Logfile bezüglich des Anchor.hss

electrostep

Ich hoffe, dass ich das richtige Poste und nicht das ich in ein Unterforum müsste???

Nun ja, ich habe gestern bzw. heute Nacht meinen Spybot laufen lassen und habe die Meldung bekommen, dass ich dieses anchor-hss auf meinem Laptop habe.

Hab´s gegoogelt und bin auf eure Seite gestoßen und da der Fall schon einmal bei euch beschrieben wurde und ich bis zum Punkt Eset Smartinstaller und SecurityCheck alles befolgt habe ist mir aufgefallen, dass diese Logfiles ja spezifisches für jeden PC bzw. für jeden Recher sind (was ich erst zur späteren Stunde verstanden habe ) und ich beim nächsten Punkt, dass man TFC runterladen und den Code von der Box einfügen solle, ich gar nicht weiß, was ich da überhaupt löschen soll... Daher wollte ich hier mal meine Logfiles einfügen:

Logfile von ESET Online Scanner:

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=9100b45e26a1a24da64bd2ef68087bb9
# engine=14194
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-06-29 09:27:55
# local_time=2013-06-29 11:27:55 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=1039 16777213 100 92 56805 59632059 0 0
# compatibility_mode=5892 16776574 100 100 32920857 210030803 0 0
# scanned=194254
# found=1
# cleaned=0
# scan_time=7127
sh=9FA5CDE80424CBA9CC88A8DAA305320EB2DD553C ft=0 fh=0000000000000000 vn="a variant of Java/TrojanDownloader.Agent.NAB trojan" ac=I fn="C:\Users\Fatih\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6\4d64fe86-323d7150"


Textdokument von SecurityCheck:

Results of screen317's Security Check version 0.99.68
Windows Vista Service Pack 2 x86 (UAC is enabled)
Internet Explorer 9
``````````````Antivirus/Firewall Check:``````````````
AVG AntiVirus Free Edition 2013
Antivirus up to date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
CCleaner
JavaFX 2.1.1
Java(TM) 6 Update 30
Java 7 Update 21
Java(TM) 6 Update 2
Java version out of Date!
Adobe Flash Player 10 Flash Player out of Date!
Adobe Flash Player 11.7.700.224
Adobe Reader 8 Adobe Reader out of Date!
Mozilla Firefox 21.0 Firefox out of Date!
````````Process Check: objlist.exe by Laurent````````
AVG avgwdsvc.exe
AVG avgrsx.exe
AVG avgnsx.exe
AVG avgemc.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: %
````````````````````End of Log``````````````````````


frisches FRST Log:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 27-06-2013
Ran by Fatih (administrator) on 29-06-2013 11:46:32
Running from C:\Users\Fatih\Downloads
Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(AVG Technologies CZ, s.r.o.) C:\PROGRA~1\AVG\AVG2013\avgrsx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgcsrvx.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(Cisco Systems, Inc.) C:\Program Files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe
(Lexmark International, Inc.) C:\Windows\System32\LEXBCES.EXE
(Lexmark International, Inc.) C:\Windows\System32\LEXPPS.EXE
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgwdsvc.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
() C:\Windows\system32\PnkBstrA.exe
() C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
() C:\Program Files\CyberLink\Shared Files\RichVideo.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Conexant Systems, Inc.) C:\Windows\system32\DRIVERS\xaudio.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgnsx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgemcx.exe
(Hewlett-Packard) c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgcsrvx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgui.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe" [181544 2007-09-30] (CyberLink Corp.)
HKLM\...\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start [202032 2007-09-19] ( Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [OnScreenDisplay] C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe [554320 2007-09-04] ( Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0" [218408 2007-08-17] (CyberLink Corp.)
HKLM\...\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [49152 2005-02-17] (Hewlett-Packard Co.)
HKLM\...\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe [311296 2007-01-08] (Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart [86016 2007-09-19] (NVIDIA Corporation)
HKLM\...\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup [8497696 2007-09-19] (NVIDIA Corporation)
HKLM\...\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit [81920 2007-09-19] (NVIDIA Corporation)
HKLM\...\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [40368 2011-08-31] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [937920 2011-03-29] (Adobe Systems Incorporated)
HKLM\...\Run: [AVG_UI] "C:\Program Files\AVG\AVG2013\avgui.exe" /TRAYONLY [4408368 2013-04-29] (AVG Technologies CZ, s.r.o.)
