| |
| |||||||
Log-Analyse und Auswertung: Seth.Avazutracking.net - Firefox öffnet selbstständig WerbetabsWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
11.07.2013, 21:02
| #7 |
| |  Seth.Avazutracking.net - Firefox öffnet selbstständig Werbetabs Hier die Logs, ESET Online Scanner Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=b9c556b553b89b4c96d11743aa88bd07
# engine=14352
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-07-11 07:07:50
# local_time=2013-07-11 09:07:50 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776573 100 94 118196 125199520 0 0
# compatibility_mode=8202 16776701 100 75 26292 78726510 0 0
# scanned=572842
# found=0
# cleaned=0
# scan_time=23584
# nod_component=V3 Build:0x30000000
Code:
ATTFilter Results of screen317's Security Check version 0.99.68 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 10 ``````````````Antivirus/Firewall Check:`````````````` ESET Smart Security 4.2 Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware Version 1.75.0.1300 Java 7 Update 25 Adobe Flash Player 11.8.800.94 Adobe Reader XI Mozilla Firefox (22.0) ````````Process Check: objlist.exe by Laurent```````` ESET NOD32 Antivirus egui.exe ESET NOD32 Antivirus ekrn.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-07-2013
Ran by *** (administrator) on 11-07-2013 21:59:17
Running from C:\Users\***\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
() C:\Windows\system32\AppleOSSMgr.exe
(Apple Inc.) C:\Windows\system32\AppleTimeSrv.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(Apple Inc.) C:\Program Files\Boot Camp\Bootcamp.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\egui.exe
() C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
(Dropbox, Inc.) C:\Users\***\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Elaborate Bytes AG) C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\acrotray.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Macrovision Europe Ltd.) C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
(Microsoft Corporation) C:\Windows\system32\taskmgr.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Apple_KbdMgr] - C:\Program Files\Boot Camp\Bootcamp.exe [741760 2011-08-15] (Apple Inc.)
HKLM\...\Run: [egui] - "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice [2918656 2011-01-12] (ESET)
HKLM\...\Run: [NvCplDaemon] - RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup [16395880 2010-01-05] (NVIDIA Corporation)
HKCU\...\Run: [Pando Media Booster] - C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe [3093624 2013-01-07] ()
HKCU\...\Run: [ICQ] - "C:\Program Files (x86)\ICQ7M\ICQ.exe" silent loginmode=4 [127040 2013-01-07] (ICQ, LLC.)
HKCU\...\Run: [Steam] - "C:\Program Files (x86)\Steam\Steam.exe" -silent [1672616 2013-07-10] (Valve Corporation)
HKCU\...\Policies\system: [DisableRegistryTools] 0
HKCU\...\Policies\system: [DisableTaskMgr] 0
HKLM-x32\...\Run: [VirtualCloneDrive] - "C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s [89456 2011-03-07] (Elaborate Bytes AG)
HKLM-x32\...\Run: [GrooveMonitor] - "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [31016 2006-10-27] (Microsoft Corporation)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] - "C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [620152 2006-10-23] (Adobe Systems Inc.)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [253816 2013-03-12] (Oracle Corporation)
HKU\Default\...\RunOnce: [mctadmin] - C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\Default User\...\RunOnce: [mctadmin] - C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
Startup: C:\ProgramData\Start Menu\Programs\Startup\Adobe Acrobat - Schnellstart.lnk
ShortcutTarget: Adobe Acrobat - Schnellstart.lnk -> C:\Windows\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SC_Acrobat.exe ()
Startup: C:\ProgramData\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
ShortcutTarget: Adobe Reader Synchronizer.lnk -> C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe ()
Startup: C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled ()
Startup: C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\***\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
==================== Internet (Whitelisted) ====================
SearchScopes: HKCU - {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/search?q={searchTerms}&utf8in=1&fr=ietb
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler-x32: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~2\MICROS~1\Office12\GRA32A~1.DLL (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
ShellExecuteHooks-x32: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL [2210608 2006-10-27] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\l72b7pk4.default
FF SelectedSearchEngine: League of Legends Wiki (en)
FF Homepage: hxxp://de.yahoo.com
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @videolan.org/vlc,version=2.0.5 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF SearchPlugin: C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\l72b7pk4.default\searchplugins\league-of-legends-wiki-en.xml
FF SearchPlugin: C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\l72b7pk4.default\searchplugins\youtube-videosuche.xml
FF Extension: exif_viewer - C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\l72b7pk4.default\Extensions\exif_viewer@mozilla.doslash.org.xpi
FF Extension: status4evar - C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\l72b7pk4.default\Extensions\status4evar@caligonstudios.com.xpi
FF Extension: No Name - C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\l72b7pk4.default\Extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}.xpi
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
FF Extension: ESET Smart Security Extension - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
==================== Services (Whitelisted) =================
S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2013-02-05] (Adobe Systems)
R2 AppleOSSMgr; C:\Windows\system32\AppleOSSMgr.exe [224640 2011-08-15] ()
S3 EhttpSrv; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [42360 2011-01-12] (ESET)
R2 ekrn; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [810144 2011-01-12] (ESET)
S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 Samsung UPD Service2; C:\Windows\System32\SUPDSvc2.exe [158208 2012-04-06] (Samsung Electronics)
==================== Drivers (Whitelisted) ====================
R3 applemtm; C:\Windows\System32\DRIVERS\applemtm.sys [12288 2011-01-31] (Apple Inc.)
