| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: GVU-Trojaner - Trojan.Script.488158Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
06.07.2013, 20:09
| #16 |
 |  GVU-Trojaner - Trojan.Script.488158 Also jetzt sind es 8 Stunden und 33% Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=ef0cc8fd58c1674bbc66c23730a76a73
# engine=14289
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-07-06 11:49:10
# local_time=2013-07-07 01:49:10 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=2056 16777213 100 85 46275 132235648 0 0
# compatibility_mode=5893 16776573 100 94 104285 124784400 0 0
# scanned=219294
# found=11
# cleaned=0
# scan_time=45549
sh=B46EDBB2F9209F528C7ECD18FD2029BC667DA4D2 ft=0 fh=0000000000000000 vn="Win32/Reveton.M trojan" ac=I fn="C:\Backup My Data\All Users\sdaksda.txt"
sh=BF7D3DF69159EB6103A38DD3E27E748F2728FAEE ft=0 fh=0000000000000000 vn="Win32/Reveton.M trojan" ac=I fn="C:\FRST\Quarantine\dzote.bat"
sh=B46EDBB2F9209F528C7ECD18FD2029BC667DA4D2 ft=0 fh=0000000000000000 vn="Win32/Reveton.M trojan" ac=I fn="C:\FRST\Quarantine\regmonstd.lnk"
sh=B46EDBB2F9209F528C7ECD18FD2029BC667DA4D2 ft=0 fh=0000000000000000 vn="Win32/Reveton.M trojan" ac=I fn="C:\ProgramData\sdaksda.txt"
sh=B46EDBB2F9209F528C7ECD18FD2029BC667DA4D2 ft=0 fh=0000000000000000 vn="Win32/Reveton.M trojan" ac=I fn="C:\Users\All Users\sdaksda.txt"
sh=057738B7B960589C0EF2F241090405A3982921F5 ft=0 fh=0000000000000000 vn="a variant of Java/Exploit.CVE-2013-1493.EG trojan" ac=I fn="C:\Users\Stefan Hambach\AppData\Local\Temp\jar_cache9073853600089378993.tmp"
sh=B46EDBB2F9209F528C7ECD18FD2029BC667DA4D2 ft=0 fh=0000000000000000 vn="Win32/Reveton.M trojan" ac=I fn="C:\Users\Stefan Hambach\AppData\Local\Temp\tratra.lnk"
sh=420FFC3E9AA39073023024A03800341A7EEAD601 ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\Stefan Hambach\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15\3a572f8f-44451425"
sh=053A5D3A1400900602422577548AAB151D97E744 ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\Stefan Hambach\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16\6c83c590-64a08fdf"
sh=9C428D2EF0D23A6FB229738C31A8D7D0102431FB ft=0 fh=0000000000000000 vn="Java/Exploit.Agent.NYZ trojan" ac=I fn="C:\Users\Stefan Hambach\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28\7ecffa5c-67bdc8f9"
sh=5F4DD6723F02463E35F2566DA4770F4FFC2510D6 ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\Stefan Hambach\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6\5ea46186-62224177"
Code:
ATTFilter Results of screen317's Security Check version 0.99.68
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 10
``````````````Antivirus/Firewall Check:``````````````
Bitdefender Virenschutz
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
Java(TM) 6 Update 39
Java version out of Date!