HKLM\...\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" [253816 2013-03-12] (Oracle Corporation)
HKCU\...\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
HKCU\...\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun [357696 2010-04-01] (DT Soft Ltd)
HKCU\...\Policies\system: [DisableRegistryTools] 0
HKCU\...\Policies\system: [DisableTaskMgr] 0
HKU\Default\...\Run: [HPADVISOR] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autoRun [ 2007-10-01] (Hewlett-Packard)
HKU\Default User\...\Run: [HPADVISOR] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autoRun [ 2007-10-01] (Hewlett-Packard)
Startup: C:\ProgramData\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.0.318\SSScheduler.exe (McAfee, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} hxxp://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} hxxp://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
DPF: {5D6F45B3-9043-443D-A792-115447494D24} hxxp://messenger.zone.msn.com/DE-DE/a-UNO1/GAME_UNO1.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} hxxp://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} https://secure.gopetslive.com/dev/GoPetsWeb.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll No File
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Fatih\AppData\Roaming\Mozilla\Firefox\Profiles\2chizomu.default
FF Homepage: https://www.google.de/
FF NetworkProxy: "no_proxies_on", "localhost, 127.0.0.1, stealthy.co"
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF Plugin: @divx.com/DivX Player Plugin,version=1.0.0 - C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF Plugin: @java.com/DTPlugin,version=10.21.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.21.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Extension: No Name - C:\Users\Fatih\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
FF Extension: Microsoft .NET Framework Assistant - C:\Users\Fatih\AppData\Roaming\Mozilla\Firefox\Profiles\2chizomu.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF Extension: TabScroller - C:\Users\Fatih\AppData\Roaming\Mozilla\Firefox\Profiles\2chizomu.default\Extensions\{DDD48E21-B5C2-46da-9EAE-E2046AD5CC9E}
FF Extension: No Name - C:\Users\Fatih\AppData\Roaming\Mozilla\Firefox\Profiles\2chizomu.default\Extensions\{E6C1199F-E687-42da-8C24-E7770CC3AE66}.xpi
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF HKLM\...\Mozilla Firefox 21.0\Extensions: [Components] C:\Program Files\Mozilla Firefox\components
FF Extension: No Name - C:\Program Files\Mozilla Firefox\components
FF HKLM\...\Mozilla Firefox 21.0\Extensions: [Plugins] C:\Program Files\Mozilla Firefox\plugins
FF Extension: No Name - C:\Program Files\Mozilla Firefox\plugins
FF HKCU\...\Mozilla Firefox 21.0\Extensions: [Components] C:\Program Files\Mozilla Firefox\components
FF Extension: No Name - C:\Program Files\Mozilla Firefox\components
FF HKCU\...\Mozilla Firefox 21.0\Extensions: [Plugins] C:\Program Files\Mozilla Firefox\plugins
FF Extension: No Name - C:\Program Files\Mozilla Firefox\plugins

========================== Services (Whitelisted) =================

R2 AVGIDSAgent; C:\Program Files\AVG\AVG2013\avgidsagent.exe [4937264 2013-05-14] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files\AVG\AVG2013\avgwdsvc.exe [283136 2013-04-18] (AVG Technologies CZ, s.r.o.)
S3 Com4Qlb; C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe [110592 2007-03-05] (Hewlett-Packard Development Company, L.P.)
R2 HP Health Check Service; c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [65536 2007-09-19] (Hewlett-Packard)
R2 LexBceS; C:\Windows\System32\LEXBCES.EXE [300544 2002-03-08] (Lexmark International, Inc.)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.)
R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [66872 2008-09-22] ()
R2 QPCapSvc; C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe [271760 2007-09-30] ()
S2 QPSched; C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe [112016 2007-09-30] ()
R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [272024 2007-01-09] ()

==================== Drivers (Whitelisted) ====================

R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdriverx.sys [208184 2013-03-29] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHX; C:\Windows\System32\DRIVERS\avgidshx.sys [60216 2013-02-08] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSShim; C:\Windows\System32\DRIVERS\avgidsshimx.sys [22328 2013-03-01] (AVG Technologies CZ, s.r.o.)
R1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [170808 2013-02-08] (AVG Technologies CZ, s.r.o.)
R0 Avglogx; C:\Windows\System32\DRIVERS\avglogx.sys [245048 2013-02-08] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx86; C:\Windows\System32\DRIVERS\avgmfx86.sys [96568 2013-02-08] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx86; C:\Windows\System32\DRIVERS\avgrkx86.sys [39224 2013-02-08] (AVG Technologies CZ, s.r.o.)
R1 Avgtdix; C:\Windows\System32\DRIVERS\avgtdix.sys [182072 2013-03-21] (AVG Technologies CZ, s.r.o.)
R3 HdAudAddService; C:\Windows\System32\drivers\CHDART.sys [176640 2007-09-10] (Conexant Systems Inc.)