R3 applemtp; C:\Windows\System32\DRIVERS\applemtp.sys [38912 2011-01-31] (Apple Inc.)
R2 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [170640 2010-12-21] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [141264 2010-12-21] (ESET)
R2 epfw; C:\Windows\System32\DRIVERS\epfw.sys [170640 2010-12-21] (ESET)
R3 Epfwndis; C:\Windows\System32\DRIVERS\Epfwndis.sys [34144 2010-12-21] (ESET)
R2 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [50624 2010-12-21] (ESET)
R3 ManyCam; C:\Windows\System32\DRIVERS\mcvidrv_x64.sys [44928 2012-10-11] (ManyCam LLC)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 mcaudrv_simple; C:\Windows\System32\drivers\mcaudrv_x64.sys [29696 2012-10-11] (ManyCam LLC)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-07-11 21:58 - 2013-07-11 21:58 - 01778065 ____A (Farbar) C:\Users\***\Desktop\FRST64.exe
2013-07-11 21:54 - 2013-07-11 21:54 - 00890988 ____A C:\Users\***\Desktop\SecurityCheck.exe
2013-07-11 15:12 - 2013-07-11 15:12 - 00007606 ____A C:\Users\***\AppData\Local\Resmon.ResmonCfg
2013-07-11 14:32 - 2013-07-11 14:32 - 02347384 ____A (ESET) C:\Users\***\Downloads\esetsmartinstaller_enu.exe
2013-07-11 14:32 - 2013-07-11 14:32 - 00000000 ____D C:\Program Files (x86)\ESET
2013-07-11 14:07 - 2013-07-11 14:07 - 00000759 ____A C:\Users\***\Desktop\JRT.txt
2013-07-11 14:02 - 2013-07-11 14:02 - 00000000 ____D C:\Windows\ERUNT
2013-07-11 13:58 - 2013-07-11 13:58 - 00001211 ____A C:\AdwCleaner[S1].txt
2013-07-11 13:56 - 2013-07-11 13:56 - 00559306 ____A (Oleg N. Scherbakov) C:\Users\***\Desktop\JRT.exe
2013-07-11 13:55 - 2013-07-11 13:55 - 00650027 ____A C:\Users\***\Desktop\adwcleaner.exe
2013-07-11 12:53 - 2013-07-11 12:53 - 00020901 ____A C:\Users\***\Desktop\Addition.txt
2013-07-11 12:52 - 2013-07-11 12:52 - 00000000 ____D C:\FRST
2013-07-11 02:25 - 2013-07-11 02:25 - 00069612 ____A C:\Users\***\Downloads\Extras.Txt
2013-07-11 02:23 - 2013-07-11 02:23 - 00076906 ____A C:\Users\***\Downloads\OTL.Txt
2013-07-11 02:14 - 2013-07-11 02:14 - 00602112 ____A (OldTimer Tools) C:\Users\***\Downloads\OTL.exe
2013-07-11 01:57 - 2013-07-11 01:57 - 10285040 ____A (Malwarebytes Corporation ) C:\Users\***\Downloads\mbam-setup-1.75.0.1300.exe
2013-07-11 01:57 - 2013-07-11 01:57 - 00001121 ____A C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-07-11 01:57 - 2013-07-11 01:57 - 00000000 ____D C:\Users\***\AppData\Roaming\Malwarebytes
2013-07-11 01:57 - 2013-07-11 01:57 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-07-11 01:57 - 2013-07-11 01:57 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-07-11 01:57 - 2013-04-04 14:50 - 00025928 ____A (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-07-10 16:18 - 2013-07-10 16:20 - 00000000 ____D C:\ProgramData\HitmanPro
2013-07-10 16:18 - 2013-07-10 16:18 - 09171472 ____A (SurfRight B.V.) C:\Users\***\Downloads\hitmanpro.exe
2013-07-10 16:16 - 2013-07-10 16:17 - 09833328 ____A (SurfRight B.V.) C:\Users\***\Downloads\HitmanPro_x64.exe
2013-07-10 16:04 - 2013-07-10 16:04 - 00388608 ____A (Trend Micro Inc.) C:\Users\***\Downloads\hijackthis.exe
2013-07-10 16:04 - 2013-07-10 16:04 - 00011129 ____A C:\Users\***\Downloads\hijackthis.log
2013-07-10 10:42 - 2013-06-12 01:43 - 14329856 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-10 10:42 - 2013-06-12 01:43 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-10 10:42 - 2013-06-12 01:43 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-10 10:42 - 2013-06-12 01:43 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-10 10:42 - 2013-06-12 01:43 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-10 10:42 - 2013-06-12 01:43 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-10 10:42 - 2013-06-12 01:43 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-10 10:42 - 2013-06-12 01:42 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-10 10:42 - 2013-06-12 01:42 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-10 10:42 - 2013-06-12 01:42 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-10 10:42 - 2013-06-12 01:42 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-07-10 10:42 - 2013-06-12 01:42 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-07-10 10:42 - 2013-06-12 01:42 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-07-10 10:42 - 2013-06-12 01:26 - 02241024 ____A (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-10 10:42 - 2013-06-12 01:26 - 01365504 ____A (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-10 10:42 - 2013-06-12 01:26 - 00051712 ____A (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-07-10 10:42 - 2013-06-12 01:25 - 19238912 ____A (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-10 10:42 - 2013-06-12 01:25 - 15404032 ____A (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-10 10:42 - 2013-06-12 01:25 - 03958784 ____A (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-10 10:42 - 2013-06-12 01:25 - 02648576 ____A (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-10 10:42 - 2013-06-12 01:25 - 00855552 ____A (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-10 10:42 - 2013-06-12 01:25 - 00603136 ____A (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-10 10:42 - 2013-06-12 01:25 - 00526336 ____A (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-10 10:42 - 2013-06-12 01:25 - 00136704 ____A (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-07-10 10:42 - 2013-06-12 01:25 - 00067072 ____A (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-07-10 10:42 - 2013-06-12 01:25 - 00053248 ____A (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-10 10:42 - 2013-06-12 01:25 - 00039936 ____A (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-07-10 10:42 - 2013-06-12 00:51 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-07-10 10:42 - 2013-06-12 00:50 - 00089600 ____A (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-07-10 10:42 - 2013-06-07 05:22 - 02706432 ____A (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-10 10:42 - 2013-06-07 04:37 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-10 10:38 - 2013-06-05 05:34 - 03153920 ____A (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-07-10 10:38 - 2013-06-04 08:00 - 00624128 ____A (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-10 10:38 - 2013-06-04 06:53 - 00509440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-10 10:38 - 2013-05-06 08:03 - 01887744 ____A (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-10 10:38 - 2013-05-06 06:56 - 01620480 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-10 10:38 - 2013-04-10 01:34 - 01247744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-10 10:38 - 2013-04-03 00:51 - 01643520 ____A (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-07-03 00:59 - 2013-07-03 00:59 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-06-27 00:47 - 2013-06-27 00:47 - 00000000 ____A C:\Users\***\Desktop\***@***head.de.txt
2013-06-25 14:28 - 2013-06-25 14:28 - 00263592 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-06-25 14:28 - 2013-06-25 14:28 - 00175016 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-06-25 14:28 - 2013-06-25 14:28 - 00175016 ____A (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-06-25 14:28 - 2013-06-25 14:28 - 00096168 ____A (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-06-25 14:28 - 2013-06-25 14:28 - 00000000 ____D C:\Program Files (x86)\Java
2013-06-23 14:04 - 2013-06-23 14:04 - 395513882 ____A C:\Windows\MEMORY.DMP
2013-06-23 14:04 - 2013-06-23 14:04 - 00292312 ____A C:\Windows\Minidump\062313-12901-01.dmp