Adobe Flash Player 11.7.700.224
Adobe Reader XI
Mozilla Firefox (22.0)
Google Chrome 27.0.1453.110
Google Chrome 27.0.1453.116
````````Process Check: objlist.exe by Laurent````````
Bitdefender Bitdefender 2012 vsserv.exe
Bitdefender Bitdefender 2012 updatesrv.exe
Bitdefender Bitdefender 2012 bdagent.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-07-2013
Ran by Stefan Hambach (administrator) on 07-07-2013 06:05:01
Running from C:\Users\Stefan Hambach\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2012\vsserv.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
() C:\Program Files (x86)\PHotkey\ASLDRSrv.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
() C:\Program Files (x86)\PHotkey\GFNEXSrv.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files\Microsoft LifeCam\MSCamS64.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2012\updatesrv.exe
(Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2012\bdagent.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Pegatron Corporation) C:\Program Files (x86)\PHotkey\PHotkey.exe
() C:\Program Files (x86)\PHotkey\MsgTranAgt.exe
() C:\Program Files (x86)\PHotkey\MsgTranAgt64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(AlcorMicro Co., Ltd.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Windows\vVX3000.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Google Inc.) C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(Samsung) C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
(Samsung) C:\Program Files (x86)\Samsung\Kies\Kies.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\YouCam\YouCamTray.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
() C:\Program Files (x86)\PHotkey\PVDesktop.exe
(Pegatron Corporation) C:\Program Files (x86)\PHotkey\POSD.exe
() C:\Program Files (x86)\PHotkey\PVDAgent.exe
(Pegatron Corporation) C:\Program Files (x86)\PHotkey\POSD.exe
(TODO: <Company name>) C:\Program Files (x86)\PHotkey\HCSynApi.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [10918504 2010-06-14] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /FORPCEE3 [2092648 2010-06-14] (Realtek Semiconductor)
HKLM\...\Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [323072 2009-08-01] (AlcorMicro Co., Ltd.)
HKLM\...\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2028328 2010-01-22] (Synaptics Incorporated)
HKLM\...\Run: [VX3000] C:\Windows\vVX3000.exe [762736 2010-05-20] (Microsoft Corporation)
HKLM\...\Run: [BDAgent] "C:\Program Files\Bitdefender\Bitdefender 2012\bdagent.exe" [1091200 2012-12-18] (Bitdefender)
HKCU\...\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [39408 2011-04-21] (Google Inc.)
HKCU\...\Run: [Facebook Update] "C:\Users\Stefan Hambach\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver [138096 2013-03-25] (Facebook Inc.)
HKCU\...\Run: [] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844144 2013-02-13] (Samsung)
HKCU\...\Run: [KiesPreload] C:\Program Files (x86)\Samsung\Kies\Kies.exe /preload [1509232 2013-02-13] (Samsung)
HKCU\...\Policies\system: [DisableRegistryTools] 0
HKCU\...\Policies\system: [DisableTaskMgr] 0
HKLM-x32\...\Run: [CLMLServer] "C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [103720 2009-11-03] (CyberLink)
HKLM-x32\...\Run: [YouCam Mirror Tray icon] "C:\Program Files (x86)\CyberLink\YouCam\YouCamTray.exe" /s [171104 2010-03-03] (CyberLink Corp.)
HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [152392 2013-05-15] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2013-05-01] (Apple Inc.)
HKU\Default\...\RunOnce: [HKCU] C:\Windows\System32\oobe\info\HKCU.vbs [126 2009-11-12] ()
HKU\Default User\...\RunOnce: [HKCU] C:\Windows\System32\oobe\info\HKCU.vbs [126 2009-11-12] ()
HKU\Gast\...\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [39408 2011-04-21] (Google Inc.)
AppInit_DLLs: C:\Windows\system32\nvinitx.dll [112232 2010-09-02] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll [100968 2010-09-02] (NVIDIA Corporation)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {0887FA5D-2B63-4876-BC1D-475D6F1D7BA0} URL = hxxp://de.search.yahoo.com/search?p={searchterms}&ei=UTF-8&fr=w3i&type=W3i_DS,105,0_0,Search,20120101,16991,0,6,0
SearchScopes: HKCU - {8A244612-A1F7-11E0-95C0-E71F4824019B} URL = hxxp://badoo.com/startpage/?source=bsb&q={searchTerms}
SearchScopes: HKCU - {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/search?q={searchTerms}&utf8in=1&fr=ietb
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Stefan Hambach\AppData\Roaming\Mozilla\Firefox\Profiles\ff368ksk.default
FF Homepage: hxxp://www.google.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll ()
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @canon.com/MycameraPlugin - C:\Program Files (x86)\Canon\MyCamera Download Plugin\NPCIG.dll (CANON INC.)
