of Date! 
 Adobe Flash Player 10 Flash Player out of Date! 
 Adobe Flash Player 	11.7.700.224  
 Adobe Reader 8 Adobe Reader out of Date! 
 Mozilla Firefox 21.0 Firefox out of Date!  
````````Process Check: objlist.exe by Laurent````````  
 AVG avgwdsvc.exe 
 AVG avgrsx.exe 
 AVG avgnsx.exe 
 AVG avgemc.exe 
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  % 
````````````````````End of Log``````````````````````

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 29-06-2013
Ran by Fatih (administrator) on 29-06-2013 15:34:48
Running from C:\Users\Fatih\Downloads
Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(AVG Technologies CZ, s.r.o.) C:\PROGRA~1\AVG\AVG2013\avgrsx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgcsrvx.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(Cisco Systems, Inc.) C:\Program Files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe
(Lexmark International, Inc.) C:\Windows\System32\LEXBCES.EXE
(Lexmark International, Inc.) C:\Windows\System32\LEXPPS.EXE
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgwdsvc.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
() C:\Windows\system32\PnkBstrA.exe
() C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgnsx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgemcx.exe
() C:\Program Files\CyberLink\Shared Files\RichVideo.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Conexant Systems, Inc.) C:\Windows\system32\DRIVERS\xaudio.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
(Hewlett-Packard) c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgui.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe
(Farbar) C:\Users\Fatih\Downloads\FRST(1).exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe" [181544 2007-09-30] (CyberLink Corp.)
HKLM\...\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start [202032 2007-09-19] ( Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [OnScreenDisplay] C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe [554320 2007-09-04] ( Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0" [218408 2007-08-17] (CyberLink Corp.)
HKLM\...\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe [311296 2007-01-08] (Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart [86016 2007-09-19] (NVIDIA Corporation)
HKLM\...\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup [8497696 2007-09-19] (NVIDIA Corporation)
HKLM\...\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit [81920 2007-09-19] (NVIDIA Corporation)
HKLM\...\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [40368 2011-08-31] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [937920 2011-03-29] (Adobe Systems Incorporated)
HKLM\...\Run: [AVG_UI] "C:\Program Files\AVG\AVG2013\avgui.exe" /TRAYONLY [4408368 2013-04-29] (AVG Technologies CZ, s.r.o.)
HKLM\...\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" [253816 2013-03-12] (Oracle Corporation)
HKCU\...\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
HKCU\...\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun [357696 2010-04-01] (DT Soft Ltd)
HKCU\...\Policies\system: [DisableRegistryTools] 0
HKCU\...\Policies\system: [DisableTaskMgr] 0
HKU\Default\...\Run: [HPADVISOR] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autoRun [ 2007-10-01] (Hewlett-Packard)
HKU\Default User\...\Run: [HPADVISOR] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autoRun [ 2007-10-01] (Hewlett-Packard)
Startup: C:\ProgramData\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.0.318\SSScheduler.exe (McAfee, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} hxxp://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} hxxp://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
DPF: {5D6F45B3-9043-443D-A792-115447494D24} hxxp://messenger.zone.msn.com/DE-DE/a-UNO1/GAME_UNO1.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} hxxp://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} https://secure.gopetslive.com/dev/GoPetsWeb.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll No File
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Fatih\AppData\Roaming\Mozilla\Firefox\Profiles\2chizomu.default
FF Homepage: https://www.google.de/
FF NetworkProxy: "no_proxies_on", "localhost, 127.0.0.1, stealthy.co"
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF Plugin: @divx.com/DivX Player Plugin,version=1.0.0 - C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF Plugin: @java.com/DTPlugin,version=10.21.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.21.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Extension: No Name - C:\Users\Fatih\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
FF Extension: Microsoft .NET Framework Assistant - C:\Users\Fatih\AppData\Roaming\Mozilla\Firefox\Profiles\2chizomu.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF Extension: TabScroller - C:\Users\Fatih\AppData\Roaming\Mozilla\Firefox\Profiles\2chizomu.default\Extensions\{DDD48E21-B5C2-46da-9EAE-E2046AD5CC9E}
FF Extension: No Name - C:\Users\Fatih\AppData\Roaming\Mozilla\Firefox\Profiles\2chizomu.default\Extensions\{E6C1199F-E687-42da-8C24-E7770CC3AE66}.xpi
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