2013-06-23 14:04 - 2013-06-23 14:04 - 00000000 ____D C:\Windows\Minidump
2013-06-12 10:32 - 2013-05-13 07:51 - 01464320 ____A (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-06-12 10:32 - 2013-05-13 07:51 - 00184320 ____A (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-06-12 10:32 - 2013-05-13 07:51 - 00139776 ____A (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-06-12 10:32 - 2013-05-13 07:50 - 00052224 ____A (Microsoft Corporation) C:\Windows\system32\certenc.dll
2013-06-12 10:32 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-06-12 10:32 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-06-12 10:32 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-06-12 10:32 - 2013-05-13 05:43 - 01192448 ____A (Microsoft Corporation) C:\Windows\system32\certutil.exe
2013-06-12 10:32 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-06-12 10:32 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-06-12 10:32 - 2013-05-10 07:49 - 00030720 ____A (Microsoft Corporation) C:\Windows\system32\cryptdlg.dll
2013-06-12 10:32 - 2013-05-10 05:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2013-06-12 10:32 - 2013-05-08 08:39 - 01910632 ____A (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-06-12 10:32 - 2013-04-26 07:51 - 00751104 ____A (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2013-06-12 10:32 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2013-06-12 10:32 - 2013-04-26 01:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-06-12 10:32 - 2013-04-17 09:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-06-12 10:32 - 2013-04-17 08:24 - 01424384 ____A (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2013-06-12 10:32 - 2013-04-01 00:52 - 01887232 ____A (Microsoft Corporation) C:\Windows\system32\d3d11.dll
==================== One Month Modified Files and Folders =======
2013-07-11 21:59 - 2013-01-07 12:05 - 00000000 ____D C:\Users\***\AppData\Local\PMB Files
2013-07-11 21:58 - 2013-07-11 21:58 - 01778065 ____A (Farbar) C:\Users\***\Desktop\FRST64.exe
2013-07-11 21:58 - 2013-05-01 11:37 - 00000000 ____D C:\Users\***\AppData\Roaming\NetSpeedMonitor
2013-07-11 21:55 - 2013-01-06 16:46 - 01917307 ____A C:\Windows\WindowsUpdate.log
2013-07-11 21:54 - 2013-07-11 21:54 - 00890988 ____A C:\Users\***\Desktop\SecurityCheck.exe
2013-07-11 21:54 - 2009-07-14 19:58 - 00654400 ____A C:\Windows\system32\perfh007.dat
2013-07-11 21:54 - 2009-07-14 19:58 - 00130240 ____A C:\Windows\system32\perfc007.dat
2013-07-11 21:54 - 2009-07-14 07:13 - 01498742 ____A C:\Windows\system32\PerfStringBackup.INI
2013-07-11 21:37 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-07-11 17:58 - 2013-01-07 12:31 - 00000000 ____D C:\Users\***\AppData\Roaming\ICQ
2013-07-11 17:39 - 2013-01-22 22:13 - 00000000 ____D C:\Program Files (x86)\Steam
2013-07-11 15:12 - 2013-07-11 15:12 - 00007606 ____A C:\Users\***\AppData\Local\Resmon.ResmonCfg
2013-07-11 14:32 - 2013-07-11 14:32 - 02347384 ____A (ESET) C:\Users\***\Downloads\esetsmartinstaller_enu.exe
2013-07-11 14:32 - 2013-07-11 14:32 - 00000000 ____D C:\Program Files (x86)\ESET
2013-07-11 14:16 - 2009-07-14 06:45 - 00016208 ___AH C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-11 14:16 - 2009-07-14 06:45 - 00016208 ___AH C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-11 14:09 - 2013-01-23 18:12 - 00000000 ___RD C:\Users\***\Dropbox
2013-07-11 14:09 - 2013-01-23 18:11 - 00000000 ____D C:\Users\***\AppData\Roaming\Dropbox
2013-07-11 14:09 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-07-11 14:09 - 2009-07-14 06:51 - 00042318 ____A C:\Windows\setupact.log
2013-07-11 14:07 - 2013-07-11 14:07 - 00000759 ____A C:\Users\***\Desktop\JRT.txt
2013-07-11 14:02 - 2013-07-11 14:02 - 00000000 ____D C:\Windows\ERUNT