R3 HpqRemHid; C:\Windows\System32\DRIVERS\HpqRemHid.sys [7168 2007-07-11] (Hewlett-Packard Development Company, L.P.)
S3 s0016bus; C:\Windows\System32\DRIVERS\s0016bus.sys [89256 2008-05-16] (MCCI Corporation)
S3 s0016mdfl; C:\Windows\System32\DRIVERS\s0016mdfl.sys [15016 2008-05-16] (MCCI Corporation)
S3 s0016mdm; C:\Windows\System32\DRIVERS\s0016mdm.sys [120744 2008-05-16] (MCCI Corporation)
S3 s0016mgmt; C:\Windows\System32\DRIVERS\s0016mgmt.sys [114216 2008-05-16] (MCCI Corporation)
S3 s0016nd5; C:\Windows\System32\DRIVERS\s0016nd5.sys [25512 2008-05-16] (MCCI Corporation)
S3 s0016obex; C:\Windows\System32\DRIVERS\s0016obex.sys [110632 2008-05-16] (MCCI Corporation)
S3 s0016unic; C:\Windows\System32\DRIVERS\s0016unic.sys [115752 2008-05-16] (MCCI Corporation)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [691696 2010-10-05] ()
U3 aegq55ud; C:\Windows\System32\Drivers\aegq55ud.sys [0 ] (Microsoft Corporation)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]
S3 catchme; \??\C:\Users\Fatih\AppData\Local\Temp\catchme.sys [x]
U1 eabfiltr;
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
S3 SymIM; system32\DRIVERS\SymIM.sys [x]
S3 SymIMMP; system32\DRIVERS\SymIM.sys [x]
S3 USBAAPL; System32\Drivers\usbaapl.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-06-29 11:34 - 2013-06-29 11:34 - 00002071 ____A C:\Users\Fatih\Desktop\ttt.txt
2013-06-29 11:31 - 2013-06-29 11:31 - 00890988 ____A C:\Users\Fatih\Downloads\SecurityCheck.exe
2013-06-29 09:26 - 2013-06-29 09:26 - 02347384 ____A (ESET) C:\Users\Fatih\Downloads\esetsmartinstaller_enu(1).exe
2013-06-29 00:40 - 2013-06-29 00:40 - 02347384 ____A (ESET) C:\Users\Fatih\Downloads\esetsmartinstaller_enu.exe
2013-06-29 00:38 - 2013-06-29 00:38 - 00033587 ____A C:\Users\Fatih\Desktop\JRT.txt
2013-06-29 00:36 - 2013-06-29 00:36 - 00000000 ____D C:\Windows\ERUNT
2013-06-29 00:35 - 2013-06-29 00:35 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\Fatih\Downloads\JRT.exe
2013-06-29 00:35 - 2013-06-29 00:35 - 00000000 ____D C:\JRT
2013-06-29 00:32 - 2013-06-29 00:32 - 00000770 ____A C:\Windows\PFRO.log
2013-06-29 00:30 - 2013-06-29 00:30 - 00005554 ____A C:\AdwCleaner[S1].txt
2013-06-29 00:28 - 2013-06-29 00:28 - 00648201 ____A C:\Users\Fatih\Downloads\adwcleaner.exe
2013-06-29 00:25 - 2013-06-29 00:25 - 00008959 ____A C:\ComboFix.txt
2013-06-29 00:02 - 2011-06-26 08:45 - 00256000 ____A C:\Windows\PEV.exe
2013-06-29 00:02 - 2010-11-07 19:20 - 00208896 ____A C:\Windows\MBR.exe
2013-06-29 00:02 - 2009-04-20 06:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe
2013-06-29 00:02 - 2000-08-31 02:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe
2013-06-29 00:02 - 2000-08-31 02:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe
2013-06-29 00:02 - 2000-08-31 02:00 - 00098816 ____A C:\Windows\sed.exe
2013-06-29 00:02 - 2000-08-31 02:00 - 00080412 ____A C:\Windows\grep.exe
2013-06-29 00:02 - 2000-08-31 02:00 - 00068096 ____A C:\Windows\zip.exe
2013-06-29 00:01 - 2013-06-29 00:25 - 00000000 ____D C:\Qoobox
2013-06-29 00:01 - 2013-06-29 00:22 - 00000000 ____D C:\Windows\erdnt
2013-06-28 23:59 - 2013-06-29 00:00 - 00020117 ____A C:\Users\Fatih\Downloads\Addition.txt
2013-06-28 23:59 - 2013-06-28 23:59 - 05084379 ____R (Swearware) C:\Users\Fatih\Downloads\ComboFix.exe
2013-06-28 23:59 - 2013-06-28 23:59 - 00000000 ____D C:\FRST
2013-06-28 23:57 - 2013-06-28 23:57 - 01371463 ____A (Farbar) C:\Users\Fatih\Downloads\FRST.exe
2013-06-25 11:54 - 2013-06-25 11:56 - 43359164 ____A C:\Users\Fatih\Desktop\goekurs_hs.zip
2013-06-25 11:54 - 2013-06-25 11:54 - 02000290 ____A C:\Users\Fatih\Desktop\Chirurgie 20%.zip
2013-06-25 11:48 - 2013-06-25 11:48 - 00000000 ____D C:\Users\Fatih\Desktop\Umweltmedizin 15%