========================== Services (Whitelisted) =================

R2 AVGIDSAgent; C:\Program Files\AVG\AVG2013\avgidsagent.exe [4937264 2013-05-14] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files\AVG\AVG2013\avgwdsvc.exe [283136 2013-04-18] (AVG Technologies CZ, s.r.o.)
S3 Com4Qlb; C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe [110592 2007-03-05] (Hewlett-Packard Development Company, L.P.)
R2 HP Health Check Service; c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [65536 2007-09-19] (Hewlett-Packard)
R2 LexBceS; C:\Windows\System32\LEXBCES.EXE [300544 2002-03-08] (Lexmark International, Inc.)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.)
R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [66872 2008-09-22] ()
R2 QPCapSvc; C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe [271760 2007-09-30] ()
S2 QPSched; C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe [112016 2007-09-30] ()
R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [272024 2007-01-09] ()

==================== Drivers (Whitelisted) ====================

R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdriverx.sys [208184 2013-03-29] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHX; C:\Windows\System32\DRIVERS\avgidshx.sys [60216 2013-02-08] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSShim; C:\Windows\System32\DRIVERS\avgidsshimx.sys [22328 2013-03-01] (AVG Technologies CZ, s.r.o.)
R1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [170808 2013-02-08] (AVG Technologies CZ, s.r.o.)
R0 Avglogx; C:\Windows\System32\DRIVERS\avglogx.sys [245048 2013-02-08] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx86; C:\Windows\System32\DRIVERS\avgmfx86.sys [96568 2013-02-08] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx86; C:\Windows\System32\DRIVERS\avgrkx86.sys [39224 2013-02-08] (AVG Technologies CZ, s.r.o.)
R1 Avgtdix; C:\Windows\System32\DRIVERS\avgtdix.sys [182072 2013-03-21] (AVG Technologies CZ, s.r.o.)
R3 HdAudAddService; C:\Windows\System32\drivers\CHDART.sys [176640 2007-09-10] (Conexant Systems Inc.)
R3 HpqRemHid; C:\Windows\System32\DRIVERS\HpqRemHid.sys [7168 2007-07-11] (Hewlett-Packard Development Company, L.P.)
S3 s0016bus; C:\Windows\System32\DRIVERS\s0016bus.sys [89256 2008-05-16] (MCCI Corporation)
S3 s0016mdfl; C:\Windows\System32\DRIVERS\s0016mdfl.sys [15016 2008-05-16] (MCCI Corporation)
S3 s0016mdm; C:\Windows\System32\DRIVERS\s0016mdm.sys [120744 2008-05-16] (MCCI Corporation)
S3 s0016mgmt; C:\Windows\System32\DRIVERS\s0016mgmt.sys [114216 2008-05-16] (MCCI Corporation)
S3 s0016nd5; C:\Windows\System32\DRIVERS\s0016nd5.sys [25512 2008-05-16] (MCCI Corporation)
S3 s0016obex; C:\Windows\System32\DRIVERS\s0016obex.sys [110632 2008-05-16] (MCCI Corporation)
S3 s0016unic; C:\Windows\System32\DRIVERS\s0016unic.sys [115752 2008-05-16] (MCCI Corporation)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [691696 2010-10-05] ()
U3 a67g551c; C:\Windows\System32\Drivers\a67g551c.sys [0 ] (Microsoft Corporation)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]
S3 catchme; \??\C:\Users\Fatih\AppData\Local\Temp\catchme.sys [x]
U1 eabfiltr; 
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
S3 SymIM; system32\DRIVERS\SymIM.sys [x]
S3 SymIMMP; system32\DRIVERS\SymIM.sys [x]
S3 USBAAPL; System32\Drivers\usbaapl.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-06-29 15:26 - 2013-06-29 15:26 - 00000937 ____A C:\Users\Fatih\Desktop\eset.txt
2013-06-29 13:18 - 2013-06-29 13:18 - 02347384 ____A (ESET) C:\Users\Fatih\Downloads\esetsmartinstaller_enu(2).exe
2013-06-29 12:49 - 2013-06-29 12:49 - 00000921 ____A C:\AdwCleaner[S2].txt
2013-06-29 12:01 - 2013-06-29 12:01 - 01372101 ____A (Farbar) C:\Users\Fatih\Downloads\FRST(1).exe
2013-06-29 11:34 - 2013-06-29 11:52 - 00028346 ____A C:\Users\Fatih\Desktop\ttt.txt
2013-06-29 11:31 - 2013-06-29 11:31 - 00890988 ____A C:\Users\Fatih\Downloads\SecurityCheck.exe
2013-06-29 09:26 - 2013-06-29 09:26 - 02347384 ____A (ESET) C:\Users\Fatih\Downloads\esetsmartinstaller_enu(1).exe
2013-06-29 00:40 - 2013-06-29 00:40 - 02347384 ____A (ESET) C:\Users\Fatih\Downloads\esetsmartinstaller_enu.exe
2013-06-29 00:36 - 2013-06-29 00:36 - 00000000 ____D C:\Windows\ERUNT
2013-06-29 00:35 - 2013-06-29 12:54 - 00000000 ____D C:\JRT