2013-07-11 13:58 - 2013-07-11 13:58 - 00001211 ____A C:\AdwCleaner[S1].txt
2013-07-11 13:56 - 2013-07-11 13:56 - 00559306 ____A (Oleg N. Scherbakov) C:\Users\***\Desktop\JRT.exe
2013-07-11 13:55 - 2013-07-11 13:55 - 00650027 ____A C:\Users\***\Desktop\adwcleaner.exe
2013-07-11 12:53 - 2013-07-11 12:53 - 00020901 ____A C:\Users\***\Desktop\Addition.txt
2013-07-11 12:52 - 2013-07-11 12:52 - 00000000 ____D C:\FRST
2013-07-11 12:51 - 2013-01-07 23:59 - 00000000 ____D C:\Users\***\AppData\Local\Adobe
2013-07-11 12:50 - 2013-01-07 12:55 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-07-11 12:50 - 2013-01-07 12:55 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-07-11 02:25 - 2013-07-11 02:25 - 00069612 ____A C:\Users\***\Downloads\Extras.Txt
2013-07-11 02:23 - 2013-07-11 02:23 - 00076906 ____A C:\Users\***\Downloads\OTL.Txt
2013-07-11 02:14 - 2013-07-11 02:14 - 00602112 ____A (OldTimer Tools) C:\Users\***\Downloads\OTL.exe
2013-07-11 01:57 - 2013-07-11 01:57 - 10285040 ____A (Malwarebytes Corporation ) C:\Users\***\Downloads\mbam-setup-1.75.0.1300.exe
2013-07-11 01:57 - 2013-07-11 01:57 - 00001121 ____A C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-07-11 01:57 - 2013-07-11 01:57 - 00000000 ____D C:\Users\***\AppData\Roaming\Malwarebytes
2013-07-11 01:57 - 2013-07-11 01:57 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-07-11 01:57 - 2013-07-11 01:57 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-07-11 01:07 - 2013-01-07 12:05 - 00000000 ____D C:\ProgramData\PMB Files
2013-07-11 00:09 - 2013-01-09 00:34 - 00000000 ____D C:\Users\***\AppData\Roaming\TS3Client
2013-07-10 16:20 - 2013-07-10 16:18 - 00000000 ____D C:\ProgramData\HitmanPro
2013-07-10 16:18 - 2013-07-10 16:18 - 09171472 ____A (SurfRight B.V.) C:\Users\***\Downloads\hitmanpro.exe
2013-07-10 16:17 - 2013-07-10 16:16 - 09833328 ____A (SurfRight B.V.) C:\Users\***\Downloads\HitmanPro_x64.exe
2013-07-10 16:13 - 2013-01-06 16:54 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-07-10 16:04 - 2013-07-10 16:04 - 00388608 ____A (Trend Micro Inc.) C:\Users\***\Downloads\hijackthis.exe
2013-07-10 16:04 - 2013-07-10 16:04 - 00011129 ____A C:\Users\***\Downloads\hijackthis.log
2013-07-10 16:04 - 2013-01-06 16:46 - 00000000 ____D C:\Users\***\AppData\Local\VirtualStore
2013-07-10 10:59 - 2009-07-14 06:45 - 00417840 ____A C:\Windows\system32\FNTCACHE.DAT
2013-07-10 10:58 - 2009-07-14 20:18 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-10 10:58 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-10 10:58 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-07-10 10:43 - 2013-01-06 19:56 - 78185248 ____A (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-07-10 01:56 - 2013-02-12 21:04 - 00000000 ____D C:\Users\***\AppData\Roaming\vlc
2013-07-04 12:36 - 2013-01-06 21:17 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-07-03 17:53 - 2013-01-16 17:20 - 00000072 ____A C:\Users\Public\LMDebug.log
2013-07-03 00:59 - 2013-07-03 00:59 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-06-27 00:47 - 2013-06-27 00:47 - 00000000 ____A C:\Users\***\Desktop\***@***head.de.txt
2013-06-25 14:28 - 2013-06-25 14:28 - 00263592 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-06-25 14:28 - 2013-06-25 14:28 - 00175016 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-06-25 14:28 - 2013-06-25 14:28 - 00175016 ____A (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-06-25 14:28 - 2013-06-25 14:28 - 00096168 ____A (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-06-25 14:28 - 2013-06-25 14:28 - 00000000 ____D C:\Program Files (x86)\Java
2013-06-25 14:28 - 2013-04-05 19:17 - 00867240 ____A (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll
2013-06-25 14:28 - 2013-04-05 19:17 - 00789416 ____A (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2013-06-23 14:04 - 2013-06-23 14:04 - 395513882 ____A C:\Windows\MEMORY.DMP
2013-06-23 14:04 - 2013-06-23 14:04 - 00292312 ____A C:\Windows\Minidump\062313-12901-01.dmp
2013-06-23 14:04 - 2013-06-23 14:04 - 00000000 ____D C:\Windows\Minidump
2013-06-12 10:31 - 2013-01-23 18:11 - 00000000 ____D C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2013-06-12 10:31 - 2013-01-06 16:46 - 00000000 ___RD C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-06-12 01:43 - 2013-07-10 10:42 - 14329856 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-12 01:43 - 2013-07-10 10:42 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-06-12 01:43 - 2013-07-10 10:42 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-06-12 01:43 - 2013-07-10 10:42 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-12 01:43 - 2013-07-10 10:42 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-06-12 01:43 - 2013-07-10 10:42 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-06-12 01:43 - 2013-07-10 10:42 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-06-12 01:42 - 2013-07-10 10:42 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-12 01:42 - 2013-07-10 10:42 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-12 01:42 - 2013-07-10 10:42 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-12 01:42 - 2013-07-10 10:42 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-06-12 01:42 - 2013-07-10 10:42 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-06-12 01:42 - 2013-07-10 10:42 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-06-12 01:26 - 2013-07-10 10:42 - 02241024 ____A (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-06-12 01:26 - 2013-07-10 10:42 - 01365504 ____A (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-06-12 01:26 - 2013-07-10 10:42 - 00051712 ____A (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-06-12 01:25 - 2013-07-10 10:42 - 19238912 ____A (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-06-12 01:25 - 2013-07-10 10:42 - 15404032 ____A (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-06-12 01:25 - 2013-07-10 10:42 - 03958784 ____A (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-06-12 01:25 - 2013-07-10 10:42 - 02648576 ____A (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-06-12 01:25 - 2013-07-10 10:42 - 00855552 ____A (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-06-12 01:25 - 2013-07-10 10:42 - 00603136 ____A (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-06-12 01:25 - 2013-07-10 10:42 - 00526336 ____A (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-06-12 01:25 - 2013-07-10 10:42 - 00136704 ____A (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-06-12 01:25 - 2013-07-10 10:42 - 00067072 ____A (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-06-12 01:25 - 2013-07-10 10:42 - 00053248 ____A (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-06-12 01:25 - 2013-07-10 10:42 - 00039936 ____A (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-06-12 00:51 - 2013-07-10 10:42 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-06-12 00:50 - 2013-07-10 10:42 - 00089600 ____A (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-07-11 21:30
==================== End Of Log ============================
Grüße black-avenge |
| Themen zu Seth.Avazutracking.net - Firefox öffnet selbstständig Werbetabs |
| adobe reader xi, bho, error, eset smart security, failed, fehler, firefox, flash player, frage, helper, hängt, iexplore.exe, install.exe, mozilla, neue tabs, neue tabs mit werbung, object, plug-in, programm, realtek, registry, rundll, scan, schädling, security, senden, seth.avazutracking.net, software, svchost.exe, tabs mit werbung, teamspeak, werbetab, werbung, windows |
Baum-Darstellung