2013-06-25 11:48 - 2013-06-25 11:48 - 00000000 ____D C:\Users\Fatih\Desktop\Arbeitsmedizin 10%
2013-06-13 20:21 - 2013-05-17 01:08 - 12329984 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-13 20:21 - 2013-05-17 00:49 - 09738752 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-13 20:21 - 2013-05-17 00:39 - 01800704 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-13 20:21 - 2013-05-17 00:28 - 01129472 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-13 20:21 - 2013-05-17 00:28 - 01104384 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-13 20:21 - 2013-05-17 00:27 - 01427968 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-06-13 20:21 - 2013-05-17 00:26 - 00231936 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-06-13 20:21 - 2013-05-17 00:23 - 00065024 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-13 20:21 - 2013-05-17 00:21 - 00717824 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-13 20:21 - 2013-05-17 00:21 - 00142848 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-06-13 20:21 - 2013-05-17 00:20 - 00420864 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-06-13 20:21 - 2013-05-17 00:19 - 00607744 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-13 20:21 - 2013-05-17 00:17 - 01796096 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-13 20:21 - 2013-05-17 00:17 - 00073216 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-06-13 20:21 - 2013-05-17 00:16 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-13 20:21 - 2013-05-17 00:12 - 00176640 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-12 08:02 - 2013-05-08 06:37 - 00905576 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-12 08:02 - 2013-05-02 06:04 - 00443904 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-12 08:02 - 2013-05-02 06:03 - 00037376 ____A (Microsoft Corporation) C:\Windows\System32\printcom.dll
2013-06-12 08:02 - 2013-04-24 06:00 - 00985600 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-12 08:02 - 2013-04-24 06:00 - 00133120 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-12 08:02 - 2013-04-24 06:00 - 00098304 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-12 08:02 - 2013-04-24 06:00 - 00041984 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-12 08:02 - 2013-04-24 03:46 - 00812544 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-12 08:01 - 2013-05-03 00:03 - 03603832 ____A (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2013-06-12 08:01 - 2013-05-03 00:03 - 03551096 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe

==================== One Month Modified Files and Folders ========

2013-06-29 11:45 - 2013-04-18 16:07 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-29 11:40 - 2008-05-26 15:03 - 00177889 ____A C:\Users\Fatih\AppData\Roaming\nvModes.001
2013-06-29 11:40 - 2008-03-09 18:59 - 00000163 ____A C:\Users\Public\Documents\hpqp.ini
2013-06-29 11:34 - 2013-06-29 11:34 - 00002071 ____A C:\Users\Fatih\Desktop\ttt.txt
2013-06-29 11:31 - 2013-06-29 11:31 - 00890988 ____A C:\Users\Fatih\Downloads\SecurityCheck.exe
2013-06-29 11:22 - 2006-11-02 14:47 - 00003296 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-29 11:22 - 2006-11-02 14:47 - 00003296 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-29 10:00 - 2012-06-13 09:15 - 01440191 ____A C:\Windows\WindowsUpdate.log
2013-06-29 09:36 - 2012-06-13 08:58 - 00000000 ____D C:\ProgramData\MFAData
2013-06-29 09:26 - 2013-06-29 09:26 - 02347384 ____A (ESET) C:\Users\Fatih\Downloads\esetsmartinstaller_enu(1).exe
2013-06-29 00:40 - 2013-06-29 00:40 - 02347384 ____A (ESET) C:\Users\Fatih\Downloads\esetsmartinstaller_enu.exe