2013-06-29 00:35 - 2013-06-29 00:35 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\Fatih\Downloads\JRT.exe
2013-06-29 00:32 - 2013-06-29 12:51 - 00002260 ____A C:\Windows\PFRO.log
2013-06-29 00:30 - 2013-06-29 00:30 - 00005554 ____A C:\AdwCleaner[S1].txt
2013-06-29 00:28 - 2013-06-29 00:28 - 00648201 ____A C:\Users\Fatih\Downloads\adwcleaner.exe
2013-06-29 00:25 - 2013-06-29 00:25 - 00008959 ____A C:\ComboFix.txt
2013-06-29 00:02 - 2011-06-26 08:45 - 00256000 ____A C:\Windows\PEV.exe
2013-06-29 00:02 - 2010-11-07 19:20 - 00208896 ____A C:\Windows\MBR.exe
2013-06-29 00:02 - 2009-04-20 06:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe
2013-06-29 00:02 - 2000-08-31 02:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe
2013-06-29 00:02 - 2000-08-31 02:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe
2013-06-29 00:02 - 2000-08-31 02:00 - 00098816 ____A C:\Windows\sed.exe
2013-06-29 00:02 - 2000-08-31 02:00 - 00080412 ____A C:\Windows\grep.exe
2013-06-29 00:02 - 2000-08-31 02:00 - 00068096 ____A C:\Windows\zip.exe
2013-06-29 00:01 - 2013-06-29 00:25 - 00000000 ____D C:\Qoobox
2013-06-29 00:01 - 2013-06-29 00:22 - 00000000 ____D C:\Windows\erdnt
2013-06-28 23:59 - 2013-06-29 12:04 - 00015744 ____A C:\Users\Fatih\Downloads\Addition.txt
2013-06-28 23:59 - 2013-06-28 23:59 - 05084379 ____R (Swearware) C:\Users\Fatih\Downloads\ComboFix.exe
2013-06-28 23:59 - 2013-06-28 23:59 - 00000000 ____D C:\FRST
2013-06-28 23:57 - 2013-06-28 23:57 - 01371463 ____A (Farbar) C:\Users\Fatih\Downloads\FRST.exe
2013-06-25 11:54 - 2013-06-25 11:56 - 43359164 ____A C:\Users\Fatih\Desktop\goekurs_hs.zip
2013-06-25 11:54 - 2013-06-25 11:54 - 02000290 ____A C:\Users\Fatih\Desktop\Chirurgie 20%.zip
2013-06-25 11:48 - 2013-06-25 11:48 - 00000000 ____D C:\Users\Fatih\Desktop\Umweltmedizin 15%
2013-06-25 11:48 - 2013-06-25 11:48 - 00000000 ____D C:\Users\Fatih\Desktop\Arbeitsmedizin 10%
2013-06-13 20:21 - 2013-05-17 01:08 - 12329984 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-13 20:21 - 2013-05-17 00:49 - 09738752 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-13 20:21 - 2013-05-17 00:39 - 01800704 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-13 20:21 - 2013-05-17 00:28 - 01129472 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-13 20:21 - 2013-05-17 00:28 - 01104384 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-13 20:21 - 2013-05-17 00:27 - 01427968 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-06-13 20:21 - 2013-05-17 00:26 - 00231936 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-06-13 20:21 - 2013-05-17 00:23 - 00065024 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-13 20:21 - 2013-05-17 00:21 - 00717824 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-13 20:21 - 2013-05-17 00:21 - 00142848 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-06-13 20:21 - 2013-05-17 00:20 - 00420864 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-06-13 20:21 - 2013-05-17 00:19 - 00607744 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-13 20:21 - 2013-05-17 00:17 - 01796096 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-13 20:21 - 2013-05-17 00:17 - 00073216 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-06-13 20:21 - 2013-05-17 00:16 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-13 20:21 - 2013-05-17 00:12 - 00176640 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-12 08:02 - 2013-05-08 06:37 - 00905576 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-12 08:02 - 2013-05-02 06:04 - 00443904 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-12 08:02 - 2013-05-02 06:03 - 00037376 ____A (Microsoft Corporation) C:\Windows\System32\printcom.dll
2013-06-12 08:02 - 2013-04-24 06:00 - 00985600 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-12 08:02 - 2013-04-24 06:00 - 00133120 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-12 08:02 - 2013-04-24 06:00 - 00098304 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-12 08:02 - 2013-04-24 06:00 - 00041984 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-12 08:02 - 2013-04-24 03:46 - 00812544 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-12 08:01 - 2013-05-03 00:03 - 03603832 ____A (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2013-06-12 08:01 - 2013-05-03 00:03 - 03551096 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe

==================== One Month Modified Files and Folders ========

2013-06-29 15:29 - 2008-05-26 15:03 - 00177889 ____A C:\Users\Fatih\AppData\Roaming\nvModes.001
2013-06-29 15:29 - 2008-03-09 18:59 - 00000163 ____A C:\Users\Public\Documents\hpqp.ini
2013-06-29 15:26 - 2013-06-29 15:26 - 00000937 ____A C:\Users\Fatih\Desktop\eset.txt
2013-06-29 14:51 - 2006-11-02 14:47 - 00003296 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-29 14:51 - 2006-11-02 14:47 - 00003296 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-29 14:45 - 2013-04-18 16:07 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-29 13:18 - 2013-06-29 13:18 - 02347384 ____A (ESET) C:\Users\Fatih\Downloads\esetsmartinstaller_enu(2).exe
2013-06-29 12:58 - 2012-06-13 09:15 - 01452159 ____A C:\Windows\WindowsUpdate.log
2013-06-29 12:54 - 2013-06-29 00:35 - 00000000 ____D C:\JRT
2013-06-29 12:51 - 2013-06-29 00:32 - 00002260 ____A C:\Windows\PFRO.log
2013-06-29 12:51 - 2006-11-02 15:01 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-29 12:51 - 2006-11-02 14:47 - 00309376 ____A C:\Windows\System32\FNTCACHE.DAT
2013-06-29 12:50 - 2006-11-02 15:01 - 00032514 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2013-06-29 12:49 - 2013-06-29 12:49 - 00000921 ____A C:\AdwCleaner[S2].txt
2013-06-29 12:31 - 2008-02-22 17:27 - 00000000 ____D C:\Program Files\Hp
2013-06-29 12:04 - 2013-06-28 23:59 - 00015744 ____A C:\Users\Fatih\Downloads\Addition.txt
2013-06-29 12:01 - 2013-06-29 12:01 - 01372101 ____A (Farbar) C:\Users\Fatih\Downloads\FRST(1).exe
2013-06-29 11:52 - 2013-06-29 11:34 - 00028346 ____A C:\Users\Fatih\Desktop\ttt.txt
2013-06-29 11:31 - 2013-06-29 11:31 - 00890988 ____A C:\Users\Fatih\Downloads\SecurityCheck.exe
2013-06-29 09:36 - 2012-06-13 08:58 - 00000000 ____D C:\ProgramData\MFAData
2013-06-29 09:26 - 2013-06-29 09:26 - 02347384 ____A (ESET) C:\Users\Fatih\Downloads\esetsmartinstaller_enu(1).exe
2013-06-29 00:40 - 2013-06-29 00:40 - 02347384 ____A (ESET) C:\Users\Fatih\Downloads\esetsmartinstaller_enu.exe
2013-06-29 00:36 - 2013-06-29 00:36 - 00000000 ____D C:\Windows\ERUNT
2013-06-29 00:35 - 2013-06-29 00:35 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\Fatih\Downloads\JRT.exe
2013-06-29 00:30 - 2013-06-29 00:30 - 00005554 ____A C:\AdwCleaner[S1].txt
2013-06-29 00:30 - 2013-04-10 18:57 - 00000000 ____D C:\Program Files\Common Files\DVDVideoSoft
2013-06-29 00:30 - 2010-01-19 21:12 - 00000000 ____D C:\ProgramData\ICQ