FF Plugin-x32: @java.com/DTPlugin,version=1.6.0_39 - C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.6 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @zylom.com/ZylomGamesPlayer - C:\ProgramData\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll (Zylom)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Stefan Hambach\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll No File
FF SearchPlugin: C:\Users\Stefan Hambach\AppData\Roaming\Mozilla\Firefox\Profiles\ff368ksk.default\searchplugins\badoo.xml
FF SearchPlugin: C:\Users\Stefan Hambach\AppData\Roaming\Mozilla\Firefox\Profiles\ff368ksk.default\searchplugins\icq.xml
FF Extension: No Name - C:\Users\Stefan Hambach\AppData\Roaming\Mozilla\Extensions\home2@tomtom.com
FF Extension: No Name - C:\Users\Stefan Hambach\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
FF Extension: Yahoo! Toolbar - C:\Users\Stefan Hambach\AppData\Roaming\Mozilla\Firefox\Profiles\ff368ksk.default\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0039-ABCDEFFEDCBA}
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM\...\Thunderbird\Extensions: [bdThunderbird@bitdefender.com] C:\Program Files\Bitdefender\Bitdefender 2012\bdtbext\
FF Extension: No Name - C:\Program Files\Bitdefender\Bitdefender 2012\bdtbext\
FF HKLM-x32\...\Thunderbird\Extensions: [bdThunderbird@bitdefender.com] C:\Program Files\Bitdefender\Bitdefender 2012\bdtbext\
FF Extension: No Name - C:\Program Files\Bitdefender\Bitdefender 2012\bdtbext\
Chrome:
=======
CHR HomePage: hxxp://www.google.com/ig/redirectdomain?brand=MDNB&bmod=MDNB
CHR RestoreOnStartup: " hxxp://badoo.com/startpage/"
CHR DefaultSearchURL: (Search) - hxxp://badoo.com/startpage/?source=bsb&q={searchTerms}
CHR DefaultSuggestURL: (Search) - "suggest_url": ""
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.116\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.116\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.116\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (Zylom Plugin) - C:\Program Files (x86)\Mozilla Firefox\plugins\npzylomgamesplayer.dll (Zylom)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (NPCIG.dll) - C:\Program Files (x86)\Canon\MyCamera Download Plugin\NPCIG.dll (CANON INC.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
CHR Plugin: (Java(TM) Platform SE 6 U39) - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (VLC Web Plugin) - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (Shockwave for Director) - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
CHR Plugin: (Java Deployment Toolkit 6.0.390.4) - C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
CHR Extension: (YouTube) - C:\Users\Stefan Hambach\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_1
CHR Extension: (Google Search) - C:\Users\Stefan Hambach\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_1
CHR Extension: (Gmail) - C:\Users\Stefan Hambach\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1
==================== Services (Whitelisted) =================
R2 ASLDRService; C:\Program Files (x86)\PHotkey\ASLDRSrv.exe [104968 2009-12-19] ()
R2 GFNEXSrv; C:\Program Files (x86)\PHotkey\GFNEXSrv.exe [159752 2010-04-24] ()
S3 SafeBox; C:\Program Files\Bitdefender\Bitdefender SafeBox\safeboxservice.exe [75384 2012-09-06] (Bitdefender)
S3 Update Server; C:\Program Files\Common Files\Bitdefender\Bitdefender Arrakis Server\bin\arrakis3.exe [466736 2011-10-14] (BitDefender)
R2 UPDATESRV; C:\Program Files\Bitdefender\Bitdefender 2012\updatesrv.exe [67904 2012-09-06] (Bitdefender)
R2 vsserv; C:\Program Files\Bitdefender\Bitdefender 2012\vsserv.exe [1957912 2012-12-18] (Bitdefender)
==================== Drivers (Whitelisted) ====================
R0 avc3; C:\Windows\System32\DRIVERS\avc3.sys [705552 2012-12-18] (BitDefender)
R3 avchv; C:\Windows\System32\DRIVERS\avchv.sys [261056 2012-12-18] (BitDefender)
R3 avckf; C:\Windows\System32\DRIVERS\avckf.sys [587024 2012-12-18] (BitDefender)
R1 BdfNdisf; c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys [93160 2012-09-06] (BitDefender LLC)
R0 bdfsfltr; C:\Windows\System32\DRIVERS\bdfsfltr.sys [442088 2011-08-16] (BitDefender)
R1 bdfwfpf; C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys [103504 2011-11-14] (BitDefender LLC)
S3 bdsandbox; C:\Windows\system32\drivers\bdsandbox.sys [79952 2011-11-17] (BitDefender SRL)
R1 BDVEDISK; C:\Windows\System32\DRIVERS\bdvedisk.sys [103944 2010-01-19] (BitDefender)
S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-02-05] ()
S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-02-05] ()
R2 PEGAGFN; C:\Program Files (x86)\PHotkey\PEGAGFN.sys [14344 2009-09-12] (PEGATRON)
R0 trufos; C:\Windows\System32\DRIVERS\trufos.sys [329800 2011-10-27] (BitDefender S.R.L.)