2013-06-29 00:38 - 2013-06-29 00:38 - 00033587 ____A C:\Users\Fatih\Desktop\JRT.txt
2013-06-29 00:36 - 2013-06-29 00:36 - 00000000 ____D C:\Windows\ERUNT
2013-06-29 00:35 - 2013-06-29 00:35 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\Fatih\Downloads\JRT.exe
2013-06-29 00:35 - 2013-06-29 00:35 - 00000000 ____D C:\JRT
2013-06-29 00:32 - 2013-06-29 00:32 - 00000770 ____A C:\Windows\PFRO.log
2013-06-29 00:32 - 2006-11-02 15:01 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-29 00:31 - 2006-11-02 15:01 - 00032514 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2013-06-29 00:30 - 2013-06-29 00:30 - 00005554 ____A C:\AdwCleaner[S1].txt
2013-06-29 00:30 - 2013-04-10 18:57 - 00000000 ____D C:\Program Files\Common Files\DVDVideoSoft
2013-06-29 00:30 - 2010-01-19 21:12 - 00000000 ____D C:\ProgramData\ICQ
2013-06-29 00:28 - 2013-06-29 00:28 - 00648201 ____A C:\Users\Fatih\Downloads\adwcleaner.exe
2013-06-29 00:25 - 2013-06-29 00:25 - 00008959 ____A C:\ComboFix.txt
2013-06-29 00:25 - 2013-06-29 00:01 - 00000000 ____D C:\Qoobox
2013-06-29 00:25 - 2006-11-02 13:18 - 00000000 __RHD C:\users\Default
2013-06-29 00:25 - 2006-11-02 13:18 - 00000000 ___RD C:\users\Public
2013-06-29 00:22 - 2013-06-29 00:01 - 00000000 ____D C:\Windows\erdnt
2013-06-29 00:15 - 2006-11-02 12:23 - 00000215 ____A C:\Windows\system.ini
2013-06-29 00:04 - 2009-01-31 18:08 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-06-29 00:04 - 2009-01-31 18:08 - 00000000 ____D C:\Program Files\Spybot - Search & Destroy
2013-06-29 00:00 - 2013-06-28 23:59 - 00020117 ____A C:\Users\Fatih\Downloads\Addition.txt
2013-06-28 23:59 - 2013-06-28 23:59 - 05084379 ____R (Swearware) C:\Users\Fatih\Downloads\ComboFix.exe
2013-06-28 23:59 - 2013-06-28 23:59 - 00000000 ____D C:\FRST
2013-06-28 23:57 - 2013-06-28 23:57 - 01371463 ____A (Farbar) C:\Users\Fatih\Downloads\FRST.exe
2013-06-28 23:16 - 2009-04-30 17:56 - 00000000 ____D C:\Users\Fatih\AppData\Roaming\Skype
2013-06-28 12:58 - 2013-05-08 17:20 - 00000000 ____D C:\Users\Fatih\Desktop\Pharma
2013-06-26 18:06 - 2011-09-16 20:14 - 00000000 ____D C:\Users\Fatih\AppData\Local\CrashDumps
2013-06-25 17:24 - 2008-12-24 22:56 - 00000000 ____D C:\Users\Fatih\AppData\Roaming\DAEMON Tools Lite
2013-06-25 11:56 - 2013-06-25 11:54 - 43359164 ____A C:\Users\Fatih\Desktop\goekurs_hs.zip
2013-06-25 11:54 - 2013-06-25 11:54 - 02000290 ____A C:\Users\Fatih\Desktop\Chirurgie 20%.zip
2013-06-25 11:48 - 2013-06-25 11:48 - 00000000 ____D C:\Users\Fatih\Desktop\Umweltmedizin 15%
2013-06-25 11:48 - 2013-06-25 11:48 - 00000000 ____D C:\Users\Fatih\Desktop\Arbeitsmedizin 10%
2013-06-24 11:26 - 2006-11-02 12:33 - 00004930 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-23 21:48 - 2009-05-10 19:56 - 00000000 ____D C:\Users\Fatih\AppData\Roaming\Winamp
2013-06-17 18:16 - 2009-07-01 00:24 - 00007592 ____A C:\Users\Fatih\AppData\Local\d3d9caps.dat
2013-06-17 12:48 - 2008-05-26 15:03 - 00177889 ____A C:\Users\Fatih\AppData\Roaming\nvModes.dat
2013-06-13 20:44 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\rescache
2013-06-13 20:24 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\System32\de-DE
2013-06-13 20:17 - 2006-11-02 12:24 - 73381792 ____A (Microsoft Corporation) C:\Windows\System32\mrt.exe
2013-06-12 13:45 - 2012-07-17 17:33 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-06-12 13:45 - 2011-12-05 15:37 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-06-29 00:39

==================== End Of Log ============================



--------------------------------------

Könnte mir bitte jemand weiterhelfen und mir sagen, was ich nun machen soll?
Wäre echt spitze von euch und bitte eine kurze Rückmeldung geben, wenn der Post hier fehl am Platz ist.

Merci im Voraus!