2013-06-29 00:28 - 2013-06-29 00:28 - 00648201 ____A C:\Users\Fatih\Downloads\adwcleaner.exe
2013-06-29 00:25 - 2013-06-29 00:25 - 00008959 ____A C:\ComboFix.txt
2013-06-29 00:25 - 2013-06-29 00:01 - 00000000 ____D C:\Qoobox
2013-06-29 00:25 - 2006-11-02 13:18 - 00000000 __RHD C:\users\Default
2013-06-29 00:25 - 2006-11-02 13:18 - 00000000 ___RD C:\users\Public
2013-06-29 00:22 - 2013-06-29 00:01 - 00000000 ____D C:\Windows\erdnt
2013-06-29 00:15 - 2006-11-02 12:23 - 00000215 ____A C:\Windows\system.ini
2013-06-29 00:04 - 2009-01-31 18:08 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-06-29 00:04 - 2009-01-31 18:08 - 00000000 ____D C:\Program Files\Spybot - Search & Destroy
2013-06-28 23:59 - 2013-06-28 23:59 - 05084379 ____R (Swearware) C:\Users\Fatih\Downloads\ComboFix.exe
2013-06-28 23:59 - 2013-06-28 23:59 - 00000000 ____D C:\FRST
2013-06-28 23:57 - 2013-06-28 23:57 - 01371463 ____A (Farbar) C:\Users\Fatih\Downloads\FRST.exe
2013-06-28 23:16 - 2009-04-30 17:56 - 00000000 ____D C:\Users\Fatih\AppData\Roaming\Skype
2013-06-28 12:58 - 2013-05-08 17:20 - 00000000 ____D C:\Users\Fatih\Desktop\Pharma
2013-06-26 18:06 - 2011-09-16 20:14 - 00000000 ____D C:\Users\Fatih\AppData\Local\CrashDumps
2013-06-25 17:24 - 2008-12-24 22:56 - 00000000 ____D C:\Users\Fatih\AppData\Roaming\DAEMON Tools Lite
2013-06-25 11:56 - 2013-06-25 11:54 - 43359164 ____A C:\Users\Fatih\Desktop\goekurs_hs.zip
2013-06-25 11:54 - 2013-06-25 11:54 - 02000290 ____A C:\Users\Fatih\Desktop\Chirurgie 20%.zip
2013-06-25 11:48 - 2013-06-25 11:48 - 00000000 ____D C:\Users\Fatih\Desktop\Umweltmedizin 15%
2013-06-25 11:48 - 2013-06-25 11:48 - 00000000 ____D C:\Users\Fatih\Desktop\Arbeitsmedizin 10%
2013-06-24 11:26 - 2006-11-02 12:33 - 00004930 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-23 21:48 - 2009-05-10 19:56 - 00000000 ____D C:\Users\Fatih\AppData\Roaming\Winamp
2013-06-17 18:16 - 2009-07-01 00:24 - 00007592 ____A C:\Users\Fatih\AppData\Local\d3d9caps.dat
2013-06-17 12:48 - 2008-05-26 15:03 - 00177889 ____A C:\Users\Fatih\AppData\Roaming\nvModes.dat
2013-06-13 20:44 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\rescache
2013-06-13 20:24 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\System32\de-DE
2013-06-13 20:17 - 2006-11-02 12:24 - 73381792 ____A (Microsoft Corporation) C:\Windows\System32\mrt.exe
2013-06-12 13:45 - 2012-07-17 17:33 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-06-12 13:45 - 2011-12-05 15:37 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-06-29 12:59