S3 TrufosAlt; C:\Windows\System32\DRIVERS\TrufosAlt.sys [350160 2012-07-27] (BitDefender S.R.L.)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-07-07 06:04 - 2013-07-07 06:04 - 01934636 ____A (Farbar) C:\Users\Stefan Hambach\Downloads\FRST64.exe
2013-07-05 19:52 - 2013-07-05 19:52 - 00000000 ____D C:\Windows\ERUNT
2013-07-05 19:52 - 2013-07-05 19:52 - 00000000 ____D C:\JRT
2013-07-05 19:39 - 2013-07-06 12:55 - 00001278 ____A C:\Windows\PFRO.log
2013-07-05 19:37 - 2013-07-05 19:38 - 00005279 ____A C:\AdwCleaner[S1].txt
2013-07-04 16:07 - 2013-07-04 16:07 - 00000000 ____D C:\FRST
2013-07-03 20:12 - 2013-07-03 20:12 - 00000000 ____D C:\Users\Gast\Documents\ZPS13
2013-07-03 20:08 - 2013-07-03 20:09 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Zoner
2013-07-03 20:08 - 2013-07-03 20:08 - 00000000 ____D C:\Users\Gast\AppData\Local\Zoner
2013-07-03 19:32 - 2013-07-03 19:32 - 00000439 ____A C:\Users\Gast\AppData\Roaminguser_gensett.xml
2013-07-02 18:05 - 2013-07-02 18:05 - 00347424 ____A (Microsoft Corporation) C:\Users\Stefan Hambach\Downloads\MicrosoftFixit.IEPerformance.MATSKB.Run.exe
2013-07-02 17:34 - 2013-07-03 19:28 - 00000000 ____A C:\ProgramData\g252qs.txt
2013-07-01 20:59 - 2013-07-01 20:59 - 00000000 ____D C:\Users\Gast\AppData\Local\Macromedia
2013-07-01 19:44 - 2013-07-01 19:46 - 00000000 ____D C:\Users\Gast\AppData\Local\Microsoft Games
2013-07-01 19:36 - 2013-07-01 19:36 - 00001005 ____A C:\ProgramData\sdaksda.txt
2013-07-01 17:21 - 2013-07-06 12:56 - 00002184 ____A C:\Windows\setupact.log
2013-07-01 17:21 - 2013-07-01 17:21 - 00000000 ____A C:\Windows\setuperr.log
2013-06-14 23:33 - 2013-06-08 16:08 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-14 23:33 - 2013-06-08 16:06 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-14 23:33 - 2013-06-08 16:06 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-14 23:33 - 2013-06-08 14:28 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-14 23:33 - 2013-06-08 13:42 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-14 23:33 - 2013-06-08 13:40 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-14 23:33 - 2013-06-08 13:40 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-14 23:33 - 2013-06-08 13:13 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-06-14 23:32 - 2013-06-08 16:07 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-14 23:32 - 2013-06-08 16:06 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-14 23:32 - 2013-06-08 13:40 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-14 23:32 - 2013-06-08 13:40 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-12 05:48 - 2013-05-17 03:25 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-06-12 05:48 - 2013-05-17 03:25 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-06-12 05:48 - 2013-05-17 03:25 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-06-12 05:48 - 2013-05-17 03:25 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-06-12 05:48 - 2013-05-17 03:25 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-06-12 05:48 - 2013-05-17 03:25 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-06-12 05:48 - 2013-05-17 03:25 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-06-12 05:48 - 2013-05-17 03:25 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-06-12 05:48 - 2013-05-17 02:59 - 02241024 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-12 05:48 - 2013-05-17 02:59 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-06-12 05:48 - 2013-05-17 02:58 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-12 05:48 - 2013-05-17 02:58 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-12 05:48 - 2013-05-17 02:58 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-12 05:48 - 2013-05-17 02:58 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-06-12 05:48 - 2013-05-17 02:58 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-06-12 05:48 - 2013-05-17 02:58 - 00053248 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-12 05:48 - 2013-05-17 02:58 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-06-12 05:48 - 2013-05-14 14:23 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-12 05:48 - 2013-05-14 10:40 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-06-12 05:39 - 2013-05-13 07:51 - 01464320 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-12 05:39 - 2013-05-13 07:51 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-12 05:39 - 2013-05-13 07:51 - 00139776 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-12 05:39 - 2013-05-13 07:50 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-12 05:39 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-06-12 05:39 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-06-12 05:39 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-06-12 05:39 - 2013-05-13 05:43 - 01192448 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-12 05:39 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-06-12 05:39 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-06-12 05:39 - 2013-05-10 07:49 - 00030720 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-12 05:39 - 2013-05-10 05:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2013-06-12 05:39 - 2013-05-08 08:39 - 01910632 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-12 05:39 - 2013-04-26 07:51 - 00751104 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-12 05:39 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2013-06-12 05:39 - 2013-04-26 01:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-06-12 05:39 - 2013-04-17 09:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-06-12 05:39 - 2013-04-17 08:24 - 01424384 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-12 05:39 - 2013-04-01 00:52 - 01887232 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
==================== One Month Modified Files and Folders =======
2013-07-07 06:04 - 2013-07-07 06:04 - 01934636 ____A (Farbar) C:\Users\Stefan Hambach\Downloads\FRST64.exe
2013-07-07 05:58 - 2012-06-27 17:36 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-07 05:54 - 2011-04-21 22:52 - 00001110 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-07 05:41 - 2012-03-20 23:53 - 00000964 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1129976758-2739971074-186298042-1001UA.job
2013-07-06 20:41 - 2012-03-20 23:53 - 00000942 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1129976758-2739971074-186298042-1001Core.job
2013-07-06 13:04 - 2009-07-14 06:45 - 00009888 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-06 13:04 - 2009-07-14 06:45 - 00009888 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-06 12:57 - 2011-04-21 22:52 - 00001106 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-06 12:56 - 2013-07-01 17:21 - 00002184 ____A C:\Windows\setupact.log
2013-07-06 12:56 - 2011-04-22 13:13 - 00000376 ____A C:\Users\Stefan Hambach\AppData\Roamingprivacy.xml
2013-07-06 12:56 - 2010-12-27 21:38 - 00000000 ____D C:\ProgramData\NVIDIA
2013-07-06 12:56 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-07-06 12:55 - 2013-07-05 19:39 - 00001278 ____A C:\Windows\PFRO.log
2013-07-06 10:20 - 2011-11-20 12:35 - 02089588 ____A C:\Windows\WindowsUpdate.log
2013-07-05 19:52 - 2013-07-05 19:52 - 00000000 ____D C:\Windows\ERUNT
2013-07-05 19:52 - 2013-07-05 19:52 - 00000000 ____D C:\JRT
2013-07-05 19:38 - 2013-07-05 19:37 - 00005279 ____A C:\AdwCleaner[S1].txt
2013-07-05 19:37 - 2011-04-23 13:52 - 00000000 ____D C:\ProgramData\ICQ
2013-07-05 09:54 - 2013-04-19 20:28 - 00000000 ____D C:\Users\Stefan Hambach\AppData\Roaming\Skype
2013-07-04 18:59 - 2011-06-08 16:08 - 00000376 ____A C:\Users\Gast\AppData\Roamingprivacy.xml
2013-07-04 16:57 - 2012-07-08 18:27 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-07-04 16:48 - 2013-05-25 07:31 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-04 16:07 - 2013-07-04 16:07 - 00000000 ____D C:\FRST
2013-07-04 05:52 - 2010-05-12 10:18 - 00654852 ____A C:\Windows\System32\perfh007.dat
2013-07-04 05:52 - 2010-05-12 10:18 - 00130434 ____A C:\Windows\System32\perfc007.dat
2013-07-04 05:52 - 2009-07-14 07:13 - 01500294 ____A C:\Windows\System32\PerfStringBackup.INI
2013-07-03 21:38 - 2011-06-08 16:08 - 00000000 ____D C:\Users\Gast\AppData\Local\VirtualStore
2013-07-03 20:14 - 2012-02-18 01:22 - 00000056 ____A C:\Windows\System32\bdsandbox.txt
2013-07-03 20:12 - 2013-07-03 20:12 - 00000000 ____D C:\Users\Gast\Documents\ZPS13
2013-07-03 20:09 - 2013-07-03 20:08 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Zoner
2013-07-03 20:08 - 2013-07-03 20:08 - 00000000 ____D C:\Users\Gast\AppData\Local\Zoner
2013-07-03 19:32 - 2013-07-03 19:32 - 00000439 ____A C:\Users\Gast\AppData\Roaminguser_gensett.xml
2013-07-03 19:28 - 2013-07-02 17:34 - 00000000 ____A C:\ProgramData\g252qs.txt
2013-07-02 18:05 - 2013-07-02 18:05 - 00347424 ____A (Microsoft Corporation) C:\Users\Stefan Hambach\Downloads\MicrosoftFixit.IEPerformance.MATSKB.Run.exe
2013-07-02 05:25 - 2012-11-07 12:11 - 00000000 ____D C:\Users\Gast\AppData\Local\Google
2013-07-01 20:59 - 2013-07-01 20:59 - 00000000 ____D C:\Users\Gast\AppData\Local\Macromedia
2013-07-01 19:46 - 2013-07-01 19:44 - 00000000 ____D C:\Users\Gast\AppData\Local\Microsoft Games
2013-07-01 19:36 - 2013-07-01 19:36 - 00001005 ____A C:\ProgramData\sdaksda.txt
2013-07-01 18:30 - 2013-05-14 19:03 - 00000000 ____D C:\Users\Stefan Hambach\Downloads\Neuer Ordner
2013-07-01 17:21 - 2013-07-01 17:21 - 00000000 ____A C:\Windows\setuperr.log
2013-06-30 19:38 - 2011-04-23 12:24 - 00000000 ____D C:\Users\Stefan Hambach\Tracing
2013-06-22 11:41 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-06-21 11:56 - 2011-04-21 22:53 - 00002187 ____A C:\Users\Public\Desktop\Google Chrome.lnk
2013-06-17 18:38 - 2013-04-19 20:28 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-06-17 18:38 - 2013-04-19 20:28 - 00000000 ____D C:\ProgramData\Skype
2013-06-15 12:40 - 2011-04-21 22:54 - 00000000 ____D C:\users\Stefan Hambach
2013-06-12 18:58 - 2012-06-27 17:36 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-06-12 18:58 - 2012-06-27 17:36 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-06-12 05:48 - 2010-12-27 22:40 - 75825640 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-08 16:08 - 2013-06-14 23:33 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-08 16:07 - 2013-06-14 23:32 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-08 16:06 - 2013-06-14 23:33 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-08 16:06 - 2013-06-14 23:33 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-08 16:06 - 2013-06-14 23:32 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-08 14:28 - 2013-06-14 23:33 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-08 13:42 - 2013-06-14 23:33 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-08 13:40 - 2013-06-14 23:33 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-08 13:40 - 2013-06-14 23:33 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-08 13:40 - 2013-06-14 23:32 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-08 13:40 - 2013-06-14 23:32 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-08 13:13 - 2013-06-14 23:33 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-07-07 03:48
==================== End Of Log ============================
--- --- --- |
|
07.07.2013, 06:36
| #17 |
| /// the machine /// TB-Ausbilder    | GVU-Trojaner - Trojan.Script.488158 Java bitte updaten.
__________________Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter C:\Backup My Data\All Users\sdaksda.txt
C:\ProgramData\sdaksda.txt
C:\Users\All Users\sdaksda.txt
C:\Users\Stefan Hambach\AppData\Local\Temp\jar_cache9073853600089378993.tmp
C:\Users\Stefan Hambach\AppData\Local\Temp\tratra.lnk
C:\Users\Stefan Hambach\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15\3a572f8f-44451425
C:\Users\Stefan Hambach\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16\6c83c590-64a08fdf
C:\Users\Stefan Hambach\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28\7ecffa5c-67bdc8f9
C:\Users\Stefan Hambach\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6\5ea46186-62224177
HKU\Default\...\RunOnce: [HKCU] C:\Windows\System32\oobe\info\HKCU.vbs [126 2009-11-12] ()
HKU\Default User\...\RunOnce: [HKCU] C:\Windows\System32\oobe\info\HKCU.vbs [126 2009-11-12] ()
2013-07-02 17:34 - 2013-07-03 19:28 - 00000000 ____A C:\ProgramData\g252qs.txt
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Noch Probleme? 
__________________ |
|
07.07.2013, 13:14
| #18 |
| | GVU-Trojaner - Trojan.Script.488158Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 04-07-2013
Ran by Stefan Hambach at 2013-07-07 14:13:33 Run:2
Running from C:\Users\Stefan Hambach\Desktop
Boot Mode: Normal
==============================================
C:\Backup My Data\All Users\sdaksda.txt => Moved successfully.
"C:\ProgramData\sdaksda.txt" => File/Directory not found.
"C:\Users\All Users\sdaksda.txt" => File/Directory not found.
C:\Users\Stefan Hambach\AppData\Local\Temp\jar_cache9073853600089378993.tmp => Moved successfully.
C:\Users\Stefan Hambach\AppData\Local\Temp\tratra.lnk => Moved successfully.
C:\Users\Stefan Hambach\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15\3a572f8f-44451425 => Moved successfully.
C:\Users\Stefan Hambach\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16\6c83c590-64a08fdf => Moved successfully.
C:\Users\Stefan Hambach\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28\7ecffa5c-67bdc8f9 => Moved successfully.
C:\Users\Stefan Hambach\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6\5ea46186-62224177 => Moved successfully.
HKU\Default\Software\Microsoft\Windows\CurrentVersion\RunOnce\\HKCU] C:\Windows\System32\oobe\info\HKCU.vbs [126 2009-11-12 => Value not found.
HKU\Default User\Software\Microsoft\Windows\CurrentVersion\RunOnce\\HKCU] C:\Windows\System32\oobe\info\HKCU.vbs [126 2009-11-12 => Value not found.
C:\ProgramData\g252qs.txt => Moved successfully.
==== End of Fixlog ====
|
|
07.07.2013, 14:06
| #19 |
| /// the machine /// TB-Ausbilder | GVU-Trojaner - Trojan.Script.488158 Fertig Die Reihenfolge ist hier entscheidend.
Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
07.07.2013, 17:16
| #20 |
| | GVU-Trojaner - Trojan.Script.488158 Hallo Schrauber, erst einmal vielen vielen Dank. Es scheint alles in Ordnung zu sein. Zu deinen weiteren Tipps... Automatisches Update ist bei mir eingestellt, habe aber die Uhrzeit jetzt umgestellt. Ansonsten nutze ich immer Bitdefender um die Registry zu reinigen, Dubletten zu finden oder Schwachstellenscan etc. zu machen. Gelegentlich den CC-Cleaner. Aber den sollte ich dann vielleicht besser deinstallieren. Nochmal ein großes Dankeschön! LG StefanNRW |
|
07.07.2013, 18:39
| #21 |
| /// the machine /// TB-Ausbilder | GVU-Trojaner - Trojan.Script.488158 Gern Geschehen
__________________ --> GVU-Trojaner - Trojan.Script.488158 |
|
| Themen zu GVU-Trojaner - Trojan.Script.488158 |
| abgesicherten, angemeldet, anmeldung, bitdefender, daten, defender, einfach, erwischt, google, guten, gvu trojaner, hilfe!, home, laptop, laufwerk, laufwerk c, meldung, modus, nachvollziehen, neustart, neuste, plötzlich, rechner, recovery, runter, tippen, trojan.script.488158, windows, windows 7 |
Linear-Darstellung