==================== End Of Log ============================

--- --- ---

--- --- ---

schrauber · 29.06.2013, 14:37

Java, Flash, Adobe und Firefox updaten.

Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop.
Schließe nun alle offenen Programme und trenne Dich von dem Internet.
Doppelklick auf die TFC.exe und drücke auf Start.
Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen.

Noch Probleme?

electrostep · 29.06.2013, 15:10

Code:

ATTFilter

Getting user folders.
 
Stopping running processes.
 
Emptying Temp folders.
 
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Fatih
->Temp folder emptied: 4475416 bytes
->Temporary Internet Files folder emptied: 4389995 bytes
->Java cache emptied: 13303487 bytes
->FireFox cache emptied: 93845050 bytes
->Flash cache emptied: 1257 bytes
 
User: Public
->Temp folder emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 476 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 6189503 bytes
%systemroot%\system32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 25494342 bytes
 
Emptying RecycleBin. Do not interrupt.
 
RecycleBin emptied: 245933 bytes
Process complete!
 
Total Files Cleaned = 141,00 mb

Hat sich das jetzt erledigt?

Hab die Sachen geupdated.

schrauber · 29.06.2013, 15:10

Hast Du noch Probleme mit dem Rechner?

electrostep · 29.06.2013, 15:14

SpyBot - Search & Destroy ist nicht mehr auf meinem Laptop

Ist das normal?
Wollte es durchlaufen lassen und gucken ob dieses anchor.hss noch auftaucht.

schrauber · 29.06.2013, 18:56

Hm, keine ahnung. Aber den Müll braucht kein Mensch

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

electrostep · 29.06.2013, 20:07

Vielen Dank! Hast mir super geholfen!

schrauber · 29.06.2013, 21:38

Gern Geschehen

29.06.2013, 15:10	#10
schrauber /// the machine /// TB-Ausbilder	Logfile bezüglich des Anchor.hss Hast Du noch Probleme mit dem Rechner? __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

29.06.2013, 21:38	#14
schrauber /// the machine /// TB-Ausbilder	Logfile bezüglich des Anchor.hss Gern Geschehen __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Logfile bezüglich des Anchor.hss

Log-Analyse und Auswertung: Logfile bezüglich des Anchor.